200-201 Practice Exam 62 — 20 Questions

Question 1

A security analyst is examining a suspicious file and calculates its SHA-256 hash. The analyst then queries Cisco Talos Intelligence for the hash. The result shows that the file is known malware with a detection name of 'Trojan.GenericKD.123456'. Which of the following does this result indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file is confirmed malicious and matches a known malware signature in the Talos database.. Cisco Talos Intelligence provides reputation and threat data for files, IPs, and domains. When a SHA-256 hash is queried and returns a known malware detection, it means the exact file has been previously analyzed and confirmed malicious. This is a reliable indicator, and the analyst should proceed with containment and remediation. Other options either misinterpret the result or assume actions that are not part of the query process.

Answer

The file is benign but has a similar hash to known malware.

Answer

The file is suspicious but requires further dynamic analysis to confirm maliciousness.

Answer

The file has been quarantined by Cisco AMP for Endpoints automatically.

Question 2

A security analyst is reviewing a Windows system for signs of malware persistence. The analyst notices a suspicious executable named 'updater.exe' in the Startup folder. Which Windows feature is being abused by the malware in this scenario?

Accepted Answer

Startup Folder. The Startup folder is a well-known location that Windows uses to automatically launch programs when a user logs in. Malware frequently places a copy of itself or a shortcut in this folder to ensure it runs every time the user logs in. The presence of 'updater.exe' in the Startup folder indicates that this persistence mechanism is being abused. Other methods like Services, Task Scheduler, or Registry Run keys are also used by malware but are not described in this scenario.

Answer

Registry Run Keys

Answer

Windows Services

Answer

Task Scheduler

Question 3

An analyst examining a PCAP sees a host send an HTTP GET request where the User-Agent string contains a long, random-looking hexadecimal value, the request path includes a similarly random string, and the server responds with a 404 status code but a response body of several kilobytes. This pattern repeats every 60 seconds. Which activity is most likely occurring?

Accepted Answer

Command-and-control beaconing over HTTP with data hidden in request and response fields. The fixed 60-second cadence, random hex identifiers in both the User-Agent and URI, and a substantial response body paired with a 404 status together indicate HTTP-based command-and-control. Implants poll at set intervals for tasking, encode session identifiers to evade signatures, and hide instructions in what appears to be an error response. Normal CDN traffic, vulnerability scanning, and backoff retries all produce different timing, field content, and response characteristics.

Answer

A content delivery network serving cached assets to a browser with a corrupted user agent

Answer

A misconfigured application retrying a failed API call with exponential backoff

Answer

An automated vulnerability scanner fuzzing the web application

Question 4

A hospital must protect patient records under a regulation that specifies administrative, physical, and technical safeguards for electronic protected health information. Which U.S. regulation establishes these requirements?

Accepted Answer

HIPAA Security Rule. The HIPAA Security Rule is the U.S. regulation that requires covered entities to implement administrative, physical, and technical safeguards for electronic protected health information. Its three safeguard categories map directly to the scenario, and compliance is enforced through risk analysis and documented policies rather than a prescriptive control checklist.

Answer

SOX

Answer

GDPR

Answer

PCI DSS

Question 5

An analyst is investigating a suspected ARP poisoning attack on a local subnet. The analyst captures traffic and reviews ARP packets. Which two characteristics would most likely indicate that ARP poisoning is occurring? (Choose two.)

Accepted Answer

Multiple ARP replies from the same MAC address claiming different IP addresses. The correct indicators are multiple ARP replies from one MAC claiming different IPs and gratuitous ARP replies not preceded by a request. Both are hallmarks of ARP poisoning, where an attacker floods the network with forged ARP mappings to intercept traffic. Normal ARP requests are broadcast and are not malicious. The other options describe normal or invalid but non-indicative behavior.

Answer

ARP packets with a sender MAC address that is a multicast address

Answer

ARP request packets with a broadcast destination MAC address

Answer

ARP requests sent to a unicast destination MAC address

Question 6

A security analyst is examining a Linux system for signs of a rootkit. The analyst runs `lsmod` and notices a kernel module named `hideproc` that is not recognized. The analyst then runs `rmmod hideproc` but receives an error that the module is in use. Which of the following is the MOST likely reason the module cannot be removed?

Accepted Answer

The module's reference count is artificially incremented to prevent removal.. Rootkits frequently manipulate kernel structures to prevent their removal. By incrementing the module's reference count or hooking the `delete_module` system call, they make `rmmod` fail with 'in use'. This ensures the rootkit remains loaded. Analysts should use memory forensics or reboot to a trusted environment to remove such modules.

Answer

The module was loaded with `modprobe` and requires `modprobe -r` to remove.

Answer

The module is compiled into the kernel and cannot be removed.

Answer

The module is currently being used by a legitimate process such as `systemd`.

Question 7

While analyzing a packet capture in Wireshark, an analyst observes a series of TCP packets with the PSH, ACK flags set and a payload containing the string 'cmd.exe /c whoami'. The destination port is 4444. Which type of activity is most likely indicated?

Accepted Answer

A reverse shell established by malware. The packet capture shows TCP traffic to port 4444 with a payload containing a Windows command. This is a classic indicator of a reverse shell, where malware on a compromised host connects back to an attacker-controlled listener. SSH would be encrypted and on port 22, web traffic would be HTTP on standard ports, and DNS tunneling would use port 53. The correct answer is the reverse shell.

Answer

A DNS tunneling session exfiltrating data

Answer

A web server serving content on a non-standard port

Answer

A legitimate remote administration session using SSH

Question 8

A security analyst is examining a memory dump from a compromised host and finds a small piece of code that resides only in memory, has no corresponding file on disk, and injects itself into a running legitimate process. The code does not replicate to other systems. Which type of malware best describes this?

Accepted Answer

A fileless malware that operates in memory and injects into processes. Fileless malware operates entirely in memory, often by injecting into legitimate processes, and leaves no file on disk. This makes it difficult to detect with traditional file-based antivirus. The absence of a disk file and the process injection behavior are the defining characteristics, distinguishing it from worms, trojans, and rootkits, which typically involve files or kernel modifications.

Answer

A worm that spreads across the network

Answer

A rootkit that hides its presence by modifying the kernel

Answer

A trojan that disguises itself as legitimate software

Question 9

A threat hunter is examining a Windows 10 host and wants to determine whether a suspicious executable was recently run by a user. The hunter knows that Windows records application execution history in the registry under the UserAssist key. Which location should the hunter inspect to find this data for the currently logged-on user?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. UserAssist under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist stores per-user execution history for programs launched through Explorer. The Count subkey under each GUID contains ROT13-encoded values that include the program path and a run counter, letting the hunter confirm recent execution by the current user.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

Answer

HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings

Question 10

A security analyst is triaging a Windows server that may have been compromised. The analyst needs to identify which network connections are currently established by processes on the host and which executable is responsible for each connection. Which two native tools provide this information? (Choose two.)

Accepted Answer

Get-NetTCPConnection -State Established. Mapping active connections to the processes that own them requires tools that expose both socket state and the owning PID. netstat with the -a, -n, and -o switches reports all connections numerically with the PID, while the Get-NetTCPConnection cmdlet returns objects whose OwningProcess property carries the same identifier. Either output can then be joined with a process listing to name the responsible executable.

Answer

ipconfig /all

Answer

arp -a

Answer

route print

Question 11

A CyberOps analyst is examining a Windows workstation and finds that a scheduled task named 'MicrosoftEdgeUpdateTask' exists in Task Scheduler, but the Task Scheduler GUI shows it as disabled. The analyst suspects it was created by malware to masquerade as a legitimate updater. Which artifact should the analyst check to determine the exact executable path and arguments the task would run if it were enabled?

Accepted Answer

The XML definition of the task, stored under C:\Windows\System32\Tasks and readable with schtasks /query /xml.. The authoritative source for what a scheduled task executes is its XML definition, which lists the action's executable, arguments, and working directory. Reading it directly with schtasks /query /xml bypasses the GUI's disabled display and reveals the true payload. Event logs and file system journals provide timing and creation context but not the task's action content, so they cannot answer what the task would run.

Answer

The prefetch file for schtasks.exe located in C:\Windows\Prefetch.

Answer

The Task Scheduler operational event log (Microsoft-Windows-TaskScheduler/Operational) filtered for Event ID 106.

Answer

The file system journal for the C: volume, queried with fsutil usn readjournal, filtered to the Tasks directory.

Question 12

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The analyst is asked to classify a document that contains the company's proprietary source code. According to typical data classification standards, which classification level is most appropriate?

Accepted Answer

Restricted. Proprietary source code is a critical asset that requires the highest level of protection. The Restricted classification is designed for such data, ensuring that only authorized personnel with a specific need can access it. This minimizes the risk of intellectual property theft and aligns with common data classification policies.

Answer

Internal

Answer

Confidential

Answer

Public

Question 13

A SOC analyst is reviewing Cisco Firepower Intrusion Event logs and notices a high volume of alerts for the signature 'SERVER-WEBAPP Apache Struts2 remote code execution attempt' coming from a single internal host to external web servers. The analyst needs to determine if this is a true positive or a false positive. Which of the following actions would BEST help make that determination?

Accepted Answer

Examine the full packet capture associated with the alert to verify if the exploit payload was actually sent and if a response indicating compromise was received.. The most reliable way to determine if an intrusion alert is a true positive is to inspect the raw packets that triggered it. By analyzing the packet capture, the analyst can see the exact payload and the server's response, which provides definitive evidence of whether the exploit attempt was successful or benign. Correlating with other logs or checking reputations can provide supporting context but does not directly confirm the nature of the event.

Answer

Correlate the alert with NetFlow records to see if the internal host successfully established a connection and transferred data.

Answer

Check the reputation of the external web servers using Cisco Talos Intelligence.

Answer

Review the Snort rule that triggered the alert to understand its detection logic and potential for false positives.

Question 14

A security analyst is reviewing a packet capture and notices that an attacker is sending a large number of SYN packets to a web server from spoofed source IP addresses. The server's connection table is filling up, and legitimate users cannot connect. Which type of attack is being described?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending numerous SYN requests with spoofed source addresses. The server allocates resources for each half-open connection, eventually exhausting its backlog queue and denying service to legitimate clients. The scenario's description of spoofed SYNs and a full connection table confirms this attack.

Answer

Smurf attack

Answer

Ping of death

Answer

UDP flood

Question 15

A security analyst is investigating a Linux host for signs of compromise. The analyst runs `ps aux` and notices a process named `kworker` with a high CPU usage. The analyst suspects this may be a masquerading malware process. Which TWO commands should the analyst use to verify whether this process is legitimate or malicious? (Choose two.)

Accepted Answer

`ls -l /proc//exe` to check the executable path. Legitimate kernel worker threads (kworker) have no user-space executable and an empty cmdline. Checking /proc//exe reveals if the process points to a real binary, and /proc//cmdline shows the command line. If either indicates a user-space path or non-empty arguments, the process is likely masquerading. These two checks together provide strong evidence.

Answer

`df -h` to check disk usage

Answer

`netstat -tulpn` to list all listening ports

Answer

`top -c` to view the process list with command lines

Question 16

A SOC manager is drafting the organization's incident response plan and wants to align it with the NIST SP 800-61 Rev. 2 lifecycle so that phases are clearly defined for auditors. Which sequence correctly represents the four phases of the incident response lifecycle as described in NIST SP 800-61 Rev. 2?

Accepted Answer

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. NIST SP 800-61 Rev. 2 organizes incident response into four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. A plan built on this structure gives clear entry and exit criteria for each phase, supports role assignment, and provides auditors with a recognizable mapping. The other sequences either describe only response sub-steps or borrow generic project management terms that do not match the standard.

Answer

Identification, Containment, Eradication, Recovery

Answer

Preparation, Prevention, Detection, Response

Answer

Planning, Execution, Monitoring, Closure

Question 17

A security team is reviewing the confidentiality, integrity, and availability (CIA) triad for a new file-sharing service. The service must ensure that data cannot be altered in transit by unauthorized parties. Which security principle is primarily addressed by implementing TLS for all connections?

Accepted Answer

Integrity. The requirement to prevent unauthorized alteration of data in transit directly addresses the integrity principle of the CIA triad. TLS provides integrity through message authentication codes, ensuring that any modification is detected. While TLS also offers confidentiality, the scenario's emphasis on preventing alteration makes integrity the primary principle.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 18

An analyst is investigating a suspected SQL injection attack captured in a PCAP. The analyst needs to identify TWO indicators in the HTTP traffic that would confirm a SQL injection attempt. Which two indicators should the analyst look for? (Choose two.)

Accepted Answer

Unexpected database error messages in HTTP responses. SQL injection attempts are characterized by the injection of SQL syntax into user inputs, often visible as keywords like UNION or OR 1=1 in HTTP requests. Additionally, when the injected query causes a database error, the error message may be returned in the HTTP response, providing confirmation of the attempt. These two indicators together strongly suggest a SQL injection attack.

Answer

HTTP response containing a large number of directory listings

Answer

Multiple HTTP 302 redirects to an external domain

Answer

Presence of encrypted payloads using TLS 1.3

Question 19

A security analyst is examining a Linux host and wants to identify which user account was used to execute a specific command that modified a critical system file. Which of the following files would provide the MOST direct evidence of the user who executed the command?

Accepted Answer

/var/log/audit/audit.log. The audit log, managed by auditd, is designed to capture security-relevant events, including command execution with user context. It logs the UID and EUID, so an analyst can determine exactly which user account executed the command that modified the critical file. Other logs may not capture this level of detail.

Answer

/var/log/auth.log

Answer

/var/log/syslog

Answer

/home/<user>/.bash_history

Question 20

A SOC analyst notices an internal host transmitting a series of ICMP Echo Request packets to an external IP, each with a payload size of exactly 1024 bytes and a repeating pattern. The echo replies are consistently the same size. Which type of activity does this most likely indicate?

Accepted Answer

ICMP tunneling. The correct answer is ICMP tunneling because the traffic shows large, fixed-size ICMP payloads with repeating patterns and matching replies, which are hallmarks of data being hidden inside ICMP Echo packets. Normal ICMP usage involves small, variable payloads for diagnostics, not consistent large payloads, indicating a covert channel.

Answer

Legitimate network latency testing

Answer

Network reconnaissance via ping sweep

Answer

ICMP flood denial-of-service