200-201 Practice Exam 61 — 20 Questions

Question 1

A security analyst is evaluating the risk of a new web application that will store customer credit card data. The analyst needs to determine the likelihood and impact of a data breach. Which risk analysis approach involves assigning numerical values to assets, threats, and vulnerabilities to calculate an annualized loss expectancy (ALE)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses numerical values for assets, threats, and vulnerabilities to calculate annualized loss expectancy, enabling cost-benefit comparisons for security investments. Qualitative analysis uses descriptive ratings, while BIA and threat modeling serve different purposes. For credit card data, the quantitative approach provides the financial justification for controls.

Answer

Qualitative risk analysis

Answer

Threat modeling

Answer

Business impact analysis (BIA)

Question 2

A security team is designing a defense-in-depth strategy. They want to add a control that inspects the actual content of network traffic for known attack signatures and can block or alert on malicious payloads in real time. Which technology best meets this requirement?

Accepted Answer

Intrusion prevention system (IPS). An IPS is designed for inline deep packet inspection, matching traffic against signatures and behavioral rules and taking action to block or alert. Because it sits in the traffic path, it can stop attacks in real time, unlike passive detection or simple filtering controls. This makes it the best fit for content inspection with active response.

Answer

Virtual private network (VPN) concentrator

Answer

Load balancer

Answer

Host-based firewall

Question 3

A security analyst is examining a suspicious file and wants to determine its reputation and threat score. Which Cisco security solution should the analyst use to query the file's SHA-256 hash and get a verdict?

Accepted Answer

Cisco Threat Grid. Cisco Threat Grid is designed for malware analysis and threat intelligence, allowing analysts to submit file hashes and receive a threat score and behavioral report. The other options focus on DNS security, identity management, or network flow analysis, none of which provide file hash reputation.

Answer

Cisco Umbrella

Answer

Cisco Identity Services Engine

Answer

Cisco Stealthwatch

Question 4

A security analyst is using Cisco Umbrella and notices a high volume of DNS queries from a single internal host to randomly generated domain names that do not resolve. The queries are for domains like 'a1b2c3d4.com', 'e5f6g7h8.net', etc. What type of malicious activity is most likely occurring?

Accepted Answer

Domain generation algorithm (DGA) used by malware for command and control.. The high volume of DNS queries to randomly generated, non-resolving domains is a hallmark of a domain generation algorithm (DGA). Malware uses DGAs to generate many potential C2 domains, hoping one will resolve and allow communication. Cisco Umbrella logs these queries, and the pattern is a strong indicator of infection. DNS tunneling and misconfigurations would present differently.

Answer

A phishing campaign attempting to redirect users to fake websites.

Answer

A misconfigured application repeatedly querying non-existent domains.

Answer

DNS tunneling for data exfiltration.

Question 5

A network engineer is deploying a Cisco Next-Generation IPS (NGIPS) in inline mode. The security team wants to ensure that the device can block malicious traffic while also providing contextual information about the attack. Which of the following Cisco NGIPS features provides detailed information about the attack and the target, including vulnerability mapping?

Accepted Answer

FireSIGHT (now Cisco Firepower) correlation and impact flags. The correct answer is the feature that correlates intrusion events with host vulnerability data. Cisco Firepower's FireSIGHT technology provides impact flags that indicate whether an attack is relevant to the target's vulnerabilities, giving analysts the context needed to prioritize response. This goes beyond simple signature matching.

Answer

Access Control Policy with URL filtering

Answer

Network Analysis Policy (NAP)

Answer

Security Intelligence (SI)

Question 6

A SOC analyst is investigating a suspected network intrusion and reviews NetFlow records. The analyst observes a sudden increase in outbound traffic from a single internal host to an external IP address, with large data volumes during off-hours. Which two additional indicators should the analyst examine to confirm data exfiltration? (Choose two.)

Accepted Answer

The duration and consistency of the outbound flow to the external IP. To confirm exfiltration from flow records, the analyst should look at the outbound-to-inbound byte ratio and the duration and consistency of the outbound flow. A high ratio and a sustained, consistent transfer to the same external IP, especially during off-hours, strongly support data exfiltration. Port counts, benign DNS queries, and failed logins are less directly related to confirming outbound data theft.

Answer

The number of distinct destination ports contacted by the internal host

Answer

The number of failed login attempts on the internal host

Answer

The presence of repeated DNS queries to known benign domains

Question 7

A security analyst is reviewing a recent security incident where an attacker gained unauthorized access to a server. The analyst needs to determine which factors contributed to the incident by examining the vulnerability, threat, and risk. Which TWO of the following best describe the relationship between these concepts in this scenario? (Choose two.)

Accepted Answer

A vulnerability is a weakness in the server's software that the attacker exploited.. A vulnerability is a weakness that can be exploited, and a threat is the potential cause that exploits it. Together, they create risk, which is the potential for loss. The correct options define vulnerability and threat accurately in the context of the incident, while the others either misdefine terms or are too narrow.

Answer

Risk is the same as vulnerability and can be used interchangeably.

Answer

Risk is the potential for loss or damage when a threat exploits a vulnerability.

Answer

A threat is always a deliberate attack by a human actor.

Question 8

A SOC analyst is reviewing a packet capture from an internal web server and notices that a single external IP sent 4,000 TCP segments with the ACK flag set to a closed port, and each segment received a RST response. No SYN packets preceded these segments. Which type of scan is this host most likely performing?

Accepted Answer

TCP ACK scan. The scanner sent only ACK-flagged TCP segments to a closed port and received RST replies, which is the signature of an ACK scan used to probe firewall filtering rather than open services. A SYN scan would require an initial SYN, a FIN scan would use the FIN flag, and a UDP sweep would not produce TCP RST responses. The pattern uniquely identifies an ACK scan.

Answer

UDP port sweep

Answer

TCP SYN stealth scan

Answer

TCP FIN scan

Question 9

An IDS alert indicates that a server received HTTP requests containing long strings of the form ../../../../etc/passwd in a URL parameter. The web server returned HTTP 200 responses to these requests. Which conclusion should the analyst draw while continuing the investigation?

Accepted Answer

The requests warrant deeper inspection of response bodies and server file access logs to determine whether traversal succeeded.. A traversal attempt returning HTTP 200 is suspicious but not conclusive, because the status code reflects request handling rather than file disclosure. Confirmation requires examining response bodies for sensitive file contents and correlating with server-side file access logs. The other choices either overstate the evidence as confirmed compromise, wrongly dismiss the alert, or mischaracterize traversal strings as normal browser behavior.

Answer

The alert is a false positive because directory traversal cannot appear in URL parameters.

Answer

The server is confirmed compromised because directory traversal strings were sent and accepted.

Answer

The activity is normal because web browsers routinely send relative path characters in requests.

Question 10

A security analyst is investigating a potential data exfiltration incident. The analyst observes that a large amount of data is being transferred from an internal database server to an external IP address during non-business hours. The transfer is using an encrypted channel that is not typical for the server's normal operations. Which type of threat is this activity most likely associated with?

Accepted Answer

Advanced persistent threat (APT). An advanced persistent threat is a prolonged and targeted attack where an intruder gains access to a network and remains undetected to steal data. The scenario's characteristics—large data transfer to an external IP, encrypted channel, and non-business hours—are typical of APT exfiltration. DDoS, ransomware, and phishing do not match the observed behavior of stealthy outbound data transfer.

Answer

Phishing

Answer

Ransomware

Answer

Distributed denial of service (DDoS)

Question 11

A Cisco Stealthwatch analyst notices a host on the internal network is sending periodic DNS queries to a single external domain with subdomains that are long, random-looking strings (e.g., a8f3k2j9d0x1.example.com). The queries occur every 60 seconds, and the responses are consistently NXDOMAIN. Which type of malicious activity does this pattern most strongly indicate?

Accepted Answer

DNS beaconing from a command-and-control implant. The combination of periodic timing, random subdomains, and consistent NXDOMAIN responses points to a DNS beacon from malware attempting to contact command-and-control. The implant uses DNS because it is often allowed through firewalls. The fixed interval and single destination domain distinguish this from normal DNS traffic or tunneling, which would carry larger payloads and expect responses.

Answer

DNS tunneling for data exfiltration

Answer

A misconfigured DNS resolver causing retry storms

Answer

Normal DNS prefetching by a web browser

Question 12

A security analyst is investigating a Linux server that was compromised. The attacker used a rootkit to hide processes and files. The analyst runs 'lsmod' and notices a kernel module named 'hideproc' that is not recognized. Which command should the analyst use to determine the module's file path and potentially identify the rootkit?

Accepted Answer

modinfo hideproc. The analyst needs to find the file path of the suspicious kernel module to analyze or remove it. The modinfo command provides detailed information about a module, including its filename and location. This is the correct tool for identifying where the rootkit module resides on disk, enabling further forensic analysis or cleanup.

Answer

lsmod | grep hideproc

Answer

dmesg | grep hideproc

Answer

rmmod hideproc

Question 13

A SOC analyst is triaging a Cisco Stealthwatch alarm that shows a workstation uploading 4 GB to an external IP address at 02:00, outside normal business hours. The destination has no prior reputation data. Which action should the analyst take first according to the incident response process?

Accepted Answer

Validate the alarm and identify the internal host and user. Incident response follows a defined sequence, and the identification phase requires validating the alarm and determining the affected asset and user before containment. This step confirms whether the activity is malicious, establishes scope, and informs subsequent decisions. Blocking, disabling accounts, or escalating to legal before validation can disrupt legitimate operations and leave related compromised systems undiscovered.

Answer

Block the external IP address on the perimeter firewall

Answer

Escalate the alarm directly to the legal department

Answer

Disable the user account associated with the workstation

Question 14

A junior SOC analyst receives an alert indicating that a workstation attempted to resolve a domain associated with a known malware family. The analyst wants to determine whether the workstation actually connected to the malicious domain or if the resolution attempt was blocked. Which data source would most directly answer this question?

Accepted Answer

DNS server response logs showing query results and response codes. DNS server response logs capture the outcome of each query, including successful answers, NXDOMAIN responses, and blocks from protective DNS filtering. This directly determines whether the workstation received an address for the malicious domain. Following up with firewall or proxy logs confirms whether an outbound connection actually occurred, allowing the analyst to decide whether endpoint containment is required.

Answer

The organization's password policy configuration

Answer

The workstation's local hosts file

Answer

The endpoint's installed application inventory

Question 15

A security analyst is evaluating the risk of a new web application that will store customer credit card data. The analyst needs to determine the likelihood and impact of a data breach. Which risk analysis approach involves assigning numerical values to assets, threats, and vulnerabilities to calculate an annualized loss expectancy (ALE)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk mitigation. The vulnerability is critical and remotely exploitable, posing a high risk to sensitive data. Mitigating the risk through patching or other controls is the most appropriate response. Risk acceptance, transference, or avoidance are less suitable because they do not directly reduce the technical exposure in a timely manner.

Answer

Risk transference

Answer

Risk avoidance

Answer

Risk acceptance

Question 16

A security analyst is examining a Cisco Umbrella Investigate report for a domain that has been flagged as malicious. The report shows a high 'security score' and lists multiple categories including 'Malware' and 'Command and Control'. Which action should the analyst take first?

Accepted Answer

Block the domain at the DNS layer and investigate any internal hosts that queried it. A domain flagged as malware and command-and-control with a high security score should be blocked immediately to sever communication. The analyst must also identify internal hosts that resolved the domain to determine the scope of compromise. This two-step approach of containment and investigation is the correct first response.

Answer

Add the domain to a watchlist and continue monitoring for 24 hours

Answer

Submit the domain to Cisco Talos for reclassification

Answer

Report the domain to the ISP and wait for their response

Question 17

A security analyst at a mid-sized company is reviewing a packet capture from the DMZ and notices a series of TCP SYN packets sent to multiple ports on a single internal web server, all originating from the same external IP address within a 3-second window. None of the SYN packets are followed by a completed three-way handshake. The analyst must classify this activity to determine the appropriate response. Which type of attack is most consistent with this traffic pattern?

Accepted Answer

SYN flood denial-of-service attack. The traffic pattern of many TCP SYN packets to multiple ports from a single source without completed handshakes is the hallmark of a SYN flood. This attack consumes server resources by leaving connections half-open, preventing legitimate users from establishing sessions. Recognizing this pattern allows the analyst to apply mitigations such as SYN cookies or rate limiting.

Answer

UDP amplification attack

Answer

ARP poisoning attack

Answer

DNS tunneling attack

Question 18

A security team is implementing a defense-in-depth strategy and wants to ensure that even if an attacker compromises a web server, the attacker cannot easily move laterally to the internal database server. Which security principle is being applied when the team segments the network and restricts traffic between the web tier and the database tier?

Accepted Answer

Network segmentation. Segmenting the network and restricting traffic between the web and database tiers limits an attacker's ability to move laterally after compromising a web server. This is the principle of network segmentation, which reduces the attack surface and contains breaches within a zone.

Answer

Zero trust

Answer

Least privilege

Answer

Defense in depth

Question 19

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. Which TWO handling requirements are typically associated with data classified as 'Restricted'? (Choose two.)

Accepted Answer

Access is limited to a need-to-know basis with strict approval workflows.. Restricted data, as the highest classification, requires strong protections such as encryption at rest and in transit, and access limited to a need-to-know basis with strict approvals. These controls reduce the risk of unauthorized disclosure. Free sharing, mandatory removable media storage, and automatic declassification are not typical requirements and would weaken security.

Answer

Data can be declassified to Public after 30 days automatically.

Answer

Data must be stored only on removable media for physical security.

Answer

Data can be shared freely within the organization without additional controls.

Question 20

An analyst notices that an internal host is sending periodic ICMP echo requests to an external IP, and the echo replies contain payloads that are longer than the default Windows ping payload. The payload bytes appear to be encoded and change with each reply. Which activity is most likely occurring?

Accepted Answer

ICMP tunneling used for command-and-control or data transfer. Non-default ICMP payload sizes with changing encoded bytes in echo replies indicate that data is being tunneled inside ICMP, a common covert channel for command-and-control or exfiltration. Latency measurement, path MTU discovery, and Smurf attacks produce different packet characteristics and do not involve variable encoded payloads in replies.

Answer

Path MTU discovery performed by the host

Answer

Network latency measurement by a monitoring tool

Answer

Smurf attack reflection against the external host