200-201 Practice Test 36 — 15 Questions

Question 1

An analyst receives a YARA rule that includes the string 'MZ' at the beginning of a file. What does this indicator typically help identify?

Accepted Answer

Windows executable files. The string 'MZ' (0x4D 0x5A) is the magic number for the MS-DOS header, which is present at the very beginning of all Windows Portable Executable (PE) files, including .exe, .dll, and .sys files. A YARA rule that checks for 'MZ' at offset 0 is specifically targeting the PE file format, which is the standard executable format for Windows. This indicator helps an analyst quickly identify that a file is likely a Windows executable, regardless of its extension.

Answer

PDF files with embedded JavaScript

Answer

Linux ELF binaries

Answer

Malicious documents containing macros

Question 2

Match each Cisco CyberOps concept to its description.

Accepted Answer

IoC: Evidence that suggests a potential security incident or intrusion.. The correct matches are: IoC = evidence of intrusion, SIEM = log aggregation and analysis system, IPS = traffic monitoring and blocking device. Common confusions include swapping definitions between similar-sounding terms or confusing tools with indicators.

Answer

IoC: A system that aggregates logs for analysis.

Answer

SIEM: Evidence of compromise.

Answer

IPS: A device that translates private IP addresses to public.

Question 3

Match each security tool to its primary purpose.

Accepted Answer

SIEM: Provides centralized log management and correlation for threat detection.. These are common security tools used in operations. SIEM centralizes logs, IDS/IPS monitors traffic, firewall filters, and antivirus protects endpoints.

Answer

SIEM: Monitors network traffic for malicious activity and can block/prevent intrusions.

Answer

Firewall: Provides centralized log management and correlation for threat detection.

Question 4

An incident handler collects a hard drive from a compromised server. To maintain chain of custody, which information must be documented?

Accepted Answer

The date, time, and signature of each person who handled the evidence. Chain of custody requires detailed documentation of who handled evidence and when.

Answer

The IP address of the server

Answer

The name of the antivirus software installed

Answer

The operating system version

Question 5

An attacker sends an email that appears to come from the company's IT department, asking the recipient to click a link and reset their password due to a security breach. Which type of social engineering is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick the recipient into clicking a malicious link and divulging credentials. This matches the definition of phishing, which is a broad social engineering technique that employs deceptive electronic communications (typically email) to steal sensitive information. The email impersonates the IT department to create a false sense of urgency, a hallmark of phishing campaigns.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 6

An organization uses Cisco AMP for Endpoints. A file with a low prevalence score is executed on multiple endpoints, and AMP identifies it as malicious after behavioral analysis. The analyst needs to ensure that all endpoints are protected from this file. Which action should be taken?

Accepted Answer

Create a custom IOC for the file hash and apply it to an outbreak policy.. Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.

Answer

Isolate all endpoints that executed the file.

Answer

Disable cloud connectivity for AMP to prevent recurrence.

Answer

Run a scan on each endpoint using the local AMP engine.

Question 7

A company needs to comply with regulations that protect personal data of EU citizens. Which TWO compliance frameworks are directly relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. GDPR (B) is directly relevant because the General Data Protection Regulation is the EU legal framework that governs the protection of personal data of EU citizens, imposing requirements on data controllers and processors regarding consent, data subject rights, breach notification, and cross-border transfers. ISO 27001 (C) is not correct because it is a voluntary international standard for establishing an Information Security Management System (ISMS), not a regulation that directly protects EU citizens' personal data. PCI DSS (A) is not correct because it applies specifically to organizations that store, process, or transmit cardholder data (payment card information), not to personal data of EU citizens generally. NIST Cybersecurity Framework (D) is not correct because it is a voluntary US-origin framework for managing cybersecurity risk rather than a data protection regulation aimed at EU personal data. HIPAA (E) is not correct because it governs protected health information in the United States, not the personal data of EU citizens.

Answer

PCI DSS

Answer

ISO 27001

Answer

NIST Cybersecurity Framework

Answer

HIPAA

Question 8

An analyst is reviewing a PCAP and sees multiple HTTP requests with the parameter 'id=1 UNION SELECT username,password FROM users'. What type of attack is being attempted?

Accepted Answer

SQL injection. The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 9

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

Accepted Answer

Incident Response Procedure for evidence preservation. Pulling the network cable of a compromised server causes the loss of volatile data such as running processes, memory contents, and network connections. The Incident Response Procedure for evidence preservation dictates that volatile data must be collected before any action that could destroy it. By pulling the cable, the first responder violated this procedure, leading to the inability to collect volatile evidence.

Answer

Chain of Custody Procedure

Answer

Forensic Analysis Procedure

Answer

Escalation Procedure

Question 10

A security analyst discovers that a server's configuration allows users to access files outside of their intended directory. In security terminology, what is this weakness called?

Accepted Answer

Vulnerability. A vulnerability is a weakness or flaw in a system's design, configuration, or code that could be exploited to violate security. The scenario describes a path traversal weakness in the server configuration, which is a classic vulnerability. This is the precise security term for the condition described.

Answer

Exploit

Answer

Threat

Answer

Risk

Question 11

Drag and drop the steps for initial configuration of a Cisco IOS device after booting into the correct order.

Accepted Answer

Step 1: Enter privileged EXEC mode (enable), Step 2: Enter global configuration mode (configure terminal), Step 3: Set hostname (hostname name), Step 4: Set enable secret (enable secret password), Step 5: Save the running configuration (copy running-config startup-config).. After booting, you must enter privileged mode, then global config, set hostname, set enable secret, and save.

Answer

Step 1: Enter global configuration mode, Step 2: Enter privileged EXEC mode, Step 3: Set hostname, Step 4: Set enable secret, Step 5: Save the running configuration.

Answer

Step 1: Enter privileged EXEC mode, Step 2: Enter global configuration mode, Step 3: Set enable secret, Step 4: Set hostname, Step 5: Save the running configuration.

Answer

Step 1: Enter privileged EXEC mode, Step 2: Enter global configuration mode, Step 3: Set hostname, Step 4: Save the running configuration, Step 5: Set enable secret.

Question 12

You are the cybersecurity analyst for a small business that has a security policy requiring all network traffic to pass through a proxy server for content filtering. Recently, employees have been complaining that some websites are not loading correctly. You check the proxy logs and see that the proxy is blocking traffic that appears to be from non-standard ports. However, upon investigation, you find that the blocked sites are legitimate business tools that use custom ports. Which action aligns with the security policy?

Accepted Answer

Create a security exception based on business need and document it.. Creating a documented security exception for the legitimate business tools allows them to function while maintaining the security policy's intent. The policy requires traffic to pass through the proxy for content filtering, but legitimate business needs may necessitate exceptions. Documenting the exception ensures auditability and control. Option A is incorrect because instructing employees to use HTTP instead of the custom ports may not be possible if the tools require specific protocols, and it could introduce security risks. Option B is incorrect because configuring the proxy to allow all traffic on custom ports broadly would bypass content filtering for those ports, potentially allowing malicious traffic. Option C is incorrect because disabling content filtering for affected employees removes the security control entirely, violating the policy.

Answer

Instruct employees to access the tools via HTTP instead.

Answer

Configure the proxy to allow all traffic on custom ports for those specific tools.

Answer

Disable content filtering for the affected employees.

Question 13

An incident responder is analyzing a Windows machine for evidence of malware persistence. Which TWO registry keys are commonly abused to achieve automatic execution at user logon?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Options A and D are correct because HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Run are the canonical Run keys that Windows automatically processes at user logon, launching any listed program for all users (HKLM) or the specific user (HKCU), which is why malware commonly writes here for persistence. Option C (RunOnce) also triggers at logon but is designed for one-time execution and the value is deleted after it runs, so it is not the standard persistent automatic-execution key the question targets. Option B (AppInit_DLLs) is a DLL-injection mechanism loaded into processes using User32.dll, not a logon-triggered program launcher. Option E (Image File Execution Options) is abused for debugger hijacking or executable redirection, not for automatic execution at logon.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 14

In the Cyber Kill Chain, which phase involves sending a malicious attachment to a targeted user?

Accepted Answer

Delivery. In the Lockheed Martin Cyber Kill Chain, Delivery is the phase where the attacker transmits the weaponised payload to the victim — for example, via a phishing email with a malicious attachment, a malicious link, or a USB drop. Sending the malicious attachment to a targeted user is the textbook definition of Delivery. Weaponization (the prior phase) is where the attacker pairs the exploit with the payload, but the actual transmission to the target is Delivery.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 15

Which phase of the NIST Cybersecurity Framework involves actions to limit the impact of a cybersecurity incident?

Accepted Answer

Respond. The Respond function of the NIST Cybersecurity Framework (CSF) covers the actions taken once an incident is detected—containment, mitigation, analysis, and communication—to limit the impact and prevent further damage. It is the phase where incident response plans, communications, and mitigation activities are executed. This directly matches the question's wording about limiting the impact of an incident.

Answer

Protect

Answer

Identify

Answer

Detect