200-201 Practice Exam 57 — 20 Questions

Question 1

Match each cybersecurity framework/standard to its focus.

Accepted Answer

NIST Cybersecurity Framework: Focuses on improving cybersecurity for critical infrastructure.. Correct matches: NIST CSF for critical infrastructure, ISO 27001 for ISMS, PCI DSS for cardholder data, CIS Controls for prioritized security actions. Common confusions include swapping these terms.

Answer

NIST Cybersecurity Framework: Focuses on a prioritized set of security actions.

Answer

ISO/IEC 27001: Focuses on protection of cardholder data.

Question 2

A company implements a policy requiring all employees to use a hardware token for remote access. This is an example of which type of security control?

Accepted Answer

Preventive. A hardware token for remote access implements multifactor authentication (something you have), which directly prevents unauthorized access by requiring a physical device in addition to credentials. This is a preventive control because it stops the threat before it can occur, aligning with the NIST definition of preventive controls that block or mitigate attacks.

Answer

Compensating

Answer

Deterrent

Answer

Detective

Question 3

A security analyst analyzes an IDS alert that triggered on the string '/etc/passwd'. What type of signature is this?

Accepted Answer

Atomic signature. The string '/etc/passwd' is a single, fixed pattern that the IDS matches against a single packet payload. This is the definition of an atomic signature: it looks for a specific content string without requiring any state or context from previous packets. Option C is correct because the alert is triggered solely by the presence of that literal string in a packet, not by any sequence of events or statistical deviation.

Answer

Stateful signature

Answer

Composite signature

Answer

Anomaly signature

Question 4

A security analyst reviews system logs and notices multiple failed login attempts from a single IP address to different user accounts over a short period. The analyst then sees a successful login for one account. Which type of attack is most likely occurring?

Accepted Answer

Password spraying. Password spraying (D) is the correct answer because the attacker attempts a small number of common passwords against many user accounts, avoiding account lockout thresholds. The pattern of multiple failed logins from a single IP across different accounts, followed by a single success, matches this low-and-slow technique rather than targeting one account with many passwords.

Answer

Brute force

Answer

Dictionary attack

Answer

Credential stuffing

Question 5

What is the purpose of a security baseline?

Accepted Answer

To define the minimum acceptable security posture. A security baseline defines the minimum acceptable security posture for systems, networks, and devices. It establishes a standard configuration that must be met to ensure a consistent level of security across the organization, such as requiring specific patch levels, disabling unnecessary services, and enforcing password policies. Without a baseline, there is no reference point to measure compliance or identify deviations that could indicate a security weakness.

Answer

To respond to security incidents

Answer

To encrypt sensitive data

Answer

To detect malware infections

Question 6

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Accepted Answer

The deny statement with logging may generate excessive logs, potentially masking attacks.. The ACL has a single permit statement for traffic from 192.168.1.0/24 to 10.10.10.10 on port 443, followed by an implicit deny all that is logged. This means every packet that does not match the permit rule generates a log entry. In a production environment, even normal background noise (e.g., scans, broadcast traffic) can produce thousands of log messages per second, overwhelming syslog storage and masking malicious activity. The core issue is that logging on the deny-all can cause log flooding, not that the permit lacks logging.

Answer

The ACL is applied inbound on the outside interface, which could allow external traffic.

Answer

The permit statement does not have logging enabled, so traffic is not monitored.

Answer

The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.

Question 7

An analyst uses Volatility's pstree plugin on a memory dump. The output shows that process 'winlogon.exe' has a child process 'cmd.exe' that is not typical. What is the most likely explanation?

Accepted Answer

An attacker may have used Sticky Keys or similar persistence.. winlogon.exe spawning cmd.exe is unusual and may indicate an attacker used Sticky Keys or similar accessibility feature abuse (sethc.exe) to gain a command prompt at the login screen. Normal winlogon does not launch cmd.exe as a child.

Answer

A user is running a command prompt remotely.

Answer

A scheduled task is running.

Answer

The system is performing a normal update.

Question 8

An analyst notices periodic HTTP GET requests to a suspicious domain every 60 seconds. The payload size is small and consistent. This behavior is characteristic of which phase of the Cyber Kill Chain?

Accepted Answer

Command and Control. Beaconing is a C2 communication technique where infected hosts periodically contact the command server.

Answer

Actions on Objectives

Answer

Delivery

Answer

Installation

Question 9

During a forensic examination of a Linux system, an analyst wants to check for persistence mechanisms. Which file or directory should be examined to find user-specific cron jobs that may have been added by an attacker?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/). /etc/crontab is system-wide, /etc/cron.d is system-wide directories, and /etc/cron.hourly are scripts. The user-specific location is under /var/spool/cron/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 10

During a security incident, a SOC analyst reviews NetFlow records and notices a single internal host communicating with a remote server on TCP port 443, sending 50 MB of data in 5 minutes, while the usual baseline for that host is 1 MB per hour. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration. The sudden spike in outbound data volume from a single internal host to a remote server over TCP port 443 (HTTPS) far exceeds the established baseline of 1 MB per hour, reaching 50 MB in just 5 minutes. This anomalous behavior is a classic indicator of data exfiltration, where an attacker is using encrypted HTTPS traffic to stealthily transfer stolen data out of the network without triggering typical signature-based alerts.

Answer

Denial of service attack

Answer

Port scan activity

Answer

Normal web browsing traffic

Question 11

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)

Accepted Answer

Connections to known IRC servers on non-standard ports. Botnets often use IRC (Internet Relay Chat) for command and control (C2) communication. Attackers configure IRC servers on non-standard ports (e.g., TCP 6667–6669 are common, but botnets may use ports like 8080, 8443, or random high ports) to evade detection by security tools that monitor default IRC ports. The presence of persistent IRC connections to unusual ports is a strong indicator of botnet activity.

Answer

Large file downloads from external servers

Answer

Frequent DNS queries to legitimate corporate DNS servers

Question 12

Refer to the exhibit. What is the effect of this ACL applied to an interface?

Accepted Answer

Allows only HTTP traffic to host 10.0.1.10 and denies all else. The ACL in the exhibit (assuming it is a standard or extended ACL with a permit statement for TCP port 80 to host 10.0.1.10 and an implicit deny all) explicitly permits only HTTP traffic (TCP port 80) to the destination host 10.0.1.10. All other traffic is denied by the implicit deny all at the end of the ACL, making option C correct.

Answer

Allows all traffic to host 10.0.1.10

Answer

Allows any TCP traffic

Answer

Denies all traffic

Question 13

An analyst is reviewing Snort alerts and notices repeated 'ET SCAN Potential SSH Scan' alerts from the same source IP. Which action should the analyst take next?

Accepted Answer

Correlate with authentication logs to confirm unsuccessful attempts.. Snort alerts for 'ET SCAN Potential SSH Scan' indicate a pattern of connection attempts to the SSH port (TCP/22), but the alert alone does not confirm whether the attempts were successful or malicious. Correlating with authentication logs (e.g., /var/log/auth.log or Windows Event ID 4625) allows the analyst to verify failed login attempts, which is the definitive evidence of an actual SSH brute-force attack. This step aligns with the network intrusion analysis methodology of validating alerts before taking action.

Answer

Run a vulnerability scan on the destination.

Answer

Ignore because it is a false positive.

Answer

Immediately block the IP on the firewall.

Question 14

A company uses Cisco Firepower NGFW with intrusion prevention. The security team notices that some legitimate traffic is being blocked by the IPS, causing application outages. The analyst reviews the IPS signature events and finds false positives. What is the best approach to handle this without reducing security posture?

Accepted Answer

Create a custom rule to exclude the affected traffic based on source/destination, while monitoring the signature for true positives.. It allows the security team to selectively exclude only the specific legitimate traffic causing false positives, using source/destination criteria in a custom rule, while keeping the IPS signature active for all other traffic. This approach maintains the overall security posture by still detecting true positives from the same signature against other traffic flows. Disabling or lowering the signature's severity would globally reduce detection capability, and updating the database may not address a signature that is inherently too broad for the environment.

Answer

Lower the severity of the signature to informational.

Answer

Disable the IPS signature that is causing the false positives.

Answer

Update the IPS signature database to the latest version.

Question 15

A security analyst is configuring Snort IDS rules. Which TWO components are mandatory in a Snort rule header?

Accepted Answer

Action (e.g., alert, drop). In a Snort rule header, the mandatory components are the action (e.g., alert, drop) and the direction operator (-> or <>). While protocol is also a required field, it is not considered a separate mandatory component in the context of this question; the action and direction operator are the two components that are always required in the rule header. Options like msg and sid are part of the rule body and are optional.

Answer

Message (msg) option

Answer

Signature ID (sid) option

Answer

Protocol (e.g., tcp, udp, icmp)

Question 16

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

Accepted Answer

SSH brute force. Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Answer

HTTP flood

Answer

SMB exploit

Answer

DNS amplification

Question 17

Based on the exhibit, what is the most likely type of attack being observed?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses, causing the target to allocate resources for half-open connections until it exhausts its backlog queue and denies legitimate traffic. The exhibit likely shows a massive spike in SYN packets without corresponding SYN-ACK or ACK completions, which is the hallmark of this attack.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

Port scan

Question 18

During packet analysis in Wireshark, which THREE findings are indicators of potential malicious activity? (Choose THREE.)

Accepted Answer

An unusually large ICMP echo request packet (e.g., 65,000 bytes).. An unusually large ICMP echo request packet, such as 65,000 bytes, exceeds the maximum allowed size for a standard ICMP packet (typically 65,535 bytes total including headers, but the data payload should not exceed 65,527 bytes). This oversized packet is a classic indicator of a 'Ping of Death' attack, where the attacker sends a malformed packet that causes a buffer overflow on the target system, leading to a crash or remote code execution. In Wireshark, such an anomaly stands out against normal ICMP traffic, which usually has a small payload (e.g., 32 or 56 bytes).

Answer

An HTTPS connection to a well-known website.

Answer

A normal DNS query for a common domain.

Question 19

An analyst wants to determine if a specific executable has been run on a Windows system. Which artifact provides evidence of prior execution?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

Answer

Registry Run keys

Answer

Task Scheduler logs

Answer

Windows Event Logs

Question 20

A company's security policy requires that all data classified as 'Confidential' must be encrypted at rest and in transit. This requirement is part of which policy?

Accepted Answer

Data Classification Policy. The requirement to encrypt 'Confidential' data is a direct outcome of a data classification policy, which defines categories (e.g., Public, Internal, Confidential, Restricted) and mandates specific security controls for each category. Encryption at rest and in transit is a typical control for the 'Confidential' tier, ensuring data is protected using mechanisms like AES-256 for storage and TLS 1.2+ for transmission.

Answer

Remote Access Policy

Answer

Password Policy

Answer

Acceptable Use Policy