200-201 Practice Test 48 — 15 Questions

Question 1

A forensic analyst uses Volatility on a memory dump and runs the 'malfind' plugin. The output shows a process with a VAD region that has PAGE_EXECUTE_READWRITE protection and contains the pattern 'MZ'. What does this indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The process has been infected with code injection, likely a PE executable mapped in memory.. PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

Answer

The process is using a packed executable that was unpacked in memory.

Answer

The process has a heap spray attack, but not necessarily injected code.

Answer

The process is a legitimate browser with dynamic code.

Question 2

Match each network attack type to its description.

Accepted Answer

Phishing: A social engineering attack where attackers trick users into revealing sensitive information by impersonating a legitimate entity.. Common attack types: Phishing is a social engineering attack, DDoS is a volumetric attack, Man-in-the-Middle intercepts communications, and SQL Injection targets databases. Distractors confuse Phishing with DDoS and SQL Injection with Man-in-the-Middle.

Answer

Phishing: An attack that overwhelms a target server with traffic from multiple sources to disrupt services.

Answer

SQL Injection: An attack where the attacker intercepts communication between two parties to eavesdrop or alter data.

Question 3

A Linux analyst wants to identify all listening TCP ports on a system. Which command is most appropriate?

Accepted Answer

ss -tlnp. ss -tlnp shows listening TCP sockets with process info.

Answer

netstat -an

Answer

lsof -i

Answer

ps aux

Question 4

An analyst needs to check for services that were set to start automatically on a Windows host. Which command-line utility can be used to query the state and start type of all services?

Accepted Answer

sc query. The 'sc query' command retrieves information about services, including their state and start type (auto, manual, disabled). It is useful for identifying suspicious services.

Answer

tasklist

Answer

schtasks

Answer

netstat

Question 5

A security analyst is investigating a Windows host and wants to view running processes along with their parent-child relationships and command-line arguments. Which tool is best suited for this task?

Accepted Answer

Process Explorer. Process Explorer provides detailed process information including parent PID and command line, while Task Manager and tasklist show limited details. Volatility is a memory analysis tool, not for live host analysis.

Answer

Volatility

Answer

tasklist

Answer

Task Manager

Question 6

A Linux system administrator notices unauthorized SSH logins in /var/log/auth.log. Which of the following log entries would indicate a failed SSH login attempt?

Accepted Answer

Failed password for root. In auth.log, failed SSH logins typically contain 'Failed password' messages. Accepted password indicates success, and Invalid user may accompany failed attempts but the key indicator is 'Failed password'.

Answer

Connection closed by authenticating user

Answer

Session opened for user

Answer

Accepted publickey for root

Question 7

In a Linux system, an analyst wants to check for unauthorized cron jobs. Which of the following is a common location for user-specific cron jobs?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), named after the user.

Answer

/var/log/cron

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 8

An analyst is examining a Linux server and notices an unusual systemd service that starts automatically. Which command would be used to disable this service?

Accepted Answer

systemctl disable servicename. The 'systemctl disable' command prevents a service from starting automatically at boot.

Answer

systemctl stop servicename

Answer

systemctl remove servicename

Answer

systemctl mask servicename

Question 9

A SIEM correlation rule is designed to detect a brute-force attack. The rule triggers when an event includes 10 or more failed logins from the same source IP within 1 minute. An analyst sees an alert for 12 failed logins from IP 10.0.0.1 in 2 minutes. Why did the rule not trigger?

Accepted Answer

The time window is too short; the rule requires 10 failures in 1 minute, but this occurred over 2 minutes. The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Answer

The source IP is not in the watch list

Answer

The rule only counts successful logins

Answer

The alert severity is too low

Question 10

Which cryptographic method uses the same key for both encryption and decryption, and is typically faster than asymmetric encryption?

Accepted Answer

AES. Symmetric encryption uses a single shared key for both operations.

Answer

Digital signature

Answer

RSA

Answer

SHA-256

Question 11

A security administrator needs to verify that a downloaded file has not been altered during transit. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing produces a fixed-size hash that changes if the file is modified, allowing integrity verification.

Answer

Public key encryption

Answer

Symmetric encryption

Answer

Digital signature

Question 12

A company is implementing a new security policy to protect customer payment information. Which TWO compliance frameworks are most relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. PCI DSS applies to payment card data; GDPR applies to personal data of EU residents, which may include payment information.

Answer

HIPAA

Answer

ISO 27001

Answer

NIST Cybersecurity Framework

Question 13

A user receives an email that appears to be from the company's IT department asking for their password to perform a security check. The email contains a link to a fake login page. Which type of social engineering attack is this?

Accepted Answer

Phishing. Phishing typically uses deceptive emails and fake websites to trick users into revealing sensitive information.

Answer

Spear phishing

Answer

Vishing

Answer

Pretexting

Question 14

Which component of the NIST Cybersecurity Framework involves taking action to stop an ongoing attack?

Accepted Answer

Respond. The Respond function includes activities to contain and mitigate incidents.

Answer

Identify

Answer

Detect

Answer

Protect

Question 15

A security analyst discovers that an attacker has captured network traffic and used it to impersonate a legitimate user in a subsequent session. Which element of the CIA triad is most directly compromised in this scenario?

Accepted Answer

Confidentiality. Confidentiality is compromised when data is accessed by unauthorized parties. The attacker captured traffic (unauthorized access to data), which leads to impersonation, but the core violation here is confidentiality because the data was disclosed.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability