200-201 Practice Exam 60 — 20 Questions

Question 1

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope

Question 2

Which THREE of the following are key principles of zero trust security? (Choose three.)

Accepted Answer

Least privilege. Least privilege is a core principle of zero trust because it ensures users, devices, and applications are granted only the minimum permissions necessary to perform their functions. This limits the blast radius of a potential compromise by restricting lateral movement and access to sensitive resources. In zero trust, least privilege is enforced through granular policies, often using micro-segmentation and identity-based access controls, rather than relying on network location.

Answer

Perimeter-based security

Answer

Implicit trust

Question 3

In the NIST SP 800-61 Rev 2 incident response process, which phase involves documenting lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 Rev 2 is specifically designed for conducting a lessons learned meeting, documenting findings, and updating the incident response plan based on those insights. This phase ensures continuous improvement of the incident response process by capturing what worked, what didn't, and what changes are needed for future incidents.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 4

Which TWO of the following are characteristics of an advanced persistent threat (APT)?

Accepted Answer

Operates with low and slow tactics to avoid detection. An advanced persistent threat (APT) is characterized by its use of low-and-slow tactics to evade detection over long periods. This involves spreading malicious activity across many small, seemingly benign actions to avoid triggering threshold-based alerts in security monitoring systems. APTs are also defined by their targeted nature, focusing on specific organizations for espionage or data theft rather than opportunistic, broad-scale attacks.

Answer

Is typically financially motivated

Answer

Uses only commodity malware

Answer

Attacks are short-lived and quickly detected

Question 5

An analyst reviews NetFlow data and sees a single internal IP communicating with many external IPs on port 53, each with small UDP packets. The internal host is not a DNS server. What is the most likely explanation?

Accepted Answer

The host is the victim of a DNS amplification attack. The internal host is not a DNS server, yet it is sending small UDP packets to many external IPs on port 53. This is characteristic of a DNS amplification attack, where the attacker spoofs the victim's IP address and sends small queries to open DNS resolvers, which then send large responses to the victim. The NetFlow data shows the victim receiving the amplified traffic, not initiating it, making C correct.

Answer

The host is acting as a DNS server

Answer

The host is performing recursive DNS lookups

Answer

The host is scanning for open DNS resolvers

Question 6

A security analyst notices that a user's account has been used to access sensitive data outside of normal working hours. Which security concept is being violated?

Accepted Answer

Confidentiality. Accessing sensitive data outside normal working hours without authorization violates confidentiality, which ensures that data is accessible only to authorized users. Option A (Non-repudiation) is incorrect because it deals with proving that an action was performed, not access control. Option C (Availability) is incorrect because it concerns system uptime and accessibility, not data protection. Option D (Integrity) is incorrect because it ensures that data is not altered, not that access is prevented.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 7

A SOC analyst is investigating a potential data exfiltration incident. Which TWO indicators from NetFlow/IPFIX analysis would most strongly suggest data exfiltration?

Accepted Answer

Connection to an IP address flagged as malicious in threat intelligence. The two strongest indicators of data exfiltration from NetFlow/IPFIX are: (1) a high volume of data transferred to a single external IP address (Option D), suggesting large-scale data theft; and (2) communication with an IP address flagged as malicious (Option B), which may indicate a command-and-control server or a known exfiltration destination. Option A (consistent traffic at regular intervals) is more characteristic of beaconing or keep-alive traffic, often associated with C2 but not directly exfiltration. Option C (multiple connection attempts to various ports) describes a port scan, which is reconnaissance activity, not exfiltration. Option E (low volume of traffic to multiple external IPs) is typical of normal browsing activity.

Answer

Consistent traffic at regular intervals to an external IP

Answer

Multiple connection attempts to various ports on the same external IP

Answer

Low volume of traffic to multiple external IPs

Question 8

An analyst is performing host-based analysis on a machine that is part of a botnet. The machine is communicating with a C2 server over HTTPS. Which host-based evidence would be most useful to identify the C2 communication?

Accepted Answer

DNS logs showing queries to the C2 domain. DNS logs can reveal the domain name used for C2 communication even when the traffic is encrypted over HTTPS. Since the analyst is performing host-based analysis, DNS query logs on the host itself (e.g., from the DNS client service or a local DNS resolver) will show the host attempting to resolve the C2 domain, providing a direct indicator of the C2 server's address without needing to decrypt the HTTPS traffic.

Answer

Packet capture showing the unencrypted payload

Answer

A memory dump of the process showing encryption keys

Answer

Windows Event ID 5157 (Filtering Platform connection) showing the process ID

Question 9

An organization uses Zeek for network monitoring. An analyst wants to extract files transferred over HTTP from network traffic. Which Zeek script or functionality should they use?

Accepted Answer

Zeek's file extraction script. Zeek's file analysis framework can extract files from protocols like HTTP. The script 'file_extraction.zeek' or 'http_file_extraction.zeek' is used. However, the question likely expects 'Zeek's file extraction capability' or similar. Among options: 'HTTP::extract_files' is a Zeek event or script. The correct answer is that Zeek can extract files via its file analysis framework, and the specific script is often 'http_file_extraction.zeek'.

Answer

Zeek's connection log

Answer

Zeek's HTTP log

Answer

Zeek's DNS log

Question 10

In Wireshark, a security analyst wants to display only packets with source IP 10.0.0.1 and destination port 80. Which display filter should be used?

Accepted Answer

ip.src == 10.0.0.1 and tcp.dstport == 80. It uses the standard display filter syntax with the `==` operator and correct field names (`ip.src` and `tcp.dstport`). Option B uses `eq`, which is a valid operator in Wireshark display filters, but the Cisco CyberOps curriculum expects the `==` operator for consistency. Therefore, option B is considered incorrect in this context. Options C and D use capture filter syntax, which is not appropriate for the Wireshark display filter bar.

Answer

ip.src eq 10.0.0.1 and tcp.dstport eq 80

Answer

src 10.0.0.1 and dst port 80

Answer

host 10.0.0.1 && port 80

Question 11

During a change management process, a security administrator approves a firewall rule change. After implementation, a critical application becomes unreachable. Which step in the change process was likely missed?

Accepted Answer

Backout plan development. A backout plan is a critical step in change management that defines the specific actions to revert a change if it causes issues. Without a pre-defined backout plan, the administrator has no structured method to quickly restore the firewall rule to its previous state, leading to extended downtime for the critical application. The backout plan should include the exact commands or steps to remove or disable the new rule, such as deleting an access control entry (ACE) in a Cisco ASA or NGFW.

Answer

Post-implementation documentation

Answer

Testing in a staging environment

Answer

Peer review of the change

Question 12

A security analyst is configuring a new SIEM platform. The organization has multiple log sources, including Windows Event Logs, Linux syslog, and firewall logs. The analyst wants to ensure that logs are not lost if the SIEM becomes unavailable. Which approach best addresses this requirement?

Accepted Answer

Configure log sources to send logs to a centralized collector with local storage and forwarding capabilities.. Deploying a centralized collector with local storage and forwarding capabilities creates a buffer that ensures logs are not lost during SIEM unavailability. The collector receives logs from sources, stores them locally (e.g., on disk or in a queue), and forwards them to the SIEM when it becomes available again. This decouples log generation from SIEM ingestion, preventing data loss even during extended outages.

Answer

Configure the SIEM to pull logs from sources via Syslog over TCP.

Answer

Implement log replication between SIEM nodes.

Answer

Increase the storage capacity of the SIEM to hold more logs.

Question 13

A SOC analyst examines an alert generated by an IDS. The alert indicates a potential SQL injection attempt. However, the analyst finds that the source IP is a known internal web server that performs legitimate database queries. What is the most likely explanation?

Accepted Answer

The traffic is legitimate but the IDS has a false positive. The source IP is a known internal web server that performs legitimate database queries. IDS signatures often trigger on SQL-like patterns in traffic, and when the traffic matches the signature but is actually benign (e.g., a web server sending parameterized queries), it constitutes a false positive. The analyst's verification that the source is a trusted internal server performing expected operations confirms the alert is not a true threat.

Answer

The web server is compromised

Answer

The IDS is misconfigured

Answer

The analyst should ignore the alert

Question 14

A security analyst is analyzing a memory dump from a compromised Linux server. Which tool is most appropriate for extracting running processes and network connections from the dump?

Accepted Answer

volatility. Volatility is the correct tool because it is a specialized memory forensics framework designed to analyze RAM dumps. It can extract a list of running processes (via the `pslist` or `pstree` plugins) and active network connections (via the `netscan` or `connscan` plugins) directly from the memory image, without relying on the live system's kernel data structures which may be compromised.

Answer

nmap

Answer

Wireshark

Answer

tcpdump

Question 15

A business impact analysis (BIA) for a critical enterprise application reveals a maximum tolerable downtime (MTD) of 4 hours and a recovery time objective (RTO) of 2 hours. The current backup solution can restore the application in 3 hours under optimal conditions. Which of the following is the most appropriate action from a policy perspective?

Accepted Answer

Upgrade the backup solution to achieve a restore time of 2 hours or less. The RTO of 2 hours is the target recovery time defined in the business continuity plan, and the current backup solution's 3-hour restore time exceeds this target. Since the MTD of 4 hours is the absolute maximum the business can tolerate, the solution must meet the stricter RTO, not just the MTD. Upgrading the backup solution to achieve a restore time of 2 hours or less aligns the technical capability with the policy requirement.

Answer

Accept the current restore time because it is within the MTD of 4 hours

Answer

Reduce the RTO to 1 hour to make the backup solution acceptable

Answer

Increase the MTD to 5 hours to match the backup restore time

Question 16

Refer to the exhibit. A security policy requires that network traffic be classified and prioritized to ensure critical applications get bandwidth. A network engineer implements this QoS policy. However, after deployment, a security scanner reports that SSH traffic is starved. Which of the following is the most likely cause?

Accepted Answer

SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.. SSH traffic is not explicitly matched by any class map in the policy, so it falls into the class-default. The class-default in this policy uses fair-queue, which does not guarantee a minimum bandwidth; if higher-priority classes (like VOIP and critical data) consume most of the link, class-default can be starved. This results in SSH sessions timing out or experiencing severe packet loss.

Answer

The priority percent for VOIP is too high.

Answer

The fair-queue algorithm does not work with this policy.

Answer

The critical data class includes SSH traffic.

Question 17

A company's security policy requires that all remote access connections be authenticated using a certificate. Which type of control is this?

Accepted Answer

Preventive. Requiring a certificate for remote access authentication enforces a specific identity verification method before granting access. This is a preventive control because it stops unauthorized connections from being established by ensuring only devices with a valid certificate can initiate the session, directly blocking access before any data exchange occurs.

Answer

Corrective

Answer

Detective

Answer

Deterrent

Question 18

Which TWO types of network traffic should be analyzed to detect a data exfiltration attempt via HTTP? (Choose two.)

Accepted Answer

HTTP request headers. HTTP request headers contain metadata such as User-Agent, Content-Type, and custom headers that can be manipulated to encode and exfiltrate data. The HTTP request body carries the payload, such as POST data, where stolen information can be embedded in form fields, JSON, or XML. Analyzing both allows detection of anomalous patterns indicative of data exfiltration.

Answer

ICMP echo requests

Answer

DNS query responses

Answer

TCP three-way handshake

Question 19

A security analyst is identifying potential vulnerabilities in the network. Which TWO of the following are examples of passive reconnaissance?

Accepted Answer

Google search for company information. Passive reconnaissance involves gathering information without directly interacting with the target systems. A Google search for company information (Option B) collects publicly available data from search engine caches and indexed pages, which does not send any packets to the target's network. A WHOIS lookup (Option C) queries public registration databases for domain ownership and contact details, again without touching the target's infrastructure. Both methods rely on third-party sources and leave no trace on the target's systems.

Answer

Vulnerability scan

Answer

Ping sweep

Answer

Port scanning

Question 20

A security analyst is reviewing logs from a Cisco Firepower Management Center and notices that many legitimate SSL connections are being blocked by the intrusion policy. Which configuration change should the analyst make to reduce false positives without compromising security?

Accepted Answer

Add the affected servers to a network analysis policy exception.. Adding the affected servers to a network analysis policy (NAP) exception allows the Firepower system to bypass intrusion inspection for traffic to and from those specific hosts while still performing SSL decryption and other security checks. This reduces false positives from legitimate SSL connections without completely disabling SSL inspection or weakening the overall security posture.

Answer

Increase the severity threshold for SSL-related rules.

Answer

Change the intrusion policy to "Connectivity Over Security".

Answer

Disable SSL inspection globally.