200-201 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. A security analyst observes a SIEM alert and a firewall log. The firewall allowed the traffic. According to the company's security policy, which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a firewall rule to block the source IP.. The firewall log shows the traffic was allowed, and the SIEM alert indicates a security event. According to the security policy, the immediate action is to block the source IP to prevent further potential malicious activity. Creating a firewall rule to block the source IP is a direct and effective response to mitigate the threat.

Answer

Check if the firewall blocked the traffic.

Answer

Investigate the user's recent activity.

Answer

Ignore the alert as it is a false positive.

Question 2

Refer to the exhibit. Which security protocol is being configured?

Accepted Answer

IPsec VPN (IKE phase 1). The exhibit shows the configuration of an IPsec VPN IKE phase 1 policy using the `crypto isakmp policy` command. The parameters set—encryption algorithm (e.g., aes), hash algorithm (e.g., sha), Diffie-Hellman group (e.g., 2), and authentication method (e.g., pre-share)—are all specific to IKE phase 1, which establishes a secure authenticated channel for further key exchange. This is not used for SSL VPN, MACsec, or SSH, as those protocols have distinct configuration syntax and purposes.

Answer

SSL VPN

Answer

MACsec

Answer

SSH

Question 3

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

Accepted Answer

The correlation rule threshold is set too high.. A SIEM correlation rule for brute-force attacks typically triggers when the number of failed login attempts from a single source exceeds a defined threshold within a specific time window. If the threshold is set too high, the rule will not fire even though failed logins are occurring, because the count never reaches the required value. This is the most direct and common cause for a correlation rule not triggering when expected.

Answer

The SIEM is receiving too many logs and dropping events.

Answer

The SIEM time zone is misconfigured.

Answer

The log source is not sending syslog data.

Question 4

An analyst is investigating a PCAP file and wants to reconstruct a conversation between two hosts. Which Wireshark filter would be most appropriate to follow the entire TCP stream?

Accepted Answer

tcp.stream eq 0. The 'tcp.stream' filter allows the analyst to follow and reconstruct the full TCP conversation.

Answer

dns.qry.name

Answer

ip.addr == 10.0.0.1

Answer

http.request

Question 5

Refer to the exhibit. An analyst runs tasklist /SVC on a suspected host. Which process is most suspicious?

Accepted Answer

notmalware.exe with PID 2300. 'notmalware.exe' is a deliberately suspicious process name that does not correspond to any legitimate Windows system binary. The tasklist /SVC command displays processes and their associated services; a process named 'notmalware.exe' is a clear indicator of potential malware attempting to disguise itself with an ironic name, whereas svchost.exe is a legitimate Windows host process for services.

Answer

svchost.exe with PID 1500

Answer

svchost.exe with PID 1240

Answer

svchost.exe with PID 1780

Question 6

An analyst captures traffic and sees a high number of DNS queries for random subdomains under a single domain, all returning NXDOMAIN. This pattern is typical of which malicious activity?

Accepted Answer

Domain generation algorithm (DGA) activity. D is correct because a high volume of DNS queries for random subdomains under a single domain, all returning NXDOMAIN, is a classic indicator of Domain Generation Algorithm (DGA) activity. Malware uses DGA to generate thousands of pseudo-random domain names to contact a command-and-control (C2) server; the NXDOMAIN responses indicate that the generated domains are not yet registered or have been sinkholed.

Answer

DNS cache poisoning

Answer

DNS amplification attack

Answer

DNS tunneling

Question 7

An organization uses Cisco Stealthwatch for network traffic analysis. The analyst observes a sudden increase in traffic from a workstation to multiple external IPs on port 443. The traffic pattern shows consistent packet sizes of 1500 bytes, and the destination IPs are spread across different geographic regions. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via HTTPS.. The consistent 1500-byte packet size indicates maximum-sized TCP segments, which is atypical for interactive web browsing but common when data is being padded to fill MTU for efficient exfiltration. Cisco Stealthwatch detects this anomalous volumetric pattern to external IPs on HTTPS (port 443) as a sign of data exfiltration, where an internal host sends large, uniform chunks of data to multiple external destinations to evade detection.

Answer

VoIP call initiation.

Answer

Normal web browsing activity.

Answer

A DDoS attack originating from the workstation.

Question 8

During a host-based analysis of a Windows system, an analyst finds a suspicious executable that runs every time the system boots. Which registry key is most commonly used for this type of persistence?

Accepted Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. The Run registry key under HKLM and HKCU is a common location for programs to automatically start at boot. Malicious software often adds entries here to achieve persistence.

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Image File Execution Options

Question 9

In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?

Accepted Answer

Reverse shell payload. Reverse shells create interactive shell sessions over a TCP connection, often used by attackers to control compromised hosts.

Answer

File transfer tool

Answer

Port scanner

Answer

SQL injection tool

Question 10

Which tool can be used to extract files from a PCAP file for further analysis?

Accepted Answer

Wireshark (Export Objects). Wireshark's 'Export Objects' feature allows you to extract files (e.g., HTTP objects, SMB files, or other application-layer payloads) from a PCAP file. This is essential for further analysis of malware or data exfiltration, as it reconstructs the original files from the captured network streams without needing to replay the traffic.

Answer

Snort

Answer

tcpdump

Answer

nmap

Question 11

During a forensic analysis, an analyst uses NetworkMiner to extract files from a PCAP. One of the extracted files contains a PE executable with a known signature of a malware variant. Which phase of the Cyber Kill Chain does the file transfer most likely represent?

Accepted Answer

Delivery. The file transfer from the PCAP represents the Delivery phase because NetworkMiner extracted a PE executable that was transmitted over the network, likely via HTTP, SMTP, or SMB. In the Cyber Kill Chain, Delivery is the phase where the weaponized payload is transmitted to the target system, which is exactly what a file transfer in a PCAP captures. The presence of a known malware signature confirms the payload was delivered, not yet executed or exploited.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 12

Which TWO of the following are best practices when configuring a SIEM correlation rule to detect lateral movement?

Accepted Answer

Include a time window to limit the correlation to a few minutes between events.. Including a time window (e.g., 5 minutes) in a SIEM correlation rule ensures that only events occurring within a short, defined interval are correlated. This is critical for detecting lateral movement, where an attacker must quickly pivot from one host to another; without a time window, the rule would match events that are too far apart in time, generating excessive false positives. The time window aligns with the typical speed of automated tools like PsExec or RDP brute-force scripts, which execute logons in rapid succession.

Answer

Exclude the source IP address from the correlation to focus on user identity.

Answer

Use only a single log source, such as domain controller logs, to simplify the rule.

Answer

Set the rule to trigger on any Event ID 4624 (successful logon) regardless of type.

Question 13

A mid-sized financial firm has a segmented network with a DMZ hosting a web server, an internal network with a database server, and an employee LAN. The security infrastructure includes a next-generation firewall (NGFW) with IPS, an endpoint detection and response (EDR) solution, and a SIEM. Over the past week, the SIEM has generated alerts for unusual outbound connections from the database server to an external IP address 198.51.100.33 on TCP port 443 during non-business hours. The EDR shows no malware on the database server, but a process named 'sqlsrv.exe' (the legitimate SQL Server process) is making these connections. The server's file integrity monitoring indicates that the sqlsrv.exe file has not been modified, but a memory dump reveals injected code that appears to be a reverse shell. The firewall logs show that the outbound connections are allowed because they match an existing rule permitting the database server to reach external update servers. The IP 198.51.100.33 is not on any threat intelligence feed as malicious, but it is geolocated to a country with known cybercrime activity. Which action should the security analyst take FIRST?

Accepted Answer

Isolate the database server from the network immediately to prevent data exfiltration.. The presence of injected reverse shell code in the memory of the legitimate sqlsrv.exe process indicates that the database server is actively compromised, regardless of the file integrity or EDR results. The immediate priority is to contain the threat by isolating the server from the network to prevent data exfiltration or lateral movement, as per incident response best practices (NIST SP 800-61).

Answer

Contact the software vendor to verify the digital signature of sqlsrv.exe.

Answer

Add a firewall rule to block outbound connections to 198.51.100.33.

Answer

Run a full antivirus scan on the database server using an updated signature database.

Question 14

A network administrator is implementing a new security policy that requires all employees to use multi-factor authentication (MFA) when accessing email from external networks. However, several employees report that they cannot receive SMS codes while traveling internationally. Which design change best balances security and usability?

Accepted Answer

Allow the use of authenticator apps that generate time-based one-time passwords (TOTP).. TOTP authenticator apps (e.g., Google Authenticator, Microsoft Authenticator) generate one-time passwords locally on the user's device without requiring cellular network connectivity. This solves the international SMS delivery problem while maintaining strong MFA security, as the TOTP algorithm (RFC 6238) uses a shared secret and the current time to produce codes that are valid for a short window (typically 30 seconds).

Answer

Allow email access without MFA from trusted countries.

Answer

Provide hardware tokens to all traveling employees.

Answer

Disable MFA for users who travel frequently.

Question 15

During alert triage, an analyst determines that an alert was triggered by legitimate administrative activity. How should this alert be classified?

Accepted Answer

False positive. A false positive is when an alert is triggered but no actual attack occurred.

Answer

True negative

Answer

False negative

Answer

True positive

Question 16

During a PCAP analysis, a security analyst notices an HTTP request with the URI parameter 'id=1 UNION SELECT username,password FROM users--'. What is the most likely attack being attempted?

Accepted Answer

SQL injection. The presence of UNION and SELECT keywords in a URL parameter indicates a SQL injection attempt, where the attacker tries to extract data from a database.

Answer

Command injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 17

A Windows system's security log shows Event ID 4720 followed by 4726 for the same username within minutes. What does this sequence indicate?

Accepted Answer

An account was created and then deleted, possibly for short-term unauthorized access.. Event 4720 is account creation, 4726 is deletion; rapid sequence suggests temporary account used for malicious activity.

Answer

A user changed their password.

Answer

The account was successfully logged on.

Answer

A group membership was changed.

Question 18

An organization's security policy defines acceptable use of corporate email. Which THREE of the following actions are typically prohibited?

Accepted Answer

Sending personal emails using the corporate account.. Corporate email accounts are company property intended for business use. Sending personal emails consumes company resources and can expose the organization to legal liability, data leakage, or productivity loss, which is why acceptable use policies (AUPs) typically prohibit this action.

Answer

Using email to subscribe to personal newsletters.

Answer

Emailing the IT support for assistance.

Question 19

A security analyst is asked to assess the risk of a new web application. The analyst calculates the likelihood of a SQL injection as 0.3 and the impact as $100,000. What is the annualized loss expectancy (ALE) if the asset value is $500,000 and the exposure factor is 0.2?

Accepted Answer

$30,000. The annualized loss expectancy (ALE) is calculated as ALE = SLE × ARO, where SLE = AV × EF. Here, AV = $500,000 and EF = 0.2, so SLE = $100,000. The likelihood of 0.3 represents the annualized rate of occurrence (ARO), so ALE = $100,000 × 0.3 = $30,000. Option D is correct because it correctly multiplies the single loss expectancy by the annualized rate of occurrence.

Answer

$100,000

Answer

$50,000

Answer

$15,000

Question 20

Which TWO of the following are best practices for configuring syslog to ensure reliable security event logging?

Accepted Answer

Use TCP (port 514) instead of UDP for log transmission.. Syslog over TCP (port 514) provides reliable, connection-oriented delivery, ensuring that log messages are not lost during transmission. Unlike UDP, TCP includes acknowledgment and retransmission mechanisms, which are critical for security event logging where message integrity and completeness are paramount.

Answer

Use UDP for faster transmission and lower overhead.

Answer

Enable debug-level logging for all devices to capture maximum detail.

Answer

Disable log filtering to ensure all messages are sent.