200-201 Practice Questions 2 — 50 Questions

Question 1

An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood attack. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting resources. The lack of SYN-ACK replies indicates the target is overwhelmed.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

ICMP flood attack

Question 2

Based on the exhibit, what is the most likely conclusion about the host's security state?

Accepted Answer

The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.. The exhibit shows svchost.exe listening on UDP port 4444, which is abnormal because svchost.exe typically hosts Windows services over TCP or named pipes, not raw UDP. Additionally, an established TCP connection to 203.0.113.5 with cmd.exe as the associated process indicates an active command shell session, which is a classic sign of a backdoor. Therefore, option D is correct. Option A is incorrect because UDP port 4444 is not a standard Windows service port. Option B is incorrect because there is no direct evidence of data exfiltration; the connection is consistent with a remote shell. Option C is incorrect because legitimate remote admin tools do not typically use svchost.exe on UDP port 4444 with cmd.exe.

Answer

The svchost.exe process on UDP port 4444 indicates a Windows service that should be monitored.

Answer

The established TCP connection to 203.0.113.5 indicates data exfiltration to a known malicious IP.

Answer

The host is running a legitimate remote administration tool on port 4444.

Question 3

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

Accepted Answer

The internal host attempted to access a secure web server but was blocked.. The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.

Answer

The connection was successfully encrypted.

Answer

The firewall allowed the connection.

Answer

The external host attempted to access the internal host.

Question 4

Which THREE factors should be considered when tuning an IPS signature? (Choose three.)

Accepted Answer

Application protocol. Application protocol (B) is critical because IPS signatures are protocol-aware and must match the specific protocol context (e.g., HTTP, SMTP, DNS) to avoid false positives. Tuning based on the protocol ensures the signature only inspects traffic where the vulnerability or exploit is relevant, such as applying a SQL injection signature only to HTTP traffic.

Answer

Time of day

Answer

Packet length

Question 5

An analyst examines a PCAP file and sees a series of HTTP POST requests to an external server with Base64-encoded payloads in the request body. The payloads decode to small text strings. Which type of data exfiltration technique is being used?

Accepted Answer

HTTP data exfiltration. The analyst observes HTTP POST requests carrying Base64-encoded payloads in the request body that decode to small text strings. This is a classic indicator of HTTP data exfiltration, where sensitive data is encoded and sent over HTTP to an external server, bypassing security controls by blending with normal web traffic.

Answer

Session hijacking

Answer

DNS exfiltration

Answer

HTTP tunneling

Question 6

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

Accepted Answer

Remove the USB drive and use a different approved method of file transfer.. The security policy mandates scanning all external media before use. Because the USB drive has hardware write-protect, the antivirus scan cannot complete. Therefore, the employee should not use this USB drive and should instead use an alternative approved method (e.g., network share, email, or cloud storage) to transfer the file. This ensures compliance with the policy. Option A is incorrect because manually checking file extensions does not replace a proper malware scan. Option C is incorrect because disabling write protection may compromise security and the scan still might not be reliable. Option D is incorrect because bypassing the scan violates the policy.

Answer

Manually check each file for suspicious extensions.

Answer

Disable write protection and rescan.

Answer

Proceed with the file transfer since the scan failed due to hardware issue.

Question 7

Which security policy defines acceptable use of an organization's IT resources, including internet browsing and email?

Accepted Answer

Acceptable Use Policy (AUP). AUP specifies what is acceptable and unacceptable use of IT resources.

Answer

Password Policy

Answer

Information Security Policy

Answer

Remote Access Policy

Question 8

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Accepted Answer

The process path is in the Downloads folder.. The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Answer

The user is 'jsmith'.

Answer

The parent process is explorer.exe.

Answer

The event type is 'Process Creation'.

Question 9

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 10

Which THREE of the following are indicators that a network may be compromised by a botnet?

Accepted Answer

Unusual outbound traffic to known command-and-control servers.. Botnet-infected systems typically communicate with command-and-control (C2) servers to receive instructions or exfiltrate data. Unusual outbound traffic to known C2 IPs or domains is a strong indicator of botnet activity, as legitimate traffic rarely targets these addresses. Security monitoring tools often use threat intelligence feeds to flag such connections.

Answer

High volume of ICMP echo requests.

Answer

Increase in legitimate business traffic.

Question 11

A security policy requires that all endpoints have host-based firewalls enabled. A user reports that an application stopped working after a recent update. What should the analyst do?

Accepted Answer

Create an exception rule for the application.. Creating an exception maintains firewall policy while allowing the app. Option A violates policy. Option C may revert security patches. Options D and E are less direct.

Answer

Escalate to the application vendor.

Answer

Roll back the update.

Answer

Disable the host firewall for that user.

Answer

Reinstall the application.

Question 12

A SOC analyst receives an alert from the SIEM indicating a high number of outbound DNS queries from an internal host to a domain known for malicious activity. The analyst reviews the logs and finds that the host is a DNS server. What should be the analyst's first action?

Accepted Answer

Isolate the DNS server from the network and escalate to incident response.. The correct first action is to isolate the DNS server from the network and escalate to incident response. A DNS server generating outbound DNS queries to a known malicious domain indicates a likely compromise (e.g., DNS tunneling or malware command-and-control), not normal recursive resolution. Immediate containment prevents further data exfiltration or lateral movement, aligning with incident response best practices.

Answer

Check the baseline of DNS traffic to confirm it is anomalous.

Answer

Block the domain at the firewall and close the alert.

Answer

Restart the DNS service on the server and monitor.

Question 13

A security analyst notices repeated failed login attempts from a single IP address against multiple user accounts. What is the best immediate action to take?

Accepted Answer

Block the source IP address on the firewall.. Blocking the source IP address on the firewall is the best immediate action because it stops the ongoing brute-force attack at the network perimeter, preventing further authentication attempts from that IP without disrupting legitimate users. This aligns with the principle of containment before investigation, as the firewall ACL can be updated quickly to deny traffic from the offending source.

Answer

Increase logging verbosity for the authentication server.

Answer

Change all user passwords immediately.

Answer

Disable the affected user accounts.

Question 14

During memory analysis with Volatility, the 'cmdline' plugin shows a process with no command-line arguments. Which plugin could help recover the original command line if it was truncated or hidden?

Accepted Answer

cmdscan. The 'cmdscan' plugin scans the memory for command-line history that might not be captured by cmdline. It can recover previously typed commands.

Answer

consoles

Answer

malfind

Answer

dlllist

Question 15

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 16

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 17

A security analyst is reviewing firewall logs and notices a rule that denies traffic from source IP 10.0.0.5 to destination port 3389. What service is being blocked?

Accepted Answer

RDP. Port 3389 is the default port for Remote Desktop Protocol (RDP), which is used for remote graphical desktop access to Windows systems. The firewall rule denying traffic from 10.0.0.5 to this port blocks RDP connections, preventing that host from initiating remote desktop sessions.

Answer

SNMP

Answer

SMTP

Answer

SSH

Question 18

A security administrator needs to ensure that data transmitted between a web browser and a web server is encrypted. Which technology should be implemented?

Accepted Answer

TLS. TLS (Transport Layer Security) is the correct technology because it operates at the transport layer and provides encryption for data in transit between a web browser and a web server. HTTPS is not a separate encryption protocol but rather HTTP over TLS, meaning TLS is the underlying technology that actually performs the encryption. Therefore, the question asks for the technology to implement, and TLS is the direct answer.

Answer

HTTPS

Answer

SSH

Answer

IPsec

Question 19

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

Accepted Answer

NetFlow records from the router. NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Answer

SNMP traps from routers

Answer

Syslog from the DHCP server

Answer

Firewall deny logs

Question 20

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service