200-201 Practice Test 40 — 15 Questions

Question 1

A healthcare organization has a security policy that mandates immediate reporting of any potential data breach to the privacy officer. An analyst notices that an employee accidentally emailed a patient list to the wrong recipient. The recipient is known to be a trusted partner, but the email contained PHI. The analyst contacts the recipient who acknowledges receipt and agrees to delete the email. What should the analyst do next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Report the incident as a data breach to the privacy officer as per policy.. The organization's security policy requires immediate reporting of any potential data breach to the privacy officer, regardless of whether the data was later deleted or the recipient is a trusted partner. The analyst must follow policy and report the incident. Option A is incorrect as updating an ACL does not address the reporting requirement. Option B is wrong because doing nothing violates policy. Option C is incorrect because sending a warning without reporting circumvents the mandated procedure.

Answer

Update the access control list to prevent similar mistakes.

Answer

Do nothing further since the data was deleted.

Answer

Send a warning email to the employee without reporting.

Question 2

An organization wants to ensure the integrity of software updates downloaded from its vendor's website. The vendor provides a hash value for each update. Which TWO properties of hashing algorithms make them suitable for integrity verification? (Choose two.)

Accepted Answer

The same input always produces the same hash.. For integrity verification, two crucial properties of hashing algorithms are determinism (the same input always produces the same hash) and the avalanche effect (a small change in input results in a significantly different hash). Fixed-length output is a characteristic of hash functions but does not directly contribute to integrity verification; it is merely a convenience. Therefore, the correct two options are A and B.

Answer

The hash can be reversed to obtain the original data.

Answer

The hash output is always the same length for a given algorithm.

Answer

Hashing requires a secret key to generate the hash.

Question 3

An IDS/IPS alert shows a signature named 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' with severity high. What is the most likely next step for an analyst?

Accepted Answer

Investigate the source IP and user-agent for malicious activity. The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.

Answer

Immediately block the source IP on the firewall

Answer

Reset the IDS/IPS signature database

Answer

Ignore the alert as it is not a critical signature

Question 4

Which data source provides the most detailed information about the application layer payload in network traffic?

Accepted Answer

Full packet capture (PCAP). Full packet capture (PCAP) provides the most detailed information because it records the entire raw network packet, including headers and the complete application-layer payload. This allows deep inspection of protocols like HTTP, DNS, or SMTP at the byte level, which is essential for detecting malware, data exfiltration, or application-specific anomalies.

Answer

NetFlow

Answer

Syslog

Answer

SNMP

Question 5

A security analyst is investigating a host that may have been compromised via a drive-by download. Which three indicators of compromise should the analyst look for in the host's logs and artifacts?

Accepted Answer

Unusual outbound network connections. A drive-by download typically exploits a browser or plugin vulnerability to silently execute code on the host. Once compromised, the malware often establishes command-and-control (C2) communication, which manifests as unusual outbound network connections to suspicious IP addresses or domains on non-standard ports (e.g., TCP 4444, 8080). Analyzing netstat output or firewall logs for unexpected outbound traffic is a primary indicator of such post-exploitation activity.

Answer

A new user account added to the local Administrators group

Answer

A large number of 404 errors in the web server log

Question 6

Refer to the exhibit. A Cisco router is configured with the shown access list applied inbound on the external interface. An external attacker sends a packet with source IP 10.0.0.1, destination IP 192.168.1.100, destination port 22. What will the router do?

Accepted Answer

Drop the packet. The access list applied inbound on the external interface denies the packet because the source IP 10.0.0.1 is a private RFC 1918 address, which is typically blocked by a standard or extended ACL to prevent spoofed or internal traffic from entering from outside. Since the packet matches a deny entry (either explicitly or implicitly via the implicit deny all at the end of the ACL), the router drops it without forwarding.

Answer

Forward the packet to the next hop

Answer

Permit the packet only if it is HTTP

Answer

Permit the packet

Question 7

Which TWO protocols are commonly used for remote administration and should be monitored for unauthorized access?

Accepted Answer

SSH (port 22). SSH (port 22) is correct because it provides encrypted remote administration, making it a common target for brute-force attacks and unauthorized access attempts. RDP (port 3389) is correct because it is the primary protocol for remote GUI administration on Windows systems and is frequently exploited via credential stuffing or vulnerability scanning. Both protocols should be monitored for anomalous login patterns and unauthorized access.

Answer

Telnet (port 23)

Answer

SNMP (port 161/162)

Answer

FTP (port 20/21)

Question 8

An analyst notices that a DNS query for 'www.attacker.com' contains a long subdomain with Base64-encoded data. This activity is observed every 5 minutes. What exfiltration technique is most likely in use?

Accepted Answer

DNS tunneling. DNS exfiltration encodes data in subdomain queries. The data is sent to a DNS server controlled by the attacker, who extracts it from the logs.

Answer

Steganography

Answer

HTTP POST exfiltration

Answer

FTP exfiltration

Question 9

You are a SOC analyst for a school district. The district uses a Cisco Firepower NGFW for traffic inspection and a SIEM for log aggregation. A teacher reports that her workstation is slow and unresponsive. You check the SIEM and see that the workstation (IP 10.1.2.10) has been generating thousands of DNS queries to a domain 'badstuff.example.com' over the past hour. The firewall logs show that the workstation also made many outbound connections to IP 203.0.113.50 on port 80. The DNS queries are for various random subdomains of 'badstuff.example.com'. The school's web filter has no policy for this domain. The user is not technical and cannot explain the behavior. What is the most likely cause and the appropriate first action?

Accepted Answer

Isolate the workstation from the network and add the domain to the block list. The workstation is generating thousands of DNS queries for random subdomains of 'badstuff.example.com' and making outbound connections to IP 203.0.113.50 on port 80. This behavior is classic DNS tunneling, where an infected host encodes data in DNS queries to bypass security controls. Isolating the workstation stops the immediate threat and data exfiltration, while adding the domain to the block list prevents further communication from other hosts. A full antivirus scan is insufficient because DNS tunneling malware often evades signature-based detection and requires network containment first.

Answer

Run a full antivirus scan on the workstation

Answer

Update the web filter to block the domain and continue monitoring

Answer

Ignore the alert because DNS tunneling is not a real threat

Question 10

A security analyst needs to verify that a downloaded software update has not been tampered with. The update's publisher provides a file containing a hash value. Which process should the analyst use to verify integrity?

Accepted Answer

Compute the file's hash and compare it with the provided hash. Verifying file integrity involves computing a cryptographic hash (e.g., SHA-256) of the downloaded file and comparing it to the hash provided by the publisher. If the hashes match, the file has not been altered; any tampering would produce a different hash value. This is a standard integrity check, not a confidentiality or authentication mechanism.

Answer

Decrypt the file using the publisher's public key

Answer

Use a digital signature to sign the file

Answer

Encrypt the file using the publisher's private key

Question 11

A SOC analyst is analyzing logs from multiple sources. Which THREE log types are most useful for detecting a brute force attack against a web application?

Accepted Answer

System authentication logs. System authentication logs (B) are critical because they record every login attempt, including failed ones, which directly reveals the repeated authentication failures characteristic of a brute force attack. Web server logs (C) capture HTTP request details such as source IP, URI, and response codes (e.g., 401 Unauthorized or 403 Forbidden), allowing an analyst to correlate many failed login requests from a single source. Firewall logs (E) show allowed and denied connections, enabling detection of high volumes of inbound traffic to the web application's port (e.g., TCP 443 or 80) from a specific IP, which is a common brute force pattern.

Answer

DNS logs

Answer

IDS/IPS alerts

Question 12

A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?

Accepted Answer

Increase the threshold to 15 failed logins within a 10-minute window.. Increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.

Answer

Whitelist all external IP addresses that belong to business partners.

Answer

Reduce the time window to 2 minutes to catch attacks faster.

Answer

Change the rule to block the source IP after 5 failed attempts.

Question 13

A security analyst is using a SIEM to create a correlation rule that triggers when more than 10 failed logins are detected from the same source IP within 1 minute. This rule is designed to detect which type of attack?

Accepted Answer

Brute-force attack. The rule detects multiple failed logins in a short time, which is characteristic of a brute-force attack.

Answer

Phishing attack

Answer

Privilege escalation

Answer

Man-in-the-middle attack

Question 14

An analyst suspects data exfiltration via DNS. Which log type would provide the most relevant information to confirm this?

Accepted Answer

DNS logs. DNS logs capture all DNS queries and responses, including the domain names being resolved. Data exfiltration via DNS often involves encoding stolen data into DNS queries (e.g., subdomains of a controlled domain). By examining DNS logs for unusual query patterns, high query volumes, or long, random-looking subdomains, an analyst can directly confirm exfiltration activity.

Answer

Web server logs

Answer

Firewall logs

Answer

IDS/IPS alerts

Question 15

Which element of the CIA triad is primarily compromised when an attacker successfully intercepts and reads encrypted network traffic without authorization?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized entities. Intercepting and reading traffic violates this principle.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability