200-201 Practice Exam 53 — 20 Questions

Question 1

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing decisions that determine the best path for data packets across interconnected networks. Protocols such as OSPF, BGP, and ICMP operate at this layer to manage routing tables and forward packets between different subnets or autonomous systems.

Answer

Application layer

Answer

Data link layer

Answer

Transport layer

Question 2

During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?

Accepted Answer

Configure the firewall to queue logs locally and forward when connectivity is restored.. Configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.

Answer

Restart the SIEM collector service.

Answer

Manually monitor the firewall console.

Answer

Ignore the gap because logs are not critical.

Question 3

Which TWO actions are examples of false positive reduction techniques? (Choose two.)

Accepted Answer

Adding destination IP to whitelist. Adding a destination IP to a whitelist (option C) reduces false positives by excluding known benign traffic from triggering alerts. Increasing the signature threshold (option E) reduces false positives by requiring a higher number of matches or a larger event count before an alert is generated, filtering out low-level noise.

Answer

Changing signature action from drop to alert

Answer

Removing the sensor

Answer

Disabling all signatures

Question 4

A SIEM correlation rule triggers when it detects more than 10 failed login attempts from the same source IP within 1 minute. Which type of attack is this rule designed to detect?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated login attempts using many password guesses against a single account or a set of accounts. The SIEM rule correlates more than 10 failed login attempts from the same source IP within 1 minute, which is a classic signature of an automated password-guessing tool. This threshold-based detection is specifically designed to identify brute-force activity, not other attack types.

Answer

Port scan

Answer

DDoS attack

Answer

Privilege escalation

Question 5

An analyst is investigating a host that is suspected of being compromised. She runs the 'netstat -anb' command and sees an established connection to an unknown IP address on port 4444. The associated process is svchost.exe. Which conclusion is MOST appropriate?

Accepted Answer

The host may be infected with malware that is injecting code into svchost.exe.. Svchost.exe is a legitimate Windows service host process, but it is a common target for malware that uses process injection or DLL sideloading to hide malicious network activity. The established connection to an unknown IP on port 4444 (often associated with Metasploit or backdoor listeners) indicates the process may be hosting injected code, not that svchost.exe itself is inherently malicious. The analyst should investigate further before concluding compromise or taking action.

Answer

The host is definitely compromised because svchost.exe should not make outbound connections.

Answer

The analyst should immediately kill the svchost.exe process.

Answer

The connection is legitimate because svchost.exe is a critical Windows process.

Question 6

You are a security administrator for a company with 500 employees. The company uses a SIEM with basic correlation rules. Recently, the HR department reported that several employees received phishing emails with a link to a fake login page. The emails bypassed the spam filter. You want to detect if any employees clicked the link. You have access to web proxy logs, DNS logs, and endpoint antivirus logs. The phishing link is 'http://malicious-login.com/verify'. Which action should you take first to identify affected users?

Accepted Answer

Query the web proxy logs for HTTP requests containing the URL.. The web proxy logs record all HTTP requests made by clients, including the full URL path. Querying for 'http://malicious-login.com/verify' directly shows which employees clicked the link, because the proxy captures the exact destination and timestamp of each request. This is the most direct and reliable evidence of user interaction with the phishing link.

Answer

Run a vulnerability scan on all employee workstations.

Answer

Search DNS logs for queries to 'malicious-login.com'.

Answer

Search endpoint logs for any malware detections.

Question 7

Which TWO of the following are indicators of a network scan?

Accepted Answer

ICMP echo requests to multiple hosts. ICMP echo requests (ping sweeps) sent to multiple hosts are a classic reconnaissance technique used to identify live hosts on a network. This type of scan maps the network topology before launching further attacks, and it is a clear indicator of network scanning activity.

Answer

Single connection to a well-known port

Answer

DNS queries for many domains

Answer

Large number of SYN packets to a single port from multiple sources

Question 8

You are a SOC analyst at a mid-sized company. The company uses a SIEM that ingests logs from firewalls, IDS, and endpoints. Over the past week, you've noticed a gradual increase in outbound traffic from several internal hosts to IP addresses in a foreign country during non-business hours. The traffic is primarily on port 443. The IDS has not generated any alerts. The firewall logs show the connections are established. You check the endpoints and find no unusual processes running. However, the outbound connections persist. What is the most likely explanation and the best next step?

Accepted Answer

Enable SSL decryption on the firewall to inspect the traffic content.. The gradual increase in outbound traffic on port 443 (HTTPS) to foreign IPs during non-business hours, without IDS alerts or suspicious processes, strongly suggests data exfiltration over encrypted channels. Since the traffic is encrypted, the IDS cannot inspect the payload, and endpoint checks may miss stealthy malware that uses legitimate processes (e.g., svchost.exe) for beaconing. Enabling SSL decryption on the firewall allows the SOC to decrypt and inspect the HTTPS traffic, revealing the actual content and confirming or ruling out exfiltration.

Answer

Assume the hosts are compromised and reimage them.

Answer

Ignore the traffic since the IDS and endpoints show no signs of compromise.

Answer

Immediately isolate all affected hosts from the network.

Question 9

A security analyst is tuning a SIEM to detect lateral movement. Which THREE log sources would provide the most useful data for this purpose? (Choose THREE.)

Accepted Answer

Windows Event Logs showing network connections and process creation.. Lateral movement often involves internal network connections, authentication events, and endpoint logs. Firewall logs show internal connections, system logs show authentication, and Windows Event Logs track process creation and network connections.

Answer

Web server logs for external requests.

Answer

DNS logs for external domain queries.

Question 10

During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?

Accepted Answer

The scan sends SYN packets and, upon receiving SYN-ACK, sends RST packets.. A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.

Answer

The scan sends SYN packets and expects ICMP unreachable messages for open ports.

Answer

The scan sends SYN packets and waits for a timeout on closed ports.

Answer

The scan sends SYN packets and completes the three-way handshake for open ports.

Question 11

In Security Onion, an analyst runs 'squert' and sees a high number of alerts from a single source IP across multiple destination ports. What is the most likely cause?

Accepted Answer

Port scan. Squert is a web interface for Sguil in Security Onion that visualizes alert data from the intrusion detection system (IDS). A high number of alerts from a single source IP targeting multiple destination ports is a classic signature of a port scan, where the attacker probes a range of ports on one or more targets to discover open services. The IDS triggers multiple alerts because each probe (e.g., SYN packets to different ports) matches a detection rule, such as those for TCP SYN scans.

Answer

Denial of service

Answer

SQL injection

Answer

Phishing attack

Question 12

A security analyst needs to ensure that a message has not been tampered with during transit and that the sender cannot deny sending it. Which cryptographic method should be used?

Accepted Answer

Digital signature. A digital signature provides both integrity (ensuring the message has not been tampered with) and non-repudiation (preventing the sender from denying they sent it). It works by hashing the message and encrypting that hash with the sender's private key; the recipient verifies the signature using the sender's public key. This cryptographic method uniquely binds the sender to the message, unlike other options that only address one of these requirements.

Answer

Symmetric encryption

Answer

Hashing

Answer

Public key infrastructure (PKI)

Question 13

A company uses Microsoft Windows Event Logging for host monitoring. The security team receives an alert from a Windows 10 workstation 'WS-102' indicating multiple failed logon attempts (Event ID 4625) within a short period from an internal IP address 10.10.10.50, followed by a successful logon (Event ID 4624) for user 'jdoe'. Shortly after, Event ID 4688 (Process Creation) shows 'cmd.exe' started by 'explorer.exe' with a command line launching 'powershell.exe -EncodedCommand ...'. The encoded command decodes to a script that attempts to download a payload from a remote server. The analyst needs to determine the most effective immediate response to limit lateral movement and impact.

Accepted Answer

Immediately reset the password for user 'jdoe', block outbound traffic to the remote server at the firewall, and initiate an incident response process.. The sequence of events—brute-force logon attempts followed by a successful logon and then an encoded PowerShell command attempting to download a payload—indicates a confirmed compromise. Resetting the password for 'jdoe' immediately revokes the attacker's authenticated access, blocking outbound traffic to the remote server prevents the payload download and C2 communication, and initiating incident response ensures proper containment and investigation. This combination directly limits lateral movement by cutting off the attacker's credentials and network egress.

Answer

Restore WS-102 from a known good backup and ignore the alert as a false positive.

Answer

Run a full antivirus scan on WS-102 and isolate it.

Answer

Disable the user account 'jdoe' and investigate the source IP 10.10.10.50.

Question 14

An organization's security policy requires that all security incidents be reported within one hour of discovery. A junior analyst notices an unauthorized login attempt but is unsure if it qualifies as an incident. What should the analyst do first?

Accepted Answer

Report the suspicious activity immediately. Reporting suspicious activity immediately aligns with the policy, even if not confirmed. Waiting or deleting logs could violate reporting requirements.

Answer

Delete the logs to avoid false alarms

Answer

Wait until the incident is confirmed

Answer

Investigate on their own without reporting

Question 15

Refer to the exhibit. An analyst observes that the router's ACL is allowing all traffic to the web server at 192.168.1.100 on ports 80 and 443, but blocking all other TCP ports below 1024. However, the web server is also running an SSH service on port 22. What will happen to SSH traffic from the outside?

Accepted Answer

SSH will be denied because of the deny line range.. The ACL denies all TCP ports below 1024 except ports 80 and 443, which are explicitly permitted. Since SSH uses TCP port 22, which falls within the denied range (below 1024) and is not explicitly permitted, it is blocked by the deny line. The last line 'permit ip any any' only applies to traffic not already denied, but SSH traffic is already denied by the earlier rule, so it never reaches that permit statement.

Answer

SSH will be permitted because of the last line 'permit ip any any'.

Answer

SSH will be denied because the ACL does not have an explicit permit for SSH.

Answer

SSH will be permitted because it is not blocked by any rule.

Question 16

A security analyst is investigating a potential data breach. They need to preserve evidence for legal proceedings. Which action should the analyst take to ensure the integrity of the data?

Accepted Answer

Use a write blocker when creating a forensic image. Write-blocking ensures original data is not altered during forensic acquisition.

Answer

Run antivirus scans on the affected system

Answer

Delete suspicious files to contain the threat

Answer

Copy files to a network share without write protection

Question 17

Which OSI layer is targeted by a TCP SYN flood attack?

Accepted Answer

Layer 4 - Transport. A TCP SYN flood attack targets the Transport layer (Layer 4) because it exploits the TCP three-way handshake mechanism. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the server to allocate resources for half-open connections that never complete, exhausting its connection queue.

Answer

Layer 7 - Application

Answer

Layer 3 - Network

Answer

Layer 2 - Data Link

Question 18

A security analyst is reviewing logs to identify a potential brute force attack. Which TWO log entries would be most suspicious? (Choose TWO.)

Accepted Answer

Successful login from IP 10.0.0.9 after 50 failed attempts.. A successful login immediately following 50 failed attempts from the same IP is a classic indicator of a brute force attack that eventually succeeded. This pattern shows an attacker systematically trying credentials until one works, which is a high-severity security event requiring immediate investigation.

Answer

A single successful login from a known IP during business hours.

Answer

A failed login attempt from an external IP at 3:00 AM.

Answer

A user changing their password after a successful login.

Question 19

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

Accepted Answer

NetFlow records from the border router.. NetFlow records from the border router provide aggregated metadata (source/destination IP, port, protocol, timestamps) that can reveal the periodic 60-second beaconing pattern to the malicious domain and the volume of outbound connections on port 443. Unlike DNS logs, NetFlow captures the actual connection attempts regardless of DNS resolution, making it ideal for identifying regular, repetitive outbound flows.

Answer

DNS logs from the internal DNS server.

Answer

Full packet capture of all outbound traffic.

Answer

Host-based firewall logs.

Question 20

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been sent to an external IP address over port 443 during non-business hours. The company uses a proxy server that logs all outbound connections. Which action should the analyst take first to validate the suspicion?

Accepted Answer

Check the proxy logs to see the destination IP and user agent string.. Proxy logs contain the destination IP and user agent string, which are critical for validating whether the external IP is legitimate or malicious. By checking these logs first, the analyst can correlate the outbound connection with known threat intelligence or anomalous user agents without disrupting operations or consuming resources on unnecessary packet captures.

Answer

Immediately block the external IP address at the firewall.

Answer

Run a packet capture on the internal server to analyze the payload.

Answer

Notify the security team lead and wait for further instructions.