200-201 Practice Test 37 — 15 Questions

Question 1

During PCAP analysis, a security analyst observes the following pattern: a series of TCP SYN packets to multiple ports on a target, followed by RST packets from the target for closed ports. Which TWO characteristics describe this scan?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It is a SYN scan. The SYN scan sends SYN packets and listens for SYN-ACK (open) or RST (closed). It is a stealthy scan because it doesn't complete the TCP handshake.

Answer

It uses ICMP echo requests

Answer

It is a UDP scan

Answer

It completes the TCP three-way handshake

Question 2

A security analyst is tuning a SIEM to detect lateral movement. Which THREE log sources would provide the most useful data for this purpose? (Choose THREE.)

Accepted Answer

Windows Event Logs showing network connections and process creation.. Option A is correct because Windows Event Logs such as Security Event ID 4688 (process creation) and Sysmon Event ID 3 (network connection) reveal suspicious process-to-network relationships that are hallmarks of lateral movement tools like PsExec or Cobalt Strike. Option D is correct because system logs capturing authentication events (e.g., Windows 4624/4625, Linux sshd and sudo entries) across multiple hosts expose pass-the-hash, credential reuse, and remote logon patterns central to lateral movement. Option E is correct because firewall logs showing internal-to-internal connections (east-west traffic) highlight anomalous host-to-host communication that would otherwise be invisible at the perimeter. Option B is not appropriate because web server logs for external requests focus on inbound client activity against a service, not host-to-host movement inside the network. Option C is not appropriate because DNS logs for external domain queries are more useful for command-and-control and exfiltration detection than for identifying lateral movement between internal hosts.

Answer

Web server logs for external requests.

Answer

DNS logs for external domain queries.

Question 3

An analyst uses 'sc query' on a Windows host and finds a service named 'WindowsUpdate' with a binary path pointing to 'C:\Users\Public\update.exe'. The service is running. Why is this suspicious?

Accepted Answer

The binary path is not in a system directory. Legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Answer

The service is running

Answer

The service name is misspelled

Answer

The service displays 'WindowsUpdate'

Question 4

A security analyst is examining a log file and notices that the hash value of a configuration file does not match the expected value. Which security goal has been violated?

Accepted Answer

Integrity. A hash mismatch indicates that the file's contents have been altered from their expected state, which directly violates the integrity security goal. Integrity ensures data has not been modified in an unauthorized or accidental way, and cryptographic hashes are the standard mechanism for verifying it. Confidentiality, non-repudiation, and availability are unrelated to detecting unauthorized modification.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 5

Which two characteristics are commonly associated with a distributed denial-of-service (DDoS) attack?

Accepted Answer

High volume of traffic from multiple sources. Option A is correct because a DDoS attack is by definition distributed: it floods the target with a high volume of traffic originating from many compromised hosts (a botnet), which is what distinguishes it from a single-source DoS attack. Option D is correct because a common DDoS technique is the ICMP flood (e.g., ping flood or smurf attack), which manifests as an unusual surge in ICMP echo requests directed at the victim to exhaust bandwidth and processing resources. Option B is not characteristic of DDoS; multiple failed login attempts indicate a brute-force or password-guessing attack against authentication, not resource exhaustion by traffic volume. Option C, slow application response time, is a possible symptom of many issues including DDoS, but it is a generic effect rather than a defining characteristic of a DDoS attack. Option E is incorrect because traffic from a single IP address describes a traditional single-source DoS attack, whereas DDoS relies on traffic from multiple distributed sources.

Answer

Multiple failed login attempts

Answer

Slow application response time

Answer

Traffic from a single IP address

Question 6

An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?

Accepted Answer

svchost.exe should be a child of services.exe, not explorer.exe. In a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

Answer

explorer.exe should not have any child processes

Answer

Nothing, svchost.exe can be a child of any process

Answer

The pstree output is unreliable

Question 7

A security analyst is analyzing a memory dump from a compromised Linux server. Which tool is most appropriate for extracting running processes and network connections from the dump?

Accepted Answer

volatility. Volatility is the correct tool because it is a specialized memory forensics framework designed to analyze RAM dumps. It can extract a list of running processes (via the `pslist` or `pstree` plugins) and active network connections (via the `netscan` or `connscan` plugins) directly from the memory image, without relying on the live system's kernel data structures which may be compromised.

Answer

nmap

Answer

Wireshark

Answer

tcpdump

Question 8

A security analyst notices that a workstation is generating multiple DNS queries to a known malicious domain. Which host-based analysis technique would be most effective in confirming the infection?

Accepted Answer

Use Process Explorer to examine the process responsible for the DNS queries. Process Explorer is a host-based analysis tool that provides detailed information about running processes, including their network connections and DNS queries. By examining the process responsible for the DNS queries to the known malicious domain, the analyst can directly identify the infected executable or script, confirming the infection at the process level.

Answer

Review the Windows Firewall logs to see blocked connections

Answer

Check the scheduled tasks for suspicious entries

Answer

Analyze the Windows Event Log for Event ID 5156

Question 9

An IPS sensor is configured inline and drops traffic that triggers the signature 'OVERFLOW-ICMP-ECHO', which triggers on ICMP packets with size > 1024 bytes. A network administrator reports that legitimate network monitoring tools using large ICMP packets are being blocked. What is the best course of action?

Accepted Answer

Create a whitelist for the monitoring tool's source IP. Creating a whitelist for the monitoring tool's source IP allows the IPS to continue dropping malicious oversized ICMP packets while permitting legitimate traffic from known, trusted sources. This maintains security for the rest of the network without disabling the signature or changing its mode, which would reduce protection.

Answer

Increase the threshold to 2048

Answer

Disable the signature entirely

Answer

Change the sensor mode to IDS for that signature

Question 10

An organization uses a qualitative risk assessment to evaluate a new vendor. Which characteristic is typical of qualitative risk assessments?

Accepted Answer

Ranks risks using scales such as high, medium, low. Qualitative assessments use subjective ratings like high, medium, low.

Answer

Calculates annual loss expectancy (ALE)

Answer

Assigns numeric probabilities and impact

Answer

Uses monetary values to estimate loss

Question 11

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

Accepted Answer

Tier 3. Tier 3 SOC analysts are the most senior and are responsible for advanced threat hunting, malware reverse engineering, and deep forensic analysis. Tier 1 handles initial triage and alert monitoring, while Tier 2 performs deeper investigation and incident response. Threat hunting and forensics are explicitly Tier 3 responsibilities in the standard SOC tier model.

Answer

Tier 1

Answer

All tiers equally

Answer

Tier 2

Question 12

A security analyst at a SOC Tier 1 receives an alert about a potential malware infection on a user's workstation. What is the primary responsibility of the Tier 1 analyst in this scenario?

Accepted Answer

Conduct initial triage and basic investigation. Tier 1 analysts monitor alerts, perform initial triage, and escalate if needed. They conduct basic investigation.

Answer

Coordinate with legal counsel for data breach notification

Answer

Develop new detection signatures

Answer

Perform deep forensic analysis of the malware

Question 13

Which TWO of the following are symmetric encryption algorithms? (Choose two.)

Accepted Answer

AES. AES (Option A) is correct because it is a symmetric block cipher that uses the same secret key for both encryption and decryption, operating on 128-bit blocks with key sizes of 128, 192, or 256 bits. 3DES (Option E) is also correct because it is a symmetric block cipher that applies the DES algorithm three times to each data block using the same shared secret key for encryption and decryption. RSA (Option B) is not correct because it is an asymmetric algorithm that uses a public key for encryption and a private key for decryption. Diffie-Hellman (Option C) is not correct because it is an asymmetric key-exchange protocol used to establish a shared secret, not a symmetric encryption algorithm itself. ECC (Option D) is not correct because it is an asymmetric public-key cryptography approach based on elliptic curve mathematics.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECC

Question 14

A security policy mandates that all employees complete annual security awareness training. Which of the following metrics best demonstrates the effectiveness of this training?

Accepted Answer

Decrease in security incidents attributed to user error. A decrease in security incidents attributed to user error directly measures the behavioral outcome of the training. Effective security awareness training should reduce the frequency of incidents caused by human mistakes, such as clicking malicious links or mishandling data. This metric reflects the ultimate goal of the training, not just participation or short-term knowledge retention.

Answer

Results of a post-training quiz

Answer

Percentage of employees who completed the training

Answer

Number of help desk tickets related to phishing

Question 15

Based on the exhibit, which type of traffic is being denied?

Accepted Answer

UDP traffic from an internal host to an external DNS server.. The exhibit shows an access control list (ACL) entry that denies UDP traffic from any source to any destination with a destination port of 53, which is the standard port for DNS. Since the ACL is applied inbound on an interface facing the internal network, it specifically blocks UDP traffic originating from an internal host destined for an external DNS server. This matches option C exactly.

Answer

Traffic permitted by the access group.

Answer

TCP traffic to a DNS server.

Answer

ICMP traffic from an external host.