200-201 Practice Test 36 — 15 Questions

Question 1

You are the cybersecurity analyst for a small business that has a security policy requiring all network traffic to pass through a proxy server for content filtering. Recently, employees have been complaining that some websites are not loading correctly. You check the proxy logs and see that the proxy is blocking traffic that appears to be from non-standard ports. However, upon investigation, you find that the blocked sites are legitimate business tools that use custom ports. Which action aligns with the security policy?

Accepted Answer

Create a security exception based on business need and document it.. Option C is correct because creating a documented exception addresses the legitimate need while maintaining policy control. Option A bypasses policy by allowing all traffic on custom ports; Option B disables content filtering entirely; Option D may not be feasible.

Answer

Instruct employees to access the tools via HTTP instead.

Answer

Configure the proxy to allow all traffic on custom ports for those specific tools.

Answer

Disable content filtering for the affected employees.

Question 2

A mid-sized financial firm has a segmented network with a DMZ hosting a web server, an internal network with a database server, and an employee LAN. The security infrastructure includes a next-generation firewall (NGFW) with IPS, an endpoint detection and response (EDR) solution, and a SIEM. Over the past week, the SIEM has generated alerts for unusual outbound connections from the database server to an external IP address 198.51.100.33 on TCP port 443 during non-business hours. The EDR shows no malware on the database server, but a process named 'sqlsrv.exe' (the legitimate SQL Server process) is making these connections. The server's file integrity monitoring indicates that the sqlsrv.exe file has not been modified, but a memory dump reveals injected code that appears to be a reverse shell. The firewall logs show that the outbound connections are allowed because they match an existing rule permitting the database server to reach external update servers. The IP 198.51.100.33 is not on any threat intelligence feed as malicious, but it is geolocated to a country with known cybercrime activity. Which action should the security analyst take FIRST?

Accepted Answer

Isolate the database server from the network immediately to prevent data exfiltration.. The presence of injected reverse shell code in the memory of the legitimate sqlsrv.exe process indicates that the database server is actively compromised, regardless of the file integrity or EDR results. The immediate priority is to contain the threat by isolating the server from the network to prevent data exfiltration or lateral movement, as per incident response best practices (NIST SP 800-61).

Answer

Contact the software vendor to verify the digital signature of sqlsrv.exe.

Answer

Add a firewall rule to block outbound connections to 198.51.100.33.

Answer

Run a full antivirus scan on the database server using an updated signature database.

Question 3

A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?

Accepted Answer

The host is infected with malware that is performing network reconnaissance.. The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.

Answer

The host is part of a distributed vulnerability scanning initiative.

Answer

The host is being used for a DDoS amplification attack.

Answer

The host is legitimately scanning the internet for outdated SMB shares.

Question 4

A large enterprise has a security policy that mandates data classification and strict access controls. An IT administrator, John, has been granted temporary administrative privileges to resolve a server issue. During the maintenance window, John accesses a file server and downloads a spreadsheet containing customer PII (Personally Identifiable Information) classified as 'Confidential'. John then emails the spreadsheet to his personal email account to work from home. The security team receives an alert from the DLP system indicating the email transmission. According to the company's incident response policy, which of the following is the FIRST action the security team should take?

Accepted Answer

Preserve evidence, isolate the affected systems, and initiate the incident response process. The correct first action is to preserve evidence, isolate affected systems, and initiate the incident response process. This aligns with NIST SP 800-61 and ISO 27035, which mandate that containment and evidence preservation precede any investigative or disciplinary steps. Jumping to revocation or interviews risks spoliation of logs, email metadata, and forensic artifacts critical to determining the scope of the data exfiltration.

Answer

Block the email transmission and restore the file from backup

Answer

Revoke John's network access immediately and escalate to HR for disciplinary action

Answer

Interview John to determine his intent and whether it was accidental

Question 5

A company uses Microsoft Windows Event Logging for host monitoring. The security team receives an alert from a Windows 10 workstation 'WS-102' indicating multiple failed logon attempts (Event ID 4625) within a short period from an internal IP address 10.10.10.50, followed by a successful logon (Event ID 4624) for user 'jdoe'. Shortly after, Event ID 4688 (Process Creation) shows 'cmd.exe' started by 'explorer.exe' with a command line launching 'powershell.exe -EncodedCommand ...'. The encoded command decodes to a script that attempts to download a payload from a remote server. The analyst needs to determine the most effective immediate response to limit lateral movement and impact.

Accepted Answer

Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.. Option B is correct because the sequence of events—brute-force logon attempts followed by a successful logon and then an encoded PowerShell command attempting to download a payload—indicates a confirmed compromise. Resetting the password for 'jdoe' immediately revokes the attacker's authenticated access, blocking outbound traffic to the remote server prevents the payload download and C2 communication, and initiating incident response ensures proper containment and investigation. This combination directly limits lateral movement by cutting off the attacker's credentials and network egress.

Answer

Restore WS-102 from a known good backup and ignore the alert as a false positive.

Answer

Run a full antivirus scan on WS-102 and isolate it.

Answer

Disable the user account 'jdoe' and investigate the source IP 10.10.10.50.

Question 6

A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.

Accepted Answer

Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.. Option D is correct because isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.

Answer

Reboot the server to clear any suspicious processes from memory.

Answer

Immediately format the server's hard drive and reinstall the OS.

Answer

Restore the server from the most recent backup taken yesterday.

Question 7

A company's security team is investigating an alert from their EDR platform indicating that a workstation in the finance department has been making repeated connections to an external IP address associated with a known command-and-control (C2) server. The analyst has isolated the host from the network and is performing host-based analysis. The host is running Windows 10 with Sysmon deployed and Windows Event Logging enabled. The analyst reviews Sysmon events and finds: - Event ID 1 (Process Creation): 'powershell.exe -NoP -NonI -W Hidden -Enc JABzAD0ATgBlAHcALQBPAEI ...' (long encoded string) - Event ID 3 (Network Connect): powershell.exe connecting to the C2 IP on port 443 (HTTPS), and also to an internal IP on port 445 (SMB). - Event ID 11 (FileCreate): a file created at C:\Users\financeuser\AppData\Roaming\Microsoft\svchost.exe (size 512KB) with no signature. - Event ID 7 (Image Load): svchost.exe (from AppData) loaded 'crypt32.dll'. - Event ID 8 (CreateRemoteThread): not observed. The analyst also checks the Windows Security log and finds Event ID 4624 (Success Logon) for the user 'financeuser' from a remote workstation at 2:00 AM, which is outside normal hours. The workstation is part of the Active Directory domain. The analyst needs to determine the most effective next step to contain the threat and prevent recurrence.

Accepted Answer

Change the user's password, revoke all Kerberos tickets, and check for lateral movement using the SMB connection observed.. Option D is correct because the SMB connection (port 445) to an internal IP strongly indicates lateral movement via techniques like PsExec or scheduled tasks. Changing the user's password and revoking Kerberos tickets (e.g., using `klist -li 0x3e7 purge`) immediately cuts off the attacker's authenticated access, while checking for lateral movement addresses the broader compromise. This aligns with the NIST incident response containment phase, prioritizing credential and token revocation over file deletion or reimaging alone.

Answer

Isolate the host further by blocking all inbound and outbound traffic via the host firewall, then perform memory acquisition and deep forensic analysis before remediation.

Answer

Remove the malicious svchost.exe file and kill the powershell process, then run a full antivirus scan.

Answer

Power off the workstation and reimage it immediately, then reset the user's password.

Question 8

A junior analyst reports that the network-based intrusion detection system (NIDS) has been generating alerts for a signature that detects a known exploit of a web server. The alert triggers on every connection to the company's internal web server over port 80. The analyst has verified that the web server is fully patched and the traffic is normal HTTP requests. The analyst asks you for advice. What should you recommend as the first step?

Accepted Answer

Disable the specific signature for the web server's IP address in the IDS.. Option D is correct because the NIDS is generating false positives: the signature matches normal HTTP traffic to a fully patched web server. Disabling the signature for that specific IP address eliminates the noise without compromising security, as the server is not vulnerable to the exploit. This is a standard tuning action in intrusion detection to reduce alert fatigue while maintaining coverage for other hosts.

Answer

Verify that the web server is fully patched and configure a patch management system.

Answer

Reconfigure the web server to use a non-standard port.

Answer

Run a packet capture to analyze the HTTP requests.

Question 9

You are monitoring network traffic and notice a sudden spike in outbound UDP traffic from a single internal host to various external IPs on port 123 (NTP). The traffic pattern shows a high volume of small packets. The host in question is a Linux server that does not run any NTP services. The IDS does not generate any alerts for this traffic. Which type of attack is most likely occurring?

Accepted Answer

The host is participating in an NTP amplification DDoS attack.. The sudden spike in outbound UDP traffic from a single internal host to multiple external IPs on port 123 (NTP) with small packets indicates the host is being used as a reflector in an NTP amplification DDoS attack. The attacker spoofs the victim's IP address and sends small queries to open NTP servers, which respond with large replies directed at the victim, but in this scenario the internal host is the one sending the queries (likely due to malware or misconfiguration), making it the amplifier. The lack of IDS alerts suggests the traffic matches normal NTP patterns, but the volume and destination diversity confirm the attack.

Answer

The host is scanning for open NTP servers.

Answer

Data exfiltration via NTP tunneling.

Answer

The host is performing an NTP time synchronization query.

Question 10

Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?

Accepted Answer

Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.. Option A is correct because creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

Answer

Add a whitelist rule that ignores any traffic from any host using self-signed certificates.

Answer

Disable the Suricata rules that match self-signed certificates and TLS renegotiation.

Answer

Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.

Question 11

You are monitoring a network segment that hosts a public-facing web server. The NIDS alerts on a signature 'ET WEB_SERVER SQL Injection Attempt' triggered by traffic to the web server. The alert details show a GET request with the parameter 'id=1 OR 1=1'. The web server responds with a 200 OK and returns data. You check the web server logs and find that the application is a legacy system that does not use prepared statements. The security team has a policy to block all SQL injection attempts at the network level. However, you notice that the web server is also receiving legitimate traffic with similar patterns from internal monitoring tools that use dynamic queries. What is the most appropriate response?

Accepted Answer

Add the internal monitoring tools' IP addresses to the whitelist and ensure that the network blocks the suspicious external request.. Option A is correct because it balances security policy compliance with operational continuity. The internal monitoring tools' IP addresses should be whitelisted at the NIDS to prevent false positives, while the suspicious external request (which matches the SQL injection signature) should be blocked at the network level, as per policy. This approach ensures that legitimate internal traffic is not disrupted, while the external threat is mitigated.

Answer

Disable the SQL injection signature for the web server because it causes false positives.

Answer

Immediately block all traffic from the external source IP that triggered the alert.

Answer

Request that the internal monitoring tools stop using dynamic queries, and leave the signature as is.

Question 12

A SOC analyst is monitoring network traffic and notices a large amount of data being transferred from the HR file server to an external IP address during off-hours. The server is supposed to be used only during business hours. The analyst checks the server logs and sees that a user account named 'backup_service' has been active and copying files. The 'backup_service' account is a service account that is normally used for automated backups, but the backup schedule is set to run at midnight, and the current time is 3 AM. The analyst suspects credential theft. Which of the following should the analyst do first?

Accepted Answer

Capture a memory dump of the server for forensic analysis.. Option A is correct because capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory credentials) that is critical for forensic analysis of a suspected credential theft incident. This aligns with the NIST SP 800-86 forensic process, where memory acquisition is prioritized before any system shutdown or network changes to avoid losing evidence of the attacker's active session or malicious code.

Answer

Disable the 'backup_service' account immediately.

Answer

Take the HR file server offline.

Answer

Block the external IP address at the firewall.

Question 13

A cybersecurity firm is conducting a red team exercise for a client. The red team successfully gained access to the client's internal network through a phishing email and escalated privileges to domain administrator. During the exercise, the red team uses a tool to dump password hashes from the domain controller. The client's security team detects the hash dump activity and sends an alert to the SOC. The SOC analyst reviews the alert and sees that the source IP of the hash dump is from a server that is part of the red team's scope. However, the red team is not scheduled to perform hash dumping until the next phase. The analyst also notes that the activity uses a known red team tool. Which of the following actions is most appropriate?

Accepted Answer

Assume the red team is acting out of scope and contact the red team lead for clarification.. Option B is correct because the red team is authorized to operate within the client's environment, but the activity occurred outside the scheduled phase, creating ambiguity. The most appropriate action is to contact the red team lead for clarification to determine if the hash dump was a deviation from the plan or a sign of a real attacker. This aligns with incident response best practices, which prioritize verification before escalation, especially when authorized testing is in progress.

Answer

Launch a full incident response procedure assuming a real attacker.

Answer

Treat the alert as a false positive because the red team is authorized.

Answer

Immediately block the red team's IP addresses and escalate to management.

Question 14

A large e-commerce company experiences a data breach where customer credit card numbers are stolen. The investigation reveals that an attacker exploited a SQL injection vulnerability in the web application to extract the data from the database. The company's web development team claims they use parameterized queries and prepared statements. However, the forensic analysis shows that the injection occurred through a search functionality that concatenates user input directly into the SQL query. The application logs indicate that the search function was developed by a third-party vendor and integrated into the application six months ago. The company wants to prevent such incidents in the future. Which of the following is the most effective long-term solution?

Accepted Answer

Establish a secure software development lifecycle (SSDLC) that includes security reviews for all third-party components.. Option B is correct because the root cause is a failure in the security review process for third-party components. Even though the company uses parameterized queries elsewhere, the third-party search module concatenates user input directly into SQL queries, bypassing that protection. Establishing an SSDLC with mandatory security reviews for all third-party components ensures that such vulnerabilities are caught before integration, addressing the process gap rather than just the symptom.

Answer

Replace the third-party search module with a custom-developed one.

Answer

Implement a web application firewall (WAF) with OWASP rules.

Answer

Conduct regular vulnerability scans and patch management.

Question 15

You are a cybersecurity analyst in a SOC. The company uses a combination of Snort NIDS and Windows Event Log monitoring. At 3:00 PM, you receive a critical alert: 'ET TROJAN Observed Malicious SSL Certificate (Fake Google)'. The alert shows that a workstation (IP 10.0.1.45) initiated an SSL connection to IP 192.0.2.10 on port 443. The certificate presented by the server is self-signed and claims to be 'google.com'. The destination IP is not in any known Google IP range. You check the firewall logs and see that the outbound connection was allowed. The workstation's host logs show that the user is a marketing employee who frequently accesses webmail. The user reports no unusual behavior. You also check the company's web proxy logs and see that the user accessed 'http://www.google.com' earlier today, but the SSL connection is to a different IP. What should be your next step?

Accepted Answer

Isolate the workstation from the network and perform a forensic analysis. The alert indicates a potential man-in-the-middle (MITM) attack or malware using a self-signed SSL certificate impersonating google.com. Isolating the workstation is critical to prevent lateral movement or data exfiltration while preserving evidence for forensic analysis. The combination of Snort NIDS detecting the malicious certificate and the connection to an unknown IP (192.0.2.10) strongly suggests compromise, regardless of user reports.

Answer

Ignore the alert because the user is unaware of any issue

Answer

Wait and monitor the workstation for further alerts before taking action

Answer

Block the destination IP 192.0.2.10 on the firewall