200-201 Practice Exam 58 — 20 Questions

Question 1

A security analyst is examining a Windows 10 endpoint suspected of compromise. The analyst runs `wmic process get name,processid,executablepath,parentprocessid` and observes a process named `lsass.exe` with PID 1234 and executable path `C:\Windows\Temp\lsass.exe`. The legitimate lsass.exe should reside in `C:\Windows\System32`. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A malware sample is masquerading as lsass.exe to evade detection by name-based monitoring.. Legitimate Windows system processes run from specific system directories, such as System32. When a process named lsass.exe is found in a non-standard location like C:\Windows\Temp, it is almost certainly malware attempting to hide by using a trusted process name. The analyst should treat this as a compromise, isolate the host, and perform further forensics including file hash analysis and persistence checks.

Answer

The output is a false positive because wmic sometimes reports incorrect executable paths for system processes.

Answer

The system is experiencing a file system corruption that moved lsass.exe to a temporary folder.

Answer

The process is a legitimate instance of lsass.exe that was moved by a Windows Update.

Question 2

A security analyst suspects that a Windows workstation was compromised by malware that schedules a recurring task to maintain persistence. The analyst opens Task Scheduler and sees dozens of scheduled tasks. Which built-in command-line utility should the analyst use to export a detailed list of all scheduled tasks, including the actions they perform, so the list can be reviewed offline?

Accepted Answer

schtasks /query /fo LIST /v. Scheduled tasks are a common persistence mechanism because they can launch a payload on a schedule or at logon. The schtasks utility is the native command-line interface to the Task Scheduler service, and the /query /fo LIST /v combination produces a verbose, exportable inventory of every task, including its action and trigger. That output can be reviewed offline to identify the malicious recurring task.

Answer

tasklist /v /fo csv

Answer

wmic startup list full

Answer

sc query type= service state= all

Question 3

An analyst is investigating a Linux server and suspects that an attacker has established persistence by modifying system startup scripts. The analyst runs 'ls -la /etc/rc.local' and finds it has been modified recently. Which TWO additional artifacts should the analyst examine to identify other potential persistence mechanisms? (Choose two.)

Accepted Answer

/etc/cron.d/. Attackers on Linux often use systemd service files and cron jobs for persistence because they are executed automatically and can blend in with legitimate system tasks. The /etc/systemd/system/ directory contains custom service units, and /etc/cron.d/ holds cron definitions. Both are critical to examine when hunting for persistence, as they allow code execution without user interaction.

Answer

/etc/passwd

Answer

/var/log/auth.log

Answer

/etc/hosts

Question 4

A security manager is updating the organization's security awareness program after several incidents caused by employees inserting found USB drives. The manager wants a control that both reduces the likelihood of this behavior and provides a measurable metric for the awareness program. Which approach best meets both goals?

Accepted Answer

Run periodic simulated USB drop tests and track the click or insertion rate over time as a key performance indicator.. Simulated USB drop tests both reduce risk through reinforced training and produce a quantitative metric, the insertion or click rate, that reflects real behavior. Technical blocks and policy acknowledgments may reduce exposure but do not measure whether employees have internalized the lesson. Quarterly reminders measured by delivery count track activity rather than effectiveness, so they fail the measurement requirement.

Answer

Require employees to sign an annual acceptable use policy acknowledgment stating they will not insert found USB drives.

Answer

Disable all USB mass storage through endpoint policy and rely solely on the technical control to prevent incidents.

Answer

Send a quarterly email reminding staff about the dangers of found USB drives and count the number of emails delivered.

Question 5

A security analyst is examining a Linux web server that is suspected of being compromised. The analyst runs `ps aux` and notices a process named `apache2` running as the user `www-data`, but its parent process ID (PPID) is 1 (init/systemd). Normally, `apache2` is started by a master process. What is the most likely explanation for this anomaly?

Accepted Answer

The `apache2` process was re-parented to init after its original parent terminated.. On Linux, when a parent process dies, its children are re-parented to PID 1 (init/systemd). An `apache2` worker with PPID 1 indicates its original parent (the Apache master) is no longer running, which is unusual and may indicate tampering or a crash. This warrants further investigation into process lineage and system logs.

Answer

The `apache2` process is a kernel thread masquerading as a user process.

Answer

The `apache2` process was started by systemd as a direct child of PID 1.

Answer

The `apache2` process was started by a cron job.

Question 6

A security analyst is examining a Windows 10 endpoint suspected of compromise. The analyst runs `wmic process get name,processid,executablepath,parentprocessid` and observes a process named `lsass.exe` with PID 1234 and executable path `C:\Windows\Temp\lsass.exe`. The legitimate lsass.exe should reside in `C:\Windows\System32`. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The attacker is using a scheduled task to maintain persistence and execute a malicious binary at regular intervals.. Scheduled tasks are frequently abused by attackers to establish persistence. The task name 'WindowsUpdateCheck' is designed to look benign, but the executable path in C:\Users\Public and the 5-minute interval are suspicious. Attackers use such tasks to ensure their malware runs regularly, even after reboots. Analysts should investigate the binary and the task's origin.

Answer

The attacker is using a WMI event subscription to maintain persistence and execute a malicious binary at regular intervals.

Answer

The attacker is using a registry Run key to maintain persistence and execute a malicious binary at regular intervals.

Answer

The attacker is using a service to maintain persistence and execute a malicious binary at regular intervals.

Question 7

A security analyst is reviewing network traffic and observes a large number of DNS queries for randomly generated domain names, such as 'a1b2c3d4e5f6g7h8.com', from a single internal host. The queries are followed by responses with very short TTL values. The analyst suspects the host is compromised. Which type of malicious activity is most likely occurring?

Accepted Answer

Domain generation algorithm (DGA) used by malware for command-and-control (C2) communication. The high volume of unique, random-looking domain queries with short TTLs from a single host is a classic indicator of a domain generation algorithm. Malware uses DGA to periodically generate many domain names and attempt to resolve them, hoping to find the one registered by the attacker for command and control. This evades static domain blocklists and makes takedown difficult.

Answer

Fast flux DNS used to hide the location of a botnet controller

Answer

DNS cache poisoning attack against the internal resolver

Answer

DNS tunneling used to exfiltrate sensitive data

Question 8

A security analyst is reviewing Windows Event Logs to determine if a user account was recently created on a compromised host. Which Windows Event ID should the analyst look for in the Security log to identify user account creation events?

Accepted Answer

Event ID 4720. Windows Security Event ID 4720 is specifically logged when a user account is created. It contains fields such as TargetUserName (the new account) and SubjectUserName (the account that created it). This event is critical for detecting unauthorized account creation, which attackers often use for persistence. Other event IDs like 4624 (logon) or 4625 (failed logon) do not indicate account creation.

Answer

Event ID 4672

Answer

Event ID 4624

Answer

Event ID 4625

Question 9

A financial services firm is building a threat model and wants to classify an attacker who is highly skilled, well funded, and focused on stealing intellectual property from a specific set of companies over a long period. Which threat actor category best fits this profile?

Accepted Answer

Advanced persistent threat. An advanced persistent threat is characterized by significant resources, advanced skills, and sustained, stealthy operations against specific targets, often for espionage or intellectual property theft. The scenario's emphasis on long duration, funding, and a defined victim set aligns with APT behavior. Hacktivists are ideologically driven, script kiddies lack sophistication and resources, and insider threats are authorized users, so none matches the described external, well-funded, persistent actor.

Answer

Script kiddie

Answer

Hacktivist

Answer

Insider threat

Question 10

A security analyst is examining a Linux system for signs of a compromised user account. The analyst runs `grep ':0:0:' /etc/passwd` and finds an entry for user `backup` with UID 0. The legitimate backup user should have a UID of 1001. Which of the following is the MOST likely explanation?

Accepted Answer

An attacker modified /etc/passwd to give the backup user root privileges for persistence or privilege escalation.. In /etc/passwd, the third field is the UID. UID 0 is reserved for the root account. If a non-root user like backup has UID 0, it means that account has root privileges. This is a common attacker technique to maintain access: they either modify an existing account or create a new one with UID 0. The analyst should investigate the file's modification time, check for other anomalies, and review authentication logs for the backup user.

Answer

The output is a false positive because `grep ':0:0:'` also matches group ID 0, not just UID.

Answer

The backup user was accidentally assigned UID 0 during system installation.

Answer

The backup user is a system account that is supposed to have UID 0 for performing backup operations.

Question 11

During a host investigation on a Windows 10 endpoint, an analyst wants to review the history of commands typed into PowerShell consoles by interactive users. Which artifact should the analyst examine?

Accepted Answer

The PowerShell console host history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt. Interactive PowerShell commands are captured by the PSReadLine module, which appends each entered line to ConsoleHost_history.txt in the user's AppData roaming profile. This file survives reboots and gives investigators a chronological list of commands typed at the console, including download cradle strings and lateral-movement commands, without requiring transcription or module logging to have been enabled beforehand.

Answer

The Windows Prefetch directory, examining POWERSHELL.EXE-*.pf

Answer

The Application event log filtered for PowerShell source events

Answer

The Windows Security event log filtered for Event ID 4688

Question 12

A security analyst is examining a suspicious executable found on a user's workstation. The file appears to be a legitimate PDF document but when opened, it executes code that encrypts the user's files and demands payment. The analyst determines that the file is actually a malicious program disguised as a benign file. Which type of malware is this?

Accepted Answer

Trojan. The key indicator is the file masquerading as a legitimate PDF while actually being a malicious executable that encrypts files. This deception is the hallmark of a Trojan, which often delivers ransomware payloads. Unlike worms or viruses, Trojans rely on user execution and do not self-replicate.

Answer

Rootkit

Answer

Virus

Answer

Worm

Question 13

A security analyst is examining a Windows 10 endpoint suspected of compromise. The analyst runs `wmic process get name,processid,executablepath,parentprocessid` and observes a process named `lsass.exe` with PID 1234 and executable path `C:\Windows\Temp\lsass.exe`. The legitimate lsass.exe should reside in `C:\Windows\System32`. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ransomware deleting volume shadow copies to prevent recovery. The command 'vssadmin delete shadows /all /quiet' is a hallmark of ransomware, used to eliminate backup copies before encrypting files. It is often executed via cmd.exe in scripts. Detecting this command in process creation logs is a high-fidelity indicator of ransomware activity, allowing for immediate response.

Answer

A legitimate backup operation removing old shadow copies

Answer

A system administrator troubleshooting disk space issues

Answer

A malware family using shadow copy deletion for anti-forensics

Question 14

A security analyst is reviewing a packet capture of traffic entering the corporate network. The analyst notices a large number of TCP SYN packets sent to multiple destination ports on a single internal host, with no corresponding ACK packets. The source IP addresses are spoofed and vary across each packet. Which type of attack is this traffic MOST likely associated with?

Accepted Answer

SYN flood. The traffic pattern of numerous TCP SYN packets from spoofed sources without completing the three-way handshake is characteristic of a SYN flood. This attack exploits the TCP connection setup process to exhaust the target's resources, denying service to legitimate users. The other options involve different protocols or layers and do not match the observed packets.

Answer

UDP amplification

Answer

ARP poisoning

Answer

DNS tunneling

Question 15

A security analyst is examining a Windows 10 endpoint suspected of compromise. The analyst runs `wmic process get name,processid,executablepath,parentprocessid` and observes a process named `lsass.exe` with PID 1234 and executable path `C:\Windows\Temp\lsass.exe`. The legitimate lsass.exe should reside in `C:\Windows\System32`. Which of the following is the MOST likely explanation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The process is likely malware masquerading as svchost.exe.. Legitimate svchost.exe always runs from %SystemRoot%\System32\svchost.exe. An instance with an executable path in C:\Users\Public is almost certainly malware masquerading as a system process. Attackers use this technique to blend in with normal system activity. Analysts should verify the digital signature, parent process, and loaded modules to confirm maliciousness.

Answer

The process is a legitimate svchost.exe because the name matches the system process.

Answer

The process is a legitimate svchost.exe running from a non-standard location due to a Windows update.

Answer

The process is likely a legitimate svchost.exe that was copied to the Public folder by a user.

Question 16

A security analyst is reviewing the organization's incident response plan. The plan currently defines containment, eradication, and recovery but does not include a formal step to determine the root cause of an incident. Which phase of the NIST SP 800-61 incident response lifecycle should the analyst add to address this gap?

Accepted Answer

Post-incident activity. The NIST SP 800-61 lifecycle includes preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Root cause analysis and lessons learned belong to the post-incident activity phase, which the plan lacks. Adding it ensures the organization systematically identifies why the incident occurred and improves future response.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Detection and analysis

Question 17

A security analyst is reviewing a packet capture from the DMZ and sees a host at 203.0.113.45 sending a flood of TCP segments with the SYN flag set to many different destination ports on a single internal web server, all within a few seconds. The source IP never completes the three-way handshake. Which type of attack is this host most likely performing?

Accepted Answer

SYN flood denial-of-service attack. The observed traffic matches a SYN flood: a high volume of TCP SYN segments to many ports from one source, with no completed three-way handshakes. Each half-open connection consumes server resources until the backlog is exhausted, denying service to legitimate clients. This is a classic volumetric denial-of-service technique at Layer 4.

Answer

Cross-site scripting attack

Answer

UDP amplification attack

Answer

ARP spoofing attack

Question 18

A security administrator is reviewing the company's incident response plan and wants to ensure that the team understands the difference between a vulnerability, a threat, and a risk. During a tabletop exercise, the administrator presents a scenario: a web server has an unpatched Apache Struts vulnerability, and a known exploit exists publicly. Which term best describes the unpatched Apache Struts vulnerability in this context?

Accepted Answer

Vulnerability. The unpatched Apache Struts issue is a software flaw that can be leveraged by an attacker, making it a vulnerability. Understanding this distinction is crucial for risk assessment: vulnerabilities are weaknesses, threats are actors or events that can exploit them, and risk is the potential impact. Correctly identifying the vulnerability helps prioritize remediation such as patching.

Answer

Threat

Answer

Exploit

Answer

Risk

Question 19

A security analyst is reviewing a packet capture and observes that a workstation is sending a large volume of TCP SYN packets to many different destination IP addresses on port 445, with no corresponding completed handshakes. The analyst suspects malware is performing reconnaissance. Which type of activity is this workstation most likely performing?

Accepted Answer

TCP port scanning of many hosts on port 445. The traffic pattern of many TCP SYN packets to numerous destination addresses on a single port, with no completed handshakes, is the signature of TCP SYN scanning. This is a reconnaissance technique used to identify live hosts and open services, commonly on port 445 for SMB. A SYN flood would focus on one target, and brute-force or man-in-the-middle activity would require established connections.

Answer

A man-in-the-middle attack intercepting SMB traffic

Answer

A SYN flood denial-of-service attack against a single target

Answer

A brute-force attack against SMB credentials

Question 20

A security analyst is reviewing Windows Event Logs on a domain controller. The analyst sees multiple Event ID 4769 (Kerberos service ticket was requested) with the same user account but different service names, occurring in a short time frame. Which of the following attacks is MOST likely indicated?

Accepted Answer

Kerberoasting. Kerberoasting is an attack where an adversary requests Kerberos service tickets for service accounts and then cracks them offline. Event ID 4769 is generated for each TGS request. A burst of 4769 events with different service names from the same user is a strong indicator. Monitoring for such patterns helps detect Kerberoasting attempts.

Answer

Golden Ticket

Answer

Pass-the-Hash

Answer

DCSync