200-201 Practice Test 42 — 15 Questions

Question 1

A company's data classification policy defines "Confidential" data. Which of the following is an example of Confidential data?

Accepted Answer

Customer payment card information. Customer payment card information (PCI) is classified as Confidential data because it is subject to regulatory compliance (e.g., PCI DSS) and its unauthorized disclosure could cause significant financial or reputational harm. Confidential data typically includes personally identifiable information (PII), financial records, and trade secrets that require strict access controls and encryption at rest and in transit.

Answer

Public marketing brochures

Answer

Company cafeteria menu

Answer

Employee phone numbers

Question 2

An analyst is reviewing Sysmon logs from a compromised host. They see Event ID 1 (Process creation) for cmd.exe with parent process winword.exe. What does this indicate?

Accepted Answer

A macro in a Word document executed cmd.exe as part of the attack. Event ID 1 (Process creation) with parent process winword.exe spawning cmd.exe is a classic indicator of a macro-based attack. Microsoft Word is not designed to launch command-line interpreters under normal operation; when cmd.exe appears as a child of winword.exe, it strongly suggests that a malicious macro within the document executed a shell command, often to download payloads, escalate privileges, or perform reconnaissance. This aligns with common phishing and malware delivery techniques where attackers embed VBA macros to execute system commands.

Answer

The Windows Update service initiated cmd from Word

Answer

The user launched cmd.exe manually from within Word using a shortcut

Answer

Word crashed and created a dump file using cmd

Question 3

An analyst sees an alert for 'SQL injection' but the target is an internal application that only accepts POST requests with JSON data. The alert was triggered by a parameter in the URL. What is the most likely issue?

Accepted Answer

False positive due to mismatch. The alert was triggered by a parameter in the URL, but the target application only accepts POST requests with JSON data. Since SQL injection via a URL parameter is impossible against an application that does not process URL parameters, the alert is a false positive caused by a mismatch between the signature's expected attack vector and the actual application behavior.

Answer

Application vulnerability

Answer

True positive SQL injection

Answer

Signature misconfiguration

Question 4

During memory analysis using Volatility, an analyst wants to identify processes with suspicious network connections and potentially injected code. Which THREE plugins should the analyst use? (Select THREE)

Accepted Answer

pstree. Option B, pstree, is correct because it displays the process list as a parent-child tree, which helps the analyst spot anomalous process relationships and suspicious processes that may be tied to injected code or malicious network activity. Option D, malfind, is correct because it scans process memory for signs of code injection such as MZ/PE headers in non-image memory regions with PAGE_EXECUTE_READWRITE permissions, directly addressing the injected-code requirement. Option E, netscan, is correct because it enumerates network artifacts (TCP connections, listening sockets, and UDP endpoints) from memory, allowing identification of processes with suspicious network connections. Option A, hashdump, is not appropriate here because it extracts password hashes from the SAM database rather than analyzing processes or network connections. Option C, hivelist, is not appropriate because it only lists registry hives loaded in memory and does not reveal process, injection, or network details.

Answer

hashdump

Answer

hivelist

Question 5

An organization is implementing monitoring for encrypted traffic without decrypting it. Which approach would be most effective for detecting malicious activity?

Accepted Answer

Use NetFlow analysis to identify unusual connection patterns. NetFlow analysis examines metadata (source/destination IPs, ports, protocols, byte counts) without decrypting the payload. Unusual patterns like beaconing to a known C2 server, data exfiltration via non-standard ports, or unexpected volumetric flows can indicate malicious activity even when the traffic is encrypted. This approach preserves privacy and compliance while still enabling threat detection through behavioral anomalies.

Answer

Deploy SSL/TLS inspection to decrypt traffic

Answer

Monitor SNMP traffic from endpoints

Answer

Block all encrypted traffic except from known good sources

Question 6

Which two are common techniques used in network intrusion analysis? (Choose two.)

Accepted Answer

Signature-based detection. Signature-based detection (C) is a core network intrusion analysis technique because it compares traffic or payloads against known attack patterns (Snort/Suricata rules, IDS signatures) to identify previously documented exploits and malware with high precision and low false positives. Anomaly-based detection (E) is also fundamental because it baselines normal network behavior and flags deviations such as unusual ports, protocol misuse, or traffic-volume spikes, allowing detection of novel or zero-day activity that signatures miss. Together they represent the two canonical IDS/IPS detection methodologies. Threat intelligence feeds (A) are data sources that can enrich analysis but are not themselves an analysis technique, sandboxing (B) is dynamic malware execution used mainly for endpoint/file analysis rather than network intrusion analysis, and heuristic analysis (D) is a related but broader/rule-of-thumb method often grouped under anomaly or behavioral detection rather than one of the two standard network IDS techniques.

Answer

Threat intelligence feeds

Answer

Sandboxing

Answer

Heuristic analysis

Question 7

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines what the policy applies to, so option C ("List of systems and networks covered") is correct because it explicitly identifies the in-scope assets, such as specific hosts, subnets, or business units, which is the primary purpose of a scope statement. Option D ("User roles and responsibilities affected") is also correct because scope must identify the people and organizational roles the policy binds, such as employees, contractors, or administrators, so accountability and applicability are unambiguous. By contrast, option A (threat intelligence sources) is an operational input typically addressed in monitoring or intelligence procedures, not in the policy scope. Option B (encryption algorithms) is a technical control standard (e.g., AES-256, RSA-2048) usually found in cryptographic standards or baselines, not in the scope statement. Option E (minimum password length) is a specific configuration requirement belonging in a password or access control standard, not in the scope statement.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 8

Which THREE are principles of the CIA triad? (Select three.)

Accepted Answer

Confidentiality. The CIA triad consists of Confidentiality, Integrity, and Availability, so options B, D, and E are correct. Confidentiality (B) ensures data is accessible only to authorized parties, typically enforced through encryption, access control lists, and authentication. Integrity (D) ensures data remains accurate and unaltered in transit or at rest, supported by hashing, checksums, and digital signatures. Availability (E) ensures systems and data are accessible to authorized users when needed, achieved through redundancy, backups, and DDoS mitigation. Non-repudiation (A) and accountability (C) are related security principles but are not part of the CIA triad; non-repudiation guarantees a party cannot deny an action, and accountability ties actions to identified entities, both often grouped under broader frameworks like the Parkerian hexad or AAA rather than the core CIA triad.

Answer

Non-repudiation

Answer

Accountability

Question 9

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

Accepted Answer

Acceptable Use Policy violation. Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Answer

Remote Access Policy violation

Answer

Incident Response Policy violation

Answer

Data Classification Policy violation

Question 10

Based on the exhibit, what condition triggers an alert?

Accepted Answer

More than 1000 DNS queries from a single source within 60 seconds.. The exhibit shows a rule configured to trigger an alert when the number of DNS queries from a single source IP exceeds 1000 within a 60-second sliding window. This is a rate-based threshold designed to detect DNS amplification or tunneling attacks, where a single host generates an abnormally high volume of DNS requests. Option A correctly describes this condition.

Answer

A single DNS query to a known malicious domain.

Answer

Any UDP traffic to port 53 exceeding 1000 packets per second.

Answer

More than 1000 UDP connections to port 53 within 60 seconds.

Question 11

A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:

Accepted Answer

Beaconing using DGA. Periodic outbound HTTPS connections to an unusual domain that resolves to different IPs each time is the classic signature of beaconing using a Domain Generation Algorithm (DGA). Malware uses DGA to generate many pseudo-random domains and rotates through them to evade blocklists, while beaconing provides regular check-ins to C2.

Answer

Exfiltration via FTP

Answer

DNS tunnelling

Answer

Port scanning

Question 12

Which Windows Event ID corresponds to a successful user logon?

Accepted Answer

4624. Event ID 4624 is correct because Windows Security auditing logs 4624 for a successful account logon, including the logon type (interactive, network, service, etc.) and the account and workstation involved. It is the canonical event analysts filter on to confirm successful authentication.

Answer

4648

Answer

4776

Answer

4625

Question 13

A Windows Event Log analysis reveals Event ID 4720 and 4726 occurrences for the same account within a short time. Which TWO actions were performed? (Select 2)

Accepted Answer

User account was deleted. Event ID 4720 indicates account creation, and 4726 indicates account deletion. The rapid creation and deletion may indicate an attempt to avoid detection or create a temporary account.

Answer

User account was locked

Answer

Group policy was updated

Answer

User logged on successfully

Question 14

An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?

Accepted Answer

SQL injection. The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

Answer

Command injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 15

In a risk management process, after identifying risks, the next step is to determine the potential impact and likelihood. This is known as:

Accepted Answer

Risk assessment. After risks have been identified, the next logical step in the risk management process is to evaluate their potential impact and likelihood. This evaluation is formally known as risk assessment (or risk analysis), which quantifies or qualifies the risk level to prioritize subsequent treatment decisions. In the context of the 200-201 exam, risk assessment is a core component of the NIST SP 800-30 risk management framework.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer