200-201 Practice Test 43 — 15 Questions

Question 1

A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an exception for the source IP of the monitoring service.. The rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.

Answer

Increase the threshold to 20 failed attempts.

Answer

Disable the rule and rely on other detection methods.

Answer

Extend the time window to 10 minutes.

Question 2

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

Accepted Answer

UDP scan. UDP scans elicit ICMP port unreachable messages from closed ports; open ports typically do not respond.

Answer

TCP SYN scan

Answer

TCP connect scan

Answer

Ping sweep

Question 3

During an incident response, an analyst identifies a PCAP containing an HTTP POST request to a suspicious external IP with a large payload. The response is not typical for web applications. What type of activity is most likely occurring?

Accepted Answer

Data exfiltration. A large HTTP POST to an external IP with an atypical response is the classic signature of data exfiltration — the attacker uses a legitimate-looking outbound channel (HTTP POST) to push stolen data to attacker-controlled infrastructure. The 'large payload' is the stolen data leaving the network, and the unusual response indicates the endpoint is not a real web application but a collection point.

Answer

SQL injection attack

Answer

Normal web browsing

Answer

Command and control beaconing

Question 4

A SOC analyst is reviewing alerts from a network-based intrusion detection system (NIDS). An alert indicates a potential SQL injection attempt, but the destination server is a web application that accepts SQL queries as part of its normal function. What should the analyst do?

Accepted Answer

Correlate with web server logs to determine if the request was malicious.. The NIDS alert alone cannot confirm malicious intent when the destination server legitimately accepts SQL queries. Correlating with web server logs allows the analyst to examine the full HTTP request (e.g., parameters, payload, referrer) to distinguish between a benign feature usage and an actual SQL injection attack, such as detecting unexpected SQL keywords or syntax in input fields that should not contain them.

Answer

Disable the alert to reduce noise.

Answer

Tune the NIDS signature to ignore that server.

Answer

Immediately block the source IP.

Question 5

An organization is implementing a new remote access policy. Which of the following is a key component that should be included in this policy?

Accepted Answer

Requirements for multi-factor authentication. Remote access policies typically specify allowed methods (e.g., VPN), authentication requirements, and security controls.

Answer

Prohibition of personal device usage for any work

Answer

Mandatory use of social media for communication

Answer

Daily password changes for remote users

Question 6

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user registry key that specifies programs to run automatically when the user logs on. Malware commonly uses this key for persistence because it executes in the user's context without requiring administrative privileges. This makes it a primary target for autostart persistence.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 7

A large e-commerce company experiences a data breach where customer credit card numbers are stolen. The investigation reveals that an attacker exploited a SQL injection vulnerability in the web application to extract the data from the database. The company's web development team claims they use parameterized queries and prepared statements. However, the forensic analysis shows that the injection occurred through a search functionality that concatenates user input directly into the SQL query. The application logs indicate that the search function was developed by a third-party vendor and integrated into the application six months ago. The company wants to prevent such incidents in the future. Which of the following is the most effective long-term solution?

Accepted Answer

Establish a secure software development lifecycle (SSDLC) that includes security reviews for all third-party components.. The root cause is a failure in the security review process for third-party components. Even though the company uses parameterized queries elsewhere, the third-party search module concatenates user input directly into SQL queries, bypassing that protection. Establishing an SSDLC with mandatory security reviews for all third-party components ensures that such vulnerabilities are caught before integration, addressing the process gap rather than just the symptom.

Answer

Replace the third-party search module with a custom-developed one.

Answer

Implement a web application firewall (WAF) with OWASP rules.

Answer

Conduct regular vulnerability scans and patch management.

Question 8

An analyst is reviewing Windows Security Event Logs and finds Event ID 4648. What does this event indicate?

Accepted Answer

A logon attempt using explicit credentials was attempted.. Windows Security Event ID 4648 indicates that a logon attempt was made using explicit credentials — that is, a process attempted to log on with credentials different from those of the current user. This is commonly seen when using RunAs or scheduled tasks with stored credentials. It is a key event for detecting lateral movement or credential misuse.

Answer

A service was installed.

Answer

A user account was created.

Answer

A scheduled task was created.

Question 9

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 10

During a network intrusion investigation, an analyst notices repeated SMB authentication attempts from a single host to multiple other hosts using different usernames. Which type of activity does this pattern suggest?

Accepted Answer

Lateral movement. Repeated SMB authentication attempts from one host to many different hosts, using different usernames, is the classic signature of lateral movement — an attacker who has foothold on one machine pivoting across the network to compromise additional systems. The pattern of one-to-many with varying credentials indicates enumeration and spread, not a single-target attack.

Answer

Pass-the-hash attack

Answer

SMB relay attack

Answer

Brute-force attack on SMB

Question 11

A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?

Accepted Answer

Constant bit rate and consistent packet size.. Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.

Answer

Random destination ports.

Answer

High number of small packets.

Answer

Low number of bytes per flow.

Question 12

Which threat intelligence sharing standard defines a language and format for representing structured threat information, such as indicators and campaigns?

Accepted Answer

STIX. STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

Answer

MISP

Answer

TAXII

Answer

OpenIOC

Question 13

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive is an alert that fires for benign activity — the detection correctly identified a signature match, but the file was confirmed benign, so the alert is a false positive. In this scenario, the malware signature matched an outbound file transfer, but investigation confirmed the file is legitimate software, making it a false positive.

Answer

True positive

Answer

False negative

Answer

True negative

Question 14

An analyst sees an alert: 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent (Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1)'. The source is an internal host that typically uses Windows 10. What should the analyst suspect?

Accepted Answer

The traffic is likely generated by malware. The User-Agent string 'Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1' mimics Internet Explorer 6 on Windows XP (NT 5.1). Since the source host normally runs Windows 10, this outdated and mismatched User-Agent is a strong indicator of malware attempting to disguise its traffic as legacy browser activity to evade detection.

Answer

The traffic is from a web proxy

Answer

The host is running Windows XP

Answer

The host is running a browser update

Question 15

An analyst observes a series of DNS queries for subdomains like 'ZGVzdGluYXRpb24= .malicious.com' where the subdomain part appears base64-encoded. The volume of DNS traffic from a single host is unusually high. Which exfiltration technique is most likely in use?

Accepted Answer

DNS tunnelling. The base64-encoded subdomains and high volume of DNS queries from a single host are classic indicators of DNS tunnelling, where data is exfiltrated by encoding it into DNS query names (e.g., subdomains) sent to an attacker-controlled domain. DNS is often allowed through firewalls, making it an attractive covert channel. The base64 encoding allows arbitrary binary data to be transmitted as DNS labels, and the high query volume reflects the data transfer.

Answer

FTP exfiltration

Answer

HTTP POST exfiltration

Answer

Steganography in images