200-201 Practice Exam 52 — 20 Questions

Question 1

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

Accepted Answer

Confidentiality, integrity, and availability (CIA). The organization's goal is to classify data based on sensitivity and impact if disclosed, which directly aligns with the confidentiality component of the CIA triad. Confidentiality ensures that sensitive information is accessed only by authorized individuals, and classification is the foundational step to enforce this principle. The CIA triad (Confidentiality, Integrity, Availability) is the core security model that governs how data is protected based on its value and risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Data loss prevention

Question 2

You are a security analyst for a mid-sized company with a flat network topology. The company uses a single firewall for internet access and has no internal segmentation. Recently, the IT team deployed a new file server running Windows Server 2019. The server was configured with default settings and placed in the same subnet as all user workstations. Two weeks later, the helpdesk receives multiple complaints about slow network performance. Upon investigation, you notice the file server's network interface is sending a high volume of broadcast traffic. Additionally, you find that the server's firewall is disabled and it is running an outdated SMBv1 protocol. The CEO is concerned about potential data loss and asks for immediate remediation. Which of the following is the most effective and immediate course of action to address the most critical security vulnerability?

Accepted Answer

Disable SMBv1 on the file server using PowerShell or Registry.. D is correct because the most critical security vulnerability is the outdated SMBv1 protocol, which is known to be exploited by ransomware like WannaCry and EternalBlue. Disabling SMBv1 immediately removes this attack vector, addressing the CEO's concern about potential data loss. While the broadcast traffic and disabled firewall are issues, SMBv1 poses a direct and severe risk to data integrity and confidentiality.

Answer

Enable the Windows Firewall on the file server and create rules to allow only essential traffic.

Answer

Configure the switch to block broadcast traffic on the file server's port.

Answer

Create VLANs to segment the file server from user workstations.

Question 3

A host-based analysis tool reports that a file has a digital signature that is valid but from an untrusted publisher. What should the analyst interpret from this?

Accepted Answer

The file may be malicious or legitimate; further analysis is needed. A valid digital signature confirms the file has not been tampered with since signing, but it does not guarantee the publisher is trustworthy. An untrusted publisher means the signing certificate is not in the system's trusted root store or has been flagged by a security policy, so the file could be either legitimate (e.g., from a new or self-signed publisher) or malicious (e.g., signed with a stolen certificate). Therefore, further analysis—such as checking the file's reputation, behavior, or origin—is required to determine its safety.

Answer

The file is definitely malicious because the publisher is untrusted

Answer

The file's signature was revoked

Answer

The file is definitely safe because the signature is valid

Question 4

A user reports receiving an email with an urgent request to click a link and reset a password. The email appears to come from the company's IT department but has slight spelling errors. Which type of attack is this?

Accepted Answer

Spear phishing. Spear phishing is a targeted phishing attack where the attacker customizes the email content for a specific individual or group, often using internal details (like the IT department) to increase credibility. The presence of slight spelling errors is a common indicator of a phishing attempt, but the targeted nature (appearing to come from the company's IT department) distinguishes this as spear phishing rather than generic phishing.

Answer

Phishing

Answer

Whaling

Answer

Vishing

Question 5

A security analyst is investigating a potential port scan. Which THREE patterns in NetFlow data would indicate a horizontal port scan?

Accepted Answer

Low number of packets per flow. A horizontal port scan targets the same port across multiple destination IPs. In NetFlow, each connection attempt typically involves a low number of packets (often just a SYN) because the scanner does not complete the TCP handshake. This pattern of low packet counts per flow is a strong indicator of scanning activity.

Answer

Multiple connection attempts from the same source IP to the same destination IP on different ports

Answer

Single source IP, multiple destination ports on one destination IP

Question 6

An analyst finds an unknown scheduled task on a Windows system that runs a PowerShell script at system startup. Which tool is best for examining the task's trigger and actions?

Accepted Answer

Task Scheduler. Task Scheduler (taskschd.msc) provides a GUI to view all scheduled tasks, their triggers, and actions.

Answer

Services.msc

Answer

Event Viewer

Answer

Registry Editor

Question 7

An analyst uses 'tshark -r capture.pcap -Y "http.request.method == POST"' to display only HTTP POST requests. This is an example of a:

Accepted Answer

Display filter. The `-Y` flag in tshark applies a display filter, which operates on packets already read from the capture file. Display filters use a syntax based on protocol fields (e.g., `http.request.method == POST`) to show or hide packets in the output without altering the underlying capture data. This is distinct from capture filters, which discard packets at the kernel level before they are stored.

Answer

Statistical filter

Answer

Read filter

Answer

Capture filter

Question 8

A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:

Accepted Answer

DNS tunnelling for exfiltration. DNS exfiltration encodes data in subdomain names to bypass security controls, as DNS is often allowed through firewalls.

Answer

Port scan via DNS

Answer

Normal DNS resolution

Answer

DGA-based C2

Question 9

An analyst is investigating a potential malware infection. Which TWO of the following are indicators of command and control (C2) communication?

Accepted Answer

DNS queries with long, random subdomains. Beaconing at regular intervals and DNS queries with encoded subdomains are classic C2 indicators.

Answer

Large file transfers to a peer host

Answer

SYN scans to multiple hosts

Answer

Regular HTTP requests to a known update server

Question 10

An analyst uses Wireshark to investigate a suspicious download. The TCP stream shows a GET request for a .exe file from an external IP, followed by a 200 OK response. The response contains the file but the last packet in the stream has a FIN flag set from the server. The client sends an ACK but then immediately sends a RST. What does this behavior suggest?

Accepted Answer

The client intentionally terminated the connection to evade detection. The client sending a RST immediately after acknowledging the FIN indicates an abnormal termination. In a normal TCP teardown, the client would send its own FIN to close the connection gracefully. The RST suggests the client application intentionally aborted the connection, which is a common evasion technique to avoid detection by network monitoring tools that may not fully process the RST.

Answer

The client application crashed after receiving the file

Answer

Normal completion of download

Answer

The server is performing a delayed response

Question 11

Which TWO components are essential in a well-written security policy?

Accepted Answer

Scope. A security policy must define its scope to specify which systems, users, and data are covered. Without a clear scope, the policy cannot be consistently applied, leading to gaps in enforcement. The scope ensures that all relevant assets are protected and that the policy's boundaries are understood by all stakeholders.

Answer

Cost estimates

Answer

Technology stack

Answer

Vendor names

Question 12

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

Accepted Answer

SMB. Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Answer

HTTPS

Answer

DNS

Answer

HTTP

Question 13

A security policy requires that all mobile devices connecting to corporate email must have a screen lock and be able to be remotely wiped. An employee's personal phone is lost. The employee reports the loss immediately. The phone is enrolled in MDM with remote wipe capability. However, the employee has not set a screen lock, violating policy. The phone contains synced email and contacts. What should the security team do?

Accepted Answer

Remotely wipe the phone immediately.. Remote wipe is the most critical action to protect corporate data. Option B is wrong because wiping should be done; Option C delays protection; Option D is impossible as the phone is lost.

Answer

Ask the employee to set a screen lock remotely.

Answer

Accept the risk since the phone is lost and wipe is possible.

Answer

Report the violation and suspend the employee's email access until compliance.

Question 14

Refer to the exhibit. What does this packet capture indicate?

Accepted Answer

Port scan. The packet capture shows multiple TCP SYN packets sent to a single host (10.10.10.10) targeting different ports (80, 443, 22, 21) with no subsequent ACK or RST responses. This pattern is characteristic of a port scan, specifically a SYN scan, where the attacker sends SYN packets to probe for open ports without completing the three-way handshake.

Answer

SYN flood

Answer

Session hijack

Answer

Normal HTTP traffic

Question 15

A company wants to ensure that employees report security incidents immediately. Which policy element is most important to include?

Accepted Answer

Define mandatory reporting procedures and contact information. The core purpose of an incident response policy is to ensure timely reporting. Without mandatory reporting procedures and clear contact information, employees may delay or fail to report security incidents, increasing dwell time and potential damage. This directly supports the incident response lifecycle (NIST SP 800-61) by establishing a clear chain of communication for initial detection and reporting.

Answer

Specify encryption standards for data at rest

Answer

List acceptable uses of company resources

Answer

Require complex passwords for all accounts

Question 16

A security analyst reviews logs and finds multiple failed login attempts from a single IP. This is indicative of what type of attack?

Accepted Answer

Brute-force. Multiple failed login attempts from a single IP address are characteristic of a brute-force attack, where an attacker systematically tries many passwords (or usernames) against a single account or service until successful. This pattern is distinct from other attack types because it involves repeated authentication attempts from one source, aiming to guess credentials rather than intercept traffic, deceive users, or overwhelm resources.

Answer

Man-in-the-middle

Answer

Phishing

Answer

DDoS

Question 17

Refer to the exhibit. A host-based analysis tool outputs a JSON report. Which persistence mechanism is being used?

Accepted Answer

Registry Run Key. The JSON report shows a registry key modification under `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`, which is a standard Registry Run Key. This key automatically launches the specified executable (`C:\Users\malware\app.exe`) at user logon, making it a persistence mechanism. The `"Value":"C:\Users\malware\app.exe"` confirms the payload path, and the key name `"MaliciousService"` is irrelevant to the actual mechanism.

Answer

Windows Service

Answer

Startup Folder

Answer

Scheduled Task

Question 18

Refer to the exhibit. What traffic is the router permitting?

Accepted Answer

SSH. The router is permitting SSH traffic because the access control list (ACL) matches TCP port 22, which is the default port for SSH. SSH provides encrypted remote administration, and the ACL entry permits inbound TCP connections to port 22, allowing secure shell access to the router.

Answer

Telnet

Answer

HTTP

Answer

FTP

Question 19

A security policy states that user activity logs must be retained for at least one year. What is the primary purpose of this requirement?

Accepted Answer

To support forensic investigations of security incidents. The primary purpose of retaining user activity logs for at least one year is to support forensic investigations of security incidents. When a breach or policy violation occurs, security analysts need historical log data to reconstruct the timeline of events, identify the initial compromise vector, and determine the scope of damage. Without long-term retention, critical evidence may be overwritten or purged before an incident is discovered, making root cause analysis impossible.

Answer

To improve system performance through log analysis

Answer

To comply with regulatory requirements only

Answer

To enable real-time monitoring of user behavior

Question 20

In the Cyber Kill Chain, which TWO phases occur after the attacker establishes command and control (C2)?

Accepted Answer

Lateral movement. After establishing command and control (C2), the attacker typically performs lateral movement to pivot within the network and then executes actions on objectives, such as data exfiltration or system disruption. In the Cyber Kill Chain, the phases following C2 are lateral movement and actions on objectives, as the attacker uses the C2 channel to explore the environment and achieve their end goal.

Answer

Exploitation

Answer

Weaponisation

Answer

Installation