200-201 Practice Test 43 — 15 Questions

Question 1

Which three steps are part of the network intrusion analysis process according to Cisco best practices?

Accepted Answer

Collection. Collection is correct because the network intrusion analysis process begins with gathering raw data from sources such as NetFlow, syslogs, and packet captures (PCAP). This step ensures that all relevant evidence is preserved for subsequent detection and analysis, aligning with Cisco's best practices for incident response.

Answer

Prevention

Answer

Remediation

Question 2

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a server is sending encrypted data to an external IP address during non-business hours. The server is supposed to only communicate with internal systems. What is the best immediate action?

Accepted Answer

Disconnect the server from the network. Disconnecting the server from the network immediately stops the potential data exfiltration by severing all communication paths. This is the fastest way to contain the threat and prevent further data loss, aligning with the first step in incident response: containment. In a suspected exfiltration scenario, preserving the system state for forensic analysis is secondary to stopping the active data transfer.

Answer

Block the external IP address at the firewall

Answer

Notify the server's administrator

Answer

Capture a packet capture (PCAP) of the traffic for analysis

Question 3

An analyst reviews the Cisco ASA syslog message shown in the exhibit. What does this entry indicate?

Accepted Answer

An attempted connection from an external host to an internal web server that was blocked by the firewall. The syslog message shows a deny action for an HTTP connection (port 80) from an external IP (outside) to an internal IP (inside). The '%ASA-4-106023' message indicates a packet was denied by the firewall's access control list (ACL). This matches the scenario of an attempted external-to-internal web connection being blocked, which is option C.

Answer

A successful HTTP connection from the outside to the inside server

Answer

A VPN tunnel initiation that was rejected due to authentication failure

Answer

A NAT translation failure for an outbound connection

Question 4

Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?

Accepted Answer

The internal server is trying to access the router's web interface, which is blocked by an ACL.. The log messages show repeated TCP connection attempts from internal server 10.0.0.2 to the router's IP on port 443 (HTTPS) and port 80 (HTTP), which are denied by an ACL. Since the source is an internal server and the destination is the router's own IP, this indicates the server is trying to reach the router's web interface, but the ACL is blocking those packets. Option C correctly identifies this scenario.

Answer

An external host is scanning the router.

Answer

The router is under a brute-force attack on the HTTP server.

Answer

The router is infected with malware and generating traffic.

Question 5

Refer to the exhibit. A security analyst is reviewing the ASA configuration. Which traffic will be permitted from the outside interface?

Accepted Answer

TCP traffic to host 10.1.1.1 on port 80. The ASA configuration shown includes an access-list entry that permits TCP traffic from any source to host 10.1.1.1 on port 80. This is the only rule that explicitly allows traffic from the outside interface to the inside network, and since the outside interface has the access-group applied inbound, only traffic matching this permit statement will be allowed.

Answer

Any IP traffic to host 10.1.1.1

Answer

All traffic from the outside to the inside network

Answer

HTTP traffic from internal hosts to the outside

Question 6

An investigator seizes a laptop as evidence from a crime scene. At the scene, the laptop is turned on and a log file is open. What should the investigator do to preserve evidence according to chain of custody procedures?

Accepted Answer

Photograph the screen and create a forensic image. The investigator must first document the volatile state of the evidence by photographing the screen (capturing the open log file) and then create a forensic image (bit-for-bit copy) of the entire hard drive. This preserves the original data integrity and adheres to chain of custody procedures, ensuring that the evidence is not altered and can be verified later via hash verification (e.g., MD5 or SHA-256).

Answer

Close the log file and copy it to a USB drive

Answer

Shut down the laptop and remove the hard drive

Answer

Execute the log file to ensure it is legitimate

Question 7

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Accepted Answer

A sudden increase in traffic from a single source IP address. A sudden increase in traffic from a single source IP address is a classic indicator of a direct DoS attack, where the attacker uses a single compromised host to flood the target with packets, overwhelming its resources. This contrasts with a distributed denial-of-service (DDoS) attack, which uses multiple sources. The abrupt spike in volume from one IP is a clear anomaly that network monitoring tools flag as a potential DoS event.

Answer

A low level of network utilization on the target server

Answer

A gradual increase in traffic from multiple geographic locations

Answer

A high number of DNS queries from diverse source IPs

Question 8

Which TWO are examples of technical security controls? (Select two.)

Accepted Answer

Firewall. A firewall is a technical security control because it is a hardware or software device that enforces access policies by inspecting network traffic based on rules (e.g., permit/deny IP addresses, ports, protocols). Encryption is a technical control that transforms plaintext data into ciphertext using algorithms like AES-256 or RSA, ensuring confidentiality during storage or transmission. Both are implemented through technology rather than administrative or physical means.

Answer

Security policy

Answer

Security awareness training

Answer

Background checks

Question 9

A Cisco Firepower sensor is generating a high number of false positives from a rule that triggers on large ICMP packets. The analyst suspects the rule threshold is too low. Which tuning action most effectively reduces false positives while maintaining detection of actual attacks?

Accepted Answer

Increase the packet size threshold.. Increasing the packet size threshold (Option D) directly addresses the root cause of the false positives: the rule is triggering on legitimate large ICMP packets that are below the actual attack size. By raising the threshold to a value that still captures known attack vectors (e.g., ICMP echo requests exceeding 65,535 bytes in a fragmented attack), the sensor reduces noise while preserving detection of true malicious oversized packets. This is the most effective tuning action because it adjusts the detection parameter without disabling or bypassing the rule.

Answer

Change the rule action from alert to drop.

Answer

Disable the rule entirely.

Answer

Add an exception for trusted source IPs.

Question 10

An analyst is using Zeek to monitor network traffic. Which THREE types of logs can Zeek generate to provide visibility into application-layer activity?

Accepted Answer

smtp.log. Zeek generates application-layer logs by parsing protocol-specific traffic. SMTP (Simple Mail Transfer Protocol) is an application-layer protocol, and Zeek's smtp.log captures email transactions, including sender, recipient, and message IDs, providing visibility into email-based activity.

Answer

conn.log

Answer

weird.log

Question 11

Based on the exhibit, which host is likely engaged in data exfiltration?

Accepted Answer

10.0.0.1. Host 10.0.0.1 is likely engaged in data exfiltration because the exhibit shows a large volume of outbound TCP traffic from this IP to an external destination on port 443 (HTTPS), with a significantly higher byte count compared to other hosts. This pattern is consistent with data being encrypted and sent to an external server, a common exfiltration technique to bypass inspection.

Answer

10.0.0.3

Answer

10.0.0.2

Answer

None of the above

Question 12

Refer to the exhibit. What does this Snort rule detect?

Accepted Answer

Exploit code for a buffer overflow. The Snort rule detects a buffer overflow attempt by matching a specific pattern (e.g., a long string of 'A' characters or a shellcode pattern) in the payload, which is characteristic of exploit code targeting a vulnerable service. Buffer overflow exploits often send oversized data to trigger memory corruption, and Snort rules use content matching and byte_test to identify such anomalies. This rule likely targets a known overflow in a protocol like SMB or RPC, but the signature is specific to the exploit payload, not the protocol itself.

Answer

A NetBIOS name service query

Answer

A vulnerability in Microsoft RPC

Answer

Normal SMB traffic

Question 13

Refer to the exhibit. A network administrator notices that remote SSH logins to the router succeed, but the router is not sending accounting records. Based on the configuration, what is the most likely cause?

Accepted Answer

The accounting command references a TACACS+ group that is not defined.. The `accounting exec default` command references a TACACS+ server group named 'tacacs_server_group' that is not defined in the configuration. Without a defined server group, the router cannot send accounting records to any TACACS+ server, even though SSH authentication succeeds via the local database.

Answer

The AAA authorization method is set to local, not TACACS+.

Answer

The TACACS+ server key is not configured correctly.

Answer

The AAA authentication method uses local database instead of TACACS+.

Question 14

An analyst is handling a data breach involving sensitive customer information (PII) stored in a database. According to data classification policy, what is the most critical step to take first?

Accepted Answer

Contain the breach and preserve evidence. The immediate priority in any data breach incident is to contain the breach to prevent further data loss and to preserve forensic evidence for investigation and potential legal action. According to NIST SP 800-61 and common incident response frameworks, containment and evidence preservation must occur before notification or classification changes to ensure the integrity of the investigation and to limit damage.

Answer

Classify the data as high impact

Answer

Review the data classification policy

Answer

Notify affected customers immediately

Question 15

Which two are best practices for deploying network-based intrusion detection systems? (Choose two.)

Accepted Answer

Use tap or SPAN ports to ensure traffic visibility.. Network-based intrusion detection systems (NIDS) must have full visibility into network traffic to detect malicious activity. Using a network tap or a SPAN (Switched Port Analyzer) port on a switch provides a copy of all traffic traversing a segment without introducing latency or single points of failure, ensuring the sensor can inspect packets without interfering with production traffic.

Answer

Place sensors behind firewalls to reduce false positives.

Answer

Enable all signatures to maximize detection.

Answer

Use inline mode for all sensors to enable blocking.