200-201 Practice Exam 54 — 20 Questions

Question 1

An analyst reviews Cisco ASA syslog messages and sees repeated entries with message ID 106023 denied inbound TCP from an external address to an internal web server on port 443. The web server is expected to receive inbound HTTPS traffic. What should the analyst investigate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whether the access control list is blocking legitimate inbound HTTPS. ASA syslog 106023 is generated when a packet is denied by an ACL. Because the internal web server is expected to accept inbound HTTPS, the repeated denials on port 443 point to an ACL that is preventing legitimate traffic. The analyst should inspect the interface ACL and object groups to confirm the web server's public address is permitted, treating this as an availability issue first.

Answer

Whether the ASA is failing over to the standby unit

Answer

Whether the external address is a known malicious scanner

Answer

Whether the web server has a valid TLS certificate installed

Question 2

A security analyst is examining a suspicious executable found on a compromised host. The analyst runs the command 'strings malware.exe' and sees the string 'cmd.exe /c net user hacker P@ssw0rd /add'. What is the most likely intent of this command?

Accepted Answer

Create a new user account named 'hacker' with a specified password.. The command 'net user hacker P@ssw0rd /add' is a classic Windows command to create a new local user account. The '/add' switch is the key indicator of account creation. This technique is often used by attackers for persistence, allowing them to regain access even if other malware is removed. The other options describe different actions that would require different syntax or switches.

Answer

Add the user 'hacker' to the local administrators group.

Answer

Modify the password of an existing user account named 'hacker'.

Answer

Delete the user account named 'hacker'.

Question 3

A SOC analyst is reviewing Cisco Firepower and NetFlow records for a suspected lateral movement campaign inside the corporate network. Which TWO monitoring observations most strongly support the hypothesis that an attacker is moving laterally using SMB? (Choose two.)

Accepted Answer

Repeated authentication attempts using a service account against multiple servers on port 445. SMB lateral movement is characterized by one host fanning out to many internal systems on port 445 and by credential reuse, such as a service account authenticating to multiple servers. These two observations together distinguish attacker pivoting from normal file share access, making them the strongest supporting evidence.

Answer

An internal host sending large volumes of ICMP echo requests to the default gateway

Answer

A single host resolving many external DNS names over port 53

Answer

A workstation downloading operating system updates from an internal WSUS server over HTTP

Question 4

A network security analyst is reviewing traffic logs and notices a series of connections from an internal host to a known command-and-control (C2) server. The connections occur every 5 minutes and are small in size. Which of the following is the MOST likely explanation for this traffic pattern?

Accepted Answer

The host is infected with malware that is beaconing to its C2 server.. Periodic connections to a known C2 server are a strong indicator of malware beaconing. Malware often uses beaconing to maintain communication with its controller, receiving commands and exfiltrating data. The regular interval and small payload size are typical to avoid detection. Other options describe benign or different malicious activities that do not match the scenario, especially the destination being a known C2 server.

Answer

The host is synchronizing time with an NTP server.

Answer

The host is running a legitimate software update service that checks for updates every 5 minutes.

Answer

The host is part of a botnet and is being used to scan other hosts.

Question 5

A security analyst is reviewing a packet capture in Wireshark and notices a series of DNS queries for randomly generated domain names such as 'a1b2c3d4e5.com', 'f6g7h8i9j0.net', and 'k1l2m3n4o5.org'. The queries are sent to multiple different DNS servers. Which type of malicious activity does this pattern most likely indicate?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2.. The pattern of numerous DNS queries for random-looking domain names across different TLDs is characteristic of a Domain Generation Algorithm (DGA). Malware uses DGAs to generate many potential C2 domains, making it difficult for defenders to block them all. The analyst should investigate the host making these queries for signs of infection. Other options like DNS tunneling, cache poisoning, or fast flux do not match the observed pattern of multiple random domains.

Answer

DNS tunneling for data exfiltration.

Answer

Fast flux DNS technique.

Answer

DNS cache poisoning attack.

Question 6

A SOC analyst is correlating multiple data sources after a suspected web application compromise on an internet-facing server. The analyst has access to web server logs, firewall logs, and endpoint detection and response (EDR) telemetry. Which TWO log sources or record types would most directly help identify the initial exploitation attempt and the subsequent post-exploitation activity? (Choose two.)

Accepted Answer

Web server access logs containing HTTP request methods, URIs, status codes, and user-agent strings. Web server access logs expose the initial malicious HTTP request and its parameters, while EDR process and command-line telemetry reveals the resulting execution on the host, such as spawned shells or web shell activity. Together they connect the attack vector to post-exploitation behavior. Firewall, DHCP, and interface statistics provide useful context but lack the application and endpoint detail required to attribute and reconstruct the intrusion.

Answer

DHCP lease logs from the corporate network

Answer

Firewall logs showing allowed and denied connections between the internet and the DMZ

Answer

Switch port mirroring statistics showing interface utilization

Question 7

An analyst is reviewing DNS logs and sees repeated queries from an internal workstation to randomly generated subdomains of a single domain, such as a1b2c3.example.com, d4e5f6.example.com, and so on. The responses are consistently NXDOMAIN. Which technique is most consistent with this pattern?

Accepted Answer

Domain generation algorithm (DGA) used by malware for command-and-control resolution.. Randomly generated subdomains under a single domain with mostly NXDOMAIN responses are a hallmark of a domain generation algorithm. Malware uses DGAs to evade static blocklists by cycling through many candidate C2 domains, and DNS logs are the primary place to detect this behavior.

Answer

Fast flux DNS used to rotate IP addresses for a botnet.

Answer

DNS cache poisoning attempt against the internal resolver.

Answer

DNS tunneling used to exfiltrate data through TXT record queries.

Question 8

A network security analyst is reviewing firewall logs and sees repeated denied inbound connection attempts from various external IP addresses to TCP port 3389 on several internal hosts. Which type of activity does this most likely represent?

Accepted Answer

A brute-force attack against Remote Desktop Protocol. Port 3389 is the default for Microsoft RDP. Multiple external IPs attempting to connect to this port on internal hosts, with the firewall denying the connections, is a classic sign of an RDP brute-force or scanning attack. Legitimate administrative sessions would come from trusted sources and likely succeed. DoS would involve higher volume from fewer sources, and database connections would use different ports. The correct answer is a brute-force attack against RDP.

Answer

A denial-of-service attack targeting the RDP service

Answer

A misconfigured application attempting to connect to a database

Answer

A legitimate remote administration session from an IT administrator

Question 9

An analyst is reviewing Cisco Firepower intrusion events and sees an alert for a TCP connection to an internal web server on port 80 with the rule message 'SERVER-WEBAPP Apache Struts2 remote code execution attempt'. The packet payload contains the string 'Content-Type: %{(#_='multipart/form-data')'. The server is running Apache Struts2 version 2.3.15. What should the analyst do next?

Accepted Answer

Check the web server logs and file system for signs of compromise, and verify whether the server was patched.. The alert shows a remote code execution attempt against a known vulnerable Apache Struts2 version. The analyst must verify whether the exploit succeeded by examining server logs, processes, and files. This is critical because the traffic reached the internal server, and the payload matches a known exploit. Proper incident response requires validation and scoping before containment.

Answer

Ignore the alert because the server is behind a firewall and the attack is not likely to succeed.

Answer

Block the source IP address at the firewall and consider the incident resolved.

Answer

Update the Snort signature to detect the specific payload string and wait for the next alert.

Question 10

A SOC analyst monitoring Cisco Stealthwatch Enterprise notices a host inside the network is receiving NetFlow records showing repeated inbound connections on TCP port 3389 from multiple external IP addresses over a short period. The host is a workstation, not a server. Which action should the analyst take first?

Accepted Answer

Investigate the workstation for signs of compromise and determine whether it is running an unauthorized RDP service.. Inbound RDP traffic to a workstation from multiple external sources is a strong indicator that the host may be compromised and running an unauthorized remote access service. The correct first step is to investigate the endpoint to confirm the compromise and gather evidence before taking containment actions. This aligns with the incident response process of identification and scoping before eradication.

Answer

Restart the workstation to terminate any active RDP sessions and clear potential malware from memory.

Answer

Block TCP port 3389 inbound on the perimeter firewall for all internal hosts.

Answer

Add the external IP addresses to the firewall blocklist and close the incident.

Question 11

A security analyst is examining a PCAP and observes a TCP stream where the client sends a single packet with the PSH, ACK flags set, and the server responds with a single packet with the RST, ACK flags set. The client then sends no further packets. What is the most likely explanation for this behavior?

Accepted Answer

The server is terminating the connection abruptly, possibly due to an application error or security policy.. The sequence of a client sending a PSH, ACK (data) followed by a server RST, ACK indicates that the server is abruptly terminating the connection. This can happen due to application errors, security policies, or misconfigurations. The client then ceases communication, which is typical after a reset. Other explanations like closed port, port scan, or packet loss do not align with the observed flags.

Answer

The client is performing a TCP port scan using a half-open scan.

Answer

The network is experiencing packet loss, causing the server to reset the connection.

Answer

The server rejected the connection attempt because the destination port is closed.

Question 12

A SOC analyst reviewing Cisco Firepower intrusion events notices that a single internal host generated hundreds of alerts for the same signature within a five-minute window, each with a different destination port on the same external IP. The analyst wants to reduce noise before escalating. Which action should the analyst take first?

Accepted Answer

Correlate the events by source IP and destination IP to determine whether this is a port sweep or a single exploit attempt.. When many alerts share a source and destination but vary in port, the analyst should correlate them to identify the pattern. Grouping by IP pairs reveals whether the activity is a port sweep, a multi-vector exploit, or benign scanning. This context is essential before deciding on containment or tuning.

Answer

Export the raw packet captures to a CSV file and archive them for compliance purposes.

Answer

Immediately block the internal host's IP address at the perimeter firewall to stop the activity.

Answer

Disable the signature that is generating the alerts because it is clearly producing false positives.

Question 13

A network analyst is examining a packet capture and notices a series of TCP packets where the client sends a SYN, the server responds with SYN-ACK, and the client never sends an ACK. The client repeats this for many destination ports on the same server. Which conclusion is most accurate?

Accepted Answer

The client is performing a TCP SYN scan to discover open ports on the server.. The pattern of SYN, SYN-ACK, and no ACK repeated across many ports is a TCP SYN scan. This technique, often called half-open scanning, allows an attacker to discover open ports without completing connections, making it harder to log on the target. It is a common reconnaissance method.

Answer

The client is using a legitimate application that only requires half-open connections.

Answer

The server is misconfigured and is dropping all incoming connections.

Answer

The client is experiencing network congestion causing packet loss of the final ACK.

Question 14

A SOC analyst is reviewing NetFlow records exported from a border router and notices a single internal host initiating outbound connections to more than 300 distinct external IP addresses on TCP port 443 within a five-minute window, with each flow carrying only a few hundred bytes. Which security monitoring conclusion is best supported by this evidence?

Accepted Answer

The host is likely performing a port scan or host sweep against external targets.. NetFlow captures metadata rather than payloads, but the metadata here is decisive: one internal host opening connections to hundreds of distinct external addresses on the same port with uniformly tiny byte counts is a host sweep. Beaconing would target few destinations; exfiltration would move large volumes to one destination; amplification would be inbound UDP. The fan-out pattern uniquely supports scanning activity.

Answer

The host is likely exfiltrating a large database to a single external cloud storage provider.

Answer

The host is likely the victim of a reflected DNS amplification attack.

Answer

The host is likely performing beaconing to a command-and-control server over HTTPS.

Question 15

A SOC analyst is reviewing NetFlow records exported from the border router. A single internal workstation is generating a steady stream of outbound sessions to dozens of unique external IP addresses on TCP port 443, each lasting only a few seconds, every day at 02:00. No corresponding firewall denies are logged. Which security monitoring conclusion is most appropriate?

Accepted Answer

The workstation is most likely beaconing to a command-and-control infrastructure and should be escalated for endpoint triage.. Periodic outbound sessions to many distinct external hosts on a single port, occurring at a fixed hour, match the behavioural profile of malware beaconing rather than normal user or update traffic. NetFlow alone cannot confirm payload, so the analyst should pivot to DNS and endpoint data, but the pattern itself justifies escalation as a suspected command-and-control channel.

Answer

The router is misconfigured and is exporting duplicate flow records, which inflates the session count.

Answer

This is expected behaviour for a patched workstation receiving software updates from a content delivery network.

Answer

The traffic is a port scan launched from the internet against the workstation and should be blocked inbound.

Question 16

A Cisco Firepower analyst notices repeated syslog messages from an ASA firewall showing TCP connections to 203.0.113.55:4444 that are reset immediately after the three-way handshake. The source hosts are internal workstations running an outdated browser plugin. Which security monitoring data source would best confirm whether these workstations established a command-and-control channel?

Accepted Answer

Endpoint process and network connection telemetry from the workstations. Confirming a command-and-control channel requires linking network activity to the responsible process on the host. Endpoint process and socket telemetry provides that link, showing the vulnerable browser plugin initiating connections to the external address. Flow, packet capture, and proxy logs can corroborate network behavior, but they lack process attribution and, for encrypted or direct traffic, may not reveal enough to confirm C2.

Answer

Full packet capture from the internal segment, analyzed in Wireshark

Answer

NetFlow records exported from the ASA to a collector

Answer

Proxy web logs recording HTTP CONNECT requests and user agents

Question 17

A junior analyst is asked to determine which log source would best reveal an attacker attempting to authenticate to a Windows file server with stolen credentials over the network. Which source should the analyst consult first?

Accepted Answer

Windows Security event log entries for logon events, including the logon type and source workstation fields.. Network authentication against a Windows file server is recorded in the Security log as logon events, which include the account, logon type, and originating address. Correlating successful and failed entries reveals password spraying, credential stuffing, or lateral movement with stolen credentials, making the Security log the correct first source for this question.

Answer

Application event log entries written by the installed line-of-business database engine.

Answer

Windows System event log entries generated by the Service Control Manager during service start and stop.

Answer

Windows Defender operational log entries recording scheduled scan completion status.

Question 18

An analyst is tuning a Cisco Firepower intrusion policy. A rule fires repeatedly with the message 'MALWARE-CNC Outbound connection to known malicious domain' against a marketing workstation. Packet capture shows the workstation resolving and connecting to a domain that the threat intelligence feed lists, but the endpoint shows no malicious process, no persistence, and the user states they clicked a link in a phishing email an hour earlier. Which action best reflects sound incident handling at this stage?

Accepted Answer

Treat the alert as a probable compromise: isolate the workstation, capture volatile data, and correlate the connection timing with the phishing email and any subsequent downloads.. Network evidence of a live connection to a threat-intelligence-listed domain, occurring shortly after a user clicked a phishing link, justifies treating the workstation as potentially compromised. Endpoint scans often miss fileless or in-memory activity, so a clean disk does not clear the host. The proportionate response is containment with evidence preservation, followed by correlation across email, DNS, proxy, and endpoint telemetry to establish scope and determine whether credentials or data were affected.

Answer

Suppress the rule permanently for the marketing subnet so analysts are not distracted by future alerts.

Answer

Close the ticket as a false positive because the endpoint security agent reported no malicious process on disk.

Answer

Block the domain at the DNS layer only and continue monitoring, since blocking prevents any further harm from the connection.

Question 19

An analyst is investigating a potential data exfiltration incident. The only available data is NetFlow records from Cisco routers. Which NetFlow field would be most useful to identify large outbound transfers to an unusual external host?

Accepted Answer

Destination IP address and byte count. NetFlow records capture metadata about flows, including source/destination IP, ports, protocol, and byte/packet counts. To detect large outbound transfers to an unusual external host, the analyst should focus on the destination IP address and the byte count. A high byte count from an internal host to an external IP that is not a known service indicates potential exfiltration. Other fields like source port, TCP flags, or interface information provide context but are not as directly useful for identifying data volume.

Answer

Input interface and output interface

Answer

Next-hop IP address and autonomous system number

Answer

Source port and TCP flags

Question 20

An analyst is reviewing a Windows event log and sees Event ID 4625 repeated many times for the same user account from different source workstations within a short period. Which activity does this most likely indicate?

Accepted Answer

A brute-force or password-spraying attack against the account. Repeated Windows Event ID 4625 entries for one account from multiple source workstations indicate many failed logon attempts, which is the signature of a brute-force or password-spraying attack. Legitimate causes such as expired passwords or stale cached credentials would not produce this volume or diversity of source hosts, so the activity should be investigated as a credential attack.

Answer

A successful privilege escalation by a domain administrator

Answer

A user account lockout due to a stale cached credential

Answer

Normal user behavior when a password has expired