200-201 Practice Exam 60 — 20 Questions

Question 1

A security analyst is reviewing a suspicious email reported by a user. The email appears to come from the CEO and requests an urgent wire transfer. The analyst examines the email headers and notices that the 'From' address is spoofed and the 'Reply-To' address is different from the 'From' address. The email also contains a link to a credential-harvesting page. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Business email compromise (BEC). The email impersonates the CEO and requests an urgent wire transfer, which is the hallmark of business email compromise (BEC). BEC attacks often involve spoofed sender addresses and may include links to credential-harvesting sites. While it is a form of phishing, BEC specifically targets financial transactions and is a distinct category.

Answer

Spear phishing

Answer

Whaling

Answer

Phishing

Question 2

A company wants to ensure that only authorized employees can enter the server room. Which type of control is a badge reader at the door?

Accepted Answer

Preventive physical control. A badge reader restricts entry to a physical space by requiring valid credentials, so it functions as a preventive physical control. Preventive controls stop incidents before they happen, which matches the goal of allowing only authorized employees into the server room. Detective controls identify events after the fact, corrective controls restore operations, and compensating controls substitute for other measures. Administrative and logical controls address policies and data rather than physical door access.

Answer

Detective technical control

Answer

Corrective administrative control

Answer

Compensating logical control

Question 3

A security analyst is reviewing a Windows 10 host for potential compromise. The analyst runs 'net user' and sees an account named 'Support' that was not created by IT. The account is a member of the local Administrators group. Which Windows Event ID should the analyst check to determine when this account was created?

Accepted Answer

4720. The analyst needs to determine when the unauthorized 'Support' account was created. Event ID 4720 is specifically logged when a user account is created, providing the account name, creator, and timestamp. Other events like 4722 (enabled), 4724 (password reset), and 4732 (added to group) do not indicate creation time. Therefore, 4720 is the correct event to review for account creation.

Answer

4722

Answer

4724

Answer

4732

Question 4

An analyst is examining a Windows 10 host and discovers that a service named 'WinDefendSvc' is registered with a binary path of C:\ProgramData\svchost.exe and a display name of 'Windows Defender Service'. The legitimate Windows Defender service uses a different name and binary path. Which conclusion is most accurate?

Accepted Answer

This indicates a masquerading attempt, because the service name mimics Windows Defender while its binary is placed in a user-writable directory, which is typical of malware persistence.. Legitimate Windows Defender registers as the WinDefend service with its binary under C:\Program Files\Windows Defender. A service named WinDefendSvc pointing to C:\ProgramData\svchost.exe combines two red flags: a typosquatted name impersonating a security product and a binary in a user-writable directory. This pattern is characteristic of masquerading persistence, and the analyst should investigate the binary, its signature, and its network activity rather than dismissing it as legitimate.

Answer

The service is a leftover from a Windows Update that failed to clean up and can be safely ignored, since the binary is named svchost.exe.

Answer

This is a benign third-party antivirus service that has registered itself under a Microsoft-like name to be trusted by the operating system.

Answer

This is a legitimate alternate Windows Defender service name used on some Windows 10 builds and should be verified with Get-Service before further action.

Question 5

A security analyst is reviewing a vulnerability scan report and sees a finding labeled 'CVE-2021-44228' with a CVSS score of 10.0. The analyst needs to prioritize remediation. Which factor does the CVSS score primarily represent?

Accepted Answer

The severity of the vulnerability based on its technical impact and exploitability. CVSS is a standardized framework for rating the severity of security vulnerabilities. The base score, such as 10.0, reflects intrinsic characteristics like exploitability and impact. It does not predict exploitation likelihood, business-specific impact, or remediation time. Analysts use CVSS alongside other factors to prioritize remediation.

Answer

The likelihood that the vulnerability will be exploited in the wild within the next 30 days

Answer

The amount of time required to patch the vulnerability

Answer

The business impact of the vulnerability specific to the organization's assets

Question 6

A hospital's security team discovers that a network device is silently forwarding copies of all traffic to an internal host that no administrator recognizes. The device is a managed switch that connects the radiology VLAN to the core. Which attack has most likely been implemented against this switch?

Accepted Answer

SPAN port misconfiguration. A SPAN session on a managed switch replicates traffic from a source interface or VLAN to a destination port. When a rogue administrator or attacker with device access creates such a session aimed at an unknown internal host, every frame on the radiology VLAN is duplicated there while normal forwarding continues unaffected. The other techniques either degrade forwarding, enable cross-VLAN access, or manipulate host caches rather than producing a sustained, targeted copy of one VLAN's traffic.

Answer

ARP cache poisoning

Answer

MAC flooding

Answer

VLAN hopping via double tagging

Question 7

A security analyst is assessing the risk profile of a new cloud-based collaboration application that employees want to adopt. The analyst must identify which factors contribute to the overall risk of introducing this application into the environment. (Choose two.)

Accepted Answer

The likelihood that a threat will exploit a vulnerability in the application or its supporting infrastructure.. Risk assessment combines the likelihood that a threat will exploit a vulnerability with the impact that exploitation would have on the organization. These two factors produce the overall risk rating for the collaboration application. User demand, UI color schemes, and vendor stock price do not measure security risk, so likelihood and impact are the two factors the analyst must evaluate.

Answer

The marketing team's preferred color scheme for the application's user interface.

Answer

The number of employees who have requested access to the application for productivity purposes.

Answer

The vendor's stock price over the past fiscal quarter.

Question 8

A security operations center is building detection rules for man-in-the-middle attacks on its internal network. The team wants to identify techniques an attacker on the same Layer 2 segment could use to intercept or redirect traffic between two hosts. (Choose two.)

Accepted Answer

On-path routing manipulation using forged ICMP redirect messages. ARP spoofing and forged ICMP redirects both manipulate how a host forwards traffic so the attacker becomes an on-path device, enabling interception and modification. ARP spoofing targets the mapping of IP to MAC on the local segment, while ICMP redirect manipulation alters the next-hop decision. Both are detectable through switch features such as dynamic ARP inspection and through monitoring for unexpected redirect messages.

Answer

DNS cache poisoning to redirect a victim to an attacker-controlled server

Answer

VLAN hopping by double-tagging 802.1Q frames to reach another segment

Answer

MAC flooding to overflow the switch CAM table and force hub-like flooding

Question 9

An organization is reviewing its exposure to attack surface. A security architect notes that employees routinely install browser extensions from unapproved sources, and several internal web applications accept unsanitized input. Which concept do these findings primarily describe?

Accepted Answer

Vulnerabilities that expand the attack surface and may be exploited by threat actors. The findings are vulnerabilities that enlarge the attack surface. Unsanitized input enables injection flaws, and unapproved extensions introduce untrusted code with broad browser privileges. Both give threat actors additional entry points and increase the likelihood of compromise. Reducing the attack surface requires application input validation, extension allowlisting, and endpoint policy enforcement, which directly address the weaknesses identified.

Answer

A compliance violation of the Payment Card Industry Data Security Standard

Answer

A social engineering campaign targeting employees through malicious extensions

Answer

A denial-of-service condition caused by excessive extension usage

Question 10

An analyst is investigating an incident and needs to determine the source of a piece of malware. The analyst finds that the malware uses a domain generation algorithm to contact command-and-control servers. Which term best describes this capability?

Accepted Answer

Command and control. A domain generation algorithm creates a large set of pseudo-random domain names that malware periodically queries to find an active command-and-control server. This technique helps the malware evade static blocklists and takedown attempts, because defenders cannot easily predict or block every possible domain. The scenario states the malware contacts command-and-control servers, so the capability is command and control. Persistence, privilege escalation, and lateral movement describe different phases or objectives of an intrusion.

Answer

Persistence

Answer

Lateral movement

Answer

Privilege escalation

Question 11

An analyst is investigating an alert for a potential ICMP tunneling attack. The analyst reviews a PCAP and notices a series of ICMP Echo Request packets with unusually large payloads (over 1000 bytes) and varying payload contents, sent from an internal host to an external IP address. The external host replies with ICMP Echo Reply packets of similar size. Which characteristic most strongly supports the conclusion that this is ICMP tunneling rather than normal ping traffic?

Accepted Answer

The payload size is consistently large and the contents are non-repetitive, indicating that data is being encapsulated in the ICMP payload.. The strongest indicator of ICMP tunneling is the presence of large, non-repetitive payloads in Echo Requests and Replies, which suggests data encapsulation. Normal ping uses small, often patterned payloads. The other options describe normal ICMP characteristics, such as standard types, regular timing, or IP header fields, none of which specifically indicate tunneling.

Answer

The ICMP packets use Type 8 and Type 0 codes, which are reserved for diagnostic purposes and should not carry data.

Answer

The ICMP Echo Requests are sent at regular intervals, which is a known signature of ICMP tunneling tools.

Answer

The external host responds with Echo Replies that have a different IP identification field than the requests, which indicates packet fragmentation.

Question 12

A security analyst is evaluating an endpoint detection and response deployment for a company that must detect fileless attacks. Which TWO techniques should the analyst expect the tool to monitor because they are commonly used by fileless malware? (Choose two.)

Accepted Answer

WMI event subscription persistence. Fileless malware lives in memory and abuses trusted system components instead of dropping executables on disk. PowerShell is a favorite because it is signed and ubiquitous, and encoded command lines hide the payload from casual inspection. WMI event subscriptions provide persistence that survives reboots without a file artifact. EDR tools therefore focus on process command lines, script block logging, and WMI activity. Disk encryption, antivirus update schedules, and Kerberos TGS requests are not fileless attack techniques and would not be expected monitoring targets for this purpose.

Answer

Kerberos ticket-granting service requests

Answer

Disk encryption of the system volume

Answer

Scheduled antivirus signature updates

Question 13

A security analyst is investigating a breach where an attacker gained access to a server by exploiting a vulnerability in a web application. The analyst needs to determine the type of attack that was used. The server logs show that the attacker sent a specially crafted HTTP request that caused the server to execute arbitrary code. Which type of attack is this?

Accepted Answer

Remote code execution (RCE). The attacker exploited a web application vulnerability to execute arbitrary code on the server. This is the definition of remote code execution (RCE). XSS and CSRF are client-side attacks, and SQL injection is a specific type of injection that may not always lead to code execution. The scenario clearly points to RCE as the attack type.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Question 14

A network security analyst is reviewing NetFlow records from a Cisco router and notices a large number of flows from a single internal host to many external IP addresses on port 445. The flows are short, with small packet counts, and occur within a few minutes. Which type of activity is most likely occurring?

Accepted Answer

A worm or scanner attempting to propagate via SMB. The combination of a single internal host, many external destinations, port 445, and short flows over a brief period is a hallmark of SMB scanning or worm propagation. This behavior aims to find and infect vulnerable systems. Analysts should isolate the host and investigate for malware, as this fan-out pattern is not normal for legitimate SMB usage.

Answer

A peer-to-peer file sharing client

Answer

A legitimate backup process to a cloud storage provider

Answer

A misconfigured application performing a port scan

Question 15

A SOC analyst is analyzing a PCAP from a suspected intrusion. The traffic shows a series of TCP connections where the client sends a SYN, receives a SYN-ACK, then immediately sends a RST instead of an ACK, and this pattern repeats across multiple ports on the same target. Which type of scan is most likely being performed?

Accepted Answer

TCP SYN stealth scan. The pattern of SYN, SYN-ACK, then RST indicates a half-open TCP scan, commonly known as a SYN stealth scan. The attacker sends a SYN, receives a SYN-ACK if the port is open, but resets the connection instead of completing the handshake. This avoids establishing a full connection and is often used to evade detection while enumerating open ports.

Answer

UDP scan

Answer

TCP connect scan

Answer

TCP FIN scan

Question 16

An analyst is examining a Windows system for evidence of malware that maintains persistence by modifying the Image File Execution Options (IFEO) registry key. Which of the following best describes how this technique works?

Accepted Answer

The malware sets the 'Debugger' value for a legitimate process, causing the debugger to execute instead of the intended process.. Image File Execution Options (IFEO) is a registry key that allows setting a debugger for a specific executable. Malware abuses this by setting the Debugger value to its own binary, so when the targeted process is launched, the malicious debugger runs instead. This provides persistence and can be used to hijack trusted processes, making detection challenging.

Answer

The malware adds a new service that runs under the context of the SYSTEM account.

Answer

The malware creates a shortcut in the Startup folder to launch automatically.

Answer

The malware modifies the 'Shell' value in the Winlogon registry key to execute on user logon.

Question 17

A security analyst is investigating a recent security incident and needs to determine the extent of the compromise. The analyst wants to understand which systems were affected and what data may have been accessed. Which phase of the incident response process is the analyst currently performing?

Accepted Answer

Detection and analysis. The detection and analysis phase of incident response involves validating incidents, determining their scope, and identifying affected systems and data. The analyst's investigation into which systems were compromised and what data was accessed is a textbook example of this phase, which must be completed before containment and eradication can be effectively planned.

Answer

Post-incident activity

Answer

Preparation

Answer

Containment, eradication, and recovery

Question 18

An analyst is investigating a Windows system for potential malware persistence. The analyst discovers a scheduled task that runs a PowerShell script every hour. The script downloads and executes a payload from a remote server. Which of the following Windows artifacts would BEST provide the original creation time and the author of this scheduled task?

Accepted Answer

C:\Windows\System32\Tasks\<TaskName>. The scheduled task definition file in C:\Windows\System32\Tasks\ contains an XML representation that includes metadata such as the task's creation time and author. This is the most direct artifact for determining the origin of a suspicious scheduled task, as it is written when the task is created.

Answer

C:\Windows\Tasks\<TaskName>

Answer

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx

Answer

C:\Windows\Prefetch\<TaskName>.pf

Question 19

A security analyst is investigating a potential security incident and needs to correlate events across multiple data sources. Which two Cisco CyberOps tools or features would provide network flow data and intrusion event details respectively? (Choose two.)

Accepted Answer

Cisco Stealthwatch for network flow analysis. Cisco Stealthwatch is purpose-built for network flow analysis using NetFlow and other telemetry, while Firepower Management Center is the central console for intrusion events from Firepower sensors. Together, they provide the flow and intrusion data needed to correlate a security incident. The other tools focus on DNS, identity, or endpoint, which are not the requested data types.

Answer

Cisco Identity Services Engine for authentication logs

Answer

Cisco Umbrella for DNS security

Answer

Cisco Advanced Malware Protection for endpoint

Question 20

A security analyst is reviewing a suspicious email reported by a user. The email appears to come from the CEO and requests an urgent wire transfer. The analyst examines the email headers and notices that the 'From' address is spoofed and the 'Reply-To' address is different from the 'From' address. The email also contains a link to a credential-harvesting page. Which type of attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A dropper that delivers a malicious payload onto the system. The macro document functions as a dropper: its sole purpose is to execute and pull a second-stage payload onto the host. Droppers are common initial-access vehicles, and classifying by function helps the analyst understand the infection chain and prioritize response. The delivered payload may later exhibit other behaviors, but the file in hand is a dropper.

Answer

A rootkit because it hides the PowerShell process

Answer

Fileless malware because it uses a scripting engine

Answer

A logic bomb because it triggers on a specific event