200-201 Practice Exam 51 — 20 Questions

Question 1

During an incident investigation, the IR team collects evidence from a compromised server. The evidence must be admissible in court. Which documentation is essential to maintain the chain of custody?

Accepted Answer

A log of who accessed the evidence and when. Chain of custody documentation includes detailed logs of evidence handling, including who collected it and when.

Answer

The CVSS score of the vulnerability

Answer

A copy of the incident response plan

Answer

The organization's acceptable use policy

Question 2

A financial institution is evaluating risk treatment options for a newly identified vulnerability in its online banking platform. The vulnerability has a high likelihood of exploitation but low business impact. Which risk treatment option is most appropriate?

Accepted Answer

Mitigate. Mitigate is appropriate when risk is high likelihood but low impact; controls can reduce likelihood further.

Answer

Transfer

Answer

Accept

Answer

Avoid

Question 3

Which TWO roles are typically responsible for making decisions regarding business impact and external communication during an incident? (Select two.)

Accepted Answer

PR. CISO decides on business impact; PR handles external communication.

Answer

Legal counsel

Answer

Incident handler

Answer

HR

Question 4

A SOC Tier 2 analyst is investigating an alert that was escalated by Tier 1. The analyst needs to perform deeper correlation and malware analysis. Which of the following actions is most appropriate for Tier 2?

Accepted Answer

Analyze the malware sample in a sandbox and correlate with other indicators.. Tier 2 analysts perform deeper investigation, correlation, and malware analysis.

Answer

Conduct threat hunting to proactively search for threats.

Answer

Develop new detection rules for the SIEM.

Answer

Perform initial triage and basic investigation.

Question 5

During a security incident involving an insider threat, which TWO roles are most likely to be directly involved in the response?

Accepted Answer

Legal counsel. HR handles personnel issues, and legal counsel handles legal aspects like termination and potential charges.

Answer

SOC Tier 1 analyst

Answer

PR

Answer

External auditor

Question 6

Which risk treatment option involves taking actions to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate means implementing controls to reduce risk.

Answer

Accept

Answer

Transfer

Answer

Avoid

Question 7

A SOC analyst at Tier 1 receives an alert for a known malware signature. After initial investigation, the analyst finds that the alert is a false positive caused by an outdated signature. What should the analyst do next?

Accepted Answer

Close the alert and document the finding. Tier 1 analysts handle basic investigation and can close false positives. Updating signatures is outside their scope.

Answer

Escalate the alert to Tier 2 for further analysis

Answer

Update the signature database on the security tools

Answer

Initiate the containment process

Question 8

In the context of risk management, which THREE are valid risk treatment options?

Accepted Answer

Mitigate. The four risk treatment options are accept, avoid, transfer, and mitigate. Monitor is not a treatment option; it is part of ongoing management.

Answer

Monitor

Answer

Ignore

Question 9

An organization is reviewing its risk management process and identifies a risk with a high probability and high impact. Management decides to stop the activity causing the risk. Which risk treatment option is being applied?

Accepted Answer

Risk avoidance. Avoidance means eliminating the risk by discontinuing the activity.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 10

During the Containment, Eradication, and Recovery phase, which TWO actions are typically performed? (Select two.)

Accepted Answer

Evidence collection. Short-term containment (e.g., isolating systems) and evidence collection are key activities in this phase.

Answer

Lessons learned analysis

Answer

Initial triage

Answer

Identifying the incident

Question 11

A security analyst is evaluating risks and calculates that a threat has a likelihood of 0.5 and an impact of $200,000. What is the risk value?

Accepted Answer

$100,000. The risk value is calculated by multiplying the likelihood (0.5) by the impact ($200,000), resulting in $100,000. This is the standard quantitative risk analysis formula used in security assessments to prioritize threats.

Answer

$50,000

Answer

$400,000

Answer

$200,000

Question 12

A network security monitoring analyst is analyzing firewall logs and sees the following traffic: Source IP 10.1.1.50 to Destination IP 203.0.113.5 on port 443, protocol TCP, with a large amount of data transferred in both directions during business hours. The analyst suspects data exfiltration. Which TWO additional indicators would most strongly support this suspicion? (Choose two.)

Accepted Answer

The traffic uses TLS encryption with a self-signed certificate.. A self-signed TLS certificate is often used by attackers to encrypt exfiltrated data without the overhead of obtaining a legitimate certificate from a trusted CA. Legitimate services typically use certificates signed by a recognized CA, so a self-signed certificate in traffic to an external IP on port 443 is a strong indicator of malicious activity, especially when combined with large data transfers.

Answer

The destination IP belongs to a cloud storage provider commonly used for backups.

Answer

The data transfer rate is consistently high for several hours.

Answer

The destination port is used by a well-known web service.

Question 13

Which TWO incident types must be reported within 1 hour under the company's incident response policy?

Accepted Answer

Unauthorized access. Unauthorized access is a security incident that directly compromises the confidentiality, integrity, or availability of systems or data. Under most incident response policies, including those aligned with NIST SP 800-61, any confirmed unauthorized access must be reported within 1 hour to initiate containment and prevent lateral movement or data exfiltration.

Answer

Phishing simulation failure

Answer

Spam campaign

Answer

Policy violation

Question 14

A SOC analyst is reviewing alerts from a network-based intrusion detection system (NIDS). An alert indicates a potential SQL injection attempt, but the destination server is a web application that accepts SQL queries as part of its normal function. What should the analyst do?

Accepted Answer

Correlate with web server logs to determine if the request was malicious.. The NIDS alert alone cannot confirm malicious intent when the destination server legitimately accepts SQL queries. Correlating with web server logs allows the analyst to examine the full HTTP request (e.g., parameters, payload, referrer) to distinguish between a benign feature usage and an actual SQL injection attack, such as detecting unexpected SQL keywords or syntax in input fields that should not contain them.

Answer

Disable the alert to reduce noise.

Answer

Tune the NIDS signature to ignore that server.

Answer

Immediately block the source IP.

Question 15

A SOC analyst reviews a firewall log with the following entry: action=deny, source IP=192.168.1.100, destination IP=10.0.0.1, destination port=22. The analyst knows that 10.0.0.1 is an SSH server. What does this log entry indicate?

Accepted Answer

An attempted SSH connection that was blocked by the firewall. The log entry shows 'action=deny', which explicitly indicates the firewall blocked the packet. Since destination port 22 is the default port for SSH, this log entry represents an attempted SSH connection from 192.168.1.100 to 10.0.0.1 that was denied by the firewall. The analyst's knowledge that 10.0.0.1 is an SSH server confirms the nature of the traffic.

Answer

A DNS query resolved to 10.0.0.1

Answer

A successful SSH connection from 192.168.1.100 to 10.0.0.1

Answer

A misconfigured firewall allowing SSH traffic

Question 16

Which two pieces of evidence are strong indicators of compromise (IOC) in network traffic?

Accepted Answer

Communication with a known malicious IP address. Communication with a known malicious IP address is a strong indicator of compromise because it directly suggests the host is interacting with a command-and-control (C2) server or a malware distribution point. Threat intelligence feeds and blocklists (e.g., AlienVault OTX, MISP) provide curated lists of known malicious IPs; matching traffic to these lists provides high-fidelity evidence of an active compromise.

Answer

Regular DNS queries to corporate DNS servers

Answer

Normal SMTP traffic to internal mail server

Answer

Standard HTTP traffic to a known content delivery network

Question 17

A security analyst is implementing multifactor authentication. Which TWO are considered factors? (Select two.)

Accepted Answer

Password. A password is a knowledge factor (something you know), which is one of the three primary categories of authentication factors. Multifactor authentication requires combining two or more distinct factors, and a password satisfies the 'something you know' requirement. Without a password, the authentication process would lack the knowledge-based element needed for multifactor verification.

Answer

Last login time

Answer

User ID

Answer

Security group membership

Question 18

A security analyst notices a sudden spike in NetFlow data from a single workstation to multiple external IP addresses on port 443. What is the most likely explanation for this traffic pattern?

Accepted Answer

Potential data exfiltration. A single workstation sending a sudden spike of NetFlow data to multiple external IP addresses on port 443 (HTTPS) is a classic indicator of data exfiltration. Attackers often encrypt stolen data in HTTPS tunnels to evade detection, and the abrupt increase in outbound connections to many distinct external hosts is not typical of normal user behavior. NetFlow records showing a high volume of flows from one source to many destinations on the same port strongly suggest an automated process, such as a data theft tool, rather than legitimate traffic.

Answer

Internal network scanning

Answer

Normal web browsing activity

Answer

A scheduled software update

Question 19

A small retail company has a security policy that requires all point-of-sale (POS) systems to be isolated on a separate network segment with strict firewall rules. During a network audit, you discover that the POS system is connected to the same network as the office workstations, violating policy. The store manager says it was done for convenience because the network cable was too short. What is the best course of action?

Accepted Answer

Move the POS system to the correct network segment immediately and report the violation.. Immediate remediation and reporting is required to address the security policy violation. Option A is incorrect because risk acceptance should be a formal process, not a casual decision based on convenience. Option B is incorrect because a software firewall does not provide the same level of isolation as a separate network segment and may not comply with policy. Option C is incorrect because it only addresses the symptom (cable length) but does not address the violation; the POS system must be moved to the correct segment.

Answer

Accept the risk because it's a small store.

Answer

Implement a software firewall on the POS system to compensate.

Answer

Purchase a longer cable and reconnect the POS to the correct segment.

Question 20

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

Accepted Answer

The monitor session source interface is incorrectly specified.. The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.

Answer

The IDS is in a different subnet.

Answer

The SPAN destination interface is not connected to the IDS.

Answer

The server is using VLAN tagging.