200-201 Practice Exam 61 — 20 Questions

Question 1

An analyst is examining a suspicious executable file. The file has a .pdf extension but the magic bytes are 'MZ'. Which THREE indicators suggest the file is malicious?

Accepted Answer

The file imports functions like URLDownloadToFile. Magic bytes MZ indicate PE, high entropy suggests packing, suspicious imports (e.g., URLDownloadToFile) are common in malware.

Answer

The file has a valid Authenticode signature

Answer

The file has a low entropy value (e.g., 2.5)

Question 2

An analyst needs to determine if a host is infected with malware that is attempting to contact a known malicious domain. Which log source is most appropriate for this analysis?

Accepted Answer

DNS server logs. DNS server logs are the most appropriate source because they record all DNS queries made by hosts on the network. If a host is attempting to contact a known malicious domain, the DNS query for that domain will appear in the logs, allowing the analyst to identify the infected host by its source IP address and the timestamp of the query.

Answer

Syslog from the host

Answer

NetFlow records

Answer

Data loss prevention (DLP) logs

Question 3

A security engineer is implementing controls to meet compliance requirements. Which TWO of the following frameworks are specifically designed for protecting personal data?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that mandates specific safeguards for protecting individually identifiable health information (PHI). It directly addresses the privacy and security of personal health data, making it a framework specifically designed for protecting personal data in the healthcare context.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001

Question 4

A security analyst is reviewing logs from multiple network devices and notices that a large number of ICMP echo requests with a payload size of 65507 bytes are being sent to a single server from various external IP addresses. The server is becoming unresponsive. Which type of attack is most likely occurring?

Accepted Answer

ICMP flood. D is correct because an ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request packets, consuming bandwidth and processing resources. The large payload size (65507 bytes) is a characteristic of a crafted ICMP packet, but the key indicator here is the sheer volume from multiple sources causing the server to become unresponsive, which aligns with a volumetric ICMP flood rather than a single malformed packet.

Answer

Ping of death

Answer

SYN flood

Answer

Smurf attack

Question 5

An organization must comply with a regulation that requires protecting the privacy of EU citizens' personal data. Which compliance framework applies?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the EU regulation specifically designed to protect the privacy and personal data of EU citizens. It applies to any organization that processes or controls the personal data of individuals in the EU, regardless of where the organization is based. This makes GDPR the correct compliance framework for the scenario described.

Answer

HIPAA

Answer

ISO 27001

Answer

PCI DSS

Question 6

Refer to the exhibit. An analyst sees repeated denied TCP connections from the same source to the same destination web server. Which of the following actions should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. Repeated denied TCP connections from the same source to the same destination web server are a classic indicator of a potential reconnaissance or attack pattern, such as a port scan or brute-force attempt. The first priority in security monitoring is to investigate the source IP for malicious activity (Option C) to determine intent and scope before taking any irreversible action. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Increase the logging level to get more details.

Answer

Create a permit rule for the source IP to allow legitimate traffic.

Answer

Block the source IP globally.

Question 7

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

Accepted Answer

Disable or modify signatures causing false positives.. False positives occur when IPS signatures incorrectly match legitimate traffic. The most direct and effective tuning approach is to disable or modify the specific signatures causing the false positives, which reduces unnecessary blocking without compromising overall security posture.

Answer

Change the IPS to fail-open mode.

Answer

Increase the number of IPS sensors.

Answer

Reduce the IPS sensitivity level to lower.

Question 8

Which log type would an analyst examine to view details about HTTP methods (GET, POST), response codes, and user-agent strings?

Accepted Answer

Web server logs. Web server logs record HTTP requests and responses, including methods, URLs, response codes, and user-agent information.

Answer

System logs

Answer

Firewall logs

Answer

DNS logs

Question 9

Which Windows registry hive is most likely to contain evidence of malware persistence via a service?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry hive stores the configuration for all Windows services, including their executable paths and startup types. Malware often installs itself as a service to achieve persistence, and evidence of this can be found by examining the ImagePath value under a suspicious service subkey. This is the correct location for service-based persistence, unlike the Run keys which handle startup programs for users.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SAM

Question 10

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Accepted Answer

An attacker is performing a port scan on internal hosts from the outside. The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

Answer

The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic

Answer

A malware is trying to phone home to an external C2 server

Answer

A user is trying to access internal web servers legitimately but is blocked by ACL

Question 11

A security monitoring tool generates an alert for a user accessing a sensitive file at an unusual hour. What is the most appropriate next step?

Accepted Answer

Contact the user to confirm if the access was legitimate.. The alert indicates an anomaly (unusual hour), but not necessarily malicious activity. The most appropriate first step is to verify the user's intent through direct communication, as this aligns with the principle of validation before escalation. In security monitoring, contacting the user helps confirm whether the access was authorized, reducing false positives and unnecessary incident response activation.

Answer

Ignore the alert since it is likely a false positive.

Answer

Escalate the alert to the incident response team.

Answer

Block the user's account immediately.

Question 12

An analyst is investigating a host that is suspected of being compromised. The host's security logs show multiple failed login attempts followed by a successful login from an unusual IP address, and then a series of outbound connections to known malicious destinations. Which TWO actions should the analyst take immediately? (Choose two.)

Accepted Answer

Isolate the host from the network. Isolating the host from the network immediately stops the outbound connections to known malicious destinations, preventing further data exfiltration, lateral movement, or command-and-control (C2) communication. This containment step is critical in incident response to limit the blast radius before any other investigative or remediation actions are taken.

Answer

Delete the malicious files found on the host

Answer

Reboot the host to clear any malware from memory

Answer

Run a full antivirus scan on the host

Question 13

Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?

Accepted Answer

Yes, because it denies RDP and Telnet.. The access-list explicitly denies TCP port 3389 (RDP) and TCP port 23 (Telnet), which matches the security policy requirement to block all remote desktop and Telnet access from external networks. The implicit deny at the end of the access-list ensures that any traffic not explicitly permitted is blocked, so the policy is fully enforced.

Answer

Yes, because it denies TCP ports 3389 and 23.

Answer

No, because it permits all other traffic.

Answer

No, because it should deny HTTP traffic as well.

Question 14

A company operating in the EU experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. Under Article 33 of the GDPR, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it. This 72-hour window is the maximum timeframe, making option B correct for the 200-201 exam context.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 15

An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?

Accepted Answer

An internal host attempted to establish an SMB connection to an external IP and was blocked.. The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.

Answer

A DNS query was made from an internal host to an external server.

Answer

An external host attempted to access an internal SMB server on port 445 and was blocked.

Answer

An internal host successfully connected to an external server on port 445.

Question 16

Which THREE of the following are valid techniques to detect a compromised host using network monitoring?

Accepted Answer

Identifying periodic outbound connections to an unknown IP at regular intervals (beaconing).. Beaconing is a classic indicator of a compromised host establishing a command-and-control (C2) channel. The host periodically sends outbound connections to an unknown IP at regular intervals, which is a behavior that network monitoring tools can detect as anomalous traffic patterns, often used by malware to maintain persistence and receive instructions.

Answer

Watching for ICMP echo requests from internal hosts to external hosts.

Answer

Monitoring for high volumes of HTTP traffic to a known CDN.

Question 17

An organization's security policy requires that all traffic between the corporate network and the internet be inspected by an IPS. However, encrypted traffic (HTTPS) cannot be inspected without breaking encryption. Which solution best meets the policy requirement?

Accepted Answer

Implement SSL/TLS interception using a proxy with a trusted certificate. SSL/TLS interception using a proxy with a trusted certificate allows the IPS to decrypt, inspect, and re-encrypt HTTPS traffic. The proxy acts as a man-in-the-middle, presenting a certificate trusted by internal clients, so the IPS can apply security policies to the decrypted content before forwarding it to the internet.

Answer

Allow all HTTPS traffic without inspection

Answer

Rely on endpoint security only

Answer

Disable HTTPS for internal users

Question 18

A cybersecurity firm is conducting a red team exercise for a client. The red team successfully gained access to the client's internal network through a phishing email and escalated privileges to domain administrator. During the exercise, the red team uses a tool to dump password hashes from the domain controller. The client's security team detects the hash dump activity and sends an alert to the SOC. The SOC analyst reviews the alert and sees that the source IP of the hash dump is from a server that is part of the red team's scope. However, the red team is not scheduled to perform hash dumping until the next phase. The analyst also notes that the activity uses a known red team tool. Which of the following actions is most appropriate?

Accepted Answer

Assume the red team is acting out of scope and contact the red team lead for clarification.. The red team is authorized to operate within the client's environment, but the activity occurred outside the scheduled phase, creating ambiguity. The most appropriate action is to contact the red team lead for clarification to determine if the hash dump was a deviation from the plan or a sign of a real attacker. This aligns with incident response best practices, which prioritize verification before escalation, especially when authorized testing is in progress.

Answer

Launch a full incident response procedure assuming a real attacker.

Answer

Treat the alert as a false positive because the red team is authorized.

Answer

Immediately block the red team's IP addresses and escalate to management.

Question 19

During a host-based investigation, an analyst finds a process named 'svchost.exe' consuming high CPU. The process path is 'C:\Windows\Temp\svchost.exe'. What should the analyst conclude?

Accepted Answer

It is likely malware disguised as a legitimate process. The legitimate svchost.exe (Service Host) runs from C:\Windows\System32, not C:\Windows\Temp. The Temp directory is a common location for malware to masquerade as system processes to evade detection. High CPU usage combined with an anomalous path strongly indicates malicious activity, as legitimate svchost.exe instances are signed by Microsoft and reside in System32.

Answer

It is a legitimate Windows service host process

Answer

It is a third-party application that requires investigation

Answer

It is a temporary file created by Windows Update

Question 20

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Accepted Answer

A sudden increase in DNS queries to unknown domains from a single host. A sudden spike in DNS queries to unknown domains from a single host is a classic sign of DNS tunneling or command-and-control (C2) activity. Attackers often use DNS to exfiltrate data or communicate with external servers by encoding data in DNS queries, bypassing traditional firewall rules that allow DNS traffic.

Answer

High bandwidth usage during business hours

Answer

A single failed login attempt from an internal user

Answer

Regular ICMP echo requests to external hosts