200-201 Practice Exam 58 — 20 Questions

Question 1

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Accepted Answer

Look for connections to known malicious IP addresses or domains.. Connections to known malicious IP addresses or domains are a strong indicator of data exfiltration, as attackers often use command-and-control (C2) servers to receive stolen data. This aligns with the principle of threat intelligence-based detection, where security feeds (e.g., Cisco Talos, AlienVault OTX) provide reputation scores for external hosts. Identifying such outbound connections helps confirm that data is being sent to an adversary-controlled destination.

Answer

Clear the network logs to ensure accurate analysis.

Answer

Focus exclusively on inbound traffic from external sources.

Answer

Immediately block all outbound traffic from the suspect host.

Question 2

Which TWO of the following are examples of Indicators of Compromise (IoCs) used in network security monitoring? (Choose two.)

Accepted Answer

MD5 hash of a malicious executable. An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a network or system. The MD5 hash of a malicious executable is a file-based IoC that allows security monitoring tools to detect known malware by comparing file hashes against threat intelligence feeds. This is a standard IoC used in signature-based detection systems like Snort or YARA.

Answer

The current time of day

Answer

The company's stock price

Answer

The number of employees in the company

Question 3

Which two actions should an analyst take when a security monitoring tool generates a high number of false positives for a specific signature? (Choose two.)

Accepted Answer

Create a whitelist for known benign traffic.. Creating a whitelist for known benign traffic allows the analyst to suppress alerts for traffic that is confirmed safe, reducing false positives without losing visibility into actual threats. This approach leverages the security monitoring tool's ability to filter based on source/destination IPs, ports, or application signatures, ensuring that only truly malicious traffic triggers the signature.

Answer

Increase the sensitivity of the signature.

Answer

Escalate to management without analysis.

Answer

Immediately disable the signature.

Question 4

A network baseline shows that a server typically sends 1-2 MB of data per hour to external IPs. Suddenly, the server sends 50 MB of data to an IP in a foreign country within 10 minutes. The traffic is encrypted. Which monitoring tool would best confirm data exfiltration?

Accepted Answer

NetFlow/IPFIX analysis comparing current traffic to baseline. NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Answer

Snort IDS with a rule to detect large file transfers

Answer

Wireshark packet capture with a display filter for the destination IP

Answer

Windows Event Logs for file access

Question 5

During a vulnerability assessment, a security team discovers that a web application allows users to upload files without proper validation. An attacker could upload a malicious file and execute it on the server. Which type of vulnerability is this?

Accepted Answer

Remote code execution (RCE). The vulnerability allows an attacker to upload a malicious file (e.g., a web shell) and then execute it on the server, which is the definition of remote code execution (RCE). This occurs because the application fails to validate file types, contents, or execution permissions, enabling arbitrary code to run in the server's context.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Insecure direct object reference

Question 6

A company's security policy requires that all employees change their passwords every 90 days. Which type of security control does this policy enforce?

Accepted Answer

Preventive. Password expiration policies enforce a preventive control by requiring users to change passwords at regular intervals, which reduces the risk of unauthorized access from compromised credentials. This control acts before a security incident occurs by limiting the window of opportunity for an attacker to use a stolen password. It is a proactive measure, not a reactive one, aligning with the definition of preventive controls in the NIST SP 800-53 framework.

Answer

Compensating

Answer

Detective

Answer

Corrective

Question 7

During a security audit, it is discovered that several users have passwords set to never expire. According to the security policy, passwords must be changed every 90 days. What is the best course of action?

Accepted Answer

Update the password policy in Active Directory to enforce 90-day expiration. The most efficient and enforceable way to ensure all users comply with the 90-day password expiration policy is to configure a Group Policy Object (GPO) in Active Directory that sets the 'Maximum password age' to 90 days. This automatically forces password changes at login after the expiration period, ensuring uniform enforcement without manual intervention or disruption.

Answer

Disable accounts that violate the policy

Answer

Notify users to change their passwords voluntarily

Answer

Immediately reset all user passwords

Question 8

An analyst receives a YARA rule that includes the string 'MZ' at the beginning of a file. What does this indicator typically help identify?

Accepted Answer

Windows executable files. The string 'MZ' (0x4D 0x5A) is the magic number for the MS-DOS header, which is present at the very beginning of all Windows Portable Executable (PE) files, including .exe, .dll, and .sys files. A YARA rule that checks for 'MZ' at offset 0 is specifically targeting the PE file format, which is the standard executable format for Windows. This indicator helps an analyst quickly identify that a file is likely a Windows executable, regardless of its extension.

Answer

PDF files with embedded JavaScript

Answer

Linux ELF binaries

Answer

Malicious documents containing macros

Question 9

An analyst is investigating an alert triggered by a Snort rule that matches traffic on port 445 (SMB). The analyst sees that the signature has a high false positive rate. Which THREE factors should the analyst evaluate to tune the signature for better accuracy? (Choose three.)

Accepted Answer

Creating a rule exception for internal subnets that use SMB for file sharing.. Creating a rule exception for internal subnets that legitimately use SMB for file sharing reduces false positives by excluding known benign traffic. This allows the Snort rule to focus on external or anomalous SMB traffic on port 445, improving detection accuracy without disabling the rule entirely.

Answer

Implementing a behavioral analysis heuristic to detect anomalous SMB activity.

Answer

Disabling the rule to eliminate false positives.

Question 10

An analyst is investigating a Windows host that likely has malware persistence via the registry. Which TWO registry hives are commonly used to store Run keys for user logon persistence? (Select 2)

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run are standard locations where Windows executes programs automatically at user logon. Malware commonly writes entries to these keys to achieve persistence, making them critical for host-based analysis.

Answer

HKEY_CLASSES_ROOT\*\shell

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 11

During packet analysis, an analyst notices a TCP connection with a large number of SYN packets sent to various ports on a single host but no completed handshakes. This is characteristic of which activity?

Accepted Answer

Port scan reconnaissance. A port scan typically sends SYN packets to multiple ports; responses indicate open ports. The lack of completed handshakes suggests a scan, not an attack.

Answer

Normal web browsing behavior

Answer

SYN flood denial-of-service attack

Answer

Data exfiltration using FTP

Question 12

An analyst is monitoring network traffic and sees a sudden spike in outbound data transfer from an internal server to an external IP that is known to be malicious. What is the most likely scenario?

Accepted Answer

Data exfiltration.. A sudden spike in outbound data transfer from an internal server to a known malicious external IP is a classic indicator of data exfiltration. Attackers often use compromised servers to siphon sensitive data (e.g., credentials, databases) to a command-and-control (C2) server. This behavior aligns with the post-compromise phase of an attack, where the goal is to extract data without triggering immediate alarms.

Answer

Software update.

Answer

User downloading a large file.

Answer

Normal backup operation.

Question 13

A Cisco ASA firewall is configured to send syslog messages to a SIEM. Which logging level includes 'informational' messages?

Accepted Answer

Level 6. C is correct because Cisco ASA syslog messages use the standard syslog severity levels defined in RFC 5424. 'Informational' messages correspond to severity Level 6, which provides normal operational information such as connection teardowns or configuration changes. This level is commonly used for monitoring without overwhelming the SIEM with debug-level data.

Answer

Level 5

Answer

Level 3

Answer

Level 0

Question 14

An analyst notices an intrusion alert triggered by an internal host scanning multiple ports on a single external IP address. The signature is 'Port Scan'. Which of the following is the most likely cause?

Accepted Answer

Network mapping tool. A port scan targeting multiple ports on a single external IP is the classic behavior of network mapping tools like Nmap or Masscan. These tools systematically probe ports to discover open services, which is distinct from the random or sequential scanning patterns of malware or the limited connections of normal user activity.

Answer

Misconfigured service

Answer

Malware spreading

Answer

Normal user activity

Question 15

An analyst analyzing a PCAP sees a series of TCP connections where the client sends data with interactive patterns and receives commands. This is most likely indicative of:

Accepted Answer

Reverse shell. A reverse shell provides an interactive command-line session from the victim to the attacker.

Answer

Web browsing

Answer

File transfer

Answer

DNS query

Question 16

A company is deploying a new web application and wants to ensure it is secure against common web attacks. Which of the following is the most effective approach to validate the security of the application before going live?

Accepted Answer

Conduct a penetration test by an external firm. A penetration test by an external firm is the most effective approach because it simulates a real-world attack, combining automated tools and manual exploitation techniques to identify vulnerabilities that automated scanners or static analysis might miss. Unlike a vulnerability scanner, a penetration test actively attempts to bypass security controls, test business logic flaws, and chain multiple low-risk issues into a critical exploit, providing a holistic validation of the application's security posture before going live.

Answer

Run a vulnerability scanner against the application

Answer

Implement a web application firewall (WAF)

Answer

Perform a code review with static analysis tools

Question 17

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. A DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server

Question 18

In Windows, prefetch files (C:\Windows\Prefetch\*.pf) are used by the system to speed up application loading. How can an analyst leverage prefetch files during host-based analysis?

Accepted Answer

They provide evidence of file execution, including frequency and timestamps.. Prefetch files in Windows record metadata about application launches, including the executable path, run count, and last run timestamp. During host-based analysis, an analyst can examine these .pf files to determine which executables have been executed, how often, and when, providing crucial evidence of file execution activity.

Answer

They store network connection logs.

Answer

They store registry keys modified by the application.

Answer

They contain the contents of the running process memory.

Question 19

Which TWO pieces of information are essential for an analyst to correlate when investigating an intrusion alert from a network-based sensor?

Accepted Answer

Source and destination IP addresses. Source and destination IP addresses are essential because they allow the analyst to identify the communicating endpoints involved in the intrusion attempt. By correlating these addresses with other alert data, the analyst can determine the origin of the attack and the targeted asset, which is critical for scoping the incident and initiating containment actions.

Answer

The color of the network cables

Answer

The brand of the sensor

Answer

The name of the security team lead

Question 20

A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?

Accepted Answer

Ping sweep. A ping sweep uses ICMP echo requests to discover live hosts; the observed high volume of ICMP echo replies from multiple internal hosts to a single external IP indicates that the external IP sent a flood of echo requests, and the internal hosts are responding. This is the classic signature of a ping sweep (or ICMP sweep) where an attacker probes a range of internal addresses to map the network.

Answer

ARP spoofing

Answer

Port scan

Answer

Smurf attack