200-201 Practice Exam 59 — 20 Questions

Question 1

Which THREE actions are mandatory in the evidence handling process according to standard forensic procedures?

Accepted Answer

Document the chain of custody. Options A, C, and D are mandatory: documenting chain of custody, using a write blocker when imaging, and creating a forensic image of the device. Option B (deleting malware) destroys evidence. Option E (rebooting) is avoided to preserve evidence.

Answer

Delete any malware found immediately

Answer

Reboot the device to clear temporary files

Question 2

Which security policy defines the process for reporting discovered security vulnerabilities to the organization?

Accepted Answer

Vulnerability Disclosure Policy. A vulnerability disclosure policy specifically defines the process for reporting discovered security vulnerabilities to the organization, including how to submit reports and how the organization will respond. The Acceptable Use Policy (B) governs employee behavior regarding technology use, not vulnerability reporting. The Incident Response Policy (C) addresses actions during active security incidents. The Change Management Policy (D) controls changes to systems and infrastructure.

Answer

Acceptable Use Policy

Answer

Incident Response Policy

Answer

Change Management Policy

Question 3

Which THREE of the following are common types of security policies that organizations typically implement?

Accepted Answer

Data Classification Policy. The correct answers are B, C, and E. Data Classification Policy (B), Password Policy (C), and Acceptable Use Policy (E) are common types of security policies. ISO 27001 Standard (A) is a framework, not a policy. Patch Management Procedure (D) is a procedure, not a policy.

Answer

ISO 27001 Standard

Answer

Patch Management Procedure

Question 4

An organization is developing a new cloud-based application. The security policy requires that all data be encrypted in transit and at rest. Which combination of controls meets this requirement?

Accepted Answer

Use HTTPS and encrypt the database with TDE. HTTPS encrypts data in transit and TDE encrypts data at rest. Option A is wrong because a VPN encrypts data in transit but not at rest. Option B is wrong because database encryption alone does not encrypt in transit. Option C is wrong because HTTPS encrypts data in transit but not at rest.

Answer

Use a VPN for all connections

Answer

Encrypt the database using Transparent Data Encryption (TDE)

Answer

Use HTTPS for all communication

Question 5

An organization's data classification policy defines four levels: Public, Internal, Confidential, and Restricted. An employee accidentally sends an email containing customer payment card information (PCI) to the entire company mailing list. The data should have been classified as which level?

Accepted Answer

Restricted. Payment card information (PCI) is highly sensitive data protected by regulations like PCI DSS. In the organization's classification, Restricted is the highest level, intended for data whose unauthorized disclosure could cause severe harm or legal penalties. The other levels are less restrictive: Public is non-sensitive, Internal is for internal use but not highly sensitive, and Confidential is sensitive but not as critical as Restricted. Therefore, the correct classification is Restricted (Option B).

Answer

Public

Answer

Internal

Answer

Confidential

Question 6

A security analyst at a medium-sized enterprise notices that an employee's workstation has been sending outbound traffic to a known malicious IP address at irregular intervals. The analyst runs a scan and finds no malware signatures. What should the analyst do next?

Accepted Answer

Escalate to the incident response team for further investigation.. The situation—outbound traffic to a known malicious IP without detected malware signatures—suggests an advanced threat such as a zero-day exploit or fileless malware. Escalating to the incident response team ensures a thorough investigation, preserves evidence, and coordinates a proper response. Blocking the IP alone (A) does not address the underlying compromise. Reviewing history (C) is part of the investigation but escalation is the immediate next step. Disconnecting and reimaging (D) could destroy evidence and is premature.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Review the employee's recent web browsing history and email attachments.

Answer

Immediately disconnect the workstation from the network and reimage it.

Question 7

Refer to the exhibit. A security analyst observes these syslog messages from an ASA firewall. Based on the messages, which type of activity is most likely occurring?

Accepted Answer

An external host scanning internal hosts for open port 80. The syslog messages show multiple connection attempts from the same external source IP to different internal destination IP addresses on port 80, with varying source ports. This pattern is characteristic of a port scan, specifically an external host scanning internal hosts for open port 80. Option A is incorrect because the traffic originates from outside, not inside. Option B is incorrect because a denial of service attack typically overwhelms the firewall with many packets or targets multiple ports, not a sequential scan. Option D is incorrect because the messages indicate connection attempts, not successful established connections.

Answer

An inside host attempting to access a web server on the outside

Answer

A denial of service attack flooding the firewall

Answer

Successful web traffic from an external client

Question 8

Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?

Accepted Answer

The source IP 10.10.10.5 should be allowed to pass HTTP traffic.. The syslog message indicates a deny action for HTTP traffic from 10.10.10.5 to 192.168.1.10 on port 80. The security policy states that all traffic from the 10.10.10.0/24 subnet to the 192.168.1.0/24 subnet is denied, except for HTTP traffic from specific IP addresses. The denial of this packet implies that 10.10.10.5 is not on the exception list. Therefore, the source IP 10.10.10.5 should be investigated to determine if it should be added to the permitted list, making option D correct.

Answer

The packet was permitted but logged.

Answer

The packet was denied because it was HTTP traffic from 10.10.10.5.

Answer

The destination IP 192.168.1.10 is compromised.

Question 9

During a security incident, the incident response team isolates a compromised workstation from the network. The security policy requires that all actions taken during the incident be documented and approved. However, the team lead isolates the workstation without waiting for formal approval. Which principle of incident response is being prioritized?

Accepted Answer

Speed of containment. The team lead prioritized isolating the workstation to prevent the threat from spreading laterally, which aligns with the principle of rapid containment. While formal approval is required by policy, in an active incident the immediate need to stop the attack often overrides administrative steps. The speed of containment is critical because delaying isolation could allow malware or an attacker to pivot to other systems, increasing the scope of the breach.

Answer

Rapid containment

Answer

Chain of custody

Answer

Preservation of evidence

Question 10

Your organization uses a SIEM solution (Cisco Secure Network Analytics and Cisco Secure Cloud Analytics) for monitoring. You are the lead analyst and receive multiple alerts: (1) A host on the internal network is making thousands of outbound connections to a known malicious IP on port 80 in a short time. (2) At the same time, there is a spike in DNS queries from the same host to a domain that is registered very recently. (3) The firewall logs show that the host is communicating with internal servers on high ports (e.g., 4444, 5555). The host is a Windows 10 workstation used by the finance department. The user reports it has been slow recently. You have access to Cisco AMP for Endpoints, Cisco Firepower NGFW, and Cisco Stealthwatch. The environment has 500 endpoints, and the network uses 802.1X authentication. What should be your first course of action?

Accepted Answer

Isolate the host from the network immediately and begin investigation.. The combination of outbound connections to a known malicious IP, recent domain DNS queries, and internal C2-like traffic on high ports (4444, 5555) indicates a confirmed compromise. Immediate isolation via 802.1X or switch ACL stops lateral movement and data exfiltration while preserving forensic evidence. Cisco AMP for Endpoints can then be used to analyze the host offline without risking further spread.

Answer

Check the current baseline for the host to confirm it is anomalous.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Update the antivirus signatures on the host and run a full scan.

Question 11

Which TWO actions are recommended when tuning IDS signatures to reduce false positives?

Accepted Answer

Modify signature thresholds to match typical traffic patterns. Options C and E are correct. Modifying signature thresholds to match typical traffic patterns (C) and whitelisting known good behavior (E) are standard IDS tuning practices to reduce false positives. Option A is ineffective because increasing severity does not reduce false positive counts. Option B replaces the system rather than tuning it. Option D may remove detection of actual threats and is not recommended.

Answer

Increase alert severity for all signatures

Answer

Replace IDS with a next-generation firewall

Answer

Disable signatures that generate frequent alerts

Question 12

What does this firewall log entry indicate?

Accepted Answer

Inbound HTTP connection denied. The firewall log entry shows a packet with source IP 203.0.113.5 (external) and destination IP 10.0.0.2 (internal) on destination port 80 (HTTP). The action is 'DENY' and the direction is 'inbound', indicating an inbound HTTP connection attempt from an external host to an internal host that was denied by the firewall.

Answer

Outbound HTTP connection denied

Answer

Inbound HTTP connection allowed

Answer

Outbound HTTP connection allowed

Question 13

A small business uses a cloud-based email service. The IT administrator wants to protect against phishing attacks that target employees. Which security control should be implemented first?

Accepted Answer

Conduct weekly security awareness training. Security awareness training is the most important first control against phishing because it educates users to recognize and avoid phishing attempts, reducing the likelihood of successful attacks. While MFA and antivirus are valuable, training addresses the human element directly. A WAF protects web applications, not email, and is not a first-line defense for phishing targeting cloud email.

Answer

Install antivirus software on all endpoints

Answer

Deploy a web application firewall (WAF)

Answer

Enable multi-factor authentication (MFA) on email accounts

Question 14

An analyst sees an alert for 'SQL injection' but the target is an internal application that only accepts POST requests with JSON data. The alert was triggered by a parameter in the URL. What is the most likely issue?

Accepted Answer

False positive due to mismatch. The alert was triggered by a parameter in the URL, but the target application only accepts POST requests with JSON data. Since SQL injection via a URL parameter is impossible against an application that does not process URL parameters, the alert is a false positive caused by a mismatch between the signature's expected attack vector and the actual application behavior.

Answer

Application vulnerability

Answer

True positive SQL injection

Answer

Signature misconfiguration

Question 15

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

Accepted Answer

The workstation is infected with malware attempting to spread via SMB. Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Answer

The user is browsing the web and the firewall is blocking HTTP

Answer

The workstation is performing a DNS lookup

Answer

The workstation is performing a legitimate file transfer using FTP

Question 16

You are a security analyst at a financial institution. The network consists of a traditional perimeter firewall, an internal IDS (Snort), and a separate network monitoring tool that captures full packet data. Recently, the bank experienced a breach where an attacker exfiltrated customer data via DNS tunneling. The attack went undetected for weeks. The CISO wants to improve detection of data exfiltration and has tasked you with proposing a new monitoring strategy. The current IDS has signatures for common malware C2 channels but no specific DNS tunneling rules. You have access to the full packet capture archive. Which approach would be most effective in detecting DNS tunneling while minimizing false positives?

Accepted Answer

Write custom Snort rules that monitor DNS query size, frequency, and domain name entropy, and use full packet capture to baseline typical DNS behavior.. DNS tunneling exploits legitimate DNS protocol behavior by encoding data in query payloads, making it invisible to signature-based detection. By writing custom Snort rules that monitor query size (typically > 255 bytes for TXT records), frequency (abnormally high query rates per domain), and domain name entropy (random-looking subdomains), and using full packet capture to baseline normal DNS traffic, you can detect anomalies indicative of tunneling with high precision and low false positives.

Answer

Block all DNS queries to external domains not on a whitelist, and log all blocked queries for review.

Answer

Increase the Snort signature sensitivity for all DNS-related alerts to maximum.

Answer

Deploy NetFlow monitoring on the DNS server and look for traffic volume anomalies.

Question 17

You are a security operations analyst for a medium-sized enterprise. The company's security policy requires that all endpoint devices have antivirus software installed and updated. During a routine check, you find that a group of 50 laptops used by the sales team have not received antivirus updates for over three months. The policy also states that any non-compliant devices must be quarantined from the network until they are remediated. The sales team manager argues that quarantining the laptops will disrupt critical sales activities. The company's incident response policy has a clause that allows for temporary exceptions in business-critical situations, but requires approval from the CISO. What is the best course of action?

Accepted Answer

Request a temporary exception from the CISO while expediting the updates. It balances security policy compliance with business continuity. The incident response policy explicitly allows temporary exceptions for business-critical situations with CISO approval, and expediting the updates ensures the 50 laptops are remediated quickly. Quarantining without considering the business impact could violate the company's own exception clause, while ignoring the issue or updating without quarantining bypasses the security controls required by policy.

Answer

Ignore the issue to avoid disrupting sales activities

Answer

Quarantine the laptops immediately as per policy

Answer

Update the antivirus without quarantining, then report to management

Question 18

You are a cybersecurity analyst in a SOC. The company uses a combination of Snort NIDS and Windows Event Log monitoring. At 3:00 PM, you receive a critical alert: 'ET TROJAN Observed Malicious SSL Certificate (Fake Google)'. The alert shows that a workstation (IP 10.0.1.45) initiated an SSL connection to IP 192.0.2.10 on port 443. The certificate presented by the server is self-signed and claims to be 'google.com'. The destination IP is not in any known Google IP range. You check the firewall logs and see that the outbound connection was allowed. The workstation's host logs show that the user is a marketing employee who frequently accesses webmail. The user reports no unusual behavior. You also check the company's web proxy logs and see that the user accessed 'http://www.google.com' earlier today, but the SSL connection is to a different IP. What should be your next step?

Accepted Answer

Isolate the workstation from the network and perform a forensic analysis. The alert indicates a potential man-in-the-middle (MITM) attack or malware using a self-signed SSL certificate impersonating google.com. Isolating the workstation is critical to prevent lateral movement or data exfiltration while preserving evidence for forensic analysis. The combination of Snort NIDS detecting the malicious certificate and the connection to an unknown IP (192.0.2.10) strongly suggests compromise, regardless of user reports.

Answer

Ignore the alert because the user is unaware of any issue

Answer

Wait and monitor the workstation for further alerts before taking action

Answer

Block the destination IP 192.0.2.10 on the firewall

Question 19

You are a security analyst at a financial institution. The network consists of three segments: internal corporate network (10.0.0.0/24), DMZ (192.168.1.0/24) hosting a web server and an email server, and a guest wireless network (172.16.0.0/24). The firewall is configured with the following rules: (1) permit inbound HTTP/HTTPS to the web server from any; (2) permit inbound SMTP to the email server from any; (3) deny all other inbound traffic; (4) permit all outbound traffic from internal network; (5) deny all outbound traffic from guest network to internal and DMZ, but permit to internet. Recently, an employee reported that sensitive files on an internal file server (10.0.0.10) were accessed without authorization. Logs show that the access originated from an IP address in the guest network (172.16.0.50) at 3:00 AM. The guest network is open (no authentication required). The internal file server is not directly accessible from the guest network per rule (5). However, the attacker used the web server as a pivot: they compromised the web server via an unpatched vulnerability, then from the web server they connected to the internal file server. Which of the following actions would BEST prevent this type of attack in the future?

Accepted Answer

Add a firewall rule that permits only necessary traffic from the DMZ to specific internal servers, and deny all other DMZ-to-internal traffic. The attack leveraged the DMZ web server as a pivot to reach the internal file server. By implementing a firewall rule that permits only necessary traffic from the DMZ to specific internal servers (e.g., only allow the web server to communicate with a database server on TCP/3306) and denies all other DMZ-to-internal traffic, you enforce a least-privilege segmentation policy. This would block the web server from initiating arbitrary connections to the internal file server (10.0.0.10), even if the web server is compromised, directly preventing the pivot attack.

Answer

Implement a firewall rule that denies all traffic from the DMZ to the internal network

Answer

Move the web server to the internal network and place a reverse proxy in the DMZ

Answer

Apply a patch to the web server and require authentication on the guest network

Question 20

Based on the exhibit, which traffic is permitted?

Accepted Answer

All HTTPS traffic to the host 198.51.100.10.. The exhibit shows an access control list (ACL) entry 'permit tcp any host 198.51.100.10 eq 443'. This permits TCP traffic with a destination port of 443 (HTTPS) to the specific host 198.51.100.10 from any source. Therefore, only HTTPS traffic destined to that host is permitted, making option D correct.

Answer

All IP traffic from the host 198.51.100.10.

Answer

Only HTTPS traffic from the host 198.51.100.10.

Answer

All TCP traffic from any host to any host.