200-201 Practice Test 37 — 15 Questions

Question 1

During a security audit, an analyst finds that a third-party vendor has access to sensitive customer data beyond what is necessary for their services. Which principle of least privilege should the policy enforce?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce a data classification and access control policy. The principle of least privilege means granting only the minimum access rights necessary. To enforce this, the policy should include data classification and access controls that restrict vendor access to only required data sets. Option C is correct. Option A (implement an incident response plan) is reactive and does not prevent excessive access. Option B (update the end-user license agreement) is a legal document, not a technical control. Option D (invoke a service-level agreement) defines performance metrics, not access restrictions.

Answer

Implement an incident response plan for data leaks

Answer

Update the end-user license agreement

Answer

Invoke a service-level agreement

Question 2

An analyst is reviewing this configuration. What is the most significant security concern?

Accepted Answer

The access-list does not specify source IPs, allowing any source.. Allowing any source IP is a security risk; source restriction is missing. Option A is the purpose. Option B is present (deny any). Option C is a design choice. Option E is not recommended.

Answer

The access-list permits all traffic to 192.168.1.100 on ports 80 and 443.

Answer

The access-list is missing a rule to deny all other traffic.

Answer

The access-list only permits traffic to a single host.

Answer

The access-list should permit traffic to the entire subnet.

Question 3

An security auditor finds that the company's backup policy does not include offsite storage. The security policy requires that backups be stored in a geographically separate location. What should the company do?

Accepted Answer

Use encrypted cloud backup in a different region. Encrypted offsite cloud storage satisfies the geographical separation requirement. Option A is wrong because onsite storage is not geographically separate. Option B is wrong because increasing retention does not change location. Option C is wrong because RAID provides redundancy but not offsite storage.

Answer

Store backups in a fireproof safe on-site

Answer

Implement RAID on the backup server

Answer

Increase backup retention period

Question 4

A NetFlow report shows that host 10.0.0.5 has sent 1 GB of data to external IP 198.51.100.10 over port 443 in the last hour, while other hosts average 100 MB. This anomaly is most indicative of:

Accepted Answer

Data exfiltration. The sudden, disproportionate egress of 1 GB of data from a single host to an external IP over port 443 (HTTPS) is a classic indicator of data exfiltration. While HTTPS traffic is common, the volume anomaly—10x the average of other hosts—suggests unauthorized copying of sensitive data, as attackers often use encrypted channels to blend in with normal traffic.

Answer

Port scan activity

Answer

Normal video streaming

Answer

DNS amplification attack

Question 5

You are a security analyst at a mid-sized company that uses a mix of on-premises servers and cloud services. The company's security policy requires all sensitive data to be encrypted at rest and in transit, and all access to be logged and monitored. Recently, the company experienced a data breach where an attacker exfiltrated a database containing customer PII. The investigation revealed that the attacker gained access using a compromised VPN account that had been inactive for 6 months. The account belonged to a former employee who left the company but the account was never disabled. The VPN logs show that the account was used from an unusual IP address, but no alert was triggered because the account was not on any watchlist. The breach occurred over a weekend when the security team was not monitoring. Which of the following would have most effectively prevented this breach?

Accepted Answer

Automate the de-provisioning of user accounts upon employee termination.. The root cause of the breach was that the former employee's VPN account remained active after termination, allowing the attacker to use it. Automating the de-provisioning of user accounts upon employee termination (Option D) directly addresses this by ensuring that accounts are disabled or removed as part of the offboarding process, eliminating the attack vector entirely. This aligns with the principle of least privilege and identity lifecycle management, which are foundational to access control policies.

Answer

Deploy a SIEM with anomaly detection for unusual VPN login locations.

Answer

Implement multi-factor authentication on all VPN accounts.

Answer

Increase the frequency of log reviews to daily.

Question 6

Refer to the exhibit. An analyst sees these syslog messages from the Cisco ASA. What is the most likely cause?

Accepted Answer

An internal host (10.0.0.10) is attempting to access the Internet on port 80 and is being blocked.. The syslog messages show the Cisco ASA denying traffic from internal IP 10.0.0.10 to external destination 203.0.113.5 on TCP port 80. The ASA's access control list (ACL) is configured to block outbound HTTP traffic from this host, which is the most likely cause of the denial. The messages indicate a standard deny action, not a signature-based attack detection.

Answer

An external host attempting to connect to an internal server.

Answer

A denial-of-service attack from the external IP.

Answer

An internal host is performing a port scan of the external server.

Question 7

You are the cybersecurity analyst for a small business that has a security policy requiring all network traffic to pass through a proxy server for content filtering. Recently, employees have been complaining that some websites are not loading correctly. You check the proxy logs and see that the proxy is blocking traffic that appears to be from non-standard ports. However, upon investigation, you find that the blocked sites are legitimate business tools that use custom ports. Which action aligns with the security policy?

Accepted Answer

Create a security exception based on business need and document it.. Creating a documented security exception for the legitimate business tools allows them to function while maintaining the security policy's intent. The policy requires traffic to pass through the proxy for content filtering, but legitimate business needs may necessitate exceptions. Documenting the exception ensures auditability and control. Option A is incorrect because instructing employees to use HTTP instead of the custom ports may not be possible if the tools require specific protocols, and it could introduce security risks. Option B is incorrect because configuring the proxy to allow all traffic on custom ports broadly would bypass content filtering for those ports, potentially allowing malicious traffic. Option C is incorrect because disabling content filtering for affected employees removes the security control entirely, violating the policy.

Answer

Instruct employees to access the tools via HTTP instead.

Answer

Configure the proxy to allow all traffic on custom ports for those specific tools.

Answer

Disable content filtering for the affected employees.

Question 8

A help desk receives a phone call from someone claiming to be from IT and requesting a password reset. What type of attack is this?

Accepted Answer

Vishing. Vishing (voice phishing) is a social engineering attack conducted over voice communication, such as a phone call, where the attacker impersonates a legitimate entity (e.g., IT support) to trick the victim into revealing sensitive information or performing an action like a password reset. This matches the scenario exactly: a phone call from someone claiming to be from IT requesting a password reset.

Answer

Social engineering

Answer

Phishing

Answer

Malware

Question 9

Which TWO of the following are indicators of a potential data exfiltration attempt?

Accepted Answer

An internal host transferring large amounts of data to an unknown external IP at 3 AM.. Data exfiltration often involves transferring large volumes of data to an unknown external IP during off-hours (e.g., 3 AM) to evade detection. This behavior deviates from normal business patterns and is a classic indicator of a data breach or insider threat.

Answer

A user accessing an internal file server during business hours.

Answer

A failed login attempt from an internal workstation.

Answer

A spike in ICMP echo requests from an external IP.

Question 10

A Linux host has an unusual cron job that runs a script from /tmp every minute. The analyst checks /etc/crontab and /var/spool/cron/ but finds nothing. Where else could the cron job be defined?

Accepted Answer

/etc/cron.d/. The cron job is defined in /etc/cron.d/ because this directory allows system administrators to drop individual cron configuration files that are parsed by the cron daemon. Unlike /etc/crontab and /var/spool/cron/ (which contain user-specific crontabs), /etc/cron.d/ is a standard location for package-maintained or custom cron jobs that run with system privileges. The fact that the analyst found nothing in the other two locations strongly suggests the job is defined in /etc/cron.d/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.allow

Answer

~/.bashrc

Question 11

An analyst is investigating a Windows system for signs of malware persistence. Which TWO registry locations are commonly used by malware to achieve automatic startup? (Choose two.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Question 12

A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?

Accepted Answer

tcp.port == 443. The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Answer

tcp.dstport == 443

Answer

https

Answer

port 443

Question 13

During a host-based analysis, an analyst discovers a suspicious service on a Windows machine. Which tool or command can be used to query the service configuration?

Accepted Answer

sc query. The 'sc' command-line tool (Service Control) can query and modify services. 'sc query' shows the status, and 'sc qc' shows the configuration.

Answer

reg query

Answer

schtasks

Answer

tasklist

Question 14

Which command-line tool is used to capture and analyze network packets in real time?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures and displays network packets in real time directly from the terminal. It uses libpcap to intercept raw packets at the network interface, making it ideal for scripting and remote session analysis where a GUI is unavailable.

Answer

Wireshark

Answer

Nmap

Answer

Nessus

Question 15

A Cisco Firepower sensor is generating an alert for a known benign application. The analyst has verified it is a false positive. What is the first step to suppress this alert?

Accepted Answer

Create a network analysis policy exception.. A network analysis policy (NAP) exception is the correct first step because it allows you to suppress alerts for specific benign applications without affecting the overall detection posture. In Cisco Firepower, NAP exceptions are applied before intrusion rules are evaluated, so they can filter out known false positives at the preprocessor level, preventing the rule from even triggering. This is more efficient than modifying the intrusion rule itself, as it avoids disabling detection for other traffic.

Answer

Increase the severity threshold.

Answer

Submit a false positive report to Talos.

Answer

Disable the intrusion rule globally.