200-201 Practice Test 36 — 15 Questions

Question 1

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 2

Refer to the exhibit. The analyst sees two IDS alerts from the same source. What should the analyst conclude?

Accepted Answer

The host is likely infected with malware. The IDS alerts indicate the same source IP is communicating with a known malicious domain (evil.com) using a suspicious user-agent string. This pattern of repeated connections to a known bad destination is characteristic of malware beaconing or command-and-control (C2) traffic, not a false positive or benign activity.

Answer

The alerts are false positives because the user-agent is common

Answer

The host is being scanned

Answer

The host is downloading a large file

Question 3

In Snort, a rule is written as: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:to_server; content:"|ff|SMB"; nocase;). What does the 'flow:to_server' option indicate?

Accepted Answer

Apply to traffic from client to server. In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.

Answer

Apply to bidirectional traffic

Answer

Apply only to traffic from server to client

Answer

Ignore the direction of traffic

Question 4

A SOC analyst is reviewing a NetFlow record and sees that a single internal IP has communicated with multiple external IPs on port 445 (SMB) within a short time frame. Which type of activity is most likely indicated?

Accepted Answer

SMB scanning or worm propagation. Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.

Answer

Normal file sharing activity

Answer

Data exfiltration over SMB

Answer

DNS tunneling

Question 5

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

Accepted Answer

Tier 3. Tier 3 analysts perform proactive threat hunting and complex forensics.

Answer

Tier 1

Answer

All tiers equally

Answer

Tier 2

Question 6

During a security incident, the incident handler identifies that the breach involves personally identifiable information (PII) of customers. Which role is primarily responsible for determining if legal notification requirements apply?

Accepted Answer

Legal counsel. Legal counsel advises on data breach notification laws and regulatory requirements.

Answer

Incident handler

Answer

HR

Answer

CISO

Question 7

Which type of attack does this Snort rule detect?

Accepted Answer

SQL injection. The Snort rule detects SQL injection by matching the pattern 'union select' in the HTTP request body. SQL injection attacks manipulate database queries by injecting malicious SQL statements, and the rule's content match for 'union select' is a classic indicator of a UNION-based SQL injection attempt.

Answer

Cross-site scripting

Answer

Buffer overflow

Answer

Directory traversal

Question 8

An analyst is investigating a potential compromise using Indicators of Compromise (IoCs). Which TWO of the following are valid types of IoCs?

Accepted Answer

IP address. IP addresses are a fundamental type of Indicator of Compromise (IoC) because they directly identify the network location of a malicious host, such as a command-and-control (C2) server or a source of an attack. Security analysts use IP addresses in threat intelligence feeds and SIEM queries to correlate logs and detect inbound or outbound connections to known malicious hosts.

Answer

User name

Answer

Geographic location

Answer

Protocol name

Question 9

Which type of attack does this Snort alert most likely indicate?

Accepted Answer

Directory traversal. The Snort alert signature 'ET WEB_SERVER ATTACKS Directory Traversal Attempt' specifically detects patterns like '../' or encoded variants (e.g., '%2e%2e%2f') in HTTP requests. This indicates an attempt to access files outside the web root directory, which is the hallmark of a directory traversal attack. The alert triggers on the URI path, not on SQL syntax or script injection patterns.

Answer

Buffer overflow

Answer

SQL injection

Answer

Cross-site scripting

Question 10

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Accepted Answer

Packets originating from a MAC address that does not match the IP's legitimate MAC. In an ARP spoofing attack, the attacker sends forged ARP replies that associate their own MAC address with the IP address of a legitimate host (e.g., the default gateway). This causes packets destined for that IP to be sent to the attacker's MAC, creating a mismatch between the source MAC in the packet and the legitimate MAC address for that IP. Detecting such mismatches is a key indicator of ARP cache poisoning.

Answer

A high number of TCP RST packets

Answer

A single host sending numerous ARP requests

Answer

An increase in broadcast ARP traffic

Question 11

An analyst is verifying a VPN configuration. Which of the following is true about this configuration?

Accepted Answer

The VPN uses AES-256 encryption and SHA-1 authentication.. The configuration shown in the exhibit (not provided here) specifies AES-256 as the encryption algorithm and SHA-1 as the authentication (integrity) algorithm. AES-256 provides a 256-bit key for strong encryption, while SHA-1 produces a 160-bit hash for data integrity. Although SHA-1 is considered cryptographically weaker than SHA-2, it is still commonly used in legacy or compatibility-focused VPN configurations, making option C the correct match for the given settings.

Answer

The VPN uses AES-128 encryption and SHA-1 authentication.

Answer

The VPN uses AES-256 encryption and SHA-2 authentication.

Answer

The VPN uses 3DES encryption and SHA-256 authentication.

Answer

The VPN uses DES encryption and MD5 authentication.

Question 12

Based on the exhibit, what does the sequence of events indicate?

Accepted Answer

A process masquerading as svchost.exe was spawned by wmiprvse.exe (likely via WMI), and then that malicious process launched calc.exe, a suspicious behavior.. The exhibit shows wmiprvse.exe (the WMI Provider Host) spawning svchost.exe, which then launches calc.exe. In normal operations, wmiprvse.exe does not spawn svchost.exe; svchost.exe is a generic host process for Windows services and is typically launched by services.exe. The sequence indicates process masquerading: an attacker used WMI to execute a malicious binary named svchost.exe, which then launched calc.exe as a suspicious payload. This is a classic indicator of lateral movement or privilege escalation via WMI.

Answer

The wmiprvse.exe process is known to spawn svchost.exe for system health checks.

Answer

The user is executing a macro that opens Calculator.

Answer

A legitimate system process (wmiprvse.exe) launched a service host, which then launched calc.exe for maintenance.

Question 13

An organization is required to protect cardholder data. Which compliance framework applies to this requirement?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that handle credit card data.

Answer

ISO 27001

Answer

HIPAA

Answer

GDPR

Question 14

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Accepted Answer

Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5. The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.

Answer

Apply a software patch to the web application to fix the SQL injection vulnerability

Answer

Restore the web server from a known good backup

Answer

Shut down the database server to prevent further data loss

Question 15

A system administrator needs to grant access to a database for a new employee. According to the principle of least privilege, what should be done?

Accepted Answer

Grant only the minimum required permissions. (Grant only the minimum required permissions) correctly follows the principle of least privilege, ensuring the employee has access only to what is necessary for their role. Option B (Grant temporary admin access) is excessive, as admin rights are not required for normal database access. Option C (Grant no access until manager approves) is too restrictive and does not directly apply least privilege. Option D (Grant full access and remove later) violates least privilege by providing more access than needed initially.

Answer

Grant temporary admin access

Answer

Grant no access until manager approves

Answer

Grant full access and remove later