200-201 Practice Test 4 — 10 Questions

Question 1

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 2

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Option A is correct because implementing access control lists (ACLs) on routers and switches restricts which traffic is permitted to reach the management plane and transit the device, enforcing least-privilege filtering as a core hardening control. Option B is correct because disabling unused services (for example, CDP, LLDP, HTTP server, or unused routing protocols) reduces the attack surface by eliminating unnecessary listening ports and daemons that could be exploited. Option E is correct because SNMPv3 with strong authentication (authNoPriv or authPriv using SHA and AES) replaces insecure SNMPv1/v2c community strings with encrypted, authenticated management traffic. Option C is not a hardening practice because Telnet transmits credentials and session data in cleartext; SSH should be used instead. Option D is not a hardening practice because default credentials are widely known and must be changed immediately during initial setup.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 3

Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.

Accepted Answer

Step 1: Discover, Step 2: Offer, Step 3: Request, Step 4: Acknowledge. The DHCP DORA process stands for Discover, Offer, Request, Acknowledge. It begins with the client broadcasting a Discover message to find DHCP servers. Servers respond with an Offer of an available IP address. The client then sends a Request to accept one of the offers. Finally, the server sends an Acknowledge to confirm the lease, completing the process. This sequence ensures proper assignment of IP addresses and avoids conflicts.

Answer

Step 1: Discover, Step 2: Request, Step 3: Offer, Step 4: Acknowledge

Answer

Step 1: Offer, Step 2: Discover, Step 3: Request, Step 4: Acknowledge

Answer

Step 1: Discover, Step 2: Offer, Step 3: Acknowledge, Step 4: Request

Question 4

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer

Social engineering

Answer

WHOIS lookups

Question 5

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

Accepted Answer

NetFlow records from the router. NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Answer

SNMP traps from routers

Answer

Syslog from the DHCP server

Answer

Firewall deny logs

Question 6

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 7

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. The UNION SELECT payload is the classic SQL injection signature: it appends a second SELECT statement to the original query, allowing the attacker to retrieve data from other tables such as 'users'. The presence of SQL keywords (UNION, SELECT, FROM) inside a URL parameter that should only contain a numeric ID is a strong indicator of SQLi. This pattern targets the backend database directly, unlike script tags which target the browser.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 8

A security analyst notices repeated failed login attempts from a single IP address to the company's VPN gateway. Which action should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.

Answer

Escalate to the incident response team immediately.

Answer

Block the IP at the firewall immediately.

Answer

Ignore the activity as it may be a user error.

Question 9

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Option B is correct because verifying a critical alert against other sources (such as SIEM logs, EDR telemetry, IDS/IPS events, or host-based logs) confirms whether the alert represents a true positive before committing resources, reducing the risk of acting on a false positive. Option C is correct because once a critical alert is validated, the analyst should escalate it to the incident response team so that containment, eradication, and recovery follow the organization's documented IR process and chain-of-custody requirements. Option A is wrong because deleting alerts destroys evidence and audit trails and could mask a real compromise. Option D, while sometimes useful for context, is not one of the two primary actions required at the moment a critical alert fires. Option E is wrong because powering off a system can destroy volatile evidence in memory and may violate incident response procedures; isolation is preferred over shutdown.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 10

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An indicator of compromise is a forensic artifact that provides evidence a system or network has been breached. A file hash such as an MD5 (or SHA-1/SHA-256) uniquely identifies a malicious file and can be searched across endpoints and threat feeds, making it a canonical host-based IoC. Hashes, IP addresses, domain names, URLs, and registry keys are all standard IoC types used in detection and threat intelligence.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name