200-201 Practice Exam 53 — 20 Questions

Question 1

A security analyst is reviewing an incident response policy that requires the team to preserve evidence for potential legal action. The analyst notices that the policy does not address how to handle evidence when a compromised system must be rebooted to restore services. What should the analyst recommend to balance evidence preservation with operational recovery?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture volatile memory and disk images before rebooting, and document the sequence of actions. When a compromised system must be rebooted, capturing volatile memory and disk images beforehand preserves evidence that would otherwise be lost. Documenting each action maintains chain of custody and supports legal admissibility. This balanced approach allows services to be restored without sacrificing the integrity of the investigation, addressing the gap in the current policy.

Answer

Shut down the system and store it in a secure room without further analysis

Answer

Continue running the compromised system indefinitely to observe attacker behavior

Answer

Reboot immediately to restore services and collect evidence afterward from backups

Question 2

A healthcare organization stores patient records and must comply with the HIPAA Security Rule. The CISO wants to document the types of safeguards that protect data through encryption, access controls, and audit logging. Which category of safeguards under the HIPAA Security Rule covers these controls?

Accepted Answer

Technical safeguards. The HIPAA Security Rule groups safeguards into administrative, physical, and technical categories. Encryption, access controls, and audit logging are technology-based protections applied to electronic protected health information, which places them squarely in the technical safeguards category. Administrative safeguards involve policies and workforce management, while physical safeguards involve facility and device protections, so neither fits the described controls.

Answer

Organizational requirements

Answer

Physical safeguards

Answer

Administrative safeguards

Question 3

A security administrator is configuring a firewall rule set to control traffic between the corporate network and the internet. The policy states that only web browsing (HTTP and HTTPS) should be allowed outbound, and all other outbound traffic should be denied. Which type of security control is this an example of?

Accepted Answer

Preventive control. The firewall rule set is a preventive control because it enforces the policy by blocking all outbound traffic except HTTP and HTTPS before it can leave the network. Preventive controls are proactive measures that stop unwanted actions. Detective controls identify events, corrective controls remediate after incidents, and compensating controls are alternatives when primary controls are not feasible.

Answer

Detective control

Answer

Compensating control

Answer

Corrective control

Question 4

A security manager is developing a business continuity plan (BCP) for a critical e-commerce application. The application has a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The manager must choose a backup strategy that meets these objectives. Which strategy is most appropriate?

Accepted Answer

Continuous data replication to a hot site with automated failover.. The RTO of 4 hours requires recovery within that time, and the RPO of 15 minutes requires minimal data loss. Continuous replication to a hot site with automated failover can achieve both by keeping data synchronized and enabling rapid switchover. Other strategies like nightly, weekly, or daily backups introduce too much data loss and longer recovery times, failing to meet the objectives.

Answer

Weekly incremental backups to a warm site with manual failover.

Answer

Daily differential backups to a cold site with tape restoration.

Answer

Nightly full backups stored offsite with manual restore.

Question 5

A SOC analyst is investigating a potential security incident involving a Windows workstation. The analyst has collected network traffic and host logs. Which two artifacts would provide the most direct evidence of a Pass-the-Hash attack? (Choose two.)

Accepted Answer

Network traffic showing SMB authentication with NTLMSSP messages containing a username and hash.. Pass-the-Hash is an attack where an adversary uses the NTLM hash of a user's password to authenticate without knowing the plaintext. The most direct evidence comes from authentication events that show NTLM usage, such as Windows Security Event ID 4624 with Logon Type 3 and NTLM, and network captures of SMB NTLMSSP authentication. Other events like process creation or privilege assignment are not specific to this technique.

Answer

Windows Security Event ID 4688 showing 'svchost.exe' with parent 'services.exe'.

Answer

Windows Security Event ID 4672 indicating special privileges assigned to a new logon.

Answer

Windows Security Event ID 4768 showing a Kerberos TGT request.

Question 6

A Cisco CyberOps analyst is reviewing a network security monitoring console and must determine which TWO data sources are most useful for detecting lateral movement by an attacker who has already compromised a workstation. (Choose two.)

Accepted Answer

Windows Security event logs collected through Cisco SecureX. Lateral movement is characterized by internal authentication attempts and internal connection fan-out. Windows Security event logs capture logon types and account usage across hosts, while NetFlow from Stealthwatch exposes the internal connection patterns to administrative ports and multiple targets. Together they correlate identity and network behavior to trace an attacker's path. External-focused sources such as DNS, email, and web proxy logs are less relevant once the attacker is moving inside the environment.

Answer

Email gateway logs from Cisco Email Security Appliance

Answer

Web proxy logs from Cisco Web Security Appliance

Answer

DNS query logs from Cisco Umbrella

Question 7

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The analyst finds that a marketing team has stored a file containing customer credit card numbers on a shared drive accessible to all employees. The analyst must recommend the appropriate classification and handling for this file. What should the analyst recommend?

Accepted Answer

Classify as Restricted, encrypt the file, and limit access to authorized personnel only.. Customer credit card numbers are highly sensitive and regulated by PCI DSS. They should be classified as Restricted, the highest level in the policy, requiring encryption and strict access controls. Leaving them on a shared drive accessible to all employees is a serious violation. The analyst should recommend reclassification and secure handling to prevent data breaches and regulatory penalties.

Answer

Classify as Public, because the customers consented to sharing their data.

Answer

Classify as Internal, because it is used by the marketing team for business purposes.

Answer

Classify as Confidential, apply password protection, and leave on the shared drive.

Question 8

A security analyst is tasked with developing a data loss prevention (DLP) strategy for the organization. The strategy must align with the CyberOps Associate curriculum and address both endpoint and network-based data exfiltration. Which two actions should the analyst include in the strategy? (Choose two.)

Accepted Answer

Deploy network DLP solutions to inspect outbound traffic for sensitive data patterns and block unauthorized transfers.. The two actions to include are endpoint DLP and network DLP. Endpoint DLP controls data transfers at the device level, such as to USB drives or cloud services, while network DLP inspects outbound traffic for sensitive data. Together, they provide comprehensive coverage for data exfiltration across both endpoints and the network. These technical controls directly address the requirement to monitor and prevent unauthorized data transfers, aligning with the CyberOps Associate curriculum's focus on data protection.

Answer

Implement role-based access control (RBAC) to limit access to sensitive data.

Answer

Configure full-disk encryption on all endpoints to prevent data loss if a device is stolen.

Answer

Establish a security awareness program to educate employees about data handling policies.

Question 9

A financial services firm must retain security audit logs for a period specified by its regulator and be able to produce them during an examination. Which action BEST ensures the logs remain trustworthy and available for that purpose?

Accepted Answer

Forward logs to a centralized, access-controlled repository with integrity protection. Centralizing logs in an access-controlled repository with integrity protections ensures they survive host compromise or failure and can be trusted during a regulatory examination. Retention enforcement and restricted access are as important as collection, because examiners expect complete, unaltered records that can be produced on demand.

Answer

Increase the local log file size limit so events are overwritten less frequently

Answer

Compress logs and email them weekly to the security team's distribution list

Answer

Store logs only on the originating server with local administrator access

Question 10

A company's security policy requires that privileged accounts use multi-factor authentication for all administrative access. An auditor finds that a database administrator logs in with a username and password only, then uses a shared service account with a static password for automation. Which policy violation represents the greater risk to the organization?

Accepted Answer

The use of a shared service account with a static password. Shared static credentials used for automation create privileged access that cannot be attributed to a person, is seldom rotated, and is often embedded in scripts where it can be harvested. If exposed, the attacker gains persistent administrative access without MFA and without accountability, complicating containment and forensics. A named administrator missing MFA is serious but remains traceable and revocable, so the shared service account poses the greater organizational risk.

Answer

The database administrator's lack of MFA on administrative login

Answer

The absence of a password vault for the administrator

Answer

The failure to log administrative database sessions

Question 11

A security team wants to adopt a framework that provides a common language for describing cyberthreats, including tactics, techniques, and procedures observed in real intrusions. Which framework should the team use to map adversary behavior?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the framework that catalogs real-world adversary tactics and techniques, giving defenders a shared vocabulary for describing intrusions. Teams use it to map detections to techniques, identify coverage gaps, and communicate findings consistently. Governance standards and vulnerability scoring systems serve different purposes and do not describe adversary behavior.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

CVSS

Question 12

An analyst is investigating a potential security incident and reviews the Cisco ASA firewall logs. The logs show the following entry: 'Deny tcp src outside:203.0.113.5/443 dst inside:10.1.1.10/3389'. Which of the following does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal host on RDP, but the connection was blocked by the firewall.. The Cisco ASA log entry shows a denied TCP connection from an external IP address to an internal IP address on port 3389, which is the default port for RDP. The 'Deny' action indicates the firewall blocked the attempt. This is a common scenario where an external host tries to exploit RDP, but the firewall prevents it. Understanding log format, including source/destination and port numbers, is essential for incident analysis.

Answer

An external host successfully connected to an internal host on RDP.

Answer

An internal host attempted to connect to an external host on RDP, but the connection was blocked.

Answer

An internal host attempted to connect to an external host on HTTPS, but the connection was blocked.

Question 13

A security analyst is reviewing the organization's password policy, which currently requires a minimum of eight characters with complexity but no expiration. After a recent audit finding, management wants to align with modern best practices. Which change should the analyst recommend?

Accepted Answer

Increase the minimum length to 14 characters and remove forced periodic expiration. Modern password guidance recommends longer minimum lengths, such as 14 characters, and discourages forced periodic expiration unless compromise is suspected. Longer passwords increase the effort required for brute-force attacks, while removing arbitrary expiration reduces predictable user behavior. This combination addresses the audit finding by aligning the policy with current best practices.

Answer

Allow users to choose any password of any length as long as it contains a special character

Answer

Reduce the minimum length to six characters and require changes every 30 days

Answer

Require passwords to be changed every 60 days and prohibit reuse of the last 24 passwords

Question 14

A SOC analyst notices that a workstation is generating NetFlow records showing repeated outbound connections to 203.0.113.45 on port 443 at regular 60-second intervals, with each flow transferring approximately 4 KB. The destination IP has no reputation data. Which analysis approach would best determine whether this traffic represents C2 beaconing?

Accepted Answer

Correlate the flow timestamps with DNS query logs and endpoint process telemetry to identify the initiating process and any associated domain resolutions.. The regular 60-second interval and small, consistent transfers are classic beaconing indicators. NetFlow shows the pattern but not the cause. Correlating flow timestamps with DNS logs and endpoint process telemetry identifies the initiating process and any resolved domains, providing definitive evidence of C2 and enabling proper containment.

Answer

Block all outbound traffic to 203.0.113.45 at the perimeter firewall and monitor for any user complaints about lost connectivity.

Answer

Run a full antivirus scan on the workstation and review the scan results for any detected malware signatures.

Answer

Increase the NetFlow sampling rate on the router to capture every packet and then analyze the payload contents for malicious strings.

Question 15

A Cisco Firepower analyst inspects an inline intrusion policy event where the packet was dropped but only a partial payload was captured. The analyst wants to confirm whether the attack was successful on the target host. Which data source should be correlated with the Firepower event?

Accepted Answer

Endpoint security product telemetry from the target host. When an intrusion event shows a partial payload capture, the network sensor can confirm the attempt but not the outcome on the host. Endpoint telemetry supplies process, file, and registry evidence that ties the network event to actual execution. Correlating the Firepower timestamp and addresses with endpoint records determines whether the attack succeeded, which is the analyst's stated goal.

Answer

NetFlow records exported from the Firepower device

Answer

Syslog messages generated by the Firepower management center

Answer

Full packet capture stored on the Firepower device

Question 16

A security analyst is reviewing the organization's incident response plan and notices that the 'Lessons Learned' phase is scheduled only after major incidents. The analyst recommends that this phase be conducted after all incidents, regardless of severity. What is the primary benefit of this recommendation?

Accepted Answer

It helps identify minor issues that could be precursors to major incidents.. The primary benefit of conducting lessons learned after every incident is to identify minor issues that could be early indicators of larger problems. This practice enables continuous improvement and helps prevent minor incidents from escalating. It does not directly reduce containment time, ensure regulatory reporting, or replace the need for an incident response plan.

Answer

It ensures that all incidents are reported to regulatory authorities.

Answer

It eliminates the need for a formal incident response plan.

Answer

It reduces the time required for the containment phase of future incidents.

Question 17

A security analyst is examining a suspicious executable and wants to extract readable strings to identify potential C2 domains or file paths. The analyst has the file on a Windows workstation and needs to use a built-in or commonly available tool. Which approach is most appropriate?

Accepted Answer

Use the Windows Command Prompt to run 'strings.exe' if Sysinternals Suite is installed, then search the output for domain-like patterns.. Sysinternals strings.exe is a standard, reliable tool for extracting ASCII and Unicode strings from binaries on Windows. It allows analysts to quickly identify potential C2 domains, file paths, and other indicators without requiring a full disassembler. Searching the output for domain-like patterns is an efficient triage step.

Answer

Open the file in Notepad and visually scan for readable text that resembles domain names.

Answer

Rename the file extension to .txt and open it in a web browser to view the text.

Answer

Use the 'type' command in Command Prompt to display the file contents and pipe to 'findstr' for domain patterns.

Question 18

A security manager is drafting a data classification policy and wants to ensure handling requirements are applied consistently. Which TWO elements should the policy define for each classification level? (Choose two.)

Accepted Answer

Labeling conventions and handling rules for storage, transmission, and disposal. An effective classification policy defines both how data at each level is labeled and handled, and who is accountable for it. Labeling and handling rules make the classification operational, while owner, custodian, and user responsibilities make it enforceable. Product selections, recovery objectives, and user rosters belong in supporting documents rather than the classification policy itself.

Answer

The maximum acceptable recovery time for each business application

Answer

A list of every employee authorized to access each data repository

Answer

The specific vendor products approved for encrypting each data type

Question 19

A SOC analyst is investigating a Windows workstation that has been exhibiting unusual outbound connections. Reviewing Sysmon Event ID 3 (Network Connection) logs, the analyst notices a process named svchost.exe with a parent process of cmd.exe initiating connections to an external IP on port 4444. On a healthy system, svchost.exe is normally spawned by services.exe. Which conclusion is most strongly supported by these log entries?

Accepted Answer

Malware is masquerading as svchost.exe to blend in while communicating with a command-and-control server. The strongest conclusion is process masquerading for command-and-control. Legitimate svchost.exe always has services.exe as its parent, so a cmd.exe parent reveals either a renamed malicious executable or code injected into a spawned process. Combined with an outbound connection to port 4444, a well-known reverse-shell and C2 port, the analyst should treat the host as compromised and begin containment and forensic triage.

Answer

A legitimate Windows service is making routine update connections

Answer

A scheduled task is running a legitimate administrative script

Answer

The system is experiencing a memory corruption issue causing process misattribution

Question 20

A threat hunter reviews Cisco Umbrella DNS logs and notices repeated queries for randomly generated subdomains under a single parent domain, each resolved by a different authoritative name server. The hunter suspects DNS tunneling. Which additional artifact would most directly confirm command-and-control activity rather than legitimate DNS behavior?

Accepted Answer

TXT record responses containing long base64-encoded strings. DNS tunneling moves data inside DNS queries and responses, most commonly using TXT records because they support larger payloads. Long base64-encoded strings in TXT responses, paired with random subdomains and rotating authoritative servers, show that the DNS channel is carrying encoded command-and-control or exfiltration data. This artifact distinguishes malicious tunneling from ordinary DNS resolution patterns.

Answer

High volume of A records with short TTL values

Answer

NXDOMAIN responses for nonexistent subdomains

Answer

Queries originating from multiple internal VLANs