200-201 Practice Test 4 — 10 Questions

Question 1

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

Accepted Answer

Event ID 8 (CreateRemoteThread). Sysmon Event ID 8 (CreateRemoteThread) is directly associated with code injection because it logs when a thread is created in a remote process, a common technique used by malware to inject malicious code into a legitimate process. Event ID 10 (ProcessAccess) is also critical as it records when a process opens a handle to another process, often a precursor to injecting code via APIs like OpenProcess and WriteProcessMemory.

Answer

Event ID 3 (Network connect)

Answer

Event ID 1 (Process creation)

Answer

Event ID 7 (Image loaded)

Question 2

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

Accepted Answer

Large DNS response packets. Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.

Answer

Use of standard DNS ports

Answer

DNSSEC enabled

Answer

Frequent DNS query retransmissions

Question 3

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet

Question 4

Given a packet capture showing TCP packets with flags: first packet SYN, second packet SYN-ACK, third packet ACK, then a fourth packet with RST flag. What should the analyst suspect?

Accepted Answer

Port scan. The three-way handshake (SYN, SYN-ACK, ACK) completes a TCP connection, but the immediate RST after the ACK indicates the client terminated the connection without sending any application data. This pattern is characteristic of a port scan (e.g., using nmap's connect scan), where the scanner verifies the port is open by completing the handshake and then immediately resets to avoid leaving the connection half-open.

Answer

Normal traffic

Answer

SYN flood

Answer

Denial of service

Question 5

Which of the following is an example of an Indicator of Compromise (IoC)?

Accepted Answer

A file hash (SHA-256). An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Answer

A SIEM dashboard

Answer

A firewall rule

Answer

A network baseline

Question 6

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive occurs when an alert is triggered but no actual attack exists. The file is benign, so the alert is incorrect.

Answer

True positive

Answer

False negative

Answer

True negative

Question 7

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

Accepted Answer

Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.. It follows the security policy by reporting the violation to the security manager and proposing a monitored approach until encryption can be applied during the next maintenance window, balancing security and operational continuity. Option B is insufficient as it creates an informal exception without proper authorization. Option C is an overreaction without evidence of data exposure. Option D violates policy by taking unauthorized action.

Answer

Accept the executive's explanation and document it as an informal exception.

Answer

Escalate to the incident response team to treat this as a data breach because data may have been exposed.

Answer

Immediately re-enable encryption on the laptop and submit an exception request after the fact.

Question 8

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Accepted Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Apply access-list to interface
5. Verify configuration. The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Configure interfaces (nameif, ip address, security-level)
4. Apply access-list to interface
5. Verify configuration

Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Verify configuration
5. Apply access-list to interface

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Apply access-list to interface
4. Configure interfaces (nameif, ip address, security-level)
5. Verify configuration

Question 9

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 10

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.