200-201 Practice Test 46 — 15 Questions

Question 1

An organization is conducting a risk assessment and assigns a monetary value to potential losses. Which risk assessment method is being used?

Accepted Answer

Quantitative risk assessment. Assigning a monetary value to potential losses is a hallmark of quantitative risk assessment. This method uses numerical data (e.g., dollar amounts, percentages) to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE), enabling objective comparison of risks. In contrast, qualitative methods rely on subjective ratings like high/medium/low.

Answer

Risk treatment

Answer

Qualitative risk assessment

Answer

Risk identification

Question 2

Based on the Cisco ASA syslog message, what does this event indicate?

Accepted Answer

An inbound UDP packet from an external source to an internal destination was denied.. The syslog message indicates that an inbound UDP packet from an external source to an internal destination was denied by the Cisco ASA. The message includes the source and destination IP addresses and ports, and the action is 'denied' due to the access-group 'OUTSIDE_IN' applied to the outside interface. This matches option B, which correctly identifies the denied inbound UDP traffic.

Answer

A DNS response from an external server to an internal client was allowed.

Answer

The access-group "OUTSIDE_IN" is misconfigured.

Answer

An outbound UDP connection was denied.

Question 3

You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?

Accepted Answer

A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.. The alert is triggered by a correlation rule that detects more than 30 failed authentication attempts from a single source IP within 10 minutes. The observed pattern—exactly 6 attempts per minute, every 5 seconds—is highly regular and mechanical, which is characteristic of an automated script or misconfigured process, not human behavior. Since the partner company locks accounts after 3 failed attempts, a human user would be locked out quickly and could not sustain 30+ attempts; only a script ignoring the lockout policy or using a cached incorrect password could produce this pattern.

Answer

The user 'john.doe' has forgotten his password and is repeatedly trying to log in.

Answer

A man-in-the-middle attack is replaying captured authentication packets.

Answer

The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.

Question 4

Which term describes a weakness in a system that could be exploited by a threat?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system, such as a missing security patch, misconfiguration, or design flaw, that a threat actor could exploit to compromise confidentiality, integrity, or availability. In the context of the 200-201 exam, this aligns with the core security concept that vulnerabilities are the specific gaps that make an asset susceptible to attack.

Answer

Risk

Answer

Exploit

Answer

Threat

Question 5

Which Cisco tool provides network-wide visibility and can detect anomalies using NetFlow and behavioral analysis?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch). Cisco Secure Network Analytics (formerly Stealthwatch) is the correct answer because it is a dedicated network visibility and security analytics platform that leverages NetFlow, IPFIX, and other telemetry sources to perform behavioral analysis and detect anomalies across the entire network. Unlike a firewall or switch, its primary function is to ingest flow data and apply machine learning models to identify threats such as lateral movement, data exfiltration, and command-and-control traffic.

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco Catalyst 9300 Switch

Answer

Cisco Identity Services Engine (ISE)

Question 6

A network analyst is troubleshooting a false positive alert from an IPS that blocks traffic to a legitimate database server. The alert signature is triggered by the pattern 'OR 1=1'. The analyst determines that the traffic is from a web application that uses dynamic SQL queries. Which action best reduces false positives while maintaining security?

Accepted Answer

Add the database server IP to an exception list. Adding the database server IP to an exception list allows the IPS to ignore traffic matching the 'OR 1=1' pattern specifically when it is destined for the legitimate database server. This preserves security by continuing to block the same pattern when it targets other servers, while eliminating the false positive caused by the web application's dynamic SQL queries. Whitelisting by destination IP is a targeted exception that does not weaken overall detection.

Answer

Increase the sensitivity of the signature

Answer

Change the signature to alert-only mode

Answer

Disable the signature entirely

Question 7

An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?

Accepted Answer

Availability. A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 8

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing

Question 9

An analyst investigating a Linux host notices an unusual process running as root. Which command would provide the most detailed process listing including parent PID and CPU usage?

Accepted Answer

top. The question requires a command that provides parent PID (PPID) and CPU usage. While `ps aux` shows CPU usage, it does not include PPID. Among the options, `top` is the only command that can be configured to display PPID (by adding the PPID column) and shows CPU usage by default. The other options either show network connections (`ss`), open files (`lsof`), or lack PPID (`ps aux`). Therefore, `top` is the most detailed process listing that includes both PPID and CPU usage.

Answer

ss -tlnp

Answer

ps aux

Answer

lsof

Question 10

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

Accepted Answer

DNS tunneling for data exfiltration.. The sudden spike in DNS queries to random subdomains of a legitimate domain (e.g., randomstring.google.com) is a classic indicator of DNS tunneling. This technique encodes data into DNS query names and exfiltrates it through the DNS protocol, bypassing network security controls that allow DNS traffic.

Answer

HTTP beaconing to a C2 server.

Answer

DNS amplification attack.

Answer

Port scanning using DNS.

Question 11

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

Accepted Answer

The SPAN source does not include that VLAN.. A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Answer

The IDS interface is set to promiscuous mode.

Answer

The SPAN destination port is in trunk mode.

Answer

The IDS is in inline mode.

Question 12

What is the primary goal of the 'integrity' pillar of the CIA triad?

Accepted Answer

Protect data from unauthorized modification. The 'integrity' pillar of the CIA triad ensures that data is not altered or tampered with by unauthorized parties. This is achieved through mechanisms such as hashing (e.g., SHA-256), checksums, and digital signatures that detect any unauthorized modification. Option D correctly identifies this goal, as protecting data from unauthorized modification is the core purpose of integrity controls.

Answer

Keep data secret from unauthorized users

Answer

Ensure data is accessible when needed

Answer

Provide proof that a user performed an action

Question 13

A security engineer discovers that an attacker has inserted fake entries into a DNS resolver's cache, redirecting users to a malicious website. Which attack has occurred?

Accepted Answer

DNS poisoning. DNS poisoning, also known as DNS cache poisoning, occurs when an attacker inserts forged DNS resource records into a resolver's cache. This causes the resolver to return a malicious IP address for a legitimate domain, redirecting users to an attacker-controlled site without their knowledge.

Answer

DDoS

Answer

Man-in-the-middle

Answer

ARP spoofing

Question 14

What is the primary purpose of a digital certificate in a Public Key Infrastructure (PKI)?

Accepted Answer

To bind a public key to an identity. The primary purpose of a digital certificate in a Public Key Infrastructure (PKI) is to bind a specific public key to a verified identity (such as a person, device, or organization). This binding is achieved through the certificate authority (CA) signing the certificate, which cryptographically asserts that the public key belongs to the named subject. Without this binding, there would be no trusted way to associate a public key with its owner, making secure communications and authentication impossible.

Answer

To encrypt all network traffic

Answer

To provide a backup of private keys

Answer

To prevent malware infections

Question 15

A company is implementing a security policy that requires all employees to use multi-factor authentication (MFA) when accessing corporate resources remotely. However, during a recent security audit, it was found that several employees have been using app passwords for legacy applications that do not support MFA. What is the best practice under this policy?

Accepted Answer

Create a separate policy for legacy applications with compensating controls.. When legacy applications cannot support MFA directly, the best practice is to create a separate policy that documents compensating controls—such as network segmentation, IP allowlisting, or strict access logging—to mitigate the risk of using app passwords. App passwords bypass the second factor and are essentially static credentials, so they must be governed by additional security measures rather than being treated as equivalent to MFA.

Answer

Allow app passwords as they provide a second factor.

Answer

Implement a VPN requirement for legacy application access.

Answer

Discontinue use of legacy applications until they support MFA.