200-201 Practice Test 48 — 15 Questions

Question 1

Which TWO of the following are characteristics of behavioral-based anomaly detection in network monitoring? (Select 2)

Accepted Answer

Establishes a baseline of normal traffic. Option A is correct because behavioral-based anomaly detection works by first establishing a baseline of what constitutes normal network traffic (protocols, volumes, timing, hosts), then flagging deviations from that learned norm. Option E is correct because, since it does not depend on known attack patterns, behavioral anomaly detection can identify previously unknown (zero-day) attacks whose traffic behavior deviates from the established baseline. Option B is incorrect because predefined signatures describe signature-based detection (e.g., IDS/IPS rules), not behavioral anomaly detection. Option C is incorrect because encrypted traffic cannot be meaningfully inspected for behavior without decryption (or metadata/TLS fingerprinting techniques), and this is not a defining characteristic of anomaly detection. Option D is incorrect because static administrator-written rules describe rule-based detection, whereas behavioral detection relies on dynamically learned baselines rather than static rules.

Answer

Relies on predefined signatures

Answer

Can inspect encrypted traffic without decryption

Answer

Uses static rules written by administrators

Question 2

A security analyst is investigating a potential data breach. The analyst identifies that the attacker used a technique to impersonate a legitimate user by spoofing the MAC address and IP address. Which TWO types of network attacks could involve these techniques? (Choose two.)

Accepted Answer

ARP spoofing. ARP spoofing (A) is correct because it works by sending forged ARP replies that map the attacker's MAC address to a legitimate user's IP address, effectively spoofing both MAC and IP to impersonate that user on the local subnet. IP spoofing (D) is correct because it involves crafting packets with a forged source IP address (and often a spoofed MAC at layer 2) to make traffic appear to originate from a legitimate host. Denial of Service (B) focuses on exhausting resources or bandwidth rather than impersonating a user via MAC/IP spoofing. DNS poisoning (C) corrupts DNS resolver cache entries to redirect name resolution, not to impersonate a user's MAC/IP identity. Phishing (E) is a social-engineering attack using deceptive messages or sites, not MAC/IP address spoofing.

Answer

Denial of Service

Answer

DNS poisoning

Answer

Phishing

Question 3

A security analyst receives an alert that an employee's workstation is generating outbound traffic to a known malware command-and-control IP address at 3:00 AM. According to the company's incident response policy, what is the FIRST action the analyst should take?

Accepted Answer

Isolate the workstation from the network by disabling the switch port.. The first action is to isolate the workstation from the network by disabling the switch port. This immediately stops the outbound command-and-control (C2) traffic, preventing data exfiltration and further compromise, while preserving the system state for forensic analysis. According to the incident response policy, containment takes precedence over eradication or recovery to limit damage.

Answer

Reimage the workstation immediately to remove the malware.

Answer

Apply the latest security patches to the workstation.

Answer

Call the employee to ask if they are working late.

Question 4

Which THREE actions are mandatory in the evidence handling process according to standard forensic procedures?

Accepted Answer

Document the chain of custody. Option A is correct because documenting the chain of custody is mandatory in forensic procedures; it records who collected, handled, transferred, and stored the evidence, ensuring its integrity and admissibility in legal proceedings. Option C is correct because a write blocker must be used when imaging a device to prevent any modification of the original evidence, preserving its integrity for analysis. Option D is correct because creating a forensic image (a bit-for-bit copy) of the device is essential; it allows analysis to be performed on the copy while the original remains unaltered and preserved as evidence. Option B is incorrect because deleting malware would alter the evidence and destroy potentially valuable artifacts; malware should be preserved and analyzed, not removed. Option E is incorrect because rebooting the device can modify volatile memory, delete temporary files, and alter system state, which would compromise the evidence and violate forensic soundness.

Answer

Delete any malware found immediately

Answer

Reboot the device to clear temporary files

Question 5

Which TWO host-based analysis techniques are most effective for detecting fileless malware?

Accepted Answer

Process memory analysis to detect injected code. Option A is correct because fileless malware typically executes in memory (e.g., via reflective DLL injection, process hollowing, or shellcode injection) without writing a malicious file to disk, so examining process memory for injected code, unbacked executable regions, or anomalous modules is one of the most effective host-based detection techniques. Option E is correct because fileless attacks frequently abuse PowerShell and other scripting engines, and PowerShell script block logging (Event ID 4104) records the actual script content executed, exposing malicious commands that never touch the filesystem. Option B is not a host-based technique and, while useful for command-and-control detection, cannot directly reveal in-memory code injection. Option C is ineffective against fileless malware because signature-based scanning relies on malicious files on disk, which fileless attacks avoid. Option D can reveal persistence mechanisms, but registry artifacts alone are not the most effective means of detecting fileless execution, which occurs in memory and via scripting.

Answer

Network traffic analysis

Answer

Signature-based file scanning

Answer

Registry analysis for persistence

Question 6

An analyst is reviewing web server logs and sees the following entries: 'GET /admin/login.php HTTP/1.1' returning 404, followed by 'GET /admin/login.html' returning 404, then 'GET /admin/login.asp' returning 200. Which TWO observations are most relevant?

Accepted Answer

The attacker is probing for valid login page paths. Option A is correct because the sequence of GET requests for /admin/login.php, /admin/login.html, and /admin/login.asp shows the source systematically trying different file extensions to discover a valid login page path, which is classic forced-browsing or path enumeration behavior. Option E is correct because the final request returned HTTP 200, meaning the server successfully served /admin/login.asp, so the attacker did reach a valid login page. Option B is not supported because brute-force attacks involve repeated authentication attempts with credential guesses, not simple GET requests for different filenames. Option C is not supported because SQL injection would require malicious input in parameters or payloads, and none is shown in these URLs. Option D is not supported because a 404 response indicates the requested resource was not found, not that directory listings were exposed.

Answer

The requests indicate a brute-force login attempt

Answer

The source IP is likely performing a SQL injection

Answer

The server is misconfigured to reveal directory listings

Question 7

An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?

Accepted Answer

Multiple SMB connection attempts from a single host to many different hosts. Option B is correct because lateral movement via SMB typically manifests as one compromised host rapidly initiating SMB (TCP 445) connections to numerous distinct internal hosts, reflecting an attempt to fan out and find accessible targets or admin shares such as C$ or ADMIN$. Option C is correct because pass-the-hash attacks, a hallmark of SMB-based lateral movement, authenticate with an NTLM hash via NTLM challenge-response rather than a cleartext password, which is anomalous and strongly indicative of credential theft and reuse. Option A is not an indicator because a single SMB connection to a file server is normal, benign business activity. Option D is not specific to SMB lateral movement, since DNS queries for internal hostnames occur routinely during normal name resolution. Option E is unrelated, as HTTP requests to a web server involve the HTTP protocol on ports 80/443, not SMB.

Answer

A single SMB connection to a file server

Answer

DNS queries for internal hostnames

Answer

HTTP requests to a web server

Question 8

A security analyst is investigating an alert about a workstation that is repeatedly resolving domain names for known malicious command-and-control servers. The analyst wants to determine whether the workstation is infected with malware that uses DNS for communication. Which type of malware behavior is most likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling is a technique where malware encodes command-and-control or data exfiltration traffic inside DNS queries and responses. Repeated resolutions of known malicious domains from a single workstation strongly suggest this behavior. The other options describe different attack types that do not match the DNS-centric evidence in the scenario.

Answer

SQL injection

Answer

Cross-site scripting

Answer

ARP spoofing

Question 9

A security team is analyzing a malware infection. Which two characteristics are typical of a worm? (Choose two.)

Accepted Answer

Exploits vulnerabilities to spread without user interaction. Option A is correct because a worm actively exploits vulnerabilities (for example, unpatched SMB or RDP flaws) to propagate autonomously across systems without requiring any user action such as clicking a link or opening an attachment. Option E is correct because self-replication is the defining trait of a worm: it copies itself from host to host over network connections, often scanning for new targets and consuming bandwidth. Option B is wrong because requiring a host file to propagate describes a virus, which needs to infect an executable or document, not a worm. Option C is wrong because disguising itself as a legitimate program is characteristic of a Trojan, which relies on deception rather than self-replication. Option D is wrong because attaching to an email to spread is typical of a mass-mailing virus or email-based malware, not the network-propagating worm behavior described here.

Answer

Requires a host file to propagate

Answer

Disguises itself as a legitimate program

Answer

Attaches to an email to spread

Question 10

A security analyst is investigating a potential data breach. Which two actions are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Searching for employee information on LinkedIn. Option B is correct because searching LinkedIn for employee information is passive reconnaissance: the analyst gathers publicly available OSINT about personnel, roles, and organizational structure without sending any packets to or interacting with the target's systems, so it cannot be detected by the target. Option D is correct because a WHOIS lookup queries public registry databases (via port 43 to the registrar/RIR) for domain registration details such as registrant, admin contacts, name servers, and creation/expiry dates; this information is obtained from third-party records rather than from the target's own infrastructure, making it passive. The unmarked options do not belong: A (port scan) and C (ping sweep) are active reconnaissance techniques that directly probe the target's hosts and services and are detectable in logs or IDS/IPS, while E (phishing email) is an active social-engineering attack that interacts with employees and is not reconnaissance at all.

Answer

Performing a port scan on the company's web server

Answer

Using a ping sweep to identify live hosts

Answer

Sending a phishing email to employees

Question 11

A security engineer is analyzing a recent data breach. Which TWO are examples of active reconnaissance techniques? (Select two.)

Accepted Answer

Port scanning. Port scanning (A) is an active reconnaissance technique because it sends TCP/UDP probes (e.g., SYN, ACK, or UDP packets via tools like Nmap) directly to target hosts to discover open ports and services, which interacts with the target and can be logged. Ping sweep (B) is also active reconnaissance because it transmits ICMP Echo Request packets (or ARP/TCP probes) across an IP range to identify live hosts, again directly engaging the target network. By contrast, LinkedIn profiling (C), WHOIS lookup (D), and Google dorking (E) are passive reconnaissance techniques, as they gather information from third-party sources or public records without sending traffic to the target's systems.

Answer

LinkedIn profiling

Answer

WHOIS lookup

Answer

Google dorking

Question 12

A security analyst is examining a PCAP and observes a series of TCP packets with the PSH flag set and small payload sizes, sent from an internal host to an external IP. The packets are spaced roughly 30 seconds apart. Which type of malicious activity is MOST likely indicated?

Accepted Answer

A command-and-control (C2) beacon. The combination of small payloads, PSH flag, and regular 30-second intervals strongly suggests C2 beaconing. Malware often beacons to its C2 server at set intervals to receive commands or exfiltrate small amounts of data. This pattern is distinct from floods, file transfers, or scans.

Answer

A TCP SYN flood attack

Answer

A TCP port scan using FIN packets

Answer

A large file transfer using FTP

Question 13

During an incident, an analyst observes the following in PCAP: (1) DNS queries with random-looking subdomains to a known malicious domain, (2) large outbound FTP transfers of .zip files, (3) HTTP POST requests with Base64-encoded data in the body. Which THREE exfiltration techniques are being used? (Select 3)

Accepted Answer

FTP exfiltration. Option B (FTP exfiltration) is correct because the PCAP shows large outbound FTP transfers of .zip files, which is a classic data exfiltration pattern where stolen data is archived and sent over FTP to an external server. Option C (DNS tunneling) is correct because DNS queries with random-looking subdomains to a known malicious domain indicate data being encoded into DNS query names and sent to an attacker-controlled authoritative DNS server, a hallmark of DNS tunneling. Option E (HTTP exfiltration via POST) is correct because HTTP POST requests carrying Base64-encoded data in the body are a common method of covertly exfiltrating data through web traffic that blends in with normal HTTP. Option A (ICMP exfiltration) does not belong because no ICMP echo request/reply traffic with embedded payloads is described in the PCAP. Option D (Steganography) does not belong because steganography involves hiding data inside other files such as images or audio, and no such carrier files or hidden-content artifacts are mentioned in the observed traffic.

Answer

ICMP exfiltration

Answer

Steganography

Question 14

Which TWO of the following are typical indicators of a C2 beaconing communication?

Accepted Answer

Regular intervals of communication at consistent times. Option A is correct because C2 beaconing is characterized by periodic check-ins from an infected host to its command-and-control server, producing highly regular, consistent communication intervals (often with jitter added to evade detection). Option E is correct because beaconing frequently abuses DNS for command-and-control or data exfiltration, generating queries to unusual, rarely visited, or algorithmically generated (DGA) domains that stand out against normal browsing patterns. Option B is not typical of beaconing itself, since beaconing traffic is usually small and low-volume; large outbound transfers suggest exfiltration rather than the beacon check-in. Option C describes a brute-force or password-guessing attack, not C2 beaconing. Option D describes ICMP echo requests (ping sweeps) used for host discovery or network reconnaissance, not command-and-control beaconing.

Answer

Large outbound data transfers to an external IP

Answer

Multiple failed login attempts from a single source

Answer

ICMP echo requests to multiple hosts

Question 15

A security analyst is investigating a Linux server that is suspected of hosting a reverse-shell backdoor. The analyst wants to identify which running process is maintaining the outbound connection and which user context it is running under. Which TWO commands would best provide this information? (Choose two.)

Accepted Answer

lsof -i -P -n. To attribute a suspicious outbound connection to a specific process and user, the analyst needs socket-to-process mapping. The ss command with -tunap and lsof with -i -P -n both provide this mapping by listing open sockets alongside the owning process and user. Static files such as /etc/passwd, resource monitors like top, and service logs from journalctl do not tie live connections to processes, so they cannot identify the reverse shell.

Answer

cat /etc/passwd

Answer

top -b -n 1

Answer

journalctl -u sshd --since '1 hour ago'