200-201 Practice Test 6 — 10 Questions

Question 1

An analyst sees a Snort alert with the message 'ET POLICY Outbound connection to known malicious IP'. What does this indicate?

Accepted Answer

An internal host is connecting to an IP that is on a threat intelligence blacklist.. Snort signature-based IDS alerts on matching rules. This alert indicates a connection from an internal host to a known malicious IP address, likely a command-and-control server.

Answer

A malicious IP is connecting to an internal host.

Answer

The firewall blocked the connection.

Answer

The connection is encrypted and safe.

Question 2

What is the primary goal of the 'integrity' pillar of the CIA triad?

Accepted Answer

Protect data from unauthorized modification. The 'integrity' pillar of the CIA triad ensures that data is not altered or tampered with by unauthorized parties. This is achieved through mechanisms such as hashing (e.g., SHA-256), checksums, and digital signatures that detect any unauthorized modification. Option D correctly identifies this goal, as protecting data from unauthorized modification is the core purpose of integrity controls.

Answer

Keep data secret from unauthorized users

Answer

Ensure data is accessible when needed

Answer

Provide proof that a user performed an action

Question 3

Refer to the exhibit. Which security protocol is being configured?

Accepted Answer

IPsec VPN (IKE phase 1). The exhibit shows the configuration of an IPsec VPN IKE phase 1 policy using the `crypto isakmp policy` command. The parameters set—encryption algorithm (e.g., aes), hash algorithm (e.g., sha), Diffie-Hellman group (e.g., 2), and authentication method (e.g., pre-share)—are all specific to IKE phase 1, which establishes a secure authenticated channel for further key exchange. This is not used for SSL VPN, MACsec, or SSH, as those protocols have distinct configuration syntax and purposes.

Answer

SSL VPN

Answer

MACsec

Answer

SSH

Question 4

A SOC analyst is reviewing proxy logs and wants to identify indicators of potential data exfiltration over HTTP. Which two patterns should the analyst treat as suspicious? (Choose two.)

Accepted Answer

Large outbound POST requests to a single external IP address at regular intervals.. Exfiltration over HTTP often appears as large outbound uploads, especially to new or untrusted destinations. Regular large POST requests and high-volume uploads to newly registered domains both indicate data leaving the environment in a manner inconsistent with normal business traffic. These patterns warrant deeper investigation.

Answer

HTTP 404 errors generated by users mistyping URLs in the browser.

Answer

Repeated GET requests to the same internal web server for static images.

Answer

Downloading software updates from a known vendor's HTTPS site.

Question 5

During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?

Accepted Answer

The scan sends SYN packets and, upon receiving SYN-ACK, sends RST packets.. A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.

Answer

The scan sends SYN packets and expects ICMP unreachable messages for open ports.

Answer

The scan sends SYN packets and waits for a timeout on closed ports.

Answer

The scan sends SYN packets and completes the three-way handshake for open ports.

Question 6

Which of the following is a common indicator of a brute-force attack on an SSH server?

Accepted Answer

Repeated login attempts with different usernames and passwords in a short period.. A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.

Answer

A single failed login attempt.

Answer

Multiple successful logins from the same user.

Answer

High CPU usage on the server.

Question 7

An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:

Accepted Answer

Pass-the-hash. Pass-the-hash is the technique where an attacker uses a captured NTLM password hash directly to authenticate without knowing the plaintext password. Because NTLM authentication accepts the hash as the credential, the attacker can replay it to access systems.

Answer

Password spraying

Answer

Brute force

Answer

Kerberos ticket reuse

Question 8

An organization must comply with a regulation that requires protecting the privacy of EU citizens' personal data. Which compliance framework applies?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the EU regulation specifically designed to protect the privacy and personal data of EU citizens. It applies to any organization that processes or controls the personal data of individuals in the EU, regardless of where the organization is based. This makes GDPR the correct compliance framework for the scenario described.

Answer

HIPAA

Answer

ISO 27001

Answer

PCI DSS

Question 9

What is the purpose of a security baseline?

Accepted Answer

To define the minimum acceptable security posture. A security baseline defines the minimum acceptable security posture for systems, networks, and devices. It establishes a standard configuration that must be met to ensure a consistent level of security across the organization, such as requiring specific patch levels, disabling unnecessary services, and enforcing password policies. Without a baseline, there is no reference point to measure compliance or identify deviations that could indicate a security weakness.

Answer

To respond to security incidents

Answer

To encrypt sensitive data

Answer

To detect malware infections

Question 10

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet