200-201 Practice Test 44 — 15 Questions

Question 1

A security analyst reviews the firewall log. What is the most likely reason for the denied connection?

Accepted Answer

The access control list does not permit the traffic. The firewall log shows a denied connection, and the most likely reason is that the access control list (ACL) does not permit the traffic. Firewalls enforce security policies by evaluating traffic against ACL rules; if no rule explicitly allows the packet (based on source/destination IP, port, and protocol), the implicit deny at the end of the ACL drops the connection. This is the default behavior for stateful firewalls and is the most common cause of denied connections in logs.

Answer

The destination port is blocked by default

Answer

The source IP address is an external threat

Answer

The destination IP is a known malicious host

Question 2

A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?

Accepted Answer

The host is infected with malware that is performing network reconnaissance.. The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.

Answer

The host is part of a distributed vulnerability scanning initiative.

Answer

The host is being used for a DDoS amplification attack.

Answer

The host is legitimately scanning the internet for outdated SMB shares.

Question 3

A security analyst is reviewing web server logs and notices a high number of 404 errors for non-existent URLs. Which TWO of the following tools would best help investigate this anomaly?

Accepted Answer

Wireshark for packet-level analysis. Using SIEM for correlation and Wireshark for packet analysis on the server's traffic can help identify the source and nature of the requests.

Answer

Snort for IDS alerts

Answer

YARA for file scanning

Answer

NetFlow for top talkers

Question 4

Which TWO of the following are best practices for implementing a security policy?

Accepted Answer

Review and update the policy annually. Security policies must be living documents that adapt to evolving threats, regulatory changes (e.g., GDPR, PCI DSS), and organizational shifts. Annual reviews ensure the policy remains aligned with current risk posture and compliance requirements, as recommended by frameworks like NIST SP 800-53.

Answer

Use technical jargon to ensure precision

Answer

Avoid enforcement to promote user compliance

Answer

Write the policy once and never change it

Question 5

A company is creating an incident response policy. Which TWO elements should be included to ensure proper handling of security incidents?

Accepted Answer

Contact information for law enforcement. An incident response policy must include contact information for law enforcement to ensure timely reporting of crimes such as data breaches or ransomware attacks, as required by regulations like GDPR or state breach notification laws. This enables proper legal handling and chain-of-custody preservation. Option C is correct because a step-by-step procedure for containment, eradication, and recovery is the core operational framework of the NIST SP 800-61 incident response lifecycle, ensuring consistent and effective response actions.

Answer

A list of employee performance metrics

Answer

A schedule for quarterly vulnerability scans

Answer

List of approved vendors for forensic tools

Question 6

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 7

An analyst is tuning Snort IDS rules and wants to reduce false positives. Which TWO rule options can be adjusted to decrease sensitivity?

Accepted Answer

Add a 'suppress' rule to ignore traffic from known benign IPs. Setting a higher threshold (e.g., detection_filter) reduces alerts for low-frequency events. Enabling 'suppress' can ignore specific sources or destinations that generate false positives.

Answer

Change the rule action from 'alert' to 'drop'

Answer

Change protocol from TCP to UDP

Answer

Increase the rule priority from low to high

Question 8

Which protocol and port pair is commonly used for secure web traffic?

Accepted Answer

HTTPS 443. HTTPS (HTTP Secure) uses port 443 for encrypted web traffic.

Answer

FTP 21

Answer

HTTP 80

Answer

SSH 22

Question 9

Which TWO of the following are functions of a SIEM system in security monitoring?

Accepted Answer

Correlation rule engine. SIEM aggregates logs from various sources and applies correlation rules to detect threats. Packet capture and port scanning are not core SIEM functions.

Answer

Packet capture and analysis

Answer

Firewall rule management

Answer

Vulnerability scanning

Question 10

Which log source would provide the most detailed information about HTTP requests, including URLs and user agents?

Accepted Answer

Web server logs. Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

Answer

DNS logs

Answer

Firewall logs

Answer

System logs

Question 11

A security analyst is monitoring network traffic and notices a large number of TCP SYN packets being sent to a single host on various ports. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves sending packets to multiple ports on a target to discover open ports. The description matches a TCP SYN scan.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 12

Which protocol is used by SNMP to send traps from network devices to the management station?

Accepted Answer

UDP port 162. SNMP traps are sent from agents to managers using UDP port 162. SNMP uses UDP, not TCP.

Answer

TCP port 162

Answer

TCP port 161

Answer

UDP port 161

Question 13

A security analyst is reviewing a Wireshark capture and notices a large number of TCP SYN packets sent to multiple ports on a single host from the same source IP. Which type of network activity is most likely being observed?

Accepted Answer

Port scan. A port scan is characterized by multiple connection attempts to different ports on a target host, often using SYN packets.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

Man-in-the-middle attack

Question 14

Which OSI layer is responsible for logical addressing and routing, and is commonly targeted by IP spoofing attacks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Answer

Application layer

Answer

Transport layer

Answer

Data Link layer

Question 15

Which TWO of the following are examples of malware that rely on user interaction to spread? (Select two.)

Accepted Answer

Trojan. A virus requires user action (e.g., opening an infected file) to execute and spread. A Trojan also relies on user deception to install. Worms spread without user interaction.

Answer

Rootkit

Answer

Worm

Answer

Ransomware