200-201 Practice Test 46 — 15 Questions

Question 1

An analyst filters PCAP with 'tcp.stream eq 0' and sees an interactive shell session with commands like 'whoami', 'ls -la', 'cd /etc'. The session originated from an HTTP POST to a web shell. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reverse shell. A web shell allows remote command execution over HTTP, essentially a reverse shell.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Cross-site scripting

Question 2

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy

Question 3

Which protocol and port combination is used by SNMP for receiving traps?

Accepted Answer

UDP 162. SNMP traps are unsolicited notifications sent from an SNMP agent to the network management system (NMS) to alert it of significant events. The correct protocol and port combination for receiving SNMP traps is UDP port 162, as defined in RFC 1157. UDP is used because traps are lightweight, connectionless messages where reliability is handled by the application layer if needed.

Answer

TCP 161

Answer

UDP 161

Answer

TCP 162

Question 4

Which TWO of the following are examples of Indicators of Compromise (IoCs) used in network security monitoring? (Choose two.)

Accepted Answer

MD5 hash of a malicious executable. Option A is correct because an MD5 hash of a malicious executable is a classic host-based/file-based IoC: the cryptographic digest uniquely identifies known malware and can be matched against threat-intelligence feeds or SIEM/file-integrity rules. Option B is correct because IP addresses of known command-and-control (C2) servers are network-based IoCs that can be detected via firewall logs, IDS/IPS signatures, or NetFlow analysis of outbound connections. Option C is not an IoC, since the time of day is merely contextual metadata and not an artifact indicating compromise. Option D is not an IoC, as a company's stock price has no bearing on security telemetry. Option E is not an IoC, because employee headcount is an organizational metric, not evidence of malicious activity.

Answer

The current time of day

Answer

The company's stock price

Answer

The number of employees in the company

Question 5

An analyst uses 'tshark -r capture.pcap -Y "http.request.method == POST"' to display only HTTP POST requests. This is an example of a:

Accepted Answer

Display filter. The `-Y` flag in tshark applies a display filter, which operates on packets already read from the capture file. Display filters use a syntax based on protocol fields (e.g., `http.request.method == POST`) to show or hide packets in the output without altering the underlying capture data. This is distinct from capture filters, which discard packets at the kernel level before they are stored.

Answer

Statistical filter

Answer

Read filter

Answer

Capture filter

Question 6

In the OSI model, which layer is primarily targeted by a SYN flood attack?

Accepted Answer

Transport Layer (Layer 4). A SYN flood attack targets the Transport Layer (Layer 4) by exploiting the TCP three-way handshake. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the target server to allocate resources for half-open connections that never complete, eventually exhausting its connection queue and denying service to legitimate users.

Answer

Network Layer (Layer 3)

Answer

Application Layer (Layer 7)

Answer

Data Link Layer (Layer 2)

Question 7

An analyst sees these logs. What should be the immediate course of action?

Accepted Answer

Investigate whether these are legitimate SSH attempts from authorized remote administrators.. The logs show repeated SSH connection attempts from the 10.0.0.0/24 subnet. The immediate priority is to determine whether these are legitimate administrative activities or malicious brute-force attempts. Investigating first prevents unnecessary disruption to authorized remote administration, which is critical for maintaining network operations and security. Blocking or changing configurations without verification could inadvertently lock out legitimate administrators or violate change-control policies.

Answer

Change the SSH port to a non-standard port.

Answer

Block all traffic from the 10.0.0.0/24 subnet.

Answer

Add an ACL permit rule for SSH from these sources.

Answer

Disable SSH access to the router.

Question 8

Which THREE are required steps in a proper incident response procedure? (Choose three.)

Accepted Answer

Containment, Eradication, and Recovery. The three correct answers map directly to the phases of the NIST SP 800-61 incident response lifecycle. Option D, Detection and Analysis, is required because an incident must first be identified and its scope, impact, and nature analyzed before any response actions can be taken. Option B, Containment, Eradication, and Recovery, is required because responders must limit the damage (containment), remove the root cause or malware (eradication), and restore affected systems to normal operation (recovery). Option C, Post-Incident Activity (Lessons Learned), is required because after recovery the organization must review what happened, update procedures and controls, and document findings to improve future response. Option A, Change Management Processing, is a supporting IT governance process rather than a required incident response phase, and Option E, System Hardening, is a preventive security control performed outside the incident response lifecycle, so neither belongs in the core required steps.

Answer

Change Management Processing

Answer

System Hardening

Question 9

An analyst is investigating a host that is making outbound HTTPS connections to multiple random-looking domains, each with a short TTL. The domains are not in any threat intelligence feeds. Which technique is most likely being used?

Accepted Answer

Domain Generation Algorithm (DGA). Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. Short TTLs allow fast changes.

Answer

Beaconing

Answer

DNS tunneling

Answer

Fast flux DNS

Question 10

An analyst is monitoring network traffic and sees a sudden spike in outbound data transfer from an internal server to an external IP that is known to be malicious. What is the most likely scenario?

Accepted Answer

Data exfiltration.. A sudden spike in outbound data transfer from an internal server to a known malicious external IP is a classic indicator of data exfiltration. Attackers often use compromised servers to siphon sensitive data (e.g., credentials, databases) to a command-and-control (C2) server. This behavior aligns with the post-compromise phase of an attack, where the goal is to extract data without triggering immediate alarms.

Answer

Software update.

Answer

User downloading a large file.

Answer

Normal backup operation.

Question 11

A security policy mandates that all network devices must have logging enabled and that logs must be reviewed regularly. Which TWO practices are essential for effective log review?

Accepted Answer

Aggregating logs from all devices into a central server.. Option A is correct because aggregating logs from all network devices into a central server (e.g., a syslog server or SIEM) is essential for effective review, as it consolidates disparate sources into one searchable location and enables cross-device analysis rather than requiring administrators to inspect each device individually. Option C is correct because automated log analysis with correlation tools (such as a SIEM) is essential to handle the high volume of log data, normalize events, and correlate activity across devices to detect patterns and anomalies that manual review would miss. Option B is incorrect because reviewing logs only after an incident is reactive and defeats the purpose of regular, proactive review mandated by policy. Option D is incorrect because while long retention (e.g., one year) supports forensics and compliance, retention alone does not constitute effective review. Option E is incorrect because a common format like Syslog aids parsing and normalization but is a supporting convenience, not an essential practice for effective log review itself.

Answer

Reviewing logs only when an incident occurs.

Answer

Storing logs for at least one year.

Answer

Ensuring logs are in a common format like Syslog.

Question 12

Which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that could be exploited. A vulnerability is a flaw or weakness in a system's design, implementation, or configuration that can be exploited by a threat actor. Option A correctly captures this as a weakness that could be exploited, which aligns with the standard definition in cybersecurity (e.g., NIST SP 800-30). It is not the act of exploitation itself, nor the likelihood of exploitation, nor the potential event causing harm.

Answer

The act of taking advantage of a weakness

Answer

The likelihood that a threat will exploit a weakness

Answer

A potential event that could cause harm

Question 13

Which Windows registry hive is most likely to contain evidence of malware persistence via a service?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry hive stores the configuration for all Windows services, including their executable paths and startup types. Malware often installs itself as a service to achieve persistence, and evidence of this can be found by examining the ImagePath value under a suspicious service subkey. This is the correct location for service-based persistence, unlike the Run keys which handle startup programs for users.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SAM

Question 14

Which best practice helps ensure accurate network intrusion analysis when reviewing logs from multiple sources?

Accepted Answer

Use synchronized time across all devices.. Synchronized time (via NTP) ensures that logs from different sources share a consistent timestamp, which is critical for correlating events across network devices during intrusion analysis. Without time synchronization, an attacker's actions might appear out of order or be missed entirely, leading to inaccurate incident reconstruction.

Answer

Disable all logging except firewall logs.

Answer

Rely solely on automated analysis tools.

Answer

Store logs in different formats for each source.

Question 15

A security analyst is reviewing logs from a network-based IPS that detected traffic from an internal host connecting to a known malicious IP address on port 6667. The traffic is encrypted IRC. Which conclusion is most likely?

Accepted Answer

The host is compromised and part of a botnet. Port 6667 is the default port for IRC (Internet Relay Chat), and encrypted IRC traffic to a known malicious IP strongly indicates command-and-control (C2) communication. Botnets commonly use IRC over TLS/SSL to evade detection and issue commands to compromised hosts. Therefore, the host is most likely compromised and part of a botnet.

Answer

The traffic is a normal application update

Answer

The host is running a legitimate IRC client

Answer

The IPS is generating a false positive