200-201 Practice Test 50 — 15 Questions

Question 1

An analyst is reviewing a memory dump using Volatility. They want to identify processes with potential code injection. Which TWO Volatility plugins would be most appropriate for detecting injected code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dlllist. malfind scans for injected code by finding memory regions with suspicious permissions (e.g., RWX). dlllist lists loaded DLLs, and ldrmodules can find hidden or suspicious modules.

Answer

cmdline

Answer

netscan

Answer

pslist

Question 2

A network administrator is using Cisco ISE to monitor endpoint authentication. Which report provides details on failed authentication attempts and the reasons?

Accepted Answer

RADIUS Authentication Report. The RADIUS Authentication Report in Cisco ISE specifically logs all authentication attempts, including failures, and provides detailed reasons for each failure (e.g., invalid credentials, user not found, or authorization policy mismatch). This report is the primary tool for troubleshooting failed authentications because it captures the RADIUS Access-Reject messages and the corresponding failure reasons from the ISE policy evaluation.

Answer

Endpoint Profiler Report

Answer

RADIUS Accounting Report

Answer

Active Session Report

Question 3

During a security incident, an analyst uses Wireshark to examine a pcap. The TCP stream shows the string 'GET /malware.exe HTTP/1.1'. Which is the most likely type of attack?

Accepted Answer

Trojan download. The TCP stream shows an HTTP GET request for a file named 'malware.exe', which indicates the client is downloading an executable from a server. This is characteristic of a Trojan download attack, where a user is tricked into downloading and executing malicious software, often disguised as a legitimate file. The use of Wireshark to capture the HTTP request confirms the network-level activity of a file transfer, aligning with the Trojan's delivery mechanism.

Answer

Cross-site scripting

Answer

Directory traversal

Answer

SQL injection

Question 4

A company's security policy requires that all laptops accessing the corporate network must have full-disk encryption enabled. During a routine audit, an analyst discovers that a manager's laptop does not have encryption enabled. What is the most appropriate first step according to standard security incident response procedures?

Accepted Answer

Document the finding and escalate to the incident response team.. The first step in standard incident response procedures (as defined by NIST SP 800-61 and Cisco's IR framework) is to document the finding and escalate to the incident response team. This ensures that the potential policy violation is formally recorded and that trained responders can assess the risk, determine if sensitive data was exposed, and coordinate remediation without prematurely destroying evidence or causing operational disruption.

Answer

Disconnect the laptop from the network immediately.

Answer

Install encryption software on the laptop without notifying the user.

Answer

Wipe the laptop and reinstall the operating system.

Question 5

An analyst discovers that an employee has been using company-issued laptops to run a personal cryptocurrency mining software. Which policy violation has occurred?

Accepted Answer

Acceptable Use Policy. Cryptocurrency mining on company assets violates the Acceptable Use Policy (AUP), which governs the proper use of company resources. Option C is correct. Option A (Incident Response Policy) deals with responding to security incidents. Option B (Change Management Policy) controls changes to systems. Option D (Data Classification Policy) addresses how data is labeled and handled.

Answer

Incident Response Policy

Answer

Change Management Policy

Answer

Data classification policy

Question 6

What is the meaning of this syslog message?

Accepted Answer

A TCP connection from outside to inside was denied.. The syslog message indicates that a TCP connection attempt from an outside (lower-security) zone to an inside (higher-security) zone was denied by the ASA's implicit or explicit access control. By default, the Cisco ASA denies all inbound traffic from a lower security level to a higher security level unless explicitly permitted by an access-list applied to the interface. The message 'denied' confirms the packet was dropped, not allowed.

Answer

A TCP connection from inside to outside was denied.

Answer

The access group name is incorrect.

Answer

A TCP connection was allowed from inside to outside.

Question 7

During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?

Accepted Answer

Reconnaissance. The SYN scan is a reconnaissance technique used to identify open ports without completing the TCP handshake. The RST response indicates the port is closed, and the lack of ACK means the handshake was intentionally not completed, characteristic of a SYN scan.

Answer

Delivery

Answer

Weaponization

Answer

Exploitation

Question 8

A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?

Accepted Answer

Credential theft via phishing. Plaintext credentials in HTTP POST bodies indicate credential theft, possibly via phishing or a compromised web form.

Answer

Cross-site scripting (XSS)

Answer

Brute force attack

Answer

SQL injection

Question 9

During alert triage, an analyst determines that an alert fired but no actual attack or malicious activity occurred on the network. How should this alert be classified?

Accepted Answer

False positive. A false positive is an alert that triggers incorrectly when no real attack exists. True positive means attack confirmed, false negative means attack missed, true negative means no alert and no attack.

Answer

True negative

Answer

False negative

Answer

True positive

Question 10

In the MITRE ATT&CK framework, TTPs are mapped to:

Accepted Answer

Real-world threat groups. MITRE ATT&CK maps adversary tactics, techniques, and procedures to real-world threat groups.

Answer

Vulnerability databases

Answer

Compliance standards

Answer

Network protocols

Question 11

Which MITRE ATT&CK tactic corresponds to the Cyber Kill Chain phase 'Actions on Objectives'?

Accepted Answer

Impact. In MITRE ATT&CK, the tactic 'Impact' covers actions that disrupt or damage systems, similar to 'Actions on Objectives' where the attacker achieves their goal.

Answer

Privilege Escalation

Answer

Command and Control

Answer

Exfiltration

Question 12

An analyst observes repeated TCP SYN packets to various ports on a target IP with no SYN-ACK responses. What type of scan is most likely being performed?

Accepted Answer

SYN scan. A SYN scan sends SYN packets and observes responses; incomplete handshakes indicate scanning.

Answer

UDP scan

Answer

Ping sweep

Answer

TCP connect scan

Question 13

An organization is required to preserve data that may be relevant to a lawsuit. Which legal process is invoked to prevent destruction of this data?

Accepted Answer

Legal hold. A legal hold is issued to preserve data relevant to litigation.

Answer

E-discovery

Answer

Chain of custody

Answer

Data retention policy

Question 14

Which risk treatment option involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate means applying controls to reduce risk.

Answer

Avoid

Answer

Transfer

Answer

Accept

Question 15

A security team is implementing a remote access policy. Which TWO controls should be included to ensure secure remote access?

Accepted Answer

Multifactor authentication (MFA). MFA and VPN are standard controls for secure remote access.

Answer

Single sign-on (SSO)

Answer

Password expiration every 90 days

Answer

Guest network access