200-201 Practice Test 38 — 15 Questions

Question 1

An analyst is monitoring network traffic and notices a host sending ICMP echo requests to multiple hosts in the same subnet with a pattern of incrementing TTL values. What is the most likely purpose of this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Traceroute to map the network topology.. The pattern of incrementing TTL values in ICMP echo requests is the hallmark of a traceroute operation. Traceroute works by sending packets with TTL=1, then TTL=2, etc., so each successive router along the path decrements the TTL to 0 and sends back an ICMP Time Exceeded message, revealing the hop-by-hop path. The target host responds with an ICMP Echo Reply when the TTL is high enough to reach it, confirming the final hop.

Answer

DNS resolution attempt.

Answer

Ping sweep to identify active hosts.

Answer

Denial of service attack against a specific host.

Question 2

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

Accepted Answer

Command-and-control (C2) communication from malware on the server. A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Answer

Distributed denial-of-service (DDoS) attack from the server

Answer

Brute-force attack on the server's SSH service

Answer

SQL injection attack against the server

Question 3

Match each Windows event log type to its description.

Accepted Answer

Application: Records events generated by software programs.. In Windows Event Viewer, the main logs are Application (software events), Security (audit events), Setup (installation events), System (system component events), and Forwarded Events (remote logs). Common confusions include mixing Application and System logs, or Security with Setup.

Answer

Application: Logs events related to system hardware failures.

Answer

Security: Logs application installation events.

Question 4

Match each network device to its primary function.

Accepted Answer

Firewall: Filters network traffic based on security rules. The correct matches are: Firewall filters traffic, IDS alerts on suspicious traffic, IPS blocks malicious traffic, and Router forwards packets between networks. Common confusions involve swapping firewall and IDS/IPS functions.

Answer

Firewall: Monitors traffic and provides alerts

Answer

IDS: Filters traffic based on security rules

Question 5

A security analyst is reviewing host-based logs from a compromised system. The Windows Security Event Log shows multiple Event ID 4625 (failed logon) from a single source IP, but no successful logon. The network team confirms that IP is a known scanning host. What is the most likely explanation for the lack of successful logon events?

Accepted Answer

The brute-force attack did not succeed in gaining access. Event ID 4625 specifically records failed logon attempts. The absence of a corresponding Event ID 4624 (successful logon) from the same source IP indicates that none of the authentication attempts succeeded. Since the network team confirms the IP belongs to a known scanning host, the most likely explanation is that the brute-force attack failed to guess valid credentials.

Answer

The logon type was interactive, which is not recorded by Event ID 4625

Answer

The attacker successfully logged in but the logs were deleted by the attacker

Answer

The attacker used a pass-the-hash technique that bypasses logon events

Question 6

During PCAP analysis, a security analyst observes the following pattern: a series of TCP SYN packets to multiple ports on a target, followed by RST packets from the target for closed ports. Which TWO characteristics describe this scan?

Accepted Answer

It is a SYN scan. The SYN scan sends SYN packets and listens for SYN-ACK (open) or RST (closed). It is a stealthy scan because it doesn't complete the TCP handshake.

Answer

It uses ICMP echo requests

Answer

It is a UDP scan

Answer

It completes the TCP three-way handshake

Question 7

An organization is developing an Acceptable Use Policy (AUP). Which of the following topics is typically covered in an AUP?

Accepted Answer

Prohibition of using company resources for illegal activities. An AUP defines acceptable use of IT resources, including prohibiting unauthorized access, personal use guidelines, and security responsibilities.

Answer

Password complexity requirements

Answer

Incident reporting procedures

Answer

Data classification levels

Question 8

During an incident response, an analyst finds evidence of lateral movement. Which THREE of the following are common techniques used for lateral movement?

Accepted Answer

Remote Desktop Protocol (RDP) connections. SMB authentication attempts, pass-the-hash, and RDP are common lateral movement techniques.

Answer

DNS tunneling

Answer

ICMP echo requests

Question 9

Which best practice helps ensure accurate network intrusion analysis when reviewing logs from multiple sources?

Accepted Answer

Use synchronized time across all devices.. Synchronized time (via NTP) ensures that logs from different sources share a consistent timestamp, which is critical for correlating events across network devices during intrusion analysis. Without time synchronization, an attacker's actions might appear out of order or be missed entirely, leading to inaccurate incident reconstruction.

Answer

Disable all logging except firewall logs.

Answer

Rely solely on automated analysis tools.

Answer

Store logs in different formats for each source.

Question 10

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. The immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Answer

Analyze packet captures to determine the full extent of the compromise

Answer

Block all outbound HTTPS traffic from the network

Answer

Reimage the host immediately to remove the malware

Question 11

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Accepted Answer

It allows MySQL traffic from DMZ to internal network and blocks all other traffic. The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Answer

It allows MySQL traffic from internal network to DMZ

Answer

It blocks all traffic from DMZ to internal network

Answer

It allows any traffic from DMZ to internal network

Question 12

A SOC analyst is tuning an IPS rule that detects SQL injection attempts. The rule currently generates a high number of alerts, most of which are false positives caused by legitimate web application traffic containing SQL-like keywords. The analyst wants to reduce false positives without missing actual attacks. Which approach is most effective?

Accepted Answer

Implement a whitelist of known good SQL queries from the application.. Implementing a whitelist of known good SQL queries from the application allows the IPS to ignore benign traffic that matches SQL-like patterns, reducing false positives while still alerting on any SQL injection attempt that deviates from the whitelist. This approach leverages application-specific knowledge to distinguish legitimate queries from malicious ones, maintaining detection coverage for actual attacks.

Answer

Reduce the rule's sensitivity to only match exact attack patterns.

Answer

Disable the rule and rely on web application firewall logs.

Answer

Exclude all HTTP GET requests from inspection.

Question 13

A SOC analyst is tuning a correlation rule that detects DNS tunneling. The rule currently generates 500 alerts per day, but only 5% are true positives. Which tuning approach would best reduce false positives while maintaining detection efficacy?

Accepted Answer

Add a condition that the number of unique domains queried per source IP exceeds 10 per minute.. DNS tunneling typically involves a single infected host querying many unique domains (often algorithmically generated) at a high rate to exfiltrate data. By requiring more than 10 unique domains per minute per source IP, the rule filters out low-volume, legitimate DNS traffic that may have slightly random-looking domains, while still catching the high-frequency queries characteristic of active tunneling. This reduces the false positive rate from 95% to a more manageable level without requiring a lower entropy threshold that would miss subtle tunneling.

Answer

Lower the entropy threshold for domain names from 3.5 to 2.0.

Answer

Disable the rule and rely on manual review of DNS logs.

Answer

Increase the observation time window from 1 hour to 24 hours.

Question 14

A security analyst is investigating an alert that indicates a host is sending a large number of DNS queries to an external domain. The analyst wants to determine if the traffic is malicious and if it is using a DNS tunnel. Which type of analysis should the analyst perform to confirm the presence of a DNS tunnel?

Accepted Answer

Analyze the payload size and query frequency of the DNS packets to detect anomalous patterns.. DNS tunneling typically involves encoding data within DNS queries or responses, resulting in abnormally large payload sizes and unusual query frequencies. By analyzing these specific packet attributes, an analyst can detect the anomalous patterns characteristic of a DNS tunnel, such as high query rates to a single domain or payloads exceeding standard DNS message sizes (e.g., >512 bytes for UDP). This direct inspection of DNS packet content is the most reliable method to confirm tunneling activity.

Answer

Check the volume of DNS traffic from the host to identify any increase over baseline.

Answer

Examine the source IP addresses of the DNS queries to see if they originate from multiple hosts.

Answer

Review the firewall logs to identify any blocked DNS queries to the external domain.

Question 15

An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?

Accepted Answer

Forward logs to a centralized, hardened log server with access controls. Forwarding logs to a centralized, hardened log server with strict access controls ensures that logs are protected from tampering and are available for forensic analysis. Centralized storage prevents attackers from altering logs on individual devices, and hardening the server along with access controls adds layers of security. Option A is incorrect because a 30-day retention period may not comply with legal or forensic requirements. Option C is incorrect because encryption alone does not prevent tampering if the logs are stored on a compromised device. Option D is incorrect because storing logs locally still leaves them vulnerable to deletion or modification by an attacker who gains access to the device.

Answer

Retain logs for only 30 days to reduce storage costs

Answer

Encrypt logs before sending them to a remote server

Answer

Store logs locally on each device with read-only permissions