200-201 Practice Test 6 — 10 Questions

Question 1

An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood attack. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting resources. The lack of SYN-ACK replies indicates the target is overwhelmed.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

ICMP flood attack

Question 2

Based on the exhibit, what is the most likely conclusion about the host's security state?

Accepted Answer

The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.. The exhibit shows svchost.exe listening on UDP port 4444, which is abnormal because svchost.exe typically hosts Windows services over TCP or named pipes, not raw UDP. Additionally, an established TCP connection to 203.0.113.5 with cmd.exe as the associated process indicates an active command shell session, which is a classic sign of a backdoor. Therefore, option D is correct. Option A is incorrect because UDP port 4444 is not a standard Windows service port. Option B is incorrect because there is no direct evidence of data exfiltration; the connection is consistent with a remote shell. Option C is incorrect because legitimate remote admin tools do not typically use svchost.exe on UDP port 4444 with cmd.exe.

Answer

The svchost.exe process on UDP port 4444 indicates a Windows service that should be monitored.

Answer

The established TCP connection to 203.0.113.5 indicates data exfiltration to a known malicious IP.

Answer

The host is running a legitimate remote administration tool on port 4444.

Question 3

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

Accepted Answer

The internal host attempted to access a secure web server but was blocked.. The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.

Answer

The connection was successfully encrypted.

Answer

The firewall allowed the connection.

Answer

The external host attempted to access the internal host.

Question 4

Which THREE factors should be considered when tuning an IPS signature? (Choose three.)

Accepted Answer

Application protocol. Application protocol (B) is critical because IPS signatures are protocol-aware and must match the specific protocol context (e.g., HTTP, SMTP, DNS) to avoid false positives. Tuning based on the protocol ensures the signature only inspects traffic where the vulnerability or exploit is relevant, such as applying a SQL injection signature only to HTTP traffic.

Answer

Time of day

Answer

Packet length

Question 5

An analyst examines a PCAP file and sees a series of HTTP POST requests to an external server with Base64-encoded payloads in the request body. The payloads decode to small text strings. Which type of data exfiltration technique is being used?

Accepted Answer

HTTP data exfiltration. The analyst observes HTTP POST requests carrying Base64-encoded payloads in the request body that decode to small text strings. This is a classic indicator of HTTP data exfiltration, where sensitive data is encoded and sent over HTTP to an external server, bypassing security controls by blending with normal web traffic.

Answer

Session hijacking

Answer

DNS exfiltration

Answer

HTTP tunneling

Question 6

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

Accepted Answer

Remove the USB drive and use a different approved method of file transfer.. The security policy mandates scanning all external media before use. Because the USB drive has hardware write-protect, the antivirus scan cannot complete. Therefore, the employee should not use this USB drive and should instead use an alternative approved method (e.g., network share, email, or cloud storage) to transfer the file. This ensures compliance with the policy. Option A is incorrect because manually checking file extensions does not replace a proper malware scan. Option C is incorrect because disabling write protection may compromise security and the scan still might not be reliable. Option D is incorrect because bypassing the scan violates the policy.

Answer

Manually check each file for suspicious extensions.

Answer

Disable write protection and rescan.

Answer

Proceed with the file transfer since the scan failed due to hardware issue.

Question 7

Which security policy defines acceptable use of an organization's IT resources, including internet browsing and email?

Accepted Answer

Acceptable Use Policy (AUP). AUP specifies what is acceptable and unacceptable use of IT resources.

Answer

Password Policy

Answer

Information Security Policy

Answer

Remote Access Policy

Question 8

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Accepted Answer

The process path is in the Downloads folder.. The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Answer

The user is 'jsmith'.

Answer

The parent process is explorer.exe.

Answer

The event type is 'Process Creation'.

Question 9

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 10

Which THREE of the following are indicators that a network may be compromised by a botnet?

Accepted Answer

Unusual outbound traffic to known command-and-control servers.. Botnet-infected systems typically communicate with command-and-control (C2) servers to receive instructions or exfiltrate data. Unusual outbound traffic to known C2 IPs or domains is a strong indicator of botnet activity, as legitimate traffic rarely targets these addresses. Security monitoring tools often use threat intelligence feeds to flag such connections.

Answer

High volume of ICMP echo requests.

Answer

Increase in legitimate business traffic.