200-201 Practice Exam 63 — 20 Questions

Question 1

You are a SOC analyst at a medium-sized enterprise. The company uses a SIEM that collects logs from firewalls, endpoints, and Active Directory. At 2:00 AM, the SIEM generates a high-priority alert: 'Multiple Failed Logins for Administrator Account from Remote IP 198.51.100.20'. The analyst on the night shift reviews the alert and sees that there were 50 failed attempts in 10 minutes, followed by a successful login at 2:12 AM. The successful login originated from the same IP. The account is a domain administrator. The analyst checks the firewall logs and sees that the IP is from a known VPN provider. The analyst also checks the endpoint logs and sees that no unusual activity has occurred after the login. The company has a policy that remote administration is allowed only from a specific jump server with IP 203.0.113.10. The analyst suspects a brute-force attack succeeded. What should the analyst do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the compromised administrator account immediately. The immediate priority is to contain the breach by disabling the compromised domain administrator account. The successful login from an unauthorized IP (198.51.100.20) after 50 failed attempts indicates a successful brute-force attack, and the account has domain-level privileges. Disabling the account stops any further lateral movement or privilege escalation, which is the first step in incident response containment before any remediation or investigation.

Answer

Block the IP address 198.51.100.20 on the firewall

Answer

Perform a full network scan of the VPN provider's entire IP range

Answer

Reset the password of the compromised administrator account

Question 2

An attacker sends an email posing as the company's IT department, asking employees to click a link and enter their credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick recipients into revealing credentials, which is the classic definition of phishing. Phishing is a broad category of social engineering that employs deceptive electronic communications (typically email) to steal sensitive information.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 3

A SOC analyst is analyzing NetFlow data and notices a sudden spike in outbound traffic from a single internal host to an external IP address during non-business hours. The traffic volume is significantly higher than the baseline. Which suspicion is most likely?

Accepted Answer

Data exfiltration is occurring. A sudden increase in outbound traffic to a single external IP, especially outside business hours, often indicates data exfiltration.

Answer

The host is running a backup to cloud storage

Answer

The host is part of a botnet performing DDoS attack

Answer

The host is performing legitimate software updates

Question 4

A company's remote access policy requires VPN connections to use two-factor authentication (2FA). An employee reports they cannot connect because their token is not syncing. What is the best course of action?

Accepted Answer

Provide a new token and synchronize it correctly. The core issue is a synchronization problem between the employee's token and the authentication server. Two-factor authentication (2FA) relies on time-based one-time passwords (TOTP) or event-based (HOTP) algorithms; if the token's clock drifts or the counter becomes out of sync, authentication fails. Providing a new token and correctly synchronizing it (e.g., via NTP time alignment or reseeding the HMAC-based OTP counter) restores secure access without bypassing the security policy.

Answer

Disable 2FA for the employee

Answer

Replace the token and allow access anyway

Answer

Temporarily allow connections without 2FA

Question 5

Drag and drop the steps for initial configuration of a Cisco IOS device after booting into the correct order.

Accepted Answer

Step 1: Enter privileged EXEC mode (enable), Step 2: Enter global configuration mode (configure terminal), Step 3: Set hostname (hostname name), Step 4: Set enable secret (enable secret password), Step 5: Save the running configuration (copy running-config startup-config).. After booting, you must enter privileged mode, then global config, set hostname, set enable secret, and save.

Answer

Step 1: Enter global configuration mode, Step 2: Enter privileged EXEC mode, Step 3: Set hostname, Step 4: Set enable secret, Step 5: Save the running configuration.

Answer

Step 1: Enter privileged EXEC mode, Step 2: Enter global configuration mode, Step 3: Set enable secret, Step 4: Set hostname, Step 5: Save the running configuration.

Answer

Step 1: Enter privileged EXEC mode, Step 2: Enter global configuration mode, Step 3: Set hostname, Step 4: Save the running configuration, Step 5: Set enable secret.

Question 6

A security analyst detects a large number of TCP RST packets from a single external IP to various internal hosts. The internal hosts are not sending any corresponding packets. What is the most likely cause?

Accepted Answer

A TCP reset attack is being performed. A TCP reset attack (also known as a forged RST attack) occurs when an attacker sends spoofed TCP RST packets to disrupt an existing connection. The key clue is that the internal hosts are not sending any corresponding packets, indicating the RST packets are unsolicited and likely forged, which is characteristic of this attack rather than a normal network event.

Answer

A denial-of-service attack is occurring

Answer

A TCP connection is being established

Answer

A port scan is in progress

Question 7

A Zeek connection log shows a high number of connections from a single internal IP to many different external IPs on port 25, with small payload sizes. Which behavior is most likely indicated?

Accepted Answer

Spam email campaign or SMTP scanning. Port 25 is the default SMTP port used for email transmission. A high volume of connections from a single internal IP to many different external IPs on port 25, with small payload sizes, is characteristic of a spam email campaign or SMTP scanning. This pattern suggests the host is either sending bulk spam emails or probing external mail servers for open relay or user enumeration.

Answer

DNS tunneling

Answer

Secure web browsing

Answer

Data exfiltration using FTP

Question 8

A security auditor reviews a company's security policies and finds that the password policy requires a minimum length of 8 characters and complexity including uppercase, lowercase, digit, and special character. However, the policy does not mandate password expiration. Which of the following is the most significant risk due to this omission?

Accepted Answer

Stolen credentials could be used for extended periods without detection. Without mandatory password expiration, an attacker who obtains valid credentials (e.g., via phishing or credential dumping) can maintain access indefinitely, as the password never needs to be changed. This increases the window of opportunity for lateral movement, data exfiltration, or privilege escalation. In contrast, periodic expiration forces re-authentication and reduces the lifespan of compromised credentials.

Answer

Users may choose weak passwords that are easy to guess

Answer

Help desk will receive an increased number of password reset requests

Answer

Users might reuse passwords across different systems

Question 9

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Accepted Answer

Run 'netstat -b' on the Windows host to display active connections with the associated process executable.. Running 'netstat -b' on a Windows host displays active TCP connections along with the executable name of the process that created each connection. This directly correlates the outbound connection to the malicious IP with the specific process, which is exactly what the analyst needs to identify the pivot point.

Answer

Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.

Answer

Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.

Answer

Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.

Question 10

An organization wants to ensure that a received email genuinely came from the claimed sender and has not been altered. Which cryptographic mechanism provides both authentication and integrity?

Accepted Answer

Digital signature. A digital signature uses the sender's private key to sign the message, and the recipient verifies it with the sender's public key. This process provides authentication (proving the sender's identity) and integrity (detecting any alteration) because any change to the message invalidates the signature. Hash functions alone provide integrity but not authentication, while PKI is the infrastructure that supports digital signatures but is not the mechanism itself.

Answer

Hash function

Answer

Public key infrastructure (PKI)

Answer

Symmetric encryption

Question 11

Refer to the exhibit from a Cisco Firepower event. Which action is most appropriate for the analyst?

Accepted Answer

Investigate the source host for compromise. The exhibit shows a single intrusion event from a specific source IP to a destination IP. The most appropriate first step is to investigate the source host for compromise because the event indicates a potential exploit attempt originating from that host. Without additional context (e.g., multiple events, confirmed data exfiltration), escalating to law enforcement or blocking the IP is premature, and disabling the signature would blind the sensor to future threats.

Answer

Escalate to law enforcement

Answer

Block the destination IP

Answer

Disable the intrusion signature

Question 12

An analyst uses 'sc query' on a Windows host and finds a service named 'WindowsUpdate' with a binary path pointing to 'C:\Users\Public\update.exe'. The service is running. Why is this suspicious?

Accepted Answer

The binary path is not in a system directory. Legitimate Windows services, especially those mimicking system components like Windows Update, should have their binary paths in protected system directories (e.g., C:\Windows\System32). A binary path pointing to C:\Users\Public\update.exe indicates the executable is in a user-writable location, which is a common technique used by malware to evade detection and maintain persistence. The 'sc query' command reveals the service configuration, and this abnormal path is a strong indicator of compromise.

Answer

The service is running

Answer

The service name is misspelled

Answer

The service displays 'WindowsUpdate'

Question 13

A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?

Accepted Answer

Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.. A brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

Answer

Alert when a single failed SSH login occurs.

Answer

Alert when successful SSH logins occur outside business hours.

Answer

Alert when multiple failed SSH logins from various IPs occur in one hour.

Question 14

A host inside the network has a connection to a known malicious IP with TCP state TIME_WAIT. What is the most likely interpretation?

Accepted Answer

The host has finished its communication. The TIME_WAIT TCP state indicates that the local host has initiated the closure of the connection and is waiting for any delayed packets to arrive before fully releasing the socket. This state is entered after the local host sends the final ACK in the four-way handshake, meaning the host has completed its communication with the remote IP. Therefore, the connection is finished, not ongoing.

Answer

The connection was terminated by the remote host

Answer

The host is being scanned

Answer

The host is actively infected and communicating

Question 15

An alert shows a high volume of outbound traffic from an internal host to an external IP using FTP. The data includes files with names matching internal document names. This activity is most likely:

Accepted Answer

Data exfiltration. Exfiltration via FTP is a common technique to steal data by transferring it to an external server.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Port scanning

Question 16

An analyst reviews a PCAP and sees HTTP requests containing script tags and event handlers such as 'onload' and 'onerror'. Additionally, the URI contains 'alert(1)'. Which TWO types of attacks are indicated? (Select 2)

Accepted Answer

Reflected XSS. The presence of script tags, event handlers like 'onload' and 'onerror', and the URI containing 'alert(1)' indicates that the attacker is injecting client-side script into the HTTP response. Since the payload is reflected in the URI (likely in a query parameter or path) and executed immediately in the browser without being stored on the server, this is Reflected XSS (option B). The same payload can also be executed via client-side JavaScript that manipulates the DOM using untrusted data from the URI, which is characteristic of DOM-based XSS (option C).

Answer

Command injection

Answer

Stored XSS

Answer

SQL injection

Question 17

Which TWO of the following are key elements that should be included in an incident response plan?

Accepted Answer

Roles and responsibilities of the incident response team. Clearly defining roles and responsibilities ensures that each incident response team member knows their specific duties during a security incident, which is a foundational element of any incident response plan as outlined in NIST SP 800-61. Without this clarity, response efforts can become chaotic, leading to delays in containment and remediation.

Answer

Requirements for antivirus software on endpoints

Answer

List of approved forensic tools

Answer

Step-by-step technical remediation instructions for specific attack types

Question 18

A SOC Tier 2 analyst is investigating an alert that was escalated from Tier 1. The analyst suspects the malware is using a new variant of ransomware. What is the most appropriate next step for the Tier 2 analyst?

Accepted Answer

Perform malware analysis and correlate with other alerts. Tier 2 conducts deeper investigation, including malware analysis and correlation with other data.

Answer

Notify legal counsel immediately

Answer

Escalate directly to Tier 3 for advanced analysis

Answer

Delete the affected files to contain the spread

Question 19

Based on the exhibit, which type of traffic is being denied?

Accepted Answer

UDP traffic from an internal host to an external DNS server.. The exhibit shows an access control list (ACL) entry that denies UDP traffic from any source to any destination with a destination port of 53, which is the standard port for DNS. Since the ACL is applied inbound on an interface facing the internal network, it specifically blocks UDP traffic originating from an internal host destined for an external DNS server. This matches option C exactly.

Answer

Traffic permitted by the access group.

Answer

TCP traffic to a DNS server.

Answer

ICMP traffic from an external host.

Question 20

What is the effect of this configuration on a Cisco device?

Accepted Answer

Users are authenticated using the local database.. The configuration shown (not provided in the question, but implied by the correct answer) is a typical local authentication setup, such as 'aaa authentication login default local' or a username/password defined in the device's local database. This means the device uses its own stored credentials to authenticate users, not an external server. Option C is correct because local authentication is explicitly configured, bypassing any external AAA server.

Answer

Users are authenticated using a TACACS+ server.

Answer

Authorization is done via RADIUS.

Answer

No authentication is required.