200-201 Practice Exam 51 — 20 Questions

Question 1

A security policy requires that employees use strong passwords. Which TWO of the following are characteristics of a strong password? (Select two.)

Accepted Answer

Uses a mix of uppercase, lowercase, numbers, and special characters. Option A is correct because a strong password uses complexity — a mix of uppercase letters, lowercase letters, digits, and special characters — which increases the search space and makes brute-force and dictionary attacks far less likely to succeed. Option E is correct because length is a primary strength factor; a minimum of at least 8 characters provides enough entropy to resist rapid guessing, and longer passwords are even stronger. Option B does not belong because a 90-day rotation schedule is a password-expiration/aging policy, not an inherent characteristic of the password's strength itself, and frequent forced changes can even lead to weaker, predictable patterns. Option C is wrong because a common dictionary word is trivially defeated by dictionary and hybrid attacks. Option D is wrong because including the username makes the password guessable and violates the principle of not deriving credentials from publicly known identifiers.

Answer

Is changed every 90 days

Answer

Is a common dictionary word

Answer

Contains the user's username

Question 2

A company wants to ensure that employees report security incidents immediately. Which policy element is most important to include?

Accepted Answer

Define mandatory reporting procedures and contact information. The core purpose of an incident response policy is to ensure timely reporting. Without mandatory reporting procedures and clear contact information, employees may delay or fail to report security incidents, increasing dwell time and potential damage. This directly supports the incident response lifecycle (NIST SP 800-61) by establishing a clear chain of communication for initial detection and reporting.

Answer

Specify encryption standards for data at rest

Answer

List acceptable uses of company resources

Answer

Require complex passwords for all accounts

Question 3

A network engineer sees the following event in the firewall logs: 'STATUS: intrusion prevented, action: drop, signature: "SQL Injection - SELECT"' on traffic from internal IP to a web server. What type of attack was detected?

Accepted Answer

SQL injection. The log entry explicitly states 'SQL Injection - SELECT' as the signature, which directly identifies the attack as SQL injection. The firewall detected a malicious SQL query (e.g., a SELECT statement with crafted input) in the traffic from an internal IP to a web server and dropped it, preventing the attack. SQL injection exploits improper input validation in web applications to manipulate backend databases.

Answer

Command injection

Answer

Buffer overflow

Answer

Cross-site scripting

Question 4

An organization's security policy states that all external connections must be authenticated using multi-factor authentication. Which type of policy is this?

Accepted Answer

Remote Access Policy. A Remote Access Policy specifically governs how external users or devices connect to an internal network, and requiring multi-factor authentication (MFA) for all external connections is a standard control within this policy. This policy defines authentication methods, encryption standards (e.g., IPsec, TLS), and access controls for remote access, directly addressing the security policy's mandate for MFA on external connections.

Answer

Password Policy

Answer

Data Classification Policy

Answer

Acceptable Use Policy

Question 5

An organization has implemented a new password policy requiring 12-character passwords with complexity. Which risk treatment option is this an example of?

Accepted Answer

Risk mitigation. Implementing controls to reduce risk is mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 6

Which TWO of the following are functions of a SIEM system in security monitoring?

Accepted Answer

Correlation rule engine. A SIEM (Security Information and Event Management) system is built around collecting and consolidating log and event data from many sources, so option D, log aggregation and normalization, is correct: the SIEM ingests logs via agents, syslog, or APIs and parses them into a common schema so disparate formats can be searched and analyzed together. Option B, correlation rule engine, is also correct because the SIEM applies correlation rules and logic (e.g., matching multiple events across sources within a time window) to detect patterns, generate alerts, and support incident detection beyond what individual devices report. The other options do not belong: packet capture and analysis (A) is the role of tools such as Wireshark, tcpdump, or NDR/IDS sensors, not the core SIEM function; firewall rule management (C) is performed on firewalls or via firewall management platforms; and vulnerability scanning (E) is done by dedicated scanners like Nessus, Qualys, or OpenVAS, which may feed findings into a SIEM but are not SIEM functions themselves.

Answer

Packet capture and analysis

Answer

Firewall rule management

Answer

Vulnerability scanning

Question 7

Refer to the exhibit. A firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. What type of activity is indicated?

Accepted Answer

Port scanning. The firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. This sequential pattern of connection attempts to multiple ports on the same target is a classic indicator of a port scan, where an attacker probes for open ports to identify potential services to exploit. The firewall's deny action confirms the traffic was blocked, but the behavior itself is characteristic of reconnaissance activity, specifically a TCP connect scan.

Answer

Worm propagation

Answer

Denial of service

Answer

Data exfiltration

Question 8

An analyst is investigating a host that is suspected of being compromised. She runs the 'netstat -anb' command and sees an established connection to an unknown IP address on port 4444. The associated process is svchost.exe. Which conclusion is MOST appropriate?

Accepted Answer

The host may be infected with malware that is injecting code into svchost.exe.. Svchost.exe is a legitimate Windows service host process, but it is a common target for malware that uses process injection or DLL sideloading to hide malicious network activity. The established connection to an unknown IP on port 4444 (often associated with Metasploit or backdoor listeners) indicates the process may be hosting injected code, not that svchost.exe itself is inherently malicious. The analyst should investigate further before concluding compromise or taking action.

Answer

The host is definitely compromised because svchost.exe should not make outbound connections.

Answer

The analyst should immediately kill the svchost.exe process.

Answer

The connection is legitimate because svchost.exe is a critical Windows process.

Question 9

A SIEM correlation rule is configured to alert when there are 10 failed login attempts from the same source IP within 1 minute. An analyst receives an alert for source IP 10.0.0.5. Which type of attack is most likely being detected?

Accepted Answer

Brute force attack. A brute force attack involves repeatedly attempting to guess login credentials, often from a single source IP, which matches the pattern of 10 failed login attempts within 1 minute. This is a classic indicator of a brute force attack, where an attacker tries multiple username/password combinations rapidly.

Answer

Man-in-the-middle attack

Answer

DDoS attack

Answer

SQL injection attempt

Question 10

To protect sensitive data at rest, a company uses AES-256 encryption. This primarily ensures which security goal?

Accepted Answer

Confidentiality. AES-256 encryption transforms plaintext data into ciphertext using a 256-bit symmetric key, rendering it unreadable without the correct decryption key. This directly ensures confidentiality by preventing unauthorized access to the stored data, even if the storage medium is compromised.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 11

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Answer

DNS amplification

Answer

ARP poisoning

Answer

SYN flood

Question 12

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

Accepted Answer

Isolate the workstation by disconnecting it from the network immediately.. The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Answer

Block the external IP address on the firewall and continue monitoring.

Answer

Run a full forensic analysis on the workstation without disconnecting it.

Answer

Update the antivirus signatures and run a full scan on the workstation.

Question 13

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

Accepted Answer

Authentication. Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Answer

Accounting

Answer

Auditing

Answer

Authorization

Question 14

An analyst examines a PCAP file and sees a series of HTTP POST requests to an external server with Base64-encoded payloads in the request body. The payloads decode to small text strings. Which type of data exfiltration technique is being used?

Accepted Answer

HTTP data exfiltration. The analyst observes HTTP POST requests carrying Base64-encoded payloads in the request body that decode to small text strings. This is a classic indicator of HTTP data exfiltration, where sensitive data is encoded and sent over HTTP to an external server, bypassing security controls by blending with normal web traffic.

Answer

Session hijacking

Answer

DNS exfiltration

Answer

HTTP tunneling

Question 15

An analyst is reviewing a network intrusion alert and sees a large number of ICMP echo requests sent from a single external IP to multiple internal hosts. The ICMP payloads are identical and the requests are sent in rapid succession. Which type of activity does this most likely represent?

Accepted Answer

ICMP ping sweep for host discovery. The rapid succession of identical ICMP echo requests to multiple internal hosts is a classic ping sweep, used to discover live hosts on a network. Attackers often perform ping sweeps during reconnaissance to map the network before launching further attacks. The identical payloads and multiple targets distinguish it from a denial-of-service flood or tunneling.

Answer

Smurf attack amplification

Answer

ICMP flood denial-of-service attack

Answer

ICMP tunneling for data exfiltration

Question 16

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident

Question 17

An analyst is triaging an alert generated by Cisco Secure Network Analytics (Stealthwatch) showing a host inside the network communicating with a known command-and-control IP. The analyst wants to determine whether the communication has already resulted in data theft. Which additional telemetry source would provide the most direct evidence of successful exfiltration?

Accepted Answer

NetFlow records showing outbound byte volume from the internal host to the C2 address.. Confirming exfiltration requires evidence of data actually leaving the network. NetFlow byte counters toward the command-and-control address provide that measurement directly and can be compared against the host's normal egress baseline. Signature updates, DHCP leases, and authentication events are useful for context and attribution but cannot quantify outbound transfer volume, so they do not answer whether theft occurred.

Answer

DHCP lease logs showing the internal host renewed its IP address.

Answer

Authentication logs showing the user logged into the host via RDP.

Answer

Syslog entries from the host's antivirus agent showing a signature update occurred.

Question 18

A SOC analyst reviewing a packet capture notices that a single internal host has initiated hundreds of short-lived TCP sessions to the same external web server over the past hour, and every session completed a full three-way handshake before being torn down with FIN/ACK. No single session transferred more than a few kilobytes. Which traffic characteristic should the analyst use to classify this activity?

Accepted Answer

Possible beaconing or automated application behavior, because repeated uniform short sessions at regular volume suggest periodic callbacks.. Repeated short TCP sessions with complete handshakes and consistent small payloads point to periodic automated communication such as malware beaconing, not resource-exhaustion attacks or scanning. A SYN flood and slowloris both leave connections incomplete by design, while a port scan varies destination ports and usually never completes a session. The distinguishing evidence is the uniform, repeating, fully established flow pattern.

Answer

A TCP SYN flood, because many connection attempts were made to one destination in a short period.

Answer

A slowloris-style denial of service, because each session stayed open for a short time.

Answer

A port scan, because the host contacted the same server repeatedly.

Question 19

During incident response, an analyst is collecting volatile evidence from a compromised Linux server that is still running. The team wants to preserve the current state of active network connections and running processes before any remediation. Which action best preserves this volatile data in a forensically sound manner?

Accepted Answer

Capture live network connection and process information to external media before remediation.. Order of volatility requires collecting the most perishable evidence first. On a live Linux server, active network connections, running processes, and memory contents will change or vanish quickly, so they must be documented and copied to external media before any disk imaging or remediation. Powering off, imaging disk first, or running scanners all destroy or alter this volatile state.

Answer

Immediately power off the server to freeze memory contents for later analysis.

Answer

Run the antivirus scanner included with the distribution to quarantine malicious files.

Answer

Create a full disk image of the server before collecting any memory-resident data.

Question 20

A security analyst is reviewing NetFlow records exported from a Cisco router at the internet edge. During a suspected ransomware staging window, a single internal host shows a sustained outbound flow to one external IP on TCP 443 with 4.2 GB transferred over 40 minutes, while the host's normal baseline for that destination is under 5 MB per day. No corresponding proxy log entry exists for this session. Which conclusion is best supported by these records?

Accepted Answer

The records indicate probable data exfiltration or bulk upload over TLS, because the volume and duration are anomalous for that host and bypass the monitored proxy.. NetFlow provides metadata such as byte counts, duration, ports, and endpoints without payload. When one host suddenly sends gigabytes to a single external address far above its baseline and no proxy record exists, the strongest supported hypothesis is bulk outbound transfer, consistent with exfiltration or staged upload. The absence of proxy inspection suggests the session avoided the monitored path, reinforcing the need to escalate and correlate with endpoint and DNS telemetry.

Answer

The flow confirms a denial-of-service attack because large outbound transfers consume bandwidth and degrade availability.

Answer

The flow is normal because TCP 443 is reserved for HTTPS and traffic on that port is always legitimate business use.

Answer

The flow represents encrypted command-and-control beaconing because beaconing is identified by high byte volume on port 443.