200-201 Practice Exam 55 — 20 Questions

Question 1

A SOC analyst is reviewing firewall logs and sees repeated outbound connections from an internal server to an external IP on TCP port 443, but the traffic is not TLS. Packet capture shows a custom binary protocol with periodic small keepalives. Which type of malicious activity is most consistent with these findings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Command-and-control beaconing over a non-standard protocol. The combination of outbound port 443, absence of TLS, a custom binary protocol, and periodic small keepalives strongly suggests command-and-control beaconing. Attackers commonly use port 443 to blend with normal web traffic while evading TLS inspection by not actually using TLS. The regular check-ins are designed to receive instructions or exfiltrate small amounts of data without drawing attention.

Answer

A misconfigured application using HTTPS on port 443

Answer

Data exfiltration over DNS

Answer

Lateral movement using SMB

Question 2

A threat hunter reviews Cisco Stealthwatch flow data and sees an internal server sending periodic 300-byte outbound flows to an external IP every 60 seconds, with consistent packet sizes and no matching inbound response beyond TCP acknowledgments. The server's DNS queries for that IP resolve through a newly registered domain. Which monitoring approach best characterizes this activity as beaconing rather than normal application traffic?

Accepted Answer

Analyze flow periodicity and packet-size consistency over time. Beaconing is a behavioral pattern characterized by regular connection intervals and consistent payload sizes, often with minimal server response. Flow telemetry preserves the timing and byte counts needed to detect that cadence, so periodicity and size consistency analysis is the right approach. Volume ranking, blocklist matching, and patch verification do not evaluate the temporal pattern that separates automated C2 from normal traffic.

Answer

Compare the flow's byte count against the organization's top-talkers report

Answer

Check whether the destination IP appears on a threat intelligence blocklist

Answer

Verify that the server's operating system is fully patched and current

Question 3

A SOC receives a threat intelligence feed indicating that a specific SHA-256 hash belongs to a trojan. An analyst searches the endpoint telemetry and finds no process with that hash, but the file name appears in several temporary directories. Which explanation best accounts for this result?

Accepted Answer

The malware mutates or is repacked on each execution, so the file content and therefore the hash differ while the name persists.. A SHA-256 value identifies exact file content, so the same malware name appearing with different bytes yields different hashes. Repacking, encryption, or packing layers can change content on every campaign or execution. The analyst should pivot from static hash matching to behavioural and name-based hunting, then capture a live sample to confirm the current variant.

Answer

The endpoint agent is not collecting file metadata, so hash matching cannot be performed.

Answer

The endpoint is using a different hash algorithm, so SHA-256 values cannot be compared.

Answer

The threat feed is stale and the hash was retired by the vendor before the analyst searched.

Question 4

A SOC analyst is reviewing a PCAP captured at the network perimeter. The analyst notices that a single internal host sends a series of ICMP echo requests to multiple external hosts, but the ICMP payload size is unusually large (over 1000 bytes) and the payload contains non-ASCII, high-entropy data. The echo replies from the external hosts are also large and contain similar data. Which type of activity is most likely occurring?

Accepted Answer

ICMP tunneling. The correct answer is ICMP tunneling because the traffic pattern shows large, high-entropy payloads in both ICMP echo requests and replies, which is a known method for covert data exfiltration or command-and-control. Normal ICMP traffic uses small, predictable payloads. The other options describe denial-of-service or routing manipulation attacks that do not match the observed bidirectional data exchange.

Answer

ICMP redirect attack

Answer

Ping flood

Answer

Smurf attack

Question 5

A security analyst notices that an internal web server is receiving HTTP requests where the User-Agent string is identical across thousands of requests originating from a single external IP address, and each request targets a different URL path on the server. The requests occur at a rate of several hundred per second. Which activity does this pattern most likely represent?

Accepted Answer

Automated directory brute-forcing or content discovery. The pattern of one external IP sending hundreds of requests per second to many different URL paths with a constant User-Agent is a classic signature of automated content discovery and directory brute-forcing. These tools enumerate paths to uncover hidden resources. Legitimate crawlers rate-limit and identify themselves, while CSRF and response splitting involve different traffic characteristics.

Answer

Web content scraping by a search engine crawler

Answer

Cross-site request forgery against authenticated users

Answer

HTTP response splitting attack

Question 6

A SOC analyst is tuning Cisco Firepower intrusion policies and reviewing alert metadata to prioritize response. Which TWO alert attributes most directly indicate that a detected event represents a successful compromise rather than a blocked attempt? (Choose two.)

Accepted Answer

Subsequent correlated events show the target initiating outbound connections to a known C2 server. Successful compromise is indicated by evidence that the target was actually affected, not merely targeted. An impact flag of Vulnerable shows the host matched the exploit's affected configuration, and later outbound connections to known C2 infrastructure demonstrate post-exploitation control. Blocked actions, severity levels, and traffic direction describe the attempt or its potential, but not confirmed success.

Answer

The alert action is recorded as 'Blocked'

Answer

The rule's signature is classified with a high severity level

Answer

The event's source is an external IP and the destination is an internal server

Question 7

An analyst examines a PCAP and observes that an internal host sends an ICMP echo request containing a payload of 1200 bytes, followed by an ICMP echo reply from an external host with a payload of 1500 bytes. The payload data does not match standard ping patterns and appears to contain encoded file fragments. Which technique is most consistent with this observation?

Accepted Answer

ICMP tunneling for data exfiltration. Oversized ICMP echo packets carrying encoded, non-standard payloads in both directions strongly indicate ICMP tunneling, a common method for covert data transfer and exfiltration. Because many networks permit ping for troubleshooting, attackers abuse it to move data past controls that do not inspect ICMP payloads. The other options describe different ICMP-based behaviors that do not involve encoded data in echo payloads.

Answer

Smurf attack amplification

Answer

Path MTU discovery using oversized ICMP

Answer

ICMP redirect manipulation

Question 8

An analyst examining a PCAP sees an internal host sending ICMP echo requests where the payload length is consistently 1,100 bytes and the payload bytes change on every packet, while the destination is an external IP that returns echo replies of normal size. The host has no monitoring tool installed and no legitimate reason to send large ICMP. Which technique is most likely being used?

Accepted Answer

ICMP tunneling used to exfiltrate or relay data inside echo request payloads.. Normal ICMP echo traffic uses small, fixed payloads for reachability. Large echo requests whose payload changes on every packet indicate the ICMP payload is being used as a transport for data, a covert channel known as ICMP tunneling. The external endpoint returning ordinary replies supports a request-carries-data-out model. Flood, MTU discovery, and smurf do not produce varying large payloads from a single internal host.

Answer

A ping flood denial-of-service attack against the external host.

Answer

Path MTU discovery using oversized ICMP packets to find fragmentation limits.

Answer

A smurf attack reflecting ICMP echo requests off the external host to a broadcast address.

Question 9

An analyst is examining a PCAP and sees a series of TCP packets where the client sends a SYN, receives a SYN-ACK, and then sends an ACK. Immediately after, the client sends a packet with the RST flag set, terminating the connection before any application data is exchanged. This pattern repeats across many destination ports on the same server. Which activity does this most likely represent?

Accepted Answer

TCP connect scan. The full three-way handshake followed by an immediate RST indicates a TCP connect scan. This scan type uses the operating system's connect() function to establish a complete TCP connection, then resets it. It is less stealthy than a SYN scan because it generates more logs on the target, but it works without raw socket privileges.

Answer

TCP SYN scan

Answer

TCP ACK scan

Answer

TCP FIN scan

Question 10

A network security analyst is configuring a SPAN session on a Cisco switch so that a Cisco Firepower sensor can inspect traffic between the internal user VLAN and the internet-facing router. The switch has a single physical uplink carrying that traffic. Which configuration goal must the analyst keep in mind to ensure the sensor receives complete sessions?

Accepted Answer

The SPAN source must include both transmit and receive directions of the monitored interface.. Session reassembly requires visibility into both directions of a conversation. When a SPAN source mirrors only one direction, the sensor sees SYN packets without replies or requests without responses, crippling detection and logging. Configuring the source to capture both transmit and receive traffic on the monitored interface ensures the sensor receives full bidirectional sessions for accurate analysis.

Answer

The sensor interface must be set to promiscuous mode and assigned an IP address on the monitored VLAN.

Answer

The SPAN session must be configured with the encapsulation replicate option to copy VLAN tags.

Answer

The SPAN destination port must be configured as a trunk carrying all VLANs.

Question 11

A SOC analyst receives an alert that a user account successfully authenticated to the VPN from two geographically distant locations within four minutes. Both sessions remain active. The identity team confirms the user is traveling and has only one device. Which monitoring conclusion is most appropriate?

Accepted Answer

This is impossible-travel behavior consistent with credential theft, so the account should be treated as compromised pending verification.. Impossible travel detection compares authentication events across time and geography to find sessions that one person could not physically produce. Two concurrent VPN sessions from distant locations, with one confirmed device and one traveling user, indicate a second party using the same credentials. The appropriate action is to treat the account as compromised, verify with the user through an out-of-band channel, and review session activity for data access or lateral movement.

Answer

This indicates a split-tunnel misconfiguration, since split tunneling causes a user to appear from multiple source networks simultaneously.

Answer

This is expected behavior because VPN concentrators load-balance sessions and users commonly appear from multiple regions.

Answer

This is a low-severity event because both sessions authenticated successfully, and successful authentication rules out misuse.

Question 12

A SOC analyst is reviewing a PCAP captured at the perimeter firewall. The analyst notices that a single internal host has sent TCP segments with the FIN, PSH, and URG flags all set simultaneously to multiple destination ports on several external hosts. No corresponding ACK, SYN, or RST packets are observed in the capture. Which type of scan is the analyst most likely observing?

Accepted Answer

TCP Xmas scan. The combination of FIN, PSH, and URG flags in a single TCP segment is the defining signature of a TCP Xmas scan. Because RFC 793 requires closed ports to respond with RST to any segment not containing SYN, and open ports to ignore such segments, attackers use this flag combination to enumerate ports without establishing a full connection and with minimal logging on the target host.

Answer

TCP NULL scan

Answer

TCP ACK scan

Answer

TCP SYN stealth scan

Question 13

A security analyst is reviewing Sysmon telemetry from a workstation that may be compromised. Which TWO event types should the analyst correlate first to identify suspicious process execution and persistence? (Choose two.)

Accepted Answer

Event ID 1, Process Create, which records the image path, command line, and parent process.. Process Create establishes what ran, from where, with which arguments, and under which parent, while Registry Value Set reveals the persistence the process installed. Correlating the two links a specific executable to a specific autorun or service entry, which is the fastest way to confirm suspicious execution and durable persistence on a Windows endpoint.

Answer

Event ID 22, DNS Query, which records name resolution requests made by processes.

Answer

Event ID 3, Network Connection, which records TCP and UDP connection attempts by processes.

Answer

Event ID 11, File Create, which records file creation and overwrite operations with their paths.

Question 14

A security analyst is correlating network and endpoint telemetry to detect a host infected with malware that is attempting to establish persistence and communicate externally. Which TWO artifacts would best support this investigation? (Choose two.)

Accepted Answer

Sysmon Event ID 13 registry value set events for Run key modifications. To confirm both persistence and external communication, the analyst needs an endpoint artifact that shows the persistence mechanism and a network artifact that shows beaconing. Sysmon registry value set events reveal Run key modifications used for persistence, while NetFlow records expose periodic outbound connections to an external IP. Together they link the infected host's persistence to its command-and-control channel.

Answer

DHCP server logs showing IP address leases for the subnet

Answer

Antivirus scan reports from the previous quarter

Answer

Windows Event ID 4688 process creation events for every process on all hosts

Question 15

A network security analyst reviews a packet capture from a compromised host and sees repeated outbound DNS queries for long, random-looking subdomains such as 'a3f9c2b81e7d4.example-cdn.net', each followed by a small response and no subsequent connection to the returned address. Which interpretation is most accurate?

Accepted Answer

This is DNS tunneling or exfiltration, because encoded data is carried in query names and the returned addresses are never contacted.. DNS tunneling encodes data inside query names so it can leave a network through permitted recursive resolution. High-entropy, variable-length subdomain labels under one parent domain, sent at volume with responses that are never used, match that behavior. A domain generation algorithm instead rotates across many registered domains, and normal CDN activity ends in a connection to the resolved address, so both alternatives conflict with the evidence shown.

Answer

This is normal content delivery network behavior, because CDNs use random subdomains to distribute requests across edge servers.

Answer

This is DNS cache poisoning, because the host is querying for records that do not exist and receiving forged responses.

Answer

This is a domain generation algorithm used for command-and-control, because the host resolves many random domains before receiving instructions.

Question 16

An analyst is correlating telemetry after a suspected Kerberoasting attack against an Active Directory environment. Which two artifacts, when found together, most strongly support that the attack succeeded in obtaining crackable service ticket material? (Choose two.)

Accepted Answer

Windows Security event 4769 logged with RC4 encryption type (0x17) for service accounts, generated in a short burst from one workstation.. Kerberoasting requires two observable steps: discovery of accounts with service principal names, and requests for their service tickets using weak encryption that can be cracked offline. A workstation issuing broad LDAP queries for the servicePrincipalName attribute, followed by a burst of event 4769 entries with RC4 encryption for service accounts, together demonstrate both steps. Failed logons or policy changes do not evidence ticket acquisition, and share access belongs to a different attack phase.

Answer

A Group Policy update pushed to all domain-joined computers changing the minimum password length requirement.

Answer

A spike in Windows Security event 4625 failed logons against many user accounts from a single source over a brief interval.

Answer

A sudden increase in SMB file share access to the finance department's documents from a user in the engineering group.

Question 17

During incident response, an analyst notices that a compromised host is making outbound SMB connections to several internal servers on TCP port 445 using the same domain user account within minutes. Which activity is most likely occurring?

Accepted Answer

Lateral movement using stolen credentials. Rapid outbound SMB connections to multiple internal servers using the same domain account indicate lateral movement with stolen credentials. Attackers use tools like PsExec or built-in SMB to pivot across the network, access shares, and deploy payloads. This behavior should be treated as a high-severity incident, triggering isolation of the source host and a review of the compromised account's activity.

Answer

Normal user access to multiple file shares

Answer

A backup application scanning file shares

Answer

A vulnerability scanner enumerating SMB services

Question 18

An analyst is examining a PCAP of what appears to be a covert channel. The analyst observes that the internal host sends ICMP Echo Requests that contain a payload of exactly 48 bytes of non-repeating binary data, and the corresponding Echo Replies always return with a zero-length payload. The payload bytes, when decoded, contain what looks like command strings. Which technique is most consistent with these observations?

Accepted Answer

ICMP tunneling using Echo Request payloads as a data exfiltration and command channel. The defining indicators of ICMP tunneling are Echo Request or Echo Reply packets carrying non-standard, often non-repeating or encoded payloads, especially when those payloads contain structured data such as command strings. Normal ping traffic uses predictable, often repeating payloads like alphabetic patterns. The one-way data flow with empty replies here strongly suggests the channel is being used to deliver commands or exfiltrate data covertly.

Answer

ICMP redirect attack manipulating the host's routing table

Answer

ICMP flood denial-of-service attack against the external host

Answer

Smurf attack using the internal host as an unwitting reflector

Question 19

A junior analyst is reviewing a packet capture and sees a workstation repeatedly sending ICMPv4 Type 8 packets to an external IP address with varying payload sizes. The analyst wants to confirm whether this activity is a covert channel. Which characteristic of the ICMP traffic would most strongly suggest that the ICMP payload is being used to exfiltrate data?

Accepted Answer

The ICMP payload data changes on every request and contains non-printable, high-entropy bytes.. Covert ICMP channels hide data inside the payload of echo requests and replies. Benign pings use fixed, printable payload patterns, so a payload that changes on every packet and contains high-entropy, non-printable bytes strongly suggests encoded data is being transmitted. Combined with an external destination, this pattern points to ICMP-based exfiltration rather than routine connectivity testing.

Answer

The ICMP echo requests are sent at a fixed interval of exactly one second.

Answer

The ICMP echo requests contain a consistent sequence number and identifier.

Answer

The ICMP echo requests receive echo replies from the same external IP address.

Question 20

A network analyst is reviewing firewall logs and sees repeated inbound connections from a single external IP to TCP port 445 on multiple internal hosts over a short period. The connections are followed by SMB negotiation attempts. Which activity does this most likely represent?

Accepted Answer

SMB enumeration or exploitation attempts against internal file-sharing services. Inbound SMB connections to TCP port 445 from one external IP across many internal hosts indicate enumeration or exploitation of file-sharing services. Backup traffic, legitimate VPN-based file access, and DNS zone transfers have different source, port, and pattern characteristics. The sweep across multiple hosts in a short time is the key indicator of malicious SMB activity.

Answer

A backup server replicating data to internal hosts

Answer

DNS zone transfer requests to internal DNS servers

Answer

Normal SMB file access by remote employees using VPN