200-201 Practice Exam 62 — 20 Questions

Question 1

An intrusion detection system (IDS) generates an alert for a packet containing the string '/etc/passwd'. What type of attack is likely detected?

Accepted Answer

Directory traversal. The string '/etc/passwd' is a classic indicator of a directory traversal attack, where an attacker attempts to access files outside the web root directory by manipulating path parameters. An IDS detecting this string in a packet payload (e.g., in a URL or HTTP request) suggests the attacker is trying to read the Unix password file, which is a common target in path traversal exploits. This attack exploits insufficient input validation to navigate the file system using '../' sequences or absolute paths.

Answer

Cross-site scripting

Answer

Buffer overflow

Answer

SQL injection

Question 2

Which TWO of the following are essential requirements for a security policy to be effective?

Accepted Answer

It must be communicated to all relevant parties. A security policy must be communicated to all relevant parties because it establishes the baseline of expected behaviors and responsibilities across the organization. Without communication, users cannot be held accountable for violations, and the policy becomes a theoretical document rather than an operational control. This aligns with the ISO 27001 requirement for awareness and training, ensuring that every stakeholder understands their role in maintaining security.

Answer

It should be as long and detailed as possible

Answer

It must comply with all applicable laws

Answer

It should be updated only when an incident occurs

Question 3

Refer to the exhibit. A security analyst sees this syslog message repeatedly. Which change should the analyst make to reduce the log volume while still detecting the activity?

Accepted Answer

Implement a shun for source IP 10.0.0.2. Implementing a shun for source IP 10.0.0.2 will block all traffic from that specific host at the Cisco ASA, preventing the repeated syslog message ID 106023 (which indicates denied traffic) from being generated. This reduces log volume while still effectively detecting and stopping the malicious activity, as the shun action drops packets before they are logged.

Answer

Change the access-group to inbound on the outside interface

Answer

Add an ACL permit statement for traffic from 10.0.0.2 to 192.168.1.1

Answer

Disable logging for syslog message ID 106023

Question 4

An organization wants to ensure that a user cannot deny having sent an email. Which security goal does this address?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny having performed a specific action, such as sending an email. This is typically achieved through digital signatures using asymmetric cryptography (e.g., RSA or ECDSA) and public key infrastructure (PKI), where the sender's private key creates a signature that can be verified by anyone with the sender's public key. The goal is to provide irrefutable proof of origin and integrity, preventing the sender from later claiming they did not send the message.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 5

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal web server and was blocked.. The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Answer

The access-group 'OUTSIDE_IN' permitted the traffic.

Answer

An internal host attempted to connect to an external web server.

Answer

The ASA allowed the connection because it is a stateful firewall.

Question 6

As a SOC analyst, you are reviewing alerts from a network-based IDS. One alert is for 'ET TROJAN Zeus Trojan Check-in' triggered by traffic from an internal host to an external IP on port 8080. The IDS packet capture shows the traffic is encrypted. You check the host's antivirus logs and find that the host has not been scanned in 30 days. The host belongs to the HR department and typically accesses only internal resources and a few external HR portals. What should be your first action?

Accepted Answer

Block the external IP address at the firewall.. Blocks the external IP, preventing further communication with the potential C2 server. Option D performs a full AV scan and reviews recent process activity to confirm the infection. Both are appropriate first actions: stopping communication while gathering evidence. Option A is incorrect because encryption does not rule out trojan activity. Option C is too aggressive without confirmation and may disrupt operations.

Answer

Ignore the alert because it is encrypted and likely a false positive.

Answer

Immediately isolate the host from the network by disabling its switch port.

Question 7

Which TWO actions are characteristic of a port scan performed by an attacker? (Choose two.)

Accepted Answer

Using TCP SYN packets without completing the three-way handshake.. A is correct because a TCP SYN scan sends a SYN packet to initiate a connection but never completes the three-way handshake by sending the final ACK. This allows the attacker to determine if a port is open (SYN-ACK received) or closed (RST received) without establishing a full connection, which helps evade some logging mechanisms.

Answer

Randomly selecting target ports without any pattern.

Answer

Spoofing the source IP address to evade detection.

Answer

Sending packets at a very low rate to avoid triggering threshold-based alerts.

Question 8

An analyst sees this syslog message on the Cisco ASA. What is the most likely cause of this alert?

Accepted Answer

A DoS attack. The syslog message likely indicates a high rate of connection attempts or incomplete sessions (e.g., %ASA-4-106017: Deny TCP due to SYN flood or %ASA-4-733100: Drop rate exceeded). This is characteristic of a Denial of Service (DoS) attack, where an attacker overwhelms the firewall with traffic to exhaust resources or disrupt service. Option C is correct because the ASA's threshold-based alerting specifically triggers on abnormal traffic volumes that match DoS patterns.

Answer

Normal traffic spike

Answer

A routing loop

Answer

A misconfigured firewall

Question 9

You are monitoring a network segment that hosts a public-facing web server. The NIDS alerts on a signature 'ET WEB_SERVER SQL Injection Attempt' triggered by traffic to the web server. The alert details show a GET request with the parameter 'id=1 OR 1=1'. The web server responds with a 200 OK and returns data. You check the web server logs and find that the application is a legacy system that does not use prepared statements. The security team has a policy to block all SQL injection attempts at the network level. However, you notice that the web server is also receiving legitimate traffic with similar patterns from internal monitoring tools that use dynamic queries. What is the most appropriate response?

Accepted Answer

Add the internal monitoring tools' IP addresses to the whitelist and ensure that the network blocks the suspicious external request.. It balances security policy compliance with operational continuity. The internal monitoring tools' IP addresses should be whitelisted at the NIDS to prevent false positives, while the suspicious external request (which matches the SQL injection signature) should be blocked at the network level, as per policy. This approach ensures that legitimate internal traffic is not disrupted, while the external threat is mitigated.

Answer

Disable the SQL injection signature for the web server because it causes false positives.

Answer

Immediately block all traffic from the external source IP that triggered the alert.

Answer

Request that the internal monitoring tools stop using dynamic queries, and leave the signature as is.

Question 10

During network intrusion analysis, an analyst observes a TCP connection with the SYN flag set but no subsequent ACK. This pattern is indicative of:

Accepted Answer

SYN flood attack. A SYN flood attack is a type of denial-of-service (DoS) attack where the attacker sends a high volume of TCP SYN packets to a target server but never completes the three-way handshake by sending the final ACK. This leaves the server with half-open connections, consuming resources and potentially exhausting the connection backlog, which prevents legitimate clients from establishing connections.

Answer

DNS resolution

Answer

Normal three-way handshake

Answer

ICMP echo request

Question 11

A company uses syslog for logging from all network devices. The SOC notices that logs from a critical router are not appearing in the SIEM for the past hour, but other devices are sending logs normally. Which step should the analyst take FIRST to troubleshoot?

Accepted Answer

Ping the SIEM server from the router. The SOC sees that only one router's logs are missing while all other devices are sending logs normally. This strongly suggests the issue is isolated to that router, not the SIEM server. The quickest first step is to verify basic IP connectivity from the router to the SIEM server using ping. If the router cannot reach the SIEM server (e.g., due to a routing problem, ACL, or firewall change), no syslog UDP packets (port 514) will arrive, and no amount of local configuration checking or service restarting will fix it. This aligns with the standard troubleshooting methodology of verifying Layer 3 reachability before diving into application-layer settings.

Answer

Restart the router syslog service

Answer

Check the router logging configuration

Answer

Check the SIEM server's log receiver status

Question 12

Which TWO of the following are commonly used protocols for network security monitoring? (Select 2)

Accepted Answer

SNMP. SNMP (Simple Network Management Protocol) is correct because it is a standard protocol used to collect and organize information about managed devices on IP networks, enabling network monitoring and alerting via traps and polls. NetFlow is correct because it is a Cisco-developed protocol that captures metadata about network traffic flows, providing visibility into bandwidth usage, top talkers, and security anomalies for monitoring purposes.

Answer

SMTP

Answer

TLS

Answer

Syslog

Question 13

An analyst is reviewing alerts from an IDS and needs to classify them. Which THREE of the following are valid alert classification types?

Accepted Answer

True positive. Alert classifications help analysts prioritize: True Positive (real attack), False Positive (no attack but alert), False Negative (attack missed, but not an alert), True Negative (no attack, no alert).

Answer

False negative

Answer

Indeterminate

Question 14

A security analyst is reviewing Zeek connection logs and sees the following entry: '192.168.1.10:12345 > 10.0.0.1:80 (tcp) duration 0.001 sec, service http, bytes 60, state S0'. Based on the state 'S0', what does this indicate about the connection?

Accepted Answer

A SYN packet was sent but no reply was received.. In Zeek, S0 indicates that a SYN packet was sent but no SYN-ACK was received (connection attempt without completion). This could be part of a port scan or a half-open connection.

Answer

Data was transferred successfully and the connection closed normally.

Answer

The connection was established successfully.

Answer

The connection was reset by the remote host.

Question 15

An analyst sees an alert: 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent (Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1)'. The source is an internal host that typically uses Windows 10. What should the analyst suspect?

Accepted Answer

The traffic is likely generated by malware. The User-Agent string 'Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1' mimics Internet Explorer 6 on Windows XP (NT 5.1). Since the source host normally runs Windows 10, this outdated and mismatched User-Agent is a strong indicator of malware attempting to disguise its traffic as legacy browser activity to evade detection.

Answer

The traffic is from a web proxy

Answer

The host is running Windows XP

Answer

The host is running a browser update

Question 16

During a security audit, an analyst discovers that several employees have shared their login credentials with colleagues to expedite work. Which policy enforcement mechanism would be most effective in preventing this behavior?

Accepted Answer

Implement multi-factor authentication.. Multi-factor authentication (MFA) is the most effective enforcement mechanism because it requires a second factor (e.g., a one-time passcode from an authenticator app, a hardware token, or a biometric) in addition to the password. Even if employees share their passwords, MFA prevents unauthorized access because the second factor is tied to the individual's device or identity and cannot be easily shared. This directly addresses the root cause of credential sharing by making shared credentials useless without the additional factor.

Answer

Implement a password complexity policy.

Answer

Enforce a password change policy every 30 days.

Answer

Conduct annual security awareness training.

Question 17

Refer to the exhibit. A security analyst notices repeated login failures. According to the company's security policy, what action should be taken?

Accepted Answer

Investigate for brute force attack. Repeated login failures are a classic indicator of a brute-force attack, where an attacker attempts to guess credentials by trying many passwords. The security policy should require investigation to confirm the attack pattern (e.g., frequency, source, target accounts) before taking irreversible actions like blocking or disabling. Option C is correct because it follows the principle of verify-then-act, aligning with incident response procedures.

Answer

Block the source IP at the firewall

Answer

Ignore because it's only three failures

Answer

Disable the user account

Question 18

A security analyst discovers that an attacker used a publicly available tool to scan a company's network for open ports and services. What type of attack is this?

Accepted Answer

Active reconnaissance. Using a publicly available tool to scan a company's network for open ports and services involves directly interacting with the target systems by sending probes (e.g., TCP SYN packets, UDP datagrams) and analyzing responses. This constitutes active reconnaissance, as the attacker's actions generate traffic that can be detected by intrusion detection systems (IDS) or firewall logs, unlike passive methods that only observe existing traffic.

Answer

Passive reconnaissance

Answer

Denial of Service

Answer

Social engineering

Question 19

A security analyst is tuning a Snort IDS to reduce false positives. Which TWO Snort rule options should the analyst modify to make the rule more specific?

Accepted Answer

Set a 'threshold' to limit the number of alerts per time window. Setting a 'threshold' in Snort limits the number of alerts generated for a given rule within a specified time window, which directly reduces false positives by suppressing repeated alerts from benign traffic that matches the rule pattern. Option D is correct because adding a 'content' field forces the rule to match specific bytes in the packet payload, making the rule more precise and less likely to trigger on unrelated traffic.

Answer

Remove the 'destination port' field

Answer

Increase the 'priority' value

Answer

Change the action from 'alert' to 'log'

Question 20

A Snort rule is configured: alert udp $HOME_NET 123 -> $EXTERNAL_NET any (msg:'NTP DDoS'; content:'|17 00 03 2a|'; depth:4;). What does this rule detect?

Accepted Answer

NTP amplification attack. The rule triggers on UDP traffic from port 123 (NTP) on the internal network to any port on an external network, with a payload starting with the bytes `17 00 03 2a`. These bytes correspond to the NTP control message header for a `MON_GETLIST` request (opcode 0x17, sequence 0x00, status 0x03, association ID 0x002a), which is the classic pattern used in NTP amplification attacks. This detects an outgoing NTP query that attempts to exploit the `monlist` command to reflect a large volume of traffic toward a victim, making D correct.

Answer

SNMP community string

Answer

NTP server misconfiguration

Answer

DNS amplification attack