200-201 Practice Test 45 — 15 Questions

Question 1

A security team is implementing a Public Key Infrastructure (PKI) to support digital signatures for email. Which THREE components are essential to the PKI framework? (Choose three.)

Accepted Answer

Registration Authority (RA). A PKI includes a Certificate Authority (CA) that issues certificates, certificates themselves that bind public keys to identities, and a registration authority (RA) that verifies identities. The private key is held by the user, not part of the PKI infrastructure. The CRL is a mechanism but not a core component.

Answer

Private key

Answer

Certificate Revocation List (CRL)

Question 2

An organization wants to ensure data integrity and non-repudiation for sensitive documents. Which THREE cryptographic mechanisms should be implemented? (Select three.)

Accepted Answer

Digital signatures. Digital signatures provide both data integrity and non-repudiation by using the sender's private key to sign a hash of the document. The recipient verifies the signature with the sender's public key, ensuring the document has not been altered and that the sender cannot deny having signed it.

Answer

Steganography

Answer

Symmetric encryption

Question 3

Which TWO locations in a Linux filesystem should be checked for evidence of malware persistence?

Accepted Answer

/var/spool/cron/crontabs. Cron is a standard Linux mechanism for scheduling recurring tasks, and malware often uses cron jobs to re-execute itself after a reboot or at specific intervals. The crontabs directory under /var/spool/cron/ contains the actual cron job files for each user, making it a primary location to check for unauthorized persistence entries. Malware can add a cron entry that downloads or runs a malicious script, ensuring its continued presence on the system.

Answer

/proc

Answer

/var/log/syslog

Answer

/etc/passwd

Question 4

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Accepted Answer

Least privilege. Least privilege, is correct because the design restricts access to the sensitive database to only the specific application server that requires it. This principle dictates that users, processes, or systems should be granted the minimum permissions necessary to perform their functions, thereby reducing the attack surface. By implementing network access control lists (ACLs) or firewall rules that permit traffic solely from the application server's IP address to the database port, the engineer enforces least privilege at the network layer.

Answer

Defense in depth

Answer

Separation of duties

Answer

Weakest link

Question 5

A SOC analyst is investigating a suspected data exfiltration. Which THREE indicators in network traffic are most consistent with exfiltration? (Choose three.)

Accepted Answer

Large outbound data transfers to an external IP at unusual hours. Large outbound data transfers to an external IP at unusual hours (A) are a classic indicator of data exfiltration because attackers often move stolen data during off-peak times to evade detection. This behavior deviates from normal business traffic patterns and can be flagged by network monitoring tools as anomalous. The volume and timing together suggest intentional data theft rather than routine operations.

Answer

Consistent HTTPS traffic to a CDN

Answer

Increased inbound web traffic

Question 6

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

Accepted Answer

SQL injection. SQL injection attacks often include SQL keywords like UNION and SELECT in crafted parameters.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

Command injection

Question 7

An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?

Accepted Answer

Multiple SMB connection attempts from a single host to many different hosts. Lateral movement via SMB often involves many SMB connections from one host to others, and pass-the-hash uses NTLM authentication with a hash.

Answer

A single SMB connection to a file server

Answer

DNS queries for internal hostnames

Answer

HTTP requests to a web server

Question 8

A SOC analyst is monitoring network traffic using Cisco Stealthwatch. An alert is generated indicating a large volume of data being transferred from a critical server to an external IP address during off-hours. The analyst observes that the data transfer is using encrypted HTTPS traffic to a cloud storage provider. The server is known to host sensitive customer data. The analyst reviews the server's outbound firewall rules and finds that HTTPS traffic to any destination is allowed. The analyst checks the server's recent login logs and sees an authentication from a user account that is typically used by a contractor who only works during business hours. The contractor's account has not been disabled after the contract ended last week. What should the analyst do first?

Accepted Answer

Investigate the alert further by checking the server for any signs of malware or unauthorized access, and then escalate to the incident response team.. The correct first step is to investigate the alert further to confirm whether it is a genuine security incident. Option C is correct because it follows established incident response procedures: gather more evidence (e.g., check for malware, unauthorized access) before taking containment or eradication actions. Prematurely blocking the IP (A) could disrupt legitimate business operations if the transfer is authorized. Disabling the account (B) is a valid remediation step but should occur after confirming the incident and as part of a coordinated response. Ignoring the alert (D) is dangerous because encryption does not automatically indicate benign activity; exfiltration often uses HTTPS to evade detection.

Answer

Ignore the alert because the traffic is encrypted and cannot be inspected.

Answer

Immediately block the external IP address at the firewall to stop the data transfer.

Answer

Disable the contractor's user account and notify the IT manager.

Question 9

A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?

Accepted Answer

DNS responses with unusually large TXT record sizes. DNS exfiltration involves encoding data in subdomain queries, often with high entropy, and can use TXT records to retrieve data.

Answer

Large number of ICMP echo requests to external hosts

Answer

Consistent traffic to a known C2 server on port 443

Answer

Multiple failed HTTP POST requests to a file-sharing site

Question 10

Which type of traffic is most prominent in this NetFlow data?

Accepted Answer

HTTP. HTTP traffic is most prominent because the NetFlow data shows a high volume of packets and bytes on TCP port 80, which is the default port for HTTP. NetFlow records summarize traffic flows, and the large number of flows and bytes on port 80 indicates that HTTP is the dominant protocol in the captured data.

Answer

SSH

Answer

DNS

Answer

HTTPS

Question 11

A SOC analyst is investigating a potential data exfiltration incident. Which TWO Indicators of Compromise (IoCs) would be most relevant for tracking the exfiltration of files over the network?

Accepted Answer

URLs. URLs are correct because they can indicate the destination of exfiltrated data, such as a cloud storage endpoint or a command-and-control server. File hashes (MD5/SHA-256) are correct because they uniquely identify the specific files being transferred, allowing the analyst to track known malicious or sensitive files across the network.

Answer

IP addresses

Answer

Mutex names

Answer

Registry keys

Question 12

During a network intrusion investigation, an analyst notices repeated SMB authentication attempts from a single host to multiple other hosts using different usernames. Which type of activity does this pattern suggest?

Accepted Answer

Lateral movement. Lateral movement via SMB involves authenticating to multiple hosts, often with different credentials, to move across the network.

Answer

Pass-the-hash attack

Answer

SMB relay attack

Answer

Brute-force attack on SMB

Question 13

An analyst is examining a PCAP file for signs of lateral movement. Which TWO of the following are typical indicators of lateral movement using pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from a single host to multiple other hosts. Pass-the-hash attacks use NTLM authentication with hashed credentials. Indicators include multiple SMB authentication attempts from one host to many others and the use of NTLM hashes.

Answer

HTTP requests to a web server

Answer

ICMP timestamp requests

Answer

Large file transfers using FTP

Question 14

An analyst is examining a PCAP for signs of pass-the-hash attack. Which THREE indicators would be consistent with pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from the same host to many targets. Pass-the-hash uses NTLM authentication with a hash, often over SMB, and may show successful authentication without password.

Answer

Large DNS queries

Answer

Kerberos ticket requests

Question 15

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

Accepted Answer

Windows Security Event Logs (Event ID 4624, 4625).. Windows Security Event Logs with Event ID 4624 (successful logon) and 4625 (failed logon) are the authoritative source for interactive and remote logon events on a Windows system. They record the target user account (jsmith), the source IP address of the remote connection, and the timestamp, making them the direct and most reliable log source to determine if a specific user account was used from a remote IP during a breach window.

Answer

NetFlow records from the core switch.

Answer

VPN concentrator logs.

Answer

File server audit logs.