200-201 Practice Exam 57 — 20 Questions

Question 1

An analyst is reviewing a PCAP of an intrusion and observes that the attacker's machine sent a TCP segment with the ACK flag set to a target host, but the target had never received a SYN from the attacker. The target responded with an RST. The analyst wants to determine what the attacker was attempting. Which technique best describes this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An ACK scan used to map firewall rules and determine which ports are filtered. An ACK scan sends TCP segments with only the ACK flag set to ports where no session exists. Targets respond with RST if the port is reachable and unfiltered, while firewalls that filter the port may drop the packet silently. This allows the attacker to infer firewall rule sets rather than open services, which matches the observed segment and RST response.

Answer

A TCP SYN scan used to identify open ports on the target

Answer

A TCP session hijacking attempt using a spoofed sequence number

Answer

A Christmas tree scan used to identify open ports via illegal flag combinations

Question 2

A security analyst is investigating a Linux server that is exhibiting unusual outbound network traffic. The analyst runs 'netstat -tulpn' and observes a listening service on TCP port 4444, but the process name is 'sshd'. The analyst knows that SSH normally listens on port 22. Which of the following is the most likely explanation for this finding?

Accepted Answer

A backdoor or reverse shell is masquerading as the SSH daemon.. The presence of a service named 'sshd' listening on port 4444, especially with unusual outbound traffic, is a red flag for a backdoor or reverse shell. Attackers frequently use common ports like 4444 for command-and-control and name their processes after legitimate services to blend in. Legitimate SSH should listen on port 22 unless explicitly changed, and such a change would be documented.

Answer

The server is running an SSH honeypot on port 4444 to attract attackers.

Answer

The SSH daemon is configured to use port 4444 for SFTP transfers only.

Answer

The SSH daemon has been reconfigured to listen on port 4444 for security through obscurity.

Question 3

An analyst investigates a suspected data exfiltration event and captures outbound traffic from a compromised host. The traffic uses HTTPS to an unfamiliar external domain and shows consistent large uploads at regular intervals. Which two indicators would most strongly support the conclusion that this is automated exfiltration rather than normal user browsing? (Choose two.)

Accepted Answer

The uploads occur at fixed intervals with near-identical byte counts. Automated exfiltration is best identified by behavior: uploads at fixed intervals with near-identical sizes indicate a scheduled tool, and outbound data with no matching user-driven inbound requests shows the transfer is not interactive browsing. Domain age, certificate issuer, and TLS version describe infrastructure or protocol choices that legitimate and malicious traffic share, so they are weaker indicators and do not specifically demonstrate automation.

Answer

The connection uses TLS version 1.2

Answer

The TLS certificate uses a self-signed issuer

Answer

The destination domain was registered recently and has no reputation history

Question 4

An analyst is investigating a suspected FTP brute-force attack. The logs show numerous failed login attempts from a single external IP to multiple user accounts on an internal FTP server. Which two additional pieces of evidence would best confirm a brute-force attack? (Choose two.)

Accepted Answer

A high number of FTP 530 Login incorrect responses within a short time window.. The correct answers are a high number of FTP 530 Login incorrect responses within a short time window and threat intelligence linking the external IP to credential stuffing. These directly support the brute-force hypothesis: repeated failures indicate automated attempts, and threat intel provides context that the source is malicious.

Answer

The FTP server is configured to allow anonymous access.

Answer

The FTP server uses plaintext authentication.

Answer

The external IP has a low reputation score but no specific threat intelligence tags.

Question 5

While reviewing firewall logs, an analyst notices repeated inbound connections from a single external IP to multiple internal hosts on TCP port 3389 within a short time window. Each connection lasts only a few seconds and is followed by a new connection to a different internal host. Which activity does this pattern most likely represent?

Accepted Answer

A vulnerability scan of internal RDP services. One external source rapidly opening short-lived TCP/3389 sessions to many internal hosts is characteristic of scanning for exposed RDP services. Legitimate RDP administration uses longer authenticated sessions from internal management addresses, backups use different protocols, and health checks come from internal load balancers at regular intervals. The burst of brief, fan-out connections therefore points to reconnaissance against RDP endpoints.

Answer

A load balancer health check against RDP servers

Answer

An administrator using Remote Desktop to manage multiple servers

Answer

A backup application replicating data over RDP

Question 6

A junior analyst is triaging a Windows workstation that users report is running slowly. The analyst suspects a malicious process is persisting by masquerading as a legitimate Windows service. Which built-in Windows tool should the analyst use to view services, their binary paths, and their current state without installing additional software?

Accepted Answer

The Services console (services.msc). The Services console (services.msc) is the native Windows management interface that enumerates all installed services and exposes each one's display name, status, start type, and the path to its executable. By reviewing those paths, the analyst can identify a service whose binary resides in an unexpected location, which is a common masquerading persistence method, without deploying any additional tooling.

Answer

Performance Monitor (perfmon.msc)

Answer

Task Manager's Processes tab

Answer

Event Viewer's Application log

Question 7

A security analyst is reviewing a Windows host for indicators of credential dumping. The analyst wants to identify artifacts that commonly indicate tools such as Mimikatz have been used on the system. Which two artifacts should the analyst look for? (Choose two.)

Accepted Answer

Security Event ID 4656 or 4663 referencing lsass.exe with unusual access rights. Credential dumping targets LSASS memory, so the most reliable host artifacts are security events showing unusual handle access to lsass.exe and the presence of a memory dump file such as lsass.dmp in a user-writable location. Together these indicate that a tool attempted to extract credentials from LSASS on the endpoint.

Answer

An increase in Windows Defender signature definition version numbers

Answer

Presence of a driver named SysmonDrv.sys in the System32\drivers directory

Answer

Event ID 4688 showing the launch of notepad.exe by the SYSTEM account

Question 8

During an investigation, an analyst observes that a workstation resolves an internal hostname to an IP address that does not match the DHCP lease record, and subsequent SMB connections to that hostname reach an attacker-controlled server. Which attack technique best explains this behavior?

Accepted Answer

DNS spoofing or rogue DNS response injection. A hostname resolving to an IP that contradicts the DHCP lease, followed by SMB traffic reaching an attacker server, points to manipulation of name resolution. DNS spoofing or rogue DNS responses inject false records so the client connects to the wrong endpoint. ARP poisoning operates at layer 2 with MAC mappings, DHCP starvation prevents lease acquisition, and SMB signing affects message integrity, so none of those explain the poisoned resolution.

Answer

SMB signing downgrade on the file server

Answer

DHCP starvation exhausting the address pool

Answer

ARP cache poisoning on the local subnet

Question 9

An analyst is reviewing logs on a Windows 10 host that is suspected of being compromised. The analyst runs 'wevtutil qe Security /q:"*[System[(EventID=4688)]]" /f:text' and sees that a process named 'powershell.exe' was launched by 'winword.exe' with the command line 'powershell -nop -w hidden -enc SQBFAFgA...'. Which type of malicious activity does this most likely indicate?

Accepted Answer

A macro-based document exploit spawning an encoded PowerShell payload. The parent-child relationship between winword.exe and powershell.exe with encoded, hidden arguments is a well-known indicator of a malicious macro exploit. Attackers often use Office documents to launch PowerShell stagers that download or execute further payloads. This pattern is commonly seen in phishing campaigns and is a key detection point for endpoint security tools.

Answer

A user manually running a PowerShell script for administrative purposes

Answer

A legitimate Office add-in that uses PowerShell for automation

Answer

A scheduled task created by Windows Update to install patches

Question 10

A multinational retailer is aligning its security program with the NIST Cybersecurity Framework. The CISO wants to prioritize activities that improve the ability to detect and respond to cybersecurity events. Which Function in the NIST CSF Core is specifically described as encompassing activities to identify the occurrence of a cybersecurity event?

Accepted Answer

Detect. The NIST CSF Core defines Detect as the Function containing activities to identify the occurrence of a cybersecurity event, including continuous monitoring and detection processes. Identify, Protect, and Respond address asset understanding, safeguards, and post-detection actions respectively. For a retailer seeking faster awareness of incidents, strengthening the Detect Function is the direct match.

Answer

Protect

Answer

Identify

Answer

Respond

Question 11

A security analyst is investigating a Linux server that is suspected of being compromised. The analyst runs 'ls -l /proc/1234/exe' and sees the output: '/proc/1234/exe -> /tmp/.hidden/backdoor (deleted)'. What does this output indicate?

Accepted Answer

The process 1234 is running from a deleted executable file, which may indicate malware hiding its presence.. The output indicates that process 1234 is executing from a file that has been deleted from the filesystem. Malware often deletes its executable after launching to evade detection by file-based scans. The hidden directory and suspicious name 'backdoor' further suggest malicious intent. Therefore, the correct interpretation is that the process is running from a deleted executable, a common malware hiding technique.

Answer

The process 1234 is a legitimate system process that was updated, and the old executable was deleted.

Answer

The process 1234 is a zombie process that has terminated but still appears in the process list.

Answer

The process 1234 has a corrupted executable file that needs to be replaced.

Question 12

An analyst suspects a Windows workstation is beaconing to a command-and-control server. The host's DNS cache contains an entry for a domain that resolves to an IP address, but the analyst cannot find any active network connection or process associated with that domain. Which Windows artifact should the analyst examine to determine whether a process previously resolved this domain and when?

Accepted Answer

The DNS Client event log (Microsoft-Windows-DNS-Client/Operational). The Microsoft-Windows-DNS-Client/Operational log is designed to record DNS client query events, including the query name, query type, timestamp, and the process that initiated the query. When a host is beaconing, the DNS cache may only show the resolved IP, but the operational log can show which process resolved the domain and when, enabling the analyst to link the beaconing behavior to a specific executable.

Answer

The Windows Firewall log at %systemroot%\system32\LogFiles\Firewall\pfirewall.log

Answer

The Application event log

Answer

The System event log

Question 13

A security analyst is examining a Linux server that is suspected of being compromised. The analyst runs `ls -l /proc/<PID>/exe` for a suspicious process and sees that the symbolic link points to `/tmp/.hidden/update` but the file no longer exists on disk. Which conclusion is most accurate?

Accepted Answer

The executable file was deleted while the process is still running.. On Linux, the /proc//exe symlink points to the executable file. If that file is deleted while the process is running, the symlink remains but the target path is marked as deleted, and the file is no longer accessible via the filesystem. This is a known malware tactic to hinder forensic analysis. The analyst should copy /proc//exe to preserve the binary before the process terminates.

Answer

The process is a kernel thread and does not have an executable on disk.

Answer

The process is running from a memory-mapped file and has no on-disk executable.

Answer

The process is a zombie and has already terminated.

Question 14

During a network intrusion analysis, an analyst observes a series of TCP packets with the FIN flag set but no corresponding ACK, followed by packets with the RST flag set. What is the most likely explanation for this traffic pattern?

Accepted Answer

A TCP port scan using FIN and RST packets.. The correct answer is a TCP port scan using FIN and RST packets. A FIN scan sends packets with only the FIN flag; closed ports reply with RST, while open ports ignore them. The observed pattern of FIN packets without ACK followed by RST responses matches this stealthy scanning technique, which can bypass some firewalls.

Answer

A SYN flood denial-of-service attack.

Answer

A TCP session hijacking attempt.

Answer

A normal TCP connection termination sequence.

Question 15

A financial services company must retain security event logs for a period defined by its policy and applicable regulations. The security architect is documenting how long different log sources must be kept and where. Which statement best reflects a sound log retention practice for security operations?

Accepted Answer

Define retention periods per log source based on regulatory and business requirements, and store logs centrally with integrity protection.. Effective log retention ties each source to a defined period justified by regulation and business need, then centralizes storage with integrity protection so logs remain available and trustworthy. Indefinite retention on source systems, extremely short deletion windows, or keeping only correlated alerts all undermine investigations and compliance. The chosen approach supports both retrospective hunting and evidentiary requirements.

Answer

Retain only logs that the SIEM has already correlated into alerts, discarding raw events to save space.

Answer

Delete logs after 24 hours to reduce the risk of exposing sensitive information in the event of a breach.

Answer

Retain all logs indefinitely on the source system to guarantee availability for any future investigation.

Question 16

A threat hunter is examining a Linux web server that is suspected of being compromised. The hunter wants to identify suspicious processes that may be communicating with external command-and-control infrastructure and to understand what files those processes have open. Which TWO artifacts or commands should the hunter use to accomplish these goals? (Choose two.)

Accepted Answer

Run 'ss -tunap' to enumerate listening and established sockets with their owning processes. Mapping C2 traffic and open files on Linux requires live process-to-socket visibility. The ss command with -tunap enumerates sockets together with owning processes, exposing established outbound connections. The /proc filesystem complements this by exposing per-process socket inodes and open file descriptors, letting the hunter pivot from a suspicious PID to the exact files and connections it holds. Together they reveal both the communication channel and the process context.

Answer

Review /var/log/secure for failed authentication attempts

Answer

Parse the wtmp and btmp binary logs with the 'last' command

Answer

Examine /etc/crontab for scheduled jobs

Question 17

A security analyst is reviewing a Windows workstation that is suspected of being infected with malware that establishes persistence. The analyst wants to check a location that is commonly used by malware to automatically start when a user logs on. Which of the following should the analyst examine?

Accepted Answer

The Startup folder for the current user. The Startup folder is a well-known user-level persistence location. Any program or shortcut placed there will execute automatically when the user logs on. Malware frequently uses this folder because it requires no administrative privileges and is easy to implement. Analysts should check both the per-user Startup folder and the all-users Startup folder for suspicious entries.

Answer

The Recycle Bin

Answer

The Prefetch folder

Answer

The Windows Defender quarantine folder

Question 18

An analyst is investigating a Windows 10 workstation suspected of being compromised. The analyst runs `wmic process get name,processid,parentprocessid,commandline` and observes a process named `powershell.exe` with the command line `powershell -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. What does the `-enc` parameter indicate about how the command was executed?

Accepted Answer

The command was Base64-encoded to obfuscate its contents.. The `-enc` parameter in PowerShell stands for `-EncodedCommand`, which accepts a Base64-encoded string representing the actual command. Attackers use it to obfuscate malicious scripts and bypass simple command-line logging. An analyst should decode the Base64 string to reveal the true intent, such as downloading a payload or establishing persistence.

Answer

The command was encrypted with AES and requires a key to decrypt.

Answer

The command was signed with a digital certificate to appear legitimate.

Answer

The command was compressed using gzip to reduce its size.

Question 19

An analyst is reviewing a Linux host that is suspected of being compromised. The analyst runs 'ls -l /proc/1234/exe' and sees that the symbolic link points to '/tmp/.hidden/backdoor'. The process with PID 1234 is owned by root and was started from an unknown parent process. Which of the following best describes what the analyst has discovered?

Accepted Answer

The process is a malicious binary running from a non-standard location, indicating a potential compromise.. The /proc/PID/exe symbolic link reveals the actual executable file backing a running process. A root-owned process executing from a hidden directory under /tmp is a classic sign of malware or an attacker's backdoor, as legitimate system processes rarely reside there. This discovery warrants immediate further investigation, such as examining the binary and its network connections.

Answer

The process is a kernel thread that has been incorrectly linked to a user-space file.

Answer

The process is a legitimate system daemon that has been relocated to /tmp for performance reasons.

Answer

The process is a containerized application that uses /tmp as its working directory.

Question 20

A security analyst is reviewing a packet capture and notices that a host is sending TCP segments with the SYN flag set to a range of ports on a single target, but the source IP address in each segment is spoofed to a different random address. The target replies with SYN-ACK packets to those spoofed addresses, and the host never completes the handshake. Which type of attack is this host performing?

Accepted Answer

SYN flood. The traffic pattern shows TCP SYN segments with spoofed source addresses and no completed three-way handshakes. This exhausts the target's half-open connection resources, which is the defining behavior of a SYN flood. UDP floods, Smurf attacks, and ping of death use different protocols and packet structures.

Answer

Smurf attack

Answer

UDP flood

Answer

Ping of death