200-201 Practice Test 37 — 15 Questions

Question 1

You are a SOC analyst at a medium-sized enterprise. The company uses a SIEM that collects logs from firewalls, endpoints, and Active Directory. At 2:00 AM, the SIEM generates a high-priority alert: 'Multiple Failed Logins for Administrator Account from Remote IP 198.51.100.20'. The analyst on the night shift reviews the alert and sees that there were 50 failed attempts in 10 minutes, followed by a successful login at 2:12 AM. The successful login originated from the same IP. The account is a domain administrator. The analyst checks the firewall logs and sees that the IP is from a known VPN provider. The analyst also checks the endpoint logs and sees that no unusual activity has occurred after the login. The company has a policy that remote administration is allowed only from a specific jump server with IP 203.0.113.10. The analyst suspects a brute-force attack succeeded. What should the analyst do first?

Accepted Answer

Disable the compromised administrator account immediately. Option B is correct because the immediate priority is to contain the breach by disabling the compromised domain administrator account. The successful login from an unauthorized IP (198.51.100.20) after 50 failed attempts indicates a successful brute-force attack, and the account has domain-level privileges. Disabling the account stops any further lateral movement or privilege escalation, which is the first step in incident response containment before any remediation or investigation.

Answer

Block the IP address 198.51.100.20 on the firewall

Answer

Perform a full network scan of the VPN provider's entire IP range

Answer

Reset the password of the compromised administrator account

Question 2

You are a security analyst at a healthcare organization. The organization uses Cisco Stealthwatch for network visibility and a SIEM for event correlation. You receive an alert that a medical records database server (IP 10.0.3.20) is communicating with an external IP (198.51.100.100) on port 22 (SSH) at 2:00 AM. The database server should have no outbound SSH connections; only remote administration is allowed from a management subnet via VPN. You check Stealthwatch and see that the connection duration is 30 minutes and the volume of data transferred is 500 MB. The database server logs show no local account logins at that time. The firewall logs show that the connection was initiated from the database server. The incident response team has been alerted. What is the most likely scenario and your immediate action?

Accepted Answer

Block the external IP 198.51.100.100 on the firewall and isolate the database server. The database server is initiating an outbound SSH connection to an unknown external IP at an anomalous time, transferring 500 MB of data—far beyond typical administrative traffic. This behavior, combined with no local account logins and the server's policy prohibiting outbound SSH, strongly indicates compromise (e.g., an attacker using SSH for data exfiltration). Immediate isolation and blocking the external IP are critical to contain the threat and prevent further data loss, aligning with incident response best practices.

Answer

Change the database administrator password immediately

Answer

Check if the SSH connection was an authorized remote administration session

Answer

Investigate the database server logs for signs of compromise before taking action

Question 3

You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?

Accepted Answer

Isolate the print server from the network and conduct a forensic investigation. The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.

Answer

Increase the alert threshold to reduce noise and continue monitoring

Answer

Disable the printer service on the server and monitor for recurrence

Answer

Dismiss the alerts as false positives because print servers often perform network discovery

Question 4

You are a security analyst for a mid-sized company with a flat network topology. The company uses a single firewall for internet access and has no internal segmentation. Recently, the IT team deployed a new file server running Windows Server 2019. The server was configured with default settings and placed in the same subnet as all user workstations. Two weeks later, the helpdesk receives multiple complaints about slow network performance. Upon investigation, you notice the file server's network interface is sending a high volume of broadcast traffic. Additionally, you find that the server's firewall is disabled and it is running an outdated SMBv1 protocol. The CEO is concerned about potential data loss and asks for immediate remediation. Which of the following is the most effective and immediate course of action to address the most critical security vulnerability?

Accepted Answer

Disable SMBv1 on the file server using PowerShell or Registry.. D is correct because the most critical security vulnerability is the outdated SMBv1 protocol, which is known to be exploited by ransomware like WannaCry and EternalBlue. Disabling SMBv1 immediately removes this attack vector, addressing the CEO's concern about potential data loss. While the broadcast traffic and disabled firewall are issues, SMBv1 poses a direct and severe risk to data integrity and confidentiality.

Answer

Enable the Windows Firewall on the file server and create rules to allow only essential traffic.

Answer

Configure the switch to block broadcast traffic on the file server's port.

Answer

Create VLANs to segment the file server from user workstations.

Question 5

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

Accepted Answer

Isolate the workstation by disconnecting it from the network immediately.. The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Answer

Block the external IP address on the firewall and continue monitoring.

Answer

Run a full forensic analysis on the workstation without disconnecting it.

Answer

Update the antivirus signatures and run a full scan on the workstation.

Question 6

You are a security operations analyst for a medium-sized enterprise. The company's security policy requires that all endpoint devices have antivirus software installed and updated. During a routine check, you find that a group of 50 laptops used by the sales team have not received antivirus updates for over three months. The policy also states that any non-compliant devices must be quarantined from the network until they are remediated. The sales team manager argues that quarantining the laptops will disrupt critical sales activities. The company's incident response policy has a clause that allows for temporary exceptions in business-critical situations, but requires approval from the CISO. What is the best course of action?

Accepted Answer

Request a temporary exception from the CISO while expediting the updates. Option C is correct because it balances security policy compliance with business continuity. The incident response policy explicitly allows temporary exceptions for business-critical situations with CISO approval, and expediting the updates ensures the 50 laptops are remediated quickly. Quarantining without considering the business impact could violate the company's own exception clause, while ignoring the issue or updating without quarantining bypasses the security controls required by policy.

Answer

Ignore the issue to avoid disrupting sales activities

Answer

Quarantine the laptops immediately as per policy

Answer

Update the antivirus without quarantining, then report to management

Question 7

You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?

Accepted Answer

A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.. The alert is triggered by a correlation rule that detects more than 30 failed authentication attempts from a single source IP within 10 minutes. The observed pattern—exactly 6 attempts per minute, every 5 seconds—is highly regular and mechanical, which is characteristic of an automated script or misconfigured process, not human behavior. Since the partner company locks accounts after 3 failed attempts, a human user would be locked out quickly and could not sustain 30+ attempts; only a script ignoring the lockout policy or using a cached incorrect password could produce this pattern.

Answer

The user 'john.doe' has forgotten his password and is repeatedly trying to log in.

Answer

A man-in-the-middle attack is replaying captured authentication packets.

Answer

The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.

Question 8

A security analyst is responding to an incident on a critical Windows server that hosts a database application. The server is running Windows Server 2019 with all current patches. The analyst suspects that a remote attacker gained access and is using living-off-the-land binaries to move laterally. The analyst has captured a memory dump and a full disk image. The analyst needs to determine if the attacker used PowerShell to download additional tools. Which analysis step should the analyst perform first to identify PowerShell usage?

Accepted Answer

Parse PowerShell operational logs (Event ID 4104) to extract executed scripts and commands.. PowerShell operational logs, specifically Event ID 4104 (Script Block Logging), capture the full text of PowerShell scripts and commands executed on the system. Since the analyst suspects the attacker used PowerShell to download additional tools, parsing these logs is the most direct and efficient first step to confirm that activity. This log source provides the actual commands run, including any download commands like Invoke-WebRequest or Start-BitsTransfer, without relying on indirect artifacts.

Answer

Examine the Windows Registry for Run keys to identify persistence mechanisms.

Answer

Review prefetch files (.pf) to determine when PowerShell was last executed.

Answer

Analyze network connection logs to identify outbound connections to known malicious IPs.

Question 9

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs.
- Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306.
- Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

Accepted Answer

Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.. The firewall logs show that outbound traffic from the web server (10.0.1.10) to the database server (10.0.2.10) on TCP 3306 is being denied, which causes the database errors. Since the web server initiates the connection to the database, a rule allowing this specific outbound traffic from the web server to the database server on port 3306 restores functionality while maintaining the default-deny posture. This is the most secure approach because it permits only the necessary traffic between the two specific hosts and port, without opening broader access.

Answer

Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.

Answer

Move the database server to the DMZ to avoid firewall restrictions.

Answer

Create a rule allowing all outbound traffic from the DMZ to the internal network.

Question 10

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Accepted Answer

Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5. The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.

Answer

Apply a software patch to the web application to fix the SQL injection vulnerability

Answer

Restore the web server from a known good backup

Answer

Shut down the database server to prevent further data loss

Question 11

You are a security analyst at a financial institution. The network consists of three segments: internal corporate network (10.0.0.0/24), DMZ (192.168.1.0/24) hosting a web server and an email server, and a guest wireless network (172.16.0.0/24). The firewall is configured with the following rules: (1) permit inbound HTTP/HTTPS to the web server from any; (2) permit inbound SMTP to the email server from any; (3) deny all other inbound traffic; (4) permit all outbound traffic from internal network; (5) deny all outbound traffic from guest network to internal and DMZ, but permit to internet. Recently, an employee reported that sensitive files on an internal file server (10.0.0.10) were accessed without authorization. Logs show that the access originated from an IP address in the guest network (172.16.0.50) at 3:00 AM. The guest network is open (no authentication required). The internal file server is not directly accessible from the guest network per rule (5). However, the attacker used the web server as a pivot: they compromised the web server via an unpatched vulnerability, then from the web server they connected to the internal file server. Which of the following actions would BEST prevent this type of attack in the future?

Accepted Answer

Add a firewall rule that permits only necessary traffic from the DMZ to specific internal servers, and deny all other DMZ-to-internal traffic. Option D is correct because the attack leveraged the DMZ web server as a pivot to reach the internal file server. By implementing a firewall rule that permits only necessary traffic from the DMZ to specific internal servers (e.g., only allow the web server to communicate with a database server on TCP/3306) and denies all other DMZ-to-internal traffic, you enforce a least-privilege segmentation policy. This would block the web server from initiating arbitrary connections to the internal file server (10.0.0.10), even if the web server is compromised, directly preventing the pivot attack.

Answer

Implement a firewall rule that denies all traffic from the DMZ to the internal network

Answer

Move the web server to the internal network and place a reverse proxy in the DMZ

Answer

Apply a patch to the web server and require authentication on the guest network

Question 12

You are a security administrator for a company with 500 employees. The company uses a SIEM with basic correlation rules. Recently, the HR department reported that several employees received phishing emails with a link to a fake login page. The emails bypassed the spam filter. You want to detect if any employees clicked the link. You have access to web proxy logs, DNS logs, and endpoint antivirus logs. The phishing link is 'http://malicious-login.com/verify'. Which action should you take first to identify affected users?

Accepted Answer

Query the web proxy logs for HTTP requests containing the URL.. The web proxy logs record all HTTP requests made by clients, including the full URL path. Querying for 'http://malicious-login.com/verify' directly shows which employees clicked the link, because the proxy captures the exact destination and timestamp of each request. This is the most direct and reliable evidence of user interaction with the phishing link.

Answer

Run a vulnerability scan on all employee workstations.

Answer

Search DNS logs for queries to 'malicious-login.com'.

Answer

Search endpoint logs for any malware detections.

Question 13

An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?

Accepted Answer

Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis. Option D is correct because the immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.

Answer

Run an antivirus scan and if nothing is found, ignore the alert as a false positive

Answer

Immediately disconnect the workstation from the network and perform a full system restore from a known good backup

Answer

Delete the scheduled task and the script from the hidden folder, then reboot the workstation

Question 14

You are a security analyst at a mid-sized company that uses a mix of on-premises servers and cloud services. The company's security policy requires all sensitive data to be encrypted at rest and in transit, and all access to be logged and monitored. Recently, the company experienced a data breach where an attacker exfiltrated a database containing customer PII. The investigation revealed that the attacker gained access using a compromised VPN account that had been inactive for 6 months. The account belonged to a former employee who left the company but the account was never disabled. The VPN logs show that the account was used from an unusual IP address, but no alert was triggered because the account was not on any watchlist. The breach occurred over a weekend when the security team was not monitoring. Which of the following would have most effectively prevented this breach?

Accepted Answer

Automate the de-provisioning of user accounts upon employee termination.. The root cause of the breach was that the former employee's VPN account remained active after termination, allowing the attacker to use it. Automating the de-provisioning of user accounts upon employee termination (Option D) directly addresses this by ensuring that accounts are disabled or removed as part of the offboarding process, eliminating the attack vector entirely. This aligns with the principle of least privilege and identity lifecycle management, which are foundational to access control policies.

Answer

Deploy a SIEM with anomaly detection for unusual VPN login locations.

Answer

Implement multi-factor authentication on all VPN accounts.

Answer

Increase the frequency of log reviews to daily.

Question 15

You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?

Accepted Answer

Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.. Option B is correct because the presence of a legitimate svchost.exe with a valid Microsoft signature does not rule out DLL sideloading or injection. By listing all DLLs loaded by the process, you can identify suspicious non-Microsoft DLLs that may be executing malicious code within the trusted svchost.exe context, which is a common technique used by malware to evade detection.

Answer

Perform a full system reimage of the workstation to ensure the malware is removed.

Answer

Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.

Answer

Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.