200-201 Practice Test 47 — 15 Questions

Question 1

Refer to the exhibit. An analyst examines the port security status on a switch interface. What action should the analyst take to restore connectivity to the device connected to this port?

Accepted Answer

Shut down and re-enable the interface. When a port security violation occurs (e.g., a MAC address limit is exceeded or a sticky MAC changes), the switch can be configured to err-disable the interface. The standard remediation is to administratively shut down the interface (shutdown) and then re-enable it (no shutdown), which clears the error condition and restores connectivity. This is the only action that directly addresses the err-disable state caused by the security violation.

Answer

Remove the port from the VLAN

Answer

Clear the MAC address table on the switch

Answer

Increase the maximum number of MAC addresses allowed

Question 2

A company wants to protect its internal network from external threats. Which security principle involves deploying multiple layers of security controls?

Accepted Answer

Defense in depth. Defense in depth (option B) is the correct answer because it describes the strategy of layering independent security controls—such as firewalls, intrusion prevention systems (IPS), endpoint protection, and access controls—so that if one layer fails, another can still block or mitigate an attack. This principle ensures that no single point of failure can compromise the entire network, which is essential for protecting internal assets from external threats.

Answer

Least privilege

Answer

Risk management

Answer

Separation of duties

Question 3

Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?

Accepted Answer

The internal server is trying to access the router's web interface, which is blocked by an ACL.. The log messages show repeated TCP connection attempts from internal server 10.0.0.2 to the router's IP on port 443 (HTTPS) and port 80 (HTTP), which are denied by an ACL. Since the source is an internal server and the destination is the router's own IP, this indicates the server is trying to reach the router's web interface, but the ACL is blocking those packets. Option C correctly identifies this scenario.

Answer

An external host is scanning the router.

Answer

The router is under a brute-force attack on the HTTP server.

Answer

The router is infected with malware and generating traffic.

Question 4

A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?

Accepted Answer

The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.. The SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.

Answer

The SIEM is not receiving logs from the authentication server.

Answer

The analyst is monitoring the wrong log source.

Answer

The SIEM correlation rule requires a minimum of 15 failed attempts.

Question 5

A security analyst is configuring a new SIEM platform. The organization has multiple log sources, including Windows Event Logs, Linux syslog, and firewall logs. The analyst wants to ensure that logs are not lost if the SIEM becomes unavailable. Which approach best addresses this requirement?

Accepted Answer

Configure log sources to send logs to a centralized collector with local storage and forwarding capabilities.. Deploying a centralized collector with local storage and forwarding capabilities creates a buffer that ensures logs are not lost during SIEM unavailability. The collector receives logs from sources, stores them locally (e.g., on disk or in a queue), and forwards them to the SIEM when it becomes available again. This decouples log generation from SIEM ingestion, preventing data loss even during extended outages.

Answer

Configure the SIEM to pull logs from sources via Syslog over TCP.

Answer

Implement log replication between SIEM nodes.

Answer

Increase the storage capacity of the SIEM to hold more logs.

Question 6

A network analyst notices that a host is sending a large volume of traffic to an external IP address on port 443 during non-business hours. The traffic volume is significantly higher than the established baseline. Which type of data exfiltration technique should be suspected?

Accepted Answer

HTTPS exfiltration. Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

Answer

HTTP post

Answer

ICMP tunneling

Answer

DNS tunneling

Question 7

An analyst is examining a suspicious PE file. The file's entropy is very high (close to 8.0) and the import table is almost empty. What does this indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy close to 8.0 indicates that the file's data is highly random, which is characteristic of packed or encrypted content. An almost empty import table suggests that the file does not statically import many functions, common in packed malware that resolves imports dynamically at runtime. Together, these strongly indicate packing or obfuscation.

Answer

The file is a DLL file

Answer

The file is a standard Windows executable with many imports

Answer

The file has been digitally signed

Question 8

A SIEM correlation rule triggers when it detects more than 10 failed login attempts from the same source IP within 1 minute. Which type of attack is this rule designed to detect?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated login attempts using many password guesses against a single account or a set of accounts. The SIEM rule correlates more than 10 failed login attempts from the same source IP within 1 minute, which is a classic signature of an automated password-guessing tool. This threshold-based detection is specifically designed to identify brute-force activity, not other attack types.

Answer

Port scan

Answer

DDoS attack

Answer

Privilege escalation

Question 9

An analyst is investigating a potential malware infection. Which TWO of the following are indicators of command and control (C2) communication?

Accepted Answer

DNS queries with long, random subdomains. Option D is correct because DNS queries with long, random subdomains are a classic sign of DNS tunneling or domain generation algorithm (DGA) activity used by malware to reach C2 infrastructure while evading domain reputation filtering. Option E is correct because periodic beaconing to an unusual domain reflects the regular check-in pattern malware uses to receive commands from its C2 server, often at fixed intervals with jitter. Option A is not specific to C2, as large file transfers to a peer host more commonly indicate data exfiltration or normal file sharing rather than command-and-control traffic. Option B is not specific to C2 either, since SYN scans to multiple hosts indicate reconnaissance or port scanning activity, not an established C2 channel. Option C is not an indicator of C2 because regular HTTP requests to a known update server are typical of legitimate software update behavior.

Answer

Large file transfers to a peer host

Answer

SYN scans to multiple hosts

Answer

Regular HTTP requests to a known update server

Question 10

A SOC analyst reviews a firewall log with the following entry: action=deny, source IP=192.168.1.100, destination IP=10.0.0.1, destination port=22. The analyst knows that 10.0.0.1 is an SSH server. What does this log entry indicate?

Accepted Answer

An attempted SSH connection that was blocked by the firewall. The log entry shows 'action=deny', which explicitly indicates the firewall blocked the packet. Since destination port 22 is the default port for SSH, this log entry represents an attempted SSH connection from 192.168.1.100 to 10.0.0.1 that was denied by the firewall. The analyst's knowledge that 10.0.0.1 is an SSH server confirms the nature of the traffic.

Answer

A DNS query resolved to 10.0.0.1

Answer

A successful SSH connection from 192.168.1.100 to 10.0.0.1

Answer

A misconfigured firewall allowing SSH traffic

Question 11

Which TWO of the following are valid sources of security monitoring data in a Cisco security architecture?

Accepted Answer

Syslog messages. Syslog messages (C) are a core source of security monitoring data because network devices, firewalls, and IPS/IDS appliances forward event, error, and audit messages to a central syslog collector or SIEM for correlation and alerting. NetFlow records (E) provide flow-level metadata (source/destination IP, ports, protocol, byte/packet counts, timestamps) that enable traffic profiling, anomaly detection, and threat hunting in a Cisco security architecture. RADIUS accounting (A) is primarily used for user session accounting and billing/AAA purposes rather than as a general security monitoring telemetry source. SNMP traps (B) are mainly for device health and fault management, not security event monitoring. WMI queries (D) are a Windows management mechanism and are not a standard Cisco security monitoring data source.

Answer

RADIUS accounting

Answer

SNMP traps

Answer

WMI queries

Question 12

A security analyst is assessing the risks to a company's data. The analyst identifies a vulnerability in the web application that could allow SQL injection. Which TWO terms correctly describe the elements of this risk scenario? (Choose two.)

Accepted Answer

The SQL injection flaw in the application is a vulnerability.. Option C is correct because a SQL injection flaw is a weakness in the web application's code that can be leveraged to compromise the system, which is the definition of a vulnerability. Option E is correct because the possibility of an attacker exploiting that flaw represents a potential danger or adversary action, which is the definition of a threat. Option A is incorrect because the flaw itself is a vulnerability, not a threat; a threat is the actor or event that could exploit it. Option B is incorrect because an exploit is the specific technique or code that takes advantage of the vulnerability, not the combination of vulnerability and threat. Option D is incorrect because the possibility of exploitation describes a threat, not a vulnerability, which is the actual weakness.

Answer

The SQL injection flaw in the application is a threat.

Answer

The combination of the vulnerability and threat is the exploit.

Answer

The possibility of an attacker exploiting the SQL injection is a vulnerability.

Question 13

A security analyst is reviewing logs from a web server and notices a high volume of HTTP requests from a single IP address targeting the same login page within a short time frame. The analyst suspects a brute force attack. Which TWO actions are most appropriate to mitigate this type of attack? (Choose two.)

Accepted Answer

Implement rate limiting on the login endpoint.. Option A is correct because rate limiting on the login endpoint directly throttles the high volume of repeated HTTP requests from a single IP address, which is the defining signature of the brute force attack observed in the logs. Option E is correct because account lockout after a certain number of failed attempts stops an attacker from making unlimited password guesses against a given account, complementing rate limiting by protecting the credential itself rather than just the request rate. Option B is not appropriate because disabling the login page entirely would deny legitimate users access and cause a self-inflicted denial of service. Option C is not the best mitigation because permanently blocking the offending IP address is brittle—attackers can rotate IPs, and legitimate users behind shared or dynamic addresses could be blocked—so it is not a sustainable control. Option D is not appropriate because increasing password complexity requirements is a preventive policy for credential strength and does not stop the ongoing high-volume request pattern of a brute force attack.

Answer

Disable the login page entirely.

Answer

Block all traffic from the offending IP address permanently.

Answer

Increase the password complexity requirements.

Question 14

Which TWO of the following are essential components of an effective security policy framework according to Cisco best practices?

Accepted Answer

A high-level security policy that defines management's intent.. Option A is correct because Cisco's security policy framework begins with a high-level policy document that articulates management's intent, objectives, and overall security stance, providing the authority and direction for all subordinate policies. Option C is correct because standards are an essential layer of the framework, translating the high-level policy into mandatory, specific rules for technology use (e.g., required encryption algorithms or protocol configurations) that must be followed consistently across the organization. Option B is not essential to the policy framework itself; a network diagram is a supporting documentation artifact rather than a policy component. Option D is not essential at the framework level because a password policy is a specific control or standard, not one of the core framework components. Option E is not essential as a framework component because log analysis is an operational procedure that supports monitoring and incident response, not a foundational policy element.

Answer

A network diagram showing all security devices.

Answer

A password policy that specifies minimum length and complexity.

Answer

A log analysis procedure for detecting anomalies.

Question 15

A company is implementing a security policy that requires all employees to use multi-factor authentication (MFA) when accessing corporate resources remotely. However, during a recent security audit, it was found that several employees have been using app passwords for legacy applications that do not support MFA. What is the best practice under this policy?

Accepted Answer

Create a separate policy for legacy applications with compensating controls.. When legacy applications cannot support MFA directly, the best practice is to create a separate policy that documents compensating controls—such as network segmentation, IP allowlisting, or strict access logging—to mitigate the risk of using app passwords. App passwords bypass the second factor and are essentially static credentials, so they must be governed by additional security measures rather than being treated as equivalent to MFA.

Answer

Allow app passwords as they provide a second factor.

Answer

Implement a VPN requirement for legacy application access.

Answer

Discontinue use of legacy applications until they support MFA.