200-201 Practice Test 38 — 15 Questions

Question 1

An analyst uses Volatility's 'netscan' on a memory dump and finds an established connection to an external IP on port 4444. Which type of activity is this commonly associated with?

Accepted Answer

Reverse shell or backdoor. Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

Answer

Email communication

Answer

DNS query

Answer

Normal web browsing

Question 2

A security analyst needs to verify the authenticity and integrity of a software update. The update is signed with a digital signature. Which key is used to verify the signature?

Accepted Answer

Sender's public key. A digital signature is created by the sender using their private key, and it is verified by anyone using the sender's public key. The public key mathematically validates that the signature was produced by the corresponding private key and that the message has not been altered. Therefore, the recipient uses the sender's public key to verify authenticity and integrity.

Answer

Sender's private key

Answer

Recipient's public key

Answer

Recipient's private key

Question 3

Which log type would an analyst examine to view details about HTTP methods (GET, POST), response codes, and user-agent strings?

Accepted Answer

Web server logs. Web server logs record HTTP requests and responses, including methods, URLs, response codes, and user-agent information.

Answer

System logs

Answer

Firewall logs

Answer

DNS logs

Question 4

An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?

Accepted Answer

An internal host attempted to establish an SMB connection to an external IP and was blocked.. The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.

Answer

A DNS query was made from an internal host to an external server.

Answer

An external host attempted to access an internal SMB server on port 445 and was blocked.

Answer

An internal host successfully connected to an external server on port 445.

Question 5

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Answer

Golden ticket

Answer

Kerberoasting

Answer

Pass-the-ticket

Question 6

During an incident response, an analyst checks for persistence mechanisms and finds an entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. What is the most likely purpose of this registry key?

Accepted Answer

It specifies programs to run automatically at user logon.. It specifies programs to run automatically at user logon is correct because the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key is a common autostart location that executes programs when the user logs in. Attackers often use this key for persistence to ensure their malware runs after a reboot or logon.

Answer

It lists recently accessed documents.

Answer

It stores user interface settings for the current user.

Answer

It controls Windows Defender exclusions.

Question 7

A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?

Accepted Answer

The threat intelligence feed contains a false positive for that domain. The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.

Answer

The Snort rule is misconfigured and should be disabled

Answer

The rule is too broad and matches all DNS queries

Answer

The Snort signature is too generic and should be tuned

Question 8

During a host-based investigation, an analyst finds a process named 'svchost.exe' consuming high CPU. The process path is 'C:\Windows\Temp\svchost.exe'. What should the analyst conclude?

Accepted Answer

It is likely malware disguised as a legitimate process. The legitimate svchost.exe (Service Host) runs from C:\Windows\System32, not C:\Windows\Temp. The Temp directory is a common location for malware to masquerade as system processes to evade detection. High CPU usage combined with an anomalous path strongly indicates malicious activity, as legitimate svchost.exe instances are signed by Microsoft and reside in System32.

Answer

It is a legitimate Windows service host process

Answer

It is a third-party application that requires investigation

Answer

It is a temporary file created by Windows Update

Question 9

An analyst is investigating a host that is suspected of being compromised. The host's security logs show multiple failed login attempts followed by a successful login from an unusual IP address, and then a series of outbound connections to known malicious destinations. Which TWO actions should the analyst take immediately? (Choose two.)

Accepted Answer

Isolate the host from the network. Isolating the host from the network immediately stops the outbound connections to known malicious destinations, preventing further data exfiltration, lateral movement, or command-and-control (C2) communication. This containment step is critical in incident response to limit the blast radius before any other investigative or remediation actions are taken.

Answer

Delete the malicious files found on the host

Answer

Reboot the host to clear any malware from memory

Answer

Run a full antivirus scan on the host

Question 10

A security analyst is using NetFlow data to investigate a potential data exfiltration incident. Which NetFlow metric is most useful for identifying large volumes of data being transferred to an external IP address?

Accepted Answer

Bytes transferred. The 'Bytes transferred' metric in NetFlow directly quantifies the volume of data sent to a specific destination IP. In a data exfiltration scenario, an unusually high byte count to an external IP is a strong indicator of large-scale data transfer, whereas other metrics like source port or packet count do not directly measure data volume.

Answer

Source port

Answer

Destination IP

Answer

Packet count

Question 11

An organization wants to ensure that a user cannot deny having sent an email. Which security goal does this address?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny having performed a specific action, such as sending an email. This is typically achieved through digital signatures using asymmetric cryptography (e.g., RSA or ECDSA) and public key infrastructure (PKI), where the sender's private key creates a signature that can be verified by anyone with the sender's public key. The goal is to provide irrefutable proof of origin and integrity, preventing the sender from later claiming they did not send the message.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 12

Which TWO of the following are best practices for implementing a security policy?

Accepted Answer

Review and update the policy annually. Option D is correct because security policies must be reviewed and updated annually (or whenever significant changes occur in the threat landscape, technology, or business operations) to remain relevant and effective; a stale policy can leave the organization exposed to new risks. Option E is correct because obtaining management approval and support is essential: without executive sponsorship, the policy lacks authority, funding, and the ability to enforce compliance across the organization. Option A is incorrect because technical jargon reduces readability and understanding for non-technical staff, undermining policy adoption. Option B is incorrect because avoiding enforcement does not promote genuine compliance; policies require consistent enforcement to be effective. Option C is incorrect because writing a policy once and never changing it ignores evolving threats, regulations, and business needs, making the policy obsolete.

Answer

Use technical jargon to ensure precision

Answer

Avoid enforcement to promote user compliance

Answer

Write the policy once and never change it

Question 13

Which three data sources are commonly used in a SIEM for threat hunting? (Choose three.)

Accepted Answer

Firewall logs.. Firewall logs are a primary data source in SIEM for threat hunting because they record all allowed and denied traffic flows, including source/destination IPs, ports, and protocols. Analyzing these logs helps identify unauthorized access attempts, policy violations, and patterns indicative of lateral movement or data exfiltration.

Answer

Social media feeds.

Answer

Physical access logs.

Question 14

A company's security policy requires that sensitive data be encrypted at rest using AES-256. Which type of encryption does AES-256 represent?

Accepted Answer

Symmetric encryption. AES-256 is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. It is widely used for data at rest due to its strength and efficiency. The '256' refers to the key size in bits, making it highly resistant to brute-force attacks.

Answer

Hashing algorithm

Answer

Digital signature

Answer

Asymmetric encryption

Question 15

An analyst is reviewing Windows Event Logs and sees Event ID 4625. What does this event indicate?

Accepted Answer

An account logon failed. Event ID 4625 in the Security log indicates a failed logon attempt. This is often used to detect brute-force attacks or unauthorized access attempts.

Answer

Credential validation was attempted

Answer

An account was created

Answer

An account was successfully logged on