200-201 Practice Exam 63 — 20 Questions

Question 1

An organization classifies data into Public, Internal, Confidential, and Restricted tiers. A developer needs to place a dataset containing customer payment card numbers into the correct tier and apply the required handling controls. According to common data classification practices, which tier and control combination is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restricted, with encryption, strict need-to-know access, and audit logging. Payment card numbers are regulated under PCI DSS and represent a high-impact asset if disclosed, so they belong in the most restrictive tier the organization defines. Restricted classification paired with encryption, need-to-know access, and audit logging satisfies both internal policy and regulatory expectations. Lower tiers such as Internal, Confidential, or Public would apply weaker controls than the data warrants and could create compliance exposure.

Answer

Confidential, with encryption at rest and in transit

Answer

Internal, because the data is used only by employees

Answer

Public, because the numbers are only partial card values

Question 2

A security manager is developing a business continuity plan (BCP) and needs to determine the maximum tolerable downtime (MTD) for a critical order-processing system. The system generates $10,000 in revenue per hour. If the system is down for more than 4 hours, the company will lose a key customer. What is the MTD for this system?

Accepted Answer

4 hours. The maximum tolerable downtime (MTD) is the longest time a system can be offline before the business suffers unacceptable consequences. Here, the loss of a key customer after 4 hours defines that threshold, so the MTD is 4 hours. Revenue loss per hour is relevant for cost analysis but does not change the MTD.

Answer

The MTD cannot be determined from the information given.

Answer

24 hours

Answer

1 hour

Question 3

During an incident response engagement, an analyst is examining a Windows Server 2019 host that is suspected of being compromised. The analyst wants to determine which user accounts were used to log on interactively to the console in the last 24 hours. Which Windows artifact should the analyst query to obtain this information?

Accepted Answer

Security Event ID 4624 with Logon Type 2. Successful interactive logons at the console are recorded as Security Event ID 4624 with Logon Type 2. Filtering for that combination and the last 24 hours gives the analyst the specific accounts used for interactive console access on the server, which is exactly the requested scope.

Answer

Security Event ID 4672 with Logon Type 2

Answer

Security Event ID 4624 with Logon Type 3

Answer

Security Event ID 4634 with Logon Type 2

Question 4

A security analyst at a mid-sized company is reviewing the organization's risk management strategy. The CIO asks the analyst to describe the primary purpose of a vulnerability assessment. Which statement best describes this purpose?

Accepted Answer

It identifies, quantifies, and prioritizes vulnerabilities in a system.. A vulnerability assessment is a systematic review that identifies, quantifies, and prioritizes security weaknesses in an environment. It differs from a penetration test because it does not exploit flaws or simulate an attacker; instead, it produces a list of vulnerabilities ranked by severity so that remediation efforts can be planned. This makes it a foundational risk management activity.

Answer

It automatically applies patches to all discovered software flaws without human intervention.

Answer

It actively exploits vulnerabilities to determine the level of access an attacker could achieve.

Answer

It provides a real-time dashboard of all security incidents occurring on the network.

Question 5

A SOC analyst receives an alert about a Windows workstation that may be infected with malware. The analyst wants to examine the system's boot configuration to determine if the malware modified boot settings to disable driver signature enforcement. Which Windows tool should the analyst use to view the current boot configuration data?

Accepted Answer

bcdedit. The correct tool is bcdedit, which manages Windows Boot Configuration Data. Malware often modifies BCD settings such as nointegritychecks or testsigning to bypass driver signature enforcement and load malicious drivers. Inspecting BCD with bcdedit /enum reveals these modifications. Other tools like msconfig, regedit, or sigverif do not provide direct access to BCD settings, making them unsuitable for this task.

Answer

regedit

Answer

msconfig

Answer

sigverif

Question 6

A network analyst is examining a PCAP and notices a series of TCP packets with the PSH flag set and small payload sizes, sent from an internal host to an external IP. The external IP responds with similar small packets. The communication is continuous and occurs at regular intervals. Which type of activity is most likely occurring?

Accepted Answer

Interactive command-and-control session. The combination of small payloads, PSH flag, and regular intervals is indicative of an interactive command-and-control channel. Attackers often use such channels to maintain stealth, sending commands and receiving responses in small packets to avoid detection by volume-based monitoring. This pattern is distinct from bulk transfers or DoS attacks.

Answer

Network time synchronization

Answer

Denial-of-service attack

Answer

Large file transfer

Question 7

A security analyst is examining a suspicious executable found on a compromised host. Static analysis reveals that the file contains a packer and obfuscated strings. When run in a sandbox, it attempts to connect to an external IP address and modifies registry keys for persistence. Which stage of the cyber kill chain does the registry modification represent?

Accepted Answer

Installation. Registry modification for persistence is part of the Installation stage of the cyber kill chain, where the attacker ensures the malware survives reboots. The other stages such as Delivery, Exploitation, and Command and Control occur at different points. The sandbox observation of registry changes indicates the malware is establishing a foothold.

Answer

Command and Control

Answer

Exploitation

Answer

Delivery

Question 8

A junior analyst is asked to identify which type of log would best show whether a Windows workstation attempted to authenticate to a file share on another server. Which log source should the analyst consult?

Accepted Answer

Windows Security event log on the workstation, looking for logon events.. Windows Security event logs on the workstation capture logon events, including network logons to remote shares. Events like 4624 with logon type 3 show that an account authenticated over the network. This is the most direct evidence of an authentication attempt to a file share.

Answer

DHCP server logs showing IP address leases.

Answer

Firewall logs showing allowed outbound TCP port 445 traffic.

Answer

Syslog from the core switch showing interface status changes.

Question 9

A network security analyst is reviewing NetFlow records from a perimeter router and observes that an internal server at 172.16.5.20 has transferred approximately 4.5 GB to an external IP address in country X over the past three hours, all during non-business hours. The destination IP has no prior communication history with the organization and the traffic uses port 443. Which analysis approach would best confirm whether this represents data exfiltration?

Accepted Answer

Capture full packet data for the transfer and perform content inspection to identify the data being sent. To confirm exfiltration, the analyst must determine what data is leaving, not just how much. Full packet capture with content inspection, or decrypted proxy and TLS logs where available, reveals file types, protocols, and payloads. NetFlow establishes the anomaly—large volume, unusual destination, off-hours timing—but content-level visibility converts suspicion into confirmation and supports incident response decisions.

Answer

Check the router's interface error counters for packet loss

Answer

Review the server's antivirus scan history for the past week

Answer

Verify the server's operating system patch level

Question 10

A company wants to protect its web application from injection attacks by ensuring that user-supplied input is not interpreted as code by the backend database. Which control should be implemented?

Accepted Answer

Parameterized queries. Parameterized queries ensure that user input is passed as data and never concatenated into the SQL statement, so the database cannot interpret it as code. This is the most effective and fundamental defense against SQL injection, unlike input validation, output encoding, or a WAF.

Answer

Web application firewall

Answer

Output encoding

Answer

Input validation

Question 11

A SOC analyst is reviewing Cisco Firepower intrusion event logs and notices a signature that fired with the message 'OS-COMMAND' on traffic destined to an internal web server on TCP port 80. Which type of activity does this signature most likely indicate?

Accepted Answer

A remote command injection attempt against a web application. An OS-COMMAND signature on HTTP traffic to a web server indicates an application-layer command injection attempt, where an attacker embeds operating system commands in a request to execute them on the target. The port and signature category align with this interpretation, making the remote command injection scenario the correct reading of the alert.

Answer

A DNS tunneling session exfiltrating data to an external resolver

Answer

A brute-force authentication attempt against the web server's SSH service

Answer

A normal software update check initiated by the web server

Question 12

A security analyst is investigating an incident where an attacker gained initial access to a corporate network. The analyst finds that the attacker sent a phishing email with a link to a malicious website that exploited a vulnerability in the user's browser. Which phase of the Cyber Kill Chain does the browser exploitation represent?

Accepted Answer

Exploitation. The Cyber Kill Chain phases are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. When a user visits a malicious website that exploits a browser vulnerability, that action is Exploitation. It follows Delivery (the phishing email with the link) and precedes Installation of any persistent payload.

Answer

Weaponization

Answer

Installation

Answer

Reconnaissance

Question 13

A security manager is drafting a service level agreement (SLA) with a cloud service provider. The SLA must specify the maximum acceptable time for the provider to restore service after a disruption. Which metric should the manager include in the SLA to define this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a service after a disruption, making it the correct metric for the SLA. RPO addresses data loss, while MTBF and MTTR are reliability and repair averages, not restoration targets. The manager should specify RTO to ensure the provider meets business continuity requirements.

Answer

Mean Time To Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 14

A security analyst is reviewing the cryptographic mechanisms used to protect data in transit and at rest. The organization wants to ensure confidentiality and integrity for sensitive files stored on a server and for data sent over a VPN. Which TWO of the following mechanisms provide both confidentiality and integrity for data? (Choose two.)

Accepted Answer

AES-256 in CBC mode with HMAC-SHA256. AES-256 in GCM mode and AES-256 in CBC mode combined with HMAC-SHA256 both provide confidentiality and integrity. GCM is an authenticated encryption mode that includes an integrity tag, while CBC with HMAC uses separate encryption and authentication. SHA-256 and HMAC-SHA256 alone lack confidentiality, and RSA-2048 encryption alone lacks inherent integrity.

Answer

HMAC-SHA256

Answer

SHA-256 hashing

Answer

RSA-2048 encryption

Question 15

A financial services firm must retain security event logs for seven years to satisfy regulatory requirements. The SOC manager asks which property of log data must be preserved so that logs cannot be altered or deleted after collection, even by administrators. Which property should the manager emphasize?

Accepted Answer

Integrity. Log integrity means the data has not been altered or destroyed after collection, which is exactly what regulators expect when logs are retained as evidence. Techniques such as write-once media, hashing, and forwarding to hardened centralized collectors enforce integrity. Confidentiality limits who can read logs, availability keeps them reachable, and non-repudiation proves authorship, so none of those properties directly prevents tampering with stored records.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 16

A security analyst is reviewing firewall logs and notices that a workstation is making outbound connections to multiple external IP addresses on port 22 (SSH). The workstation is not authorized to use SSH for external connections. Which type of activity does this most likely indicate?

Accepted Answer

The workstation is infected with malware attempting to establish SSH tunnels for data exfiltration or C2.. Unauthorized outbound SSH from a workstation to multiple external IPs is highly suspicious. Attackers and malware often use SSH for encrypted C2 channels or data exfiltration because it blends with legitimate traffic. The lack of authorization and multiple destinations reinforce this as malicious activity.

Answer

The workstation is being used as a jump host for legitimate remote administration.

Answer

The workstation is synchronizing time with external NTP servers over port 22.

Answer

The workstation is performing a vulnerability scan against external hosts.

Question 17

A security analyst is reviewing the organization's incident response plan and wants to ensure it aligns with the NIST incident response lifecycle. Which two phases are part of the NIST incident response lifecycle? (Choose two.)

Accepted Answer

Preparation. The NIST incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation and Detection and Analysis are two of these phases, while vulnerability scanning, risk assessment, and penetration testing are separate security activities.

Answer

Vulnerability Scanning

Answer

Penetration Testing

Answer

Risk Assessment

Question 18

A SOC analyst is investigating a suspected data exfiltration event on a corporate network. The analyst runs a Wireshark display filter on a captured PCAP and sees a large volume of outbound packets from an internal workstation to an external IP address, all with the same destination port and with the TCP PSH flag set on nearly every packet. The payloads are small but consistently sized, and the transfer continues for over 30 minutes. Which statement best explains why this traffic pattern is suspicious in the context of network intrusion analysis?

Accepted Answer

The steady, long-duration outbound flow with consistent packet sizes suggests a scripted or automated transfer, which is consistent with data exfiltration rather than normal interactive user activity.. The correct answer focuses on behavioral indicators: a long, steady, automated-looking outbound flow with uniform packet sizes and the PSH flag set on most packets. This pattern is typical of data exfiltration tools that chunk and push data continuously, unlike bursty interactive user traffic. The other options misattribute meaning to TCP flags or make incorrect claims about detection limits, which would mislead an analyst.

Answer

The PSH flag indicates the sender is bypassing TCP flow control, which is a known evasion technique used by rootkits to hide data in the TCP header.

Answer

The presence of the PSH flag on nearly every packet means the connection is using TCP Fast Open, which is only seen in malicious command-and-control channels.

Answer

The use of a single destination port for all outbound packets indicates the traffic is encrypted, and encrypted exfiltration cannot be detected by network analysis.

Question 19

A SOC analyst is reviewing a Windows 10 endpoint that is suspected of being compromised by malware that hides its network connections. The analyst runs 'netstat -anob' on the live system but does not see any suspicious outbound connections. Which Windows artifact should the analyst examine next to identify network connections that may have been hidden from the live API?

Accepted Answer

The SRUM database (SRUDB.dat) parsed with a tool such as srum-dump. SRUM maintains a rolling record of per-application resource usage, including bytes sent and received and network interface activity, in the SRUDB.dat ESE database. Because it is populated by the SRUM service rather than by the APIs malware commonly hooks to hide from netstat or GetTcpTable, it can surface external communications that live commands miss. Parsing SRUM therefore gives the analyst network evidence the live system concealed.

Answer

The Amcache.hve registry hive parsed with AmcacheParser

Answer

The ShimCache (AppCompatCache) entries in the SYSTEM hive

Answer

The Windows Prefetch files parsed with PECmd

Question 20

A network security analyst is examining a packet capture in Wireshark and notices a series of TCP packets with the PSH, ACK flags set, and a payload containing the string 'cmd.exe /c whoami'. The packets are destined to port 445 on an internal server. Which type of malicious activity is most likely indicated?

Accepted Answer

SMB lateral movement and command execution. The presence of SMB traffic on port 445 carrying a command shell payload such as 'cmd.exe /c whoami' is a strong indicator of lateral movement and remote command execution. Attackers often use SMB to move between systems and execute commands, making this the most likely malicious activity in the scenario.

Answer

DNS tunneling for data exfiltration

Answer

SMTP email-based malware delivery

Answer

HTTP command-and-control communication