200-201 Practice Test 42 — 15 Questions

Question 1

You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the print server from the network and conduct a forensic investigation. The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.

Answer

Increase the alert threshold to reduce noise and continue monitoring

Answer

Disable the printer service on the server and monitor for recurrence

Answer

Dismiss the alerts as false positives because print servers often perform network discovery

Question 2

Which protocol and port combination is commonly used for secure remote administration of network devices?

Accepted Answer

SSH on port 22. SSH (Secure Shell) on port 22 is the correct answer because it provides encrypted, authenticated remote administration of network devices, replacing insecure protocols like Telnet. SSH uses public-key cryptography to establish a secure channel over an unsecured network, ensuring confidentiality and integrity of management traffic. This is the standard for secure CLI-based device management in enterprise environments.

Answer

Telnet on port 23

Answer

RDP on port 3389

Answer

HTTP on port 80

Question 3

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Accepted Answer

NTP traffic. The syslog message %ASA-4-106023 shows a UDP deny from source 192.0.2.1 port 123 to destination 10.0.0.5 port 123. Port 123 is the well-known port for Network Time Protocol (NTP), which is used for clock synchronization. Therefore, the denied traffic is NTP traffic.

Answer

HTTP traffic

Answer

SNMP traffic

Answer

DNS traffic

Question 4

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Answer

DNS amplification

Answer

ARP poisoning

Answer

SYN flood

Question 5

A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?

Accepted Answer

False positive. The alert fired on a pattern that resembles SQL injection, but the server was not vulnerable or the input was sanitized; thus no actual attack occurred.

Answer

True negative

Answer

False negative

Answer

True positive

Question 6

Which Windows registry hive contains user-specific configuration settings that can be modified by applications?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) is the correct answer because it stores user-specific configuration settings, such as desktop preferences, environment variables, and application settings, that are loaded from the NTUSER.DAT file when a user logs in. Applications modify this hive to persist per-user customizations, making it the primary location for user-level registry changes.

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_USERS

Question 7

A security auditor reviews the SNMP configuration. Which security concern should be reported?

Accepted Answer

The community strings are set to default values. Default SNMP community strings (e.g., 'public' for read-only, 'private' for read-write) are well-known and widely documented. An attacker who discovers these defaults can query or modify the device's MIB, leading to information disclosure or unauthorized configuration changes. This is a critical security concern that must be reported.

Answer

The location and contact information is exposed

Answer

SNMP is disabled on the router

Answer

The private community string is read-only

Question 8

A security analyst wants to monitor file creation events on a critical Windows server without installing additional software. Which Windows audit policy should be configured?

Accepted Answer

Audit File System. Audit File System policy is the correct choice because it specifically enables auditing of file creation, modification, and deletion events on NTFS volumes. By configuring this policy under Advanced Audit Policy in Windows, the security analyst can monitor file creation events on the critical server without requiring any third-party software, as the events are logged to the Windows Security log with Event ID 4663.

Answer

Audit Detailed Tracking

Answer

Audit Account Logon

Answer

Audit Process Creation

Question 9

Which security principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In network security, this is often implemented through protocols like PKI (Public Key Infrastructure) where a sender signs data with their private key, and the receiver verifies it with the corresponding public key, providing irrefutable proof of origin.

Answer

Availability

Answer

Confidentiality

Answer

Integrity

Question 10

During incident response, a security analyst reviews a PCAP file and sees TCP packets with only the SYN flag set, followed by RST packets upon receiving a SYN-ACK. No connection is established. Which scanning technique is being used?

Accepted Answer

Half-open scan (SYN scan). The described behavior—sending a SYN packet, receiving a SYN-ACK, and immediately replying with an RST—is the hallmark of a half-open (SYN) scan. This technique never completes the three-way handshake, so the target does not log an established connection, making it stealthier than a full connect scan. The RST sent after the SYN-ACK terminates the handshake before it can be fully established, confirming the port is open without creating a full session.

Answer

FIN scan

Answer

Christmas tree scan

Answer

Full connect scan

Question 11

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. The integrity element of the CIA triad ensures that data cannot be modified by unauthorized parties. Integrity mechanisms, such as hashing algorithms (e.g., SHA-256) or digital signatures, detect any unauthorized changes to data in transit or at rest. If an attacker alters a packet or file, the hash value will not match, alerting the system to the breach.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 12

Which TWO of the following are essential components of an effective security policy framework according to Cisco best practices?

Accepted Answer

A high-level security policy that defines management's intent.. A high-level security policy is essential because it defines management's intent, establishes the organization's security philosophy, and provides the authoritative foundation for all subordinate policies, standards, and procedures. According to Cisco best practices, this top-tier document must be approved by senior leadership and sets the strategic direction for the entire security program, ensuring alignment with business objectives and regulatory requirements.

Answer

A network diagram showing all security devices.

Answer

A password policy that specifies minimum length and complexity.

Answer

A log analysis procedure for detecting anomalies.

Question 13

Refer to the exhibit. A host-based analyst reviews auth.log. What does the accepted password log entry indicate?

Accepted Answer

The admin account was accessed by an attacker after brute-forcing root. The log entry shows 'Accepted password for admin from 10.10.10.10 port 22 ssh2' followed by 'Failed password for root from 10.10.10.10 port 22 ssh2'. The sequence indicates that the attacker first successfully logged in as 'admin' (accepted password), then attempted to escalate privileges by brute-forcing the 'root' account. Option D correctly identifies that the admin account was accessed by an attacker who then attempted to brute-force root, as evidenced by the failed root attempts after a successful admin login.

Answer

The root account was successfully compromised

Answer

The system prevented a brute-force attack on the admin account

Answer

The admin login is legitimate because it was accepted

Question 14

A security team implements an IPS that uses behavioral profiling. Which type of detection method is being used?

Accepted Answer

Anomaly-based. Behavioral profiling establishes a baseline of normal network traffic patterns and then flags deviations from that baseline as potential threats. This is the core mechanism of anomaly-based detection, which identifies malicious activity by comparing observed behavior against a learned model of normal behavior rather than against predefined signatures or rules.

Answer

Heuristic

Answer

Signature-based

Answer

Rule-based

Question 15

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

Accepted Answer

The file is likely packed or encrypted to evade signature-based detection.. A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Answer

The file contains no executable code.

Answer

The file is likely a legitimate application with high compression.

Answer

The file's imports are all standard Windows DLLs.