200-201 Practice Test 5 — 10 Questions

Question 1

A company's endpoint detection and response (EDR) agent is reporting a file that was created with a name matching a known ransomware pattern. The analyst suspects the file is malicious. What is the best first step to contain the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the host from the network. Isolating the host from the network is the best first step because it immediately stops the ransomware from communicating with its command-and-control (C2) server and prevents lateral movement to other systems. The EDR agent has already flagged the file as suspicious, so the priority is containment, not further analysis or deletion, which could trigger the ransomware to encrypt data. Network isolation breaks the attack chain at the host level, buying time for forensic analysis and remediation.

Answer

Create a new firewall rule

Answer

Run a full antivirus scan

Answer

Delete the file

Question 2

A security analyst is creating a network baseline for normal traffic patterns. Which TWO metrics should be included to detect anomalies?

Accepted Answer

Average bandwidth usage per hour. Average bandwidth usage per hour is correct because it establishes a baseline of typical traffic volume over time, allowing the analyst to detect sudden spikes or drops that may indicate anomalies such as DDoS attacks or data exfiltration. Number of connections per host is correct because it provides a per-device baseline for connection counts, enabling detection of unusual behavior like port scans, botnet activity, or compromised hosts generating excessive outbound connections.

Answer

Geolocation of source IPs

Answer

MAC addresses of devices

Answer

CPU utilization of servers

Question 3

An attacker sends a fraudulent email that appears to come from the company's IT department, requesting that the recipient click a link and enter their login credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because the attacker uses a fraudulent email that impersonates a trusted entity (the IT department) to trick the recipient into clicking a malicious link and entering sensitive login credentials. Phishing is a broad category of social engineering that relies on deceptive electronic communications, typically email, to harvest credentials or deliver malware.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 4

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Accepted Answer

Frequent use of TXT record type in DNS queries. DNS tunneling often uses high query volumes, TXT records to encode data, and large response sizes.

Answer

DNS queries with TTL values greater than 86400

Answer

DNS queries for multiple well-known domains

Question 5

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 6

A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?

Accepted Answer

Constant bit rate and consistent packet size.. Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.

Answer

Random destination ports.

Answer

High number of small packets.

Answer

Low number of bytes per flow.

Question 7

Which compliance standard specifically applies to organizations that handle credit card information?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard for credit card data.

Answer

HIPAA

Answer

GDPR

Answer

ISO 27001

Question 8

An analyst observes an alert triggered by a single SYN packet to a closed port. The packet did not complete a TCP handshake. What type of attack does this most likely indicate?

Accepted Answer

SYN scan. A SYN scan sends SYN packets to target ports. If a RST is received, the port is closed. The incomplete handshake is characteristic of a SYN scan, not a full connection scan or DoS attack.

Answer

TCP connect scan

Answer

Ping sweep

Answer

UDP scan

Question 9

A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Reconnaissance. The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.

Answer

Weaponisation

Answer

Exploitation

Answer

Delivery

Question 10

Which organization facilitates threat intelligence sharing among members in a specific sector, such as finance or healthcare?

Accepted Answer

ISAC. ISACs (Information Sharing and Analysis Centers) are sector-specific threat intelligence sharing groups.

Answer

MISP

Answer

STIX

Answer

TAXII