200-201 Practice Exam 59 — 20 Questions

Question 1

A security analyst at a financial services company is reviewing the organization's security program. The CISO wants to ensure that the confidentiality, integrity, and availability of information assets are protected by administrative, physical, and technical controls. Which security concept is the CISO describing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CIA triad, which defines the three core objectives of information security that controls must protect.. The scenario names confidentiality, integrity, and availability as the properties controls must protect. These three objectives form the CIA triad, the foundational model of information security. Administrative, physical, and technical controls are all implemented to preserve these properties, so the concept described is the CIA triad rather than an access framework, a network model, or a single control principle.

Answer

The AAA framework, which governs authentication, authorization, and accounting for user access.

Answer

The OSI model, which defines seven layers of network communication used to design secure protocols.

Answer

The principle of least privilege, which restricts users to only the access required to perform their jobs.

Question 2

A security analyst is reviewing a suspicious file found on a user's workstation. The file has a .docx extension but when the analyst inspects its header bytes, the file begins with the magic number for a Windows Portable Executable. The user reports the file arrived as an email attachment. Which type of malware delivery technique does this describe?

Accepted Answer

A file masquerading as a document but actually an executable. The file's extension claims it is a Word document, but its header bytes match a Windows Portable Executable. This is a classic masquerading technique where malware is disguised as a benign file type to trick users into executing it. The mismatch between the expected file signature and the actual content is the key indicator, distinguishing it from macro viruses, polymorphic code, or rootkits.

Answer

A rootkit that hides its presence on the system

Answer

A polymorphic virus that changes its own code to evade detection

Answer

A macro virus embedded in a legitimate document

Question 3

An analyst is reviewing network traffic and observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by large TXT record responses. The queries occur at regular intervals and the volume is unusually high. Which type of attack is most likely indicated?

Accepted Answer

DNS tunneling. The use of long, random-looking subdomains under one domain with large TXT record responses and regular intervals is characteristic of DNS tunneling. Attackers use DNS to exfiltrate data or maintain command-and-control because DNS is often allowed through firewalls. This pattern is not consistent with cache poisoning, amplification, or DGA, which have different traffic profiles.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

Domain generation algorithm

Question 4

An analyst is investigating a Linux web server that is exhibiting unusual outbound network traffic. The analyst runs 'lsof -i' and notices that the process 'apache2' has an established connection to an external IP address on port 4444. Further investigation shows that a file named 'update.php' in the web root contains obfuscated code. Which type of compromise does this most likely represent?

Accepted Answer

A web shell providing remote command and control. The combination of an outbound connection from the web server process on a common reverse shell port (4444) and an obfuscated PHP file in the web root is a classic indication of a web shell. Attackers use web shells to execute commands and maintain access, often leading to data exfiltration or further network compromise.

Answer

A scheduled backup process transferring data to a remote server

Answer

A legitimate plugin communicating with an update server

Answer

A misconfigured Apache module causing unexpected connections

Question 5

A security operations center analyst is reviewing a vulnerability scan report for a web server. The report identifies that the server is running an outdated version of Apache HTTP Server with a known remote code execution vulnerability. The analyst needs to classify this finding. Which term best describes this vulnerability?

Accepted Answer

A known software vulnerability, because it is a documented flaw in the Apache code that can be exploited.. The scan reveals an outdated Apache version with a published remote code execution flaw. That is a known software vulnerability: a documented weakness in code for which a fix typically exists. It is not a configuration error, an unknown zero-day, or a human-focused social engineering technique, so the appropriate classification is a known software vulnerability requiring patch or upgrade remediation.

Answer

A software misconfiguration, because the server is running an unsupported version.

Answer

A social engineering attack, because the attacker could trick users into visiting a malicious site.

Answer

A zero-day exploit, because the vulnerability allows remote code execution.

Question 6

A security analyst is reviewing the access control strategy for a research and development department. The department handles highly sensitive intellectual property, and the organization wants to ensure that employees can only access information strictly necessary for their current project tasks, even if they have previously worked on other projects. Which access control principle is being enforced?

Accepted Answer

Need to know. The need-to-know principle ensures that access to information is granted only to individuals whose current responsibilities require that specific information. In this scenario, the organization wants to restrict access to intellectual property based on project tasks, which directly reflects need-to-know. Least privilege is about minimum permissions, but need-to-know is more granular and focuses on information relevance to the task.

Answer

Mandatory access control

Answer

Separation of duties

Answer

Least privilege

Question 7

A security operations center (SOC) analyst is investigating a security incident where an attacker gained initial access to a corporate network. The analyst suspects the attacker used a technique that involves exploiting a vulnerability in a public-facing web server to execute arbitrary code. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Exploitation. The Cyber Kill Chain phase of exploitation involves taking advantage of a vulnerability to execute code on a target system. The scenario describes an attacker exploiting a web server vulnerability to run arbitrary code, which fits the exploitation phase. Reconnaissance and weaponization are preparatory, while installation is a later step for maintaining access.

Answer

Weaponization

Answer

Installation

Answer

Reconnaissance

Question 8

An analyst is examining a Windows system for evidence of credential dumping. The analyst runs 'Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688}' and filters for processes with 'lsass.exe' as the target. The output shows that a process named 'procdump.exe' was executed with the command line 'procdump.exe -ma lsass.exe lsass.dmp'. Which type of attack does this indicate?

Accepted Answer

Credential dumping via LSASS memory dump. Using procdump to dump LSASS memory is a well-known credential dumping technique. Attackers often rename procdump or use it directly to avoid detection. The resulting dump file can be exfiltrated and analyzed offline to extract credentials. Detecting this behavior involves monitoring for process creation of procdump.exe with lsass.exe as an argument, as well as other tools like Task Manager or comsvcs.dll.

Answer

A backup process capturing system state

Answer

A malware family using process injection into LSASS

Answer

A legitimate troubleshooting step to diagnose LSASS crashes

Question 9

A security analyst at a retail company is reviewing DNS logs and notices a workstation repeatedly resolving random-looking subdomains such as a8f3k2.example-bad.com, followed by a long TXT record response containing encoded data. No user reported visiting any website. Which technique is most likely occurring?

Accepted Answer

DNS tunneling used for command-and-control or data exfiltration. Random subdomains plus oversized TXT replies from a single workstation indicate DNS tunneling, a covert channel that abuses port 53 to move data or commands past egress controls. Because DNS is almost always permitted, attackers use it for command-and-control and exfiltration. The analyst should isolate the host, capture full DNS traffic, and inspect the resolver logs for the encoded payload pattern.

Answer

Cache poisoning of the local resolver to redirect the workstation to a malicious site

Answer

A domain generation algorithm used only for load balancing legitimate traffic

Answer

A DNS amplification attack targeting the internal recursive resolver

Question 10

A security analyst is investigating a Windows host for signs of fileless malware. The analyst runs a memory analysis tool and observes a process named 'powershell.exe' with a parent process of 'winword.exe'. The command line includes '-enc' followed by a long base64 string. Which technique is most likely being used by the attacker?

Accepted Answer

Malicious macro execution. The scenario describes winword.exe spawning powershell.exe with an encoded command, a hallmark of malicious macro execution. Attackers embed macros in Word documents that execute PowerShell to download or run payloads, often using base64 encoding to hide the script. Other techniques like DLL injection, process hollowing, or scheduled tasks do not match the observed parent-child relationship and command-line pattern, making macro execution the most likely.

Answer

Process hollowing

Answer

DLL injection

Answer

Scheduled task persistence

Question 11

An analyst is triaging a Windows 10 host and finds a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' that runs a PowerShell script from C:\Users\Public\update.ps1 every 30 minutes. The script base64-decodes a payload and calls Invoke-WebRequest to a remote host. Which action should the analyst take FIRST to preserve evidence while containing the threat?

Accepted Answer

Capture volatile data including the running process list, network connections, and the contents of C:\Users\Public\update.ps1, then disable the scheduled task and isolate the host.. The order of volatility dictates that the most perishable evidence (memory, network state, running processes) is captured before less volatile evidence (disk files) and before any remediation. Capturing the script, process list, and connections first preserves investigative value; disabling the task and isolating the host then stops the beaconing without destroying evidence. Reboots, AV quarantine, and deletion all destroy or alter artifacts needed to scope the compromise.

Answer

Immediately reboot the host into Safe Mode to stop the PowerShell execution, then begin collecting forensic artifacts from the disk.

Answer

Run a full antivirus scan and allow it to quarantine any detected files, then review the scheduled task XML for indicators.

Answer

Delete the scheduled task and the update.ps1 file immediately, then capture a memory image of the host for offline analysis.

Question 12

A security analyst is examining a suspicious executable found on a compromised host. The analyst runs the file in a sandbox and observes that it creates a mutex named 'Global\MyMutex123', attempts to connect to an external IP address on port 443, and modifies the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Which type of analysis is the analyst performing?

Accepted Answer

Dynamic analysis. Dynamic analysis is the process of executing malware in a controlled environment and observing its behavior, such as network connections, registry changes, and mutex creation. The analyst's actions in the sandbox directly match this definition. Static analysis, memory forensics, and log analysis do not involve running the sample and monitoring its runtime effects.

Answer

Static analysis

Answer

Memory forensics

Answer

Log analysis

Question 13

A security analyst is investigating a recent security breach. The analyst discovers that an attacker gained access to the network by exploiting a vulnerability in an unpatched web server. After gaining access, the attacker moved laterally to other systems and exfiltrated sensitive data. The organization wants to improve its security posture to prevent similar incidents. Which security concept best describes the attacker's actions after initial compromise?

Accepted Answer

Lateral movement. After exploiting the web server, the attacker moved to other systems, which is lateral movement. This phase is about expanding access within the network. Privilege escalation, persistence, and reconnaissance are different phases of an attack. Lateral movement is a key concept in understanding how attackers spread and compromise additional assets.

Answer

Reconnaissance

Answer

Persistence

Answer

Privilege escalation

Question 14

A security analyst is reviewing the organization's defense-in-depth strategy. The analyst must recommend TWO controls that specifically reduce the risk of successful phishing attacks against employees. Which two controls should the analyst recommend? (Choose two.)

Accepted Answer

Implementing email filtering that blocks messages with malicious attachments and links.. Email filtering and security awareness training are both direct anti-phishing controls. Filtering blocks malicious messages before delivery, while training helps users recognize and avoid phishing attempts that bypass filters. Together they form a layered defense. The other options address different threats such as web application attacks, data-at-rest protection, and lateral movement containment.

Answer

Configuring network segmentation to isolate the finance department from the rest of the network.

Answer

Deploying a web application firewall (WAF) to inspect HTTP traffic to the company's public website.

Answer

Enabling full-disk encryption on all employee laptops.

Question 15

A security analyst is examining a network capture and observes that an attacker is sending a large volume of SYN packets to a web server with spoofed source IP addresses. The server's connection table is filling up, and legitimate users cannot connect. Which type of attack is the analyst observing?

Accepted Answer

A TCP SYN flood, which exhausts the server's connection table with half-open connections.. The capture shows many SYN packets with spoofed sources, and the server's connection table is exhausted, blocking legitimate users. This is the classic signature of a TCP SYN flood, a denial-of-service attack that abuses the TCP three-way handshake. Smurf uses ICMP, DNS amplification uses resolvers, and man-in-the-middle intercepts traffic, so none match the observed half-open connection exhaustion.

Answer

A DNS amplification attack, which uses open resolvers to send large responses to a victim.

Answer

A man-in-the-middle attack, which intercepts and relays traffic between two parties.

Answer

A Smurf attack, which uses ICMP echo requests with a spoofed source to amplify traffic.

Question 16

An analyst is examining a suspicious executable recovered from a compromised host. Static analysis shows it is packed, and dynamic analysis in a sandbox reveals it creates a mutex, modifies registry Run keys, and attempts to connect to a hardcoded IP address on port 443. The file also contains a section with high entropy. Which characteristic most strongly suggests the file is packed or encrypted?

Accepted Answer

A section with high entropy. High entropy in a section is a classic static indicator of packing or encryption, because compressed or encrypted data lacks the patterns of normal executable code. Packers use this to hide the original code and evade signature-based detection. The other observed behaviors are runtime actions related to persistence and command-and-control, not structural evidence of packing.

Answer

Connection to a hardcoded IP on port 443

Answer

Modification of registry Run keys

Answer

Creation of a mutex

Question 17

A security analyst is evaluating the organization's use of cryptographic algorithms. The analyst must identify which TWO algorithms are symmetric encryption algorithms that can be used for bulk data encryption. (Choose two.)

Accepted Answer

3DES. Symmetric encryption algorithms use a single shared key for both encryption and decryption and are efficient for bulk data. AES and 3DES are both symmetric block ciphers suitable for this purpose. RSA and ECDSA are asymmetric, and SHA-256 is a hash function, so they do not meet the criteria.

Answer

ECDSA

Answer

SHA-256

Answer

RSA

Question 18

A security analyst is reviewing an incident in which an attacker gained initial access to a corporate workstation by exploiting a vulnerability in a browser plugin. After gaining access, the attacker moved laterally to a file server and exfiltrated data. The analyst must map these activities to the cyber kill chain. Which phase of the kill chain does the browser plugin exploitation represent?

Accepted Answer

Exploitation, because the attacker took advantage of the vulnerability to execute code on the workstation.. The browser plugin vulnerability was leveraged to gain code execution and initial access on the workstation. In the cyber kill chain, that action is exploitation, which follows reconnaissance and weaponization and precedes actions such as command and control, lateral movement, and exfiltration. The later lateral movement and data theft are separate phases, so the exploitation itself maps to the exploitation phase.

Answer

Command and control, because the attacker established a channel to manage the compromised host.

Answer

Weaponization, because the attacker prepared an exploit payload for the browser plugin.

Answer

Reconnaissance, because the attacker gathered information about the target before the attack.

Question 19

A security analyst is classifying security controls for a new data center. Which TWO of the following are examples of physical controls? (Choose two.)

Accepted Answer

Bollards installed at the building entrance. Physical controls are measures that protect tangible assets, facilities, and people. Bollards and security guards both operate in the physical world: bollards block vehicle access, and guards control and monitor entry. Access control lists, full-disk encryption, and awareness training are technical or administrative controls because they address logical access, data protection, or human behavior rather than physical barriers or presence. Only the two physical measures fit the requested category.

Answer

Security awareness training for staff

Answer

Full-disk encryption on employee laptops

Answer

Access control lists on the core router

Question 20

An organization is implementing a new security control that will verify the integrity of critical system files by comparing their current hash values against known good baseline values. Which security concept does this control primarily address?

Accepted Answer

Integrity. Integrity is the security principle that ensures data remains accurate and unaltered. By comparing current hash values to a baseline, the organization can detect unauthorized modifications to critical files. This control directly supports integrity, as any change would produce a different hash. Confidentiality, availability, and non-repudiation are separate concerns not addressed by hash comparison.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality