200-201 Practice Test 41 — 15 Questions

Question 1

During an incident, an analyst finds a workstation that is beaconing to an external IP every 60 seconds using DNS TXT queries. The queries contain long, base64-encoded subdomains. The endpoint has no other suspicious network connections. Which technique is most likely being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS tunneling for command-and-control. The combination of regular beaconing, TXT record use, and base64-encoded subdomains strongly indicates DNS tunneling for command-and-control. Attackers use DNS because it is widely allowed through firewalls and rarely inspected deeply. Detecting it requires monitoring for anomalous query volume, unusually long labels, and consistent timing to a single external resolver.

Answer

Domain generation algorithm for ransomware

Answer

Fast flux DNS for phishing

Answer

DNS cache poisoning for redirection

Question 2

In Wireshark, an analyst follows a TCP stream and sees plaintext usernames and passwords. Which protocol is likely in use?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including login credentials, in cleartext over TCP. When an analyst follows a TCP stream in Wireshark and sees plaintext usernames and passwords, it indicates that no encryption is applied. HTTPS, SFTP, and SSH all encrypt their payloads, so credentials would not be visible in plaintext. Therefore, FTP is the likely protocol.

Answer

HTTPS

Answer

SFTP

Answer

SSH

Question 3

Which component of the NIST Cybersecurity Framework involves taking action to stop an ongoing attack?

Accepted Answer

Respond. The Respond function includes activities to contain and mitigate incidents.

Answer

Identify

Answer

Detect

Answer

Protect

Question 4

Which THREE of the following are common elements of an incident response policy?

Accepted Answer

Procedures for containment and eradication. An incident response policy must define what constitutes a security incident (E), because without a clear definition of triggering events, the organization cannot consistently determine when the IR process should be activated. It must also specify the roles and responsibilities of the incident response team (C), so that each member knows who leads, who investigates, who communicates, and who has authority to act during an incident. Additionally, it must include procedures for containment and eradication (B), since these are core phases of the incident response lifecycle that limit damage and remove the threat from the environment. Options A and D are incorrect in this context: data classification levels (A) belong to a data governance or information classification policy, and acceptable use of company resources (D) belongs to an acceptable use policy, not specifically to an incident response policy.

Answer

Data classification levels

Answer

Acceptable use of company resources

Question 5

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Accepted Answer

Run 'netstat -b' on the Windows host to display active connections with the associated process executable.. Running 'netstat -b' on a Windows host displays active TCP connections along with the executable name of the process that created each connection. This directly correlates the outbound connection to the malicious IP with the specific process, which is exactly what the analyst needs to identify the pivot point.

Answer

Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.

Answer

Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.

Answer

Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.

Question 6

An analyst is triaging a host that antivirus flagged for a file named svchost.exe running from C:\Users\Public\Downloads. The file has a valid digital signature issued to a legitimate software publisher, and the hash matches a known-good installer component. The process is making outbound SMB connections to several internal servers. Which action best reflects sound security monitoring practice?

Accepted Answer

Escalate for investigation because a signed binary executing from a user-writable path and initiating internal SMB sessions is anomalous.. Signature validity and hash reputation address integrity, not intent or context. A trusted binary in a user-writable directory that opens SMB sessions to multiple internal servers is a behavioural red flag consistent with abuse for lateral movement, so the analyst should escalate, preserve evidence, and determine scope rather than dismiss or prematurely remediate the alert.

Answer

Close the alert as a false positive because the signature and hash both verify as trusted.

Answer

Ignore the alert because the process name matches a legitimate Windows system binary.

Answer

Immediately delete the file and the user profile, then document the incident as remediated.

Question 7

A security analyst needs to share threat intelligence with other organizations in a standardized, machine-readable format. Which combination of standards should the analyst use?

Accepted Answer

STIX and TAXII. STIX is a language for threat intelligence, and TAXII is a protocol for sharing it. They are commonly used together.

Answer

TAXII and MISP

Answer

ISAC and STIX

Answer

OpenIOC and MISP

Question 8

An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?

Accepted Answer

ss -tlnp. 'ss -tlnp' lists TCP (-t) listening (-l) sockets with numeric ports (-n) and the owning process (-p), which is exactly what the analyst needs. The ss utility reads kernel netlink sockets directly, making it faster and more accurate than netstat on modern Linux systems.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

lsof -i TCP

Question 9

During a security incident, the incident handler identifies that the breach involves personally identifiable information (PII) of customers. Which role is primarily responsible for determining if legal notification requirements apply?

Accepted Answer

Legal counsel. Legal counsel is primarily responsible for interpreting breach notification laws (e.g., GDPR, CCPA, HIPAA) and determining whether the incident triggers mandatory legal notifications. They assess factors such as the type of data involved, the number of affected individuals, and the jurisdiction to decide if notification is required. The incident handler focuses on technical containment and recovery, not legal analysis.

Answer

Incident handler

Answer

HR

Answer

CISO

Question 10

Refer to the exhibit. An analyst runs tasklist /SVC on a suspected host. Which process is most suspicious?

Accepted Answer

notmalware.exe with PID 2300. 'notmalware.exe' is a deliberately suspicious process name that does not correspond to any legitimate Windows system binary. The tasklist /SVC command displays processes and their associated services; a process named 'notmalware.exe' is a clear indicator of potential malware attempting to disguise itself with an ironic name, whereas svchost.exe is a legitimate Windows host process for services.

Answer

svchost.exe with PID 1500

Answer

svchost.exe with PID 1240

Answer

svchost.exe with PID 1780

Question 11

During a forensic analysis, an analyst uses NetworkMiner to extract files from a PCAP. One of the extracted files contains a PE executable with a known signature of a malware variant. Which phase of the Cyber Kill Chain does the file transfer most likely represent?

Accepted Answer

Delivery. The file transfer from the PCAP represents the Delivery phase because NetworkMiner extracted a PE executable that was transmitted over the network, likely via HTTP, SMTP, or SMB. In the Cyber Kill Chain, Delivery is the phase where the weaponized payload is transmitted to the target system, which is exactly what a file transfer in a PCAP captures. The presence of a known malware signature confirms the payload was delivered, not yet executed or exploited.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 12

An analyst notices periodic HTTP GET requests to a suspicious domain every 60 seconds. The payload size is small and consistent. This behavior is characteristic of which phase of the Cyber Kill Chain?

Accepted Answer

Command and Control. Periodic, small, consistent HTTP GET requests to a suspicious external domain are the hallmark of beaconing, which occurs during the Command and Control (C2) phase of the Cyber Kill Chain. The compromised host is checking in with its C2 server at regular intervals to receive instructions or exfiltrate small amounts of data. This regular, low-volume traffic pattern is designed to blend in with normal traffic while maintaining persistent control.

Answer

Actions on Objectives

Answer

Delivery

Answer

Installation

Question 13

A security analyst discovers that an employee's computer is infected with malware that encrypts files and demands payment. What type of malware is this?

Accepted Answer

Ransomware. Ransomware is a type of malware that encrypts files on a victim's system and demands payment (often in cryptocurrency) for the decryption key. The scenario explicitly describes file encryption and a payment demand, which are the defining characteristics of ransomware. Unlike other malware types, ransomware's primary goal is extortion through data denial, not stealth or data theft.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 14

An organization has implemented a security information and event management (SIEM) system. The SOC analyst receives an alert indicating a high number of failed login attempts from a single IP address targeting a critical server. The analyst checks the server logs and finds that the server is configured to lock the account after 5 failed attempts. However, the alert shows thousands of attempts. Which of the following explains this discrepancy?

Accepted Answer

The failed attempts are against different usernames, not the same account. The account lockout policy (5 failed attempts) applies per individual username, not per source IP address. If the attacker is attempting to authenticate with many different usernames from the same IP, each username can fail up to 5 times before being locked, allowing thousands of total failed attempts across different accounts. The SIEM aggregates all failed authentication events from that IP, while the server's lockout mechanism only triggers per user, explaining the discrepancy.

Answer

The attacker is using a brute-force tool that bypasses account lockout

Answer

The server's logging is not capturing all authentication events

Answer

The SIEM alert is a false positive due to a misconfiguration

Question 15

Which security policy defines acceptable use of an organization's IT resources, including internet browsing and email?

Accepted Answer

Acceptable Use Policy (AUP). AUP specifies what is acceptable and unacceptable use of IT resources.

Answer

Password Policy

Answer

Information Security Policy

Answer

Remote Access Policy