200-201 Practice Test 41 — 15 Questions

Question 1

During a threat hunt, an analyst discovers sustained outbound traffic from a workstation to multiple IP addresses in different countries on port 443. The traffic patterns show periodic spikes at 5-minute intervals. The workstation is used by a sales representative who frequently accesses cloud CRM. Which additional evidence would most strongly suggest the workstation is compromised?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The outbound traffic includes connections to IPs not associated with the CRM. Outbound traffic to IP addresses not associated with the CRM application indicates the workstation is communicating with unknown or malicious destinations. Since the CRM is accessed via a known domain or IP range, connections to unrelated IPs on port 443 (HTTPS) suggest the workstation may be part of a botnet or exfiltrating data, especially given the periodic spikes at 5-minute intervals, which are characteristic of beaconing behavior used by malware to maintain command-and-control (C2) communications.

Answer

The CRM application uses port 443

Answer

The sales representative reported slow performance

Answer

The workstation has antivirus installed and up-to-date

Question 2

Refer to the exhibit. What does this syslog message indicate?

Accepted Answer

Denied SSH connection attempt. The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).

Answer

Failed telnet attempt

Answer

Successful SSH connection

Answer

Allowed TCP traffic

Question 3

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following are common indicators that data exfiltration may be occurring over DNS? (Choose two.)

Accepted Answer

High volume of DNS queries to a single domain not normally visited. A high volume of DNS queries to a single domain that is not normally visited is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS query subdomains. This behavior creates an abnormal query pattern that stands out in baseline traffic analysis.

Answer

DNS responses with a large number of IP addresses

Answer

DNS queries for AAAA records (IPv6) from an IPv4-only network

Answer

DNS query responses with high TTL values

Question 4

A security analyst notices that an employee is accessing the corporate network from an unauthorized device. According to the security policy, which action should the analyst take first?

Accepted Answer

Disable the device's network access immediately. The immediate priority when an unauthorized device is detected on the corporate network is to contain the threat by disabling network access. This aligns with the principle of least privilege and incident response procedures, where the first step is to stop the unauthorized access to prevent potential data breaches or malware propagation. The security policy typically mandates such immediate action to enforce access control, often implemented via 802.1X or MAC address filtering at the switch or NAC (Network Access Control) level.

Answer

Report the employee to human resources for disciplinary action

Answer

Ignore the incident because it is a minor violation

Answer

Update the security policy to allow personal devices

Question 5

A SOC Tier 3 analyst is performing threat hunting. Which activity best describes the primary focus of a Tier 3 analyst?

Accepted Answer

Proactively searching for advanced threats. Tier 3 focuses on proactive threat hunting and advanced analysis.

Answer

Monitoring incoming alerts for potential incidents

Answer

Correlating alerts from multiple sources

Answer

Creating user accounts and permissions

Question 6

An analyst detects HTTPS traffic to a domain that was registered only 24 hours ago and has no web content. The traffic occurs at odd hours and with consistent packet sizes. What technique is likely being used for C2?

Accepted Answer

HTTPS beaconing to a malicious domain. Attackers often use newly registered domains (DGAs or manually registered) for C2 to avoid blacklists. HTTPS provides encryption to hide the beaconing.

Answer

DNS tunneling

Answer

HTTP POST exfiltration

Answer

Domain Generation Algorithm (DGA)

Question 7

An analyst detects an internal host communicating with an external IP known for malware distribution. Which THREE of the following are valid Indicators of Compromise (IoCs) that should be recorded?

Accepted Answer

Domain name used in the communication. The domain name used in the communication is a classic Indicator of Compromise (IoC). When an internal host contacts an external IP known for malware distribution, the domain name (e.g., via DNS query) provides a persistent, human-readable identifier that can be used to block or investigate the threat, even if the IP address changes. This aligns with the NIST definition of IoCs as forensic evidence of a potential intrusion.

Answer

Email address of the user

Answer

Registry key from the endpoint

Question 8

A security analyst is reviewing Snort IDS alerts and sees the following rule triggered: alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:'Possible SQL Injection'; content:'UNION'; nocase; sid:1000001;). Which action will Snort take when it detects matching traffic?

Accepted Answer

Generate an alert. The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).

Answer

Log the packet only

Answer

Drop the packet

Answer

Reject the connection

Question 9

Which component of a SIEM is responsible for converting log data from various sources into a standard format?

Accepted Answer

Normalization. Normalization is the SIEM component that parses incoming log data from diverse sources (e.g., syslog, Windows Event Log, NetFlow) and maps the fields into a common, standardized schema. This process ensures that fields like source IP, destination IP, and timestamp are consistently named and formatted, enabling effective correlation and analysis across heterogeneous devices.

Answer

Aggregation

Answer

Alerting

Answer

Correlation

Question 10

A company's security policy requires that all servers have host-based intrusion detection (HIDS) installed and configured to send alerts to the SIEM. During a routine check, you find that a critical database server has HIDS installed but is not sending alerts because the agent service is stopped. The server administrator says he stopped the service because it was using too much CPU. The policy requires that any deviation from baseline must be approved by the security team. What should you do?

Accepted Answer

Restart the service on the server and submit a change request for CPU optimization.. Restarting the service and submitting a change request for CPU optimization addresses the immediate non-compliance while working on a solution. Option B is too lenient; Option C is too harsh; Option D may not solve the CPU issue and bypasses approval.

Answer

Accept the server administrator's justification and document it.

Answer

Recommend setting the HIDS process priority to low to reduce CPU impact.

Answer

Report the non-compliance to the security manager and disable the server until compliance is restored.

Question 11

A security analyst is investigating a PCAP and sees the following HTTP POST request: POST /login HTTP/1.1 ... username=admin&password=letmein. Which TWO attack indicators are present?

Accepted Answer

Use of weak or default credentials. The plaintext credentials in an HTTP POST indicate credential theft (sniffing) and the use of weak or default passwords (common attack vector).

Answer

Cross-site scripting (XSS) payload

Answer

Buffer overflow attempt

Answer

SQL injection attack

Question 12

Which TWO are common indicators of a phishing email? (Select two.)

Accepted Answer

Urgent call to action. Phishing emails often create a false sense of urgency to pressure recipients into acting without verifying the source. An urgent call to action, such as 'Your account will be suspended in 24 hours,' is a classic social engineering tactic that exploits fear or time pressure to bypass rational scrutiny.

Answer

Personal salutation

Answer

Proper spelling and grammar

Answer

Matching sender domain

Question 13

An analyst is investigating a potential data exfiltration via DNS. In Zeek DNS logs, the analyst sees many queries for subdomains like 'a1b2c3.malicious.com', 'd4e5f6.malicious.com' etc. from an internal host. Which technique is likely being used?

Accepted Answer

DNS tunneling. The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 14

A healthcare organization uses an online patient portal where patients can view their medical records. Recently, it was discovered that patient records were being modified by an unauthorized insider, and the system suffered a ransomware attack that encrypted the database, making it inaccessible for three days. Which TWO security principles were primarily violated? (Choose two.)

Accepted Answer

Integrity. The unauthorized modification of patient records violates integrity, which ensures data has not been altered by unauthorized entities. The ransomware attack that encrypted the database and made it inaccessible for three days violates availability, which ensures systems and data are accessible when needed. These two incidents directly compromise the CIA triad principles of integrity and availability.

Answer

Confidentiality

Answer

Authentication

Answer

Non-repudiation

Question 15

Which TWO of the following are best practices for configuring syslog in a secure monitoring environment? (Choose two.)

Accepted Answer

Configure a maximum log file size to prevent disk exhaustion. Configuring a maximum log file size prevents syslog messages from filling up the disk, which could cause the system to crash or become unresponsive. This is a critical best practice in secure monitoring to ensure logging continues without exhausting storage resources.

Answer

Use UDP as the transport protocol to ensure reliable delivery

Answer

Set log files to overwrite daily

Answer

Change the default syslog port to avoid detection by attackers