200-201 Practice Test 49 — 15 Questions

Question 1

A company is implementing a security policy to reduce risk. Which THREE activities are examples of risk mitigation? (Choose three.)

Accepted Answer

Implementing access controls. Risk mitigation involves implementing controls to reduce risk: patching, access controls, and encryption.

Answer

Accepting the risk without action

Answer

Purchasing cyber insurance

Question 2

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Accepted Answer

ICMP tunneling. ICMP tunneling encapsulates non-ICMP data (e.g., command-and-control traffic) within ICMP echo request/reply packets. The random payload data and larger-than-typical payload size are hallmarks of this technique, as the attacker uses the ICMP protocol to bypass firewalls and exfiltrate data or establish covert communication.

Answer

Ping of death

Answer

Traceroute

Answer

Smurf attack

Question 3

An analyst is reviewing a web server log and sees the following entry: '192.168.1.1 - - [25/Oct/2023:10:15:30 -0400] "GET /admin/index.php?cmd=id HTTP/1.1" 200 1532 "-" "Mozilla/5.0"'. What potential attack does this log entry suggest?

Accepted Answer

Command injection. The presence of 'cmd=id' in the URL suggests an attempt to execute the 'id' command via a web shell or command injection vulnerability. The response code 200 indicates success, which is concerning.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 4

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

Accepted Answer

Examine /var/log/auth.log for successful logins.. Checking /var/log/auth.log for successful SSH logins on that port helps identify unauthorized connections.

Answer

Review the bash history of root user.

Answer

Check /etc/crontab for malicious scheduled tasks.

Answer

Run 'ps aux' to list all processes.

Question 5

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

Accepted Answer

Prefetch files. Prefetch files (*.pf) are created by Windows to speed up application loading. They contain metadata about executed programs, including execution count and last run time.

Answer

Windows Event Logs

Answer

Registry hives

Answer

Scheduled tasks

Question 6

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

Accepted Answer

/var/log/auth.log. On most Linux distributions, /var/log/auth.log (or /var/log/secure on Red Hat-based systems) records authentication events including SSH logins.

Answer

/var/log/kern.log

Answer

/var/log/messages

Answer

/var/log/syslog

Question 7

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Crontabs for users are stored in /var/spool/cron/crontabs/ and system-wide cron jobs are in /etc/crontab.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/

Question 8

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Event ID 4720 is logged when a user account is created in Active Directory or local SAM.

Answer

4726

Answer

4648

Answer

4624

Question 9

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location for user-level autoruns.

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Question 10

Which Linux log file is most appropriate for reviewing failed SSH login attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log (or /var/log/secure on some distributions) records authentication events including SSH failures.

Answer

/var/log/messages

Answer

/var/log/kern.log

Answer

/var/log/syslog

Question 11

An analyst is reviewing Windows Security Event Logs and finds Event ID 4648. What does this event indicate?

Accepted Answer

A logon attempt using explicit credentials was attempted.. Event ID 4648 indicates explicit credentials were used to log on, such as running a program as a different user or using secondary logon. It is distinct from interactive logon (4624) or failed logon (4625).

Answer

A service was installed.

Answer

A user account was created.

Answer

A scheduled task was created.

Question 12

Which Windows Prefetch file extension indicates that a program has been executed on the system?

Accepted Answer

.pf. Prefetch files have the .pf extension and contain execution data for applications.

Answer

.evtx

Answer

.tmp

Answer

.log

Question 13

A security analyst is analyzing a memory dump from a compromised Windows system using Volatility. Which command would best reveal hidden or injected code within a process?

Accepted Answer

vol.py malfind. The 'malfind' command scans for anomalous memory regions that often indicate code injection, such as executable pages not backed by a file on disk.

Answer

vol.py netscan

Answer

vol.py pslist

Answer

vol.py dlllist

Question 14

A network analyst notices that a host is sending a large volume of traffic to an external IP address on port 443 during non-business hours. The traffic volume is significantly higher than the established baseline. Which type of data exfiltration technique should be suspected?

Accepted Answer

HTTPS exfiltration. Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

Answer

HTTP post

Answer

ICMP tunneling

Answer

DNS tunneling

Question 15

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive. The magic bytes 50 4B 03 04 correspond to a ZIP archive (PK is the signature). This suggests the file is actually a ZIP file disguised with a PDF extension, possibly containing malicious content.

Answer

The file is a genuine PDF file

Answer

The file is a plain text file

Answer

The file is an executable