200-201 Practice Test 39 — 15 Questions

Question 1

A security analyst is investigating a potential brute-force attack on an SSH server. Which TWO of the following log sources would provide the most relevant evidence for detecting and confirming this attack? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System logs (authentication events). System logs contain authentication events (success/failure) which are essential to detect repeated failed SSH logins. Firewall logs show source IPs and ports being accessed (SSH port 22), which can identify the attacking IP. IDS/IPS alerts might detect brute-force patterns but are not the primary source; DNS logs and web server logs are irrelevant to SSH brute-force.

Answer

IDS/IPS alerts (signature name, severity)

Answer

Web server logs (HTTP method, URL, response code)

Answer

DNS logs (query type, domain queried)

Question 2

A company is developing a new security policy for cloud storage. Which principle should be the foundation of the policy to ensure data confidentiality and integrity?

Accepted Answer

All data must be encrypted at rest and in transit.. Encryption at rest and in transit directly protects data confidentiality and integrity by rendering data unreadable without the proper decryption keys and by ensuring data is not tampered with during transmission. In cloud storage, encryption at rest (e.g., AES-256) safeguards data stored on disk, while encryption in transit (e.g., TLS 1.2/1.3) prevents interception or modification during upload/download. This dual-layer approach is the foundational security control for meeting confidentiality and integrity objectives, as defined in the CIA triad.

Answer

Access logs must be retained for at least one year.

Answer

Only authorized users can access the cloud storage.

Answer

Data must be backed up daily.

Question 3

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Verifying a critical alert with other sources (e.g., correlating with firewall logs, NetFlow data, or endpoint detection responses) is a fundamental step to confirm the alert is a true positive and not a false positive. This cross-validation reduces the risk of acting on inaccurate information and ensures that the incident response process is based on reliable evidence. Without verification, an analyst might escalate a non-threatening event, wasting resources and potentially missing a real threat.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 4

A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?

Accepted Answer

Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy. It balances the security policy requirement for specific IPs with the vendor's need for redundancy by collaboratively defining a list of specific IPs that meet both objectives. Option A weakens policy by allowing entire subnets, Option B accepts non-compliance, and Option C is overly rigid and may disrupt operations without addressing the vendor's valid concern.

Answer

Amend the policy to allow entire subnets for vendors with multi-factor authentication

Answer

Accept the subnet as long as multi-factor authentication is used

Answer

Require the vendor to comply with the existing policy exactly as written

Question 5

Which TWO activities are typically part of a security policy review cycle? (Choose two.)

Accepted Answer

Reviewing regulatory updates. A security policy review cycle focuses on evaluating and updating the policy to ensure it remains effective and compliant. Reviewing regulatory updates (A) is necessary to incorporate new legal or industry requirements. Conducting periodic policy audits (C) assesses whether the policy is being followed and identifies areas for improvement. Delivering security awareness training (B) is an implementation activity, not a review activity. Handling a security incident (D) is an operational response, and applying system patches (E) is a maintenance task, neither of which is part of the policy review cycle.

Answer

Delivering security awareness training

Answer

Handling a security incident

Answer

Applying system patches

Question 6

A company's security policy states that all employees must use multi-factor authentication (MFA) when accessing the corporate network remotely. Which policy is being applied?

Accepted Answer

Access Control Policy. Multi-factor authentication (MFA) is an authentication control that falls under the broader category of access controls. The Access Control Policy (D) governs how access to resources is granted and enforced, including authentication mechanisms like MFA. While a Remote Access Policy (B) might address MFA for remote connections, the question directly asks which policy is being applied when requiring MFA for remote network access — this is fundamentally an access control requirement. The other options are incorrect: Incident Response Policy (A) deals with handling security incidents, Acceptable Use Policy (C) defines acceptable behavior, and Remote Access Policy (B) is a subset of access control but not the highest-level policy being applied here.

Answer

Incident Response Policy

Answer

Remote Access Policy

Answer

Acceptable Use Policy

Question 7

Refer to the exhibit. A network administrator applied this ACL inbound on the external interface of a firewall. An attacker sends a TCP SYN packet with source IP 192.0.2.1 to destination 10.1.1.100 port 80. Which statement accurately describes the packet's treatment?

Accepted Answer

The packet is permitted by the first ACE. The ACL permits TCP traffic to destination 10.1.1.100 on port 80, so the TCP SYN packet matches the first ACE and is permitted. Therefore, Option D is correct. Option A is incorrect because the ACL does deny certain traffic (e.g., non-matching packets are subject to implicit deny). Option B is incorrect because the packet matches an explicit permit before the implicit deny is reached. Option C is incorrect because the ACL does not require a source IP permit; the first ACE permits based on destination and protocol.

Answer

The packet is permitted because the ACL only denies non-TCP traffic

Answer

The packet is denied by the implicit deny at the end

Answer

The packet is denied because there is no permit for source 192.0.2.1

Question 8

A security policy requires that all remote access be authenticated using a one-time password (OTP) token. Which technology should be implemented?

Accepted Answer

RADIUS with token server. RADIUS can integrate with an OTP token server to provide one-time password authentication. Option A is wrong because SSH key pairs are not OTP-based. Option C is wrong because LDAP with username and password does not support OTP. Option D is wrong because pre-shared keys are not OTP.

Answer

SSH key pairs

Answer

LDAP with username and password

Answer

VPN with pre-shared key

Question 9

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

Accepted Answer

Incident Response Procedure for evidence preservation. Incident response procedures typically require preserving volatile data before disconnecting the system. By pulling the network cable first, the first responder violated the evidence preservation steps, making option B the correct answer.

Answer

Chain of Custody Procedure

Answer

Forensic Analysis Procedure

Answer

Escalation Procedure

Question 10

A company's incident response policy defines four phases: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity. During an active ransomware outbreak, the IR team is unable to contain the spread because the containment plan did not account for the malware's use of PowerShell for lateral movement. Which phase had a deficiency?

Accepted Answer

Preparation. The deficiency lies in the Preparation phase. The incident response policy's Preparation phase should include threat modeling, playbooks, and planning for common attacker TTPs, such as PowerShell-based lateral movement. Since the containment plan did not account for this specific technique, the preparation was inadequate. Options A, D, and E represent later phases that depend on effective preparation; they are not the source of the deficiency.

Answer

Containment Eradication & Recovery

Answer

None of the above

Answer

Post-Incident Activity

Answer

Detection & Analysis

Question 11

A security analyst detects a host infected with ransomware on the corporate network. According to incident response procedures, what should be the first action?

Accepted Answer

Isolate the host from the network. The first action when a host is infected with ransomware is to isolate it from the network to prevent lateral movement and further encryption of shared resources. Ransomware often uses SMB, RDP, or other network protocols to spread, so disconnecting the host (e.g., by disabling the switch port or unplugging the cable) stops the propagation immediately. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the attack before any remediation.

Answer

Reimage the host immediately

Answer

Update antivirus signatures

Answer

Notify the IT management team

Question 12

During an incident, an analyst captures network traffic. Which field in a TCP header is used to reassemble fragmented packets?

Accepted Answer

Sequence number. The Sequence Number field in the TCP header is used to reassemble the original data stream from received TCP segments. It indicates the byte offset of the segment's data within the overall stream, allowing the receiver to order segments correctly. Note that IP fragmentation (splitting packets at the network layer) relies on the Identification field and Fragment Offset in the IP header, not the TCP Sequence Number.

Answer

Flags

Answer

Window size

Answer

Acknowledgment number

Question 13

A security analyst is responding to an incident on a critical Windows server that hosts a database application. The server is running Windows Server 2019 with all current patches. The analyst suspects that a remote attacker gained access and is using living-off-the-land binaries to move laterally. The analyst has captured a memory dump and a full disk image. The analyst needs to determine if the attacker used PowerShell to download additional tools. Which analysis step should the analyst perform first to identify PowerShell usage?

Accepted Answer

Parse PowerShell operational logs (Event ID 4104) to extract executed scripts and commands.. PowerShell operational logs, specifically Event ID 4104 (Script Block Logging), capture the full text of PowerShell scripts and commands executed on the system. Since the analyst suspects the attacker used PowerShell to download additional tools, parsing these logs is the most direct and efficient first step to confirm that activity. This log source provides the actual commands run, including any download commands like Invoke-WebRequest or Start-BitsTransfer, without relying on indirect artifacts.

Answer

Examine the Windows Registry for Run keys to identify persistence mechanisms.

Answer

Review prefetch files (.pf) to determine when PowerShell was last executed.

Answer

Analyze network connection logs to identify outbound connections to known malicious IPs.

Question 14

A company's security policy states that all network traffic must be inspected by an IPS. However, encrypted traffic (SSL/TLS) is bypassing inspection. The network team wants to implement SSL decryption. What is the primary policy consideration before implementing?

Accepted Answer

Obtain legal approval for decryption of user traffic.. SSL/TLS decryption involves intercepting and inspecting encrypted communications, which can violate privacy laws and regulations such as GDPR, HIPAA, or the Wiretap Act. Before implementing decryption, the organization must obtain legal approval to ensure compliance with applicable laws and to define the scope of inspection, especially regarding personal or sensitive data. Without legal clearance, the company could face severe penalties, even if the technical implementation is sound.

Answer

Configure the firewall to block SSL traffic that cannot be decrypted.

Answer

Notify all users that their traffic will be inspected.

Answer

Create a certificate authority to issue certificates to all internal servers.

Answer

Ensure that the SSL decryption device has enough CPU capacity.

Question 15

GreenTech Inc. is a mid-sized company with 500 employees. The company uses Microsoft Exchange Online for email and has implemented a security policy that requires all employees to report suspicious emails to the security team. The security team uses a phishing simulation tool to train employees. In the past month, several employees have reported receiving emails that appear to be from the CEO requesting urgent wire transfers. The security team has blocked the sender domains and updated the email filters. However, one employee fell for the latest scam and transferred $50,000 to an account before reporting it. The security incident response plan states that any monetary loss must be reported to the board within 24 hours. The security analyst receives the report on Monday morning. What should the analyst do first based on the policy and best practices?

Accepted Answer

Immediately contact the bank to attempt to reverse the wire transfer. The immediate priority is to attempt to recover the funds. Contacting the bank to reverse the wire transfer should be the first step because there is a chance to stop or reverse the transaction if done promptly. Notifying the board (C) is required within 24 hours but is secondary to attempting recovery. A full forensic investigation (B) can be launched later, but it does not prevent monetary loss. Disabling email access (A) is overly disruptive and not the first action; it may be considered after containment, but the immediate need is to try to recover the funds.

Answer

Disable email access for all employees to prevent further attacks

Answer

Launch a full forensic investigation to identify the source

Answer

Notify the board within the 24-hour window as per policy