200-201 Practice Exam 55 — 20 Questions

Question 1

A company's data classification policy defines "Confidential" data. Which of the following is an example of Confidential data?

Accepted Answer

Customer payment card information. Customer payment card information (PCI) is classified as Confidential data because it is subject to regulatory compliance (e.g., PCI DSS) and its unauthorized disclosure could cause significant financial or reputational harm. Confidential data typically includes personally identifiable information (PII), financial records, and trade secrets that require strict access controls and encryption at rest and in transit.

Answer

Public marketing brochures

Answer

Company cafeteria menu

Answer

Employee phone numbers

Question 2

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is fundamental to the principle of least privilege because it assigns permissions based on job functions rather than individual users, ensuring users receive only the access necessary for their roles. The 'need-to-know' concept restricts access to information strictly required for a user's tasks, directly enforcing least privilege by limiting data exposure. Together, RBAC provides a scalable framework for access management, while need-to-know ensures granular data-level control.

Answer

Mandatory access control (MAC)

Answer

Separation of duties

Answer

Defense in depth

Question 3

A security analyst reviews an alert from the IPS that shows a spike in TCP SYN packets from an external IP to multiple internal hosts on port 443. What is the most likely attack type?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to multiple hosts without completing the handshake, exhausting server resources. The alert describes a spike in TCP SYN packets from an external IP to multiple internal hosts on port 443, which matches the behavior of a distributed SYN flood targeting HTTPS services. This is the most likely attack because the IPS is detecting the initial connection attempts characteristic of a SYN flood.

Answer

Port scanning

Answer

Man-in-the-middle

Answer

DNS amplification

Question 4

A security analyst is investigating a potential data breach. The analyst identifies that the attacker used a technique to impersonate a legitimate user by spoofing the MAC address and IP address. Which TWO types of network attacks could involve these techniques? (Choose two.)

Accepted Answer

ARP spoofing. ARP spoofing is correct because it involves an attacker sending forged ARP messages over a local network to associate their MAC address with the IP address of a legitimate user. This allows the attacker to intercept, modify, or redirect traffic intended for that user, effectively impersonating them at Layer 2.

Answer

Denial of Service

Answer

DNS poisoning

Answer

Phishing

Question 5

A security engineer reviews syslog data and sees multiple authentication failures from a single source IP to different SSH servers. The source IP is internal. What does this indicate?

Accepted Answer

Brute-force attack. Multiple authentication failures from a single internal source IP to different SSH servers is a classic indicator of a brute-force attack. The attacker is systematically attempting to guess credentials across multiple targets, which is distinct from a single misconfiguration or user error. This pattern is commonly seen in post-compromise lateral movement or initial foothold attempts within the network.

Answer

User error

Answer

Misconfigured client

Answer

Network scan

Question 6

An analyst is investigating a security incident where an attacker gained access to a server by exploiting a known vulnerability. The attacker then moved laterally and exfiltrated data. Which THREE phases of the Cyber Kill Chain are evident in this scenario? (Choose three.)

Accepted Answer

Exploitation. Exploitation uses the vulnerability, lateral movement is installation or command and control, and exfiltration is actions on objectives.

Answer

Reconnaissance

Answer

Weaponization

Question 7

Which protocol and port combination is used by SNMP for receiving traps?

Accepted Answer

UDP 162. SNMP traps are unsolicited notifications sent from an SNMP agent to the network management system (NMS) to alert it of significant events. The correct protocol and port combination for receiving SNMP traps is UDP port 162, as defined in RFC 1157. UDP is used because traps are lightweight, connectionless messages where reliability is handled by the application layer if needed.

Answer

TCP 161

Answer

UDP 161

Answer

TCP 162

Question 8

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. Preparation includes creating the IR plan, team, tools, and conducting exercises. The other phases occur after an incident is detected.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 9

An analyst notices a series of SYN packets sent to a host at increasing speed, with no SYN-ACK replies. What kind of attack is this?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a rapid succession of SYN packets to a target host without completing the handshake. The target allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate traffic. The absence of SYN-ACK replies confirms the attacker is not responding to the handshake, a hallmark of this volumetric denial-of-service technique.

Answer

SSL stripping

Answer

ARP spoofing

Answer

Smurf attack

Question 10

During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?

Accepted Answer

Analyze the memory dump to identify indicators of compromise. After isolating the host and collecting a memory dump, the next step is to analyze the dump to extract volatile evidence such as running processes, network connections, and injected code. This analysis identifies indicators of compromise (IoCs) that inform containment and eradication. Skipping analysis would lose critical forensic data and hinder understanding of the attack vector.

Answer

Reboot the host to clear any malware from memory

Answer

Notify the public relations team immediately

Answer

Restore the host from a known good backup

Question 11

A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?

Accepted Answer

The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.. The SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.

Answer

The SIEM is not receiving logs from the authentication server.

Answer

The analyst is monitoring the wrong log source.

Answer

The SIEM correlation rule requires a minimum of 15 failed attempts.

Question 12

Refer to the exhibit. A firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. What type of activity is indicated?

Accepted Answer

Port scanning. The firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. This sequential pattern of connection attempts to multiple ports on the same target is a classic indicator of a port scan, where an attacker probes for open ports to identify potential services to exploit. The firewall's deny action confirms the traffic was blocked, but the behavior itself is characteristic of reconnaissance activity, specifically a TCP connect scan.

Answer

Worm propagation

Answer

Denial of service

Answer

Data exfiltration

Question 13

Which THREE of the following are best practices for creating and maintaining security policies? (Choose three.)

Accepted Answer

Obtain approval from senior management.. Security policies require executive endorsement to ensure organization-wide compliance and resource allocation. Senior management approval establishes authority and accountability, making the policy enforceable across all departments, not just IT. Without this buy-in, policies lack the legal and organizational weight needed for disciplinary actions or budget justification.

Answer

Develop policies in isolation by the security team.

Answer

Store policies in a secure location accessible only to security staff.

Question 14

An analyst is reviewing IDS alerts and sees an alert with signature name 'ET POLICY Suspicious inbound to MySQL port 3306'. The source IP is external and destination is an internal database server. What is the best immediate action?

Accepted Answer

Block the external IP at the firewall. An inbound connection from an external IP to a MySQL server (port 3306) is highly suspicious — MySQL is a database service that should never be exposed directly to the internet. The immediate best action is to block the external IP at the firewall to prevent potential exploitation, data exfiltration, or brute-force attacks. This aligns with the principle of least privilege and defense-in-depth, as database servers should only accept connections from trusted internal hosts.

Answer

Allow the traffic because it is a legitimate database query

Answer

Ignore the alert as it is a false positive

Answer

Disable the signature to reduce noise

Question 15

Which principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using digital signatures or cryptographic mechanisms. In network security, this is often achieved through protocols like HMAC or digital certificates that bind an action to a specific identity, providing irrefutable proof. Without non-repudiation, a user could claim they never sent a message or executed a command, undermining audit trails and legal accountability.

Answer

Authentication

Answer

Accountability

Answer

Authorization

Question 16

A hospital's network security team has received reports from nurses that the patient record system has become unresponsive. Upon investigation, the IT administrator finds that the database server is experiencing extremely high disk I/O and the system logs show repeated failed login attempts from an internal IP address that belongs to a medical imaging device. The imaging device is known to run an outdated embedded OS that cannot be patched. The device is isolated on its own VLAN, but the VLAN is allowed to communicate with the database server on TCP port 1433 for legitimate purposes. The attack logs show that the database server is being targeted with a dictionary attack using the default 'sa' account. What should the security analyst do first to contain the incident without disrupting critical medical operations?

Accepted Answer

Change the database server's 'sa' account password and implement account lockout policies.. The immediate priority is to stop the ongoing dictionary attack against the database server's 'sa' account without disrupting critical medical operations. Changing the 'sa' password and implementing account lockout policies directly mitigates the brute-force attack at the authentication layer, while leaving the imaging device and its VLAN operational so that legitimate medical imaging traffic can continue. This containment step buys time for a more permanent solution, such as replacing or further isolating the vulnerable device.

Answer

Block the imaging device's IP address at the core firewall.

Answer

Take the imaging device offline immediately and isolate it from the network.

Answer

Disable the VLAN allowing communication between the imaging device and the database server.

Question 17

An organization's security policy states that all external connections must be authenticated using multi-factor authentication. Which type of policy is this?

Accepted Answer

Remote Access Policy. A Remote Access Policy specifically governs how external users or devices connect to an internal network, and requiring multi-factor authentication (MFA) for all external connections is a standard control within this policy. This policy defines authentication methods, encryption standards (e.g., IPsec, TLS), and access controls for remote access, directly addressing the security policy's mandate for MFA on external connections.

Answer

Password Policy

Answer

Data Classification Policy

Answer

Acceptable Use Policy

Question 18

In a PCAP, an analyst sees a large outbound data transfer over FTP to an external IP address during non-business hours. The source host is a database server. Which phase of the Cyber Kill Chain does this represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's 'Actions on Objectives' phase is where the attacker achieves their ultimate goal, such as exfiltrating data. In this scenario, a large outbound FTP transfer from a database server to an external IP during non-business hours directly indicates data theft, which is the final objective of the intrusion. FTP (port 21/20) is used here as the exfiltration protocol, moving sensitive data out of the network.

Answer

Installation

Answer

Weaponization

Answer

Exploitation

Question 19

A security analyst is investigating a suspected malware infection on a Windows host. The analyst wants to identify processes that have network connections. Which built-in Windows tool should the analyst use?

Accepted Answer

netstat. Netstat (network statistics) is the correct built-in Windows tool for displaying active TCP and UDP connections, listening ports, and the associated process IDs (PIDs). By using netstat with the `-b` or `-o` flag, the analyst can map each network connection to its owning process, which is essential for identifying suspicious processes communicating over the network.

Answer

ipconfig

Answer

tasklist

Answer

nslookup

Question 20

When performing file analysis, which method is most reliable for determining the actual file type regardless of its extension?

Accepted Answer

Examining the file's magic bytes. Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

Answer

Opening the file in a text editor

Answer

Checking the file extension

Answer

Checking the file size