200-201 Practice Test 8 — 10 Questions

Question 1

An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?

Accepted Answer

ss -tlnp. The 'ss' command with options -t (TCP), -l (listening), -n (numeric), -p (process) shows listening TCP ports and the corresponding processes.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

lsof -i TCP

Question 2

Which type of malware is designed to spread automatically across networks without user interaction?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, often exploiting vulnerabilities without any user intervention. Unlike viruses, worms do not require a host file or user action to propagate, making them capable of rapid, automated spread across networks.

Answer

Ransomware

Answer

Virus

Answer

Trojan

Question 3

A SIEM correlation rule triggers an alert when more than 10 failed login attempts from the same source IP occur within 60 seconds. Which attack is this rule designed to detect?

Accepted Answer

Brute force attack. This SIEM rule detects a brute force attack by correlating a high volume of failed login attempts (more than 10) from the same source IP within a short time window (60 seconds). Brute force attacks rely on rapid, repeated authentication attempts to guess credentials, and this threshold-based correlation is a classic detection method for such behavior.

Answer

Phishing attack

Answer

Man-in-the-middle

Answer

SQL injection

Question 4

A security analyst is reviewing the company's incident response plan. The plan states that 'all incidents must be contained within 30 minutes.' During a recent ransomware incident, the analyst identified the affected systems but could not contain them because the containment procedures required manual steps that took over an hour. What is the most likely gap in the plan?

Accepted Answer

The plan does not provide automated containment options.. The plan's requirement to contain incidents within 30 minutes is unachievable because the containment procedures rely solely on manual steps that take over an hour. The most likely gap is the absence of automated containment options, such as pre-configured firewall ACLs, host-based IPS policies, or SOAR playbooks that can isolate affected systems in seconds. Without automation, the response time objective (RTO) for containment is fundamentally mismatched with the procedural capability.

Answer

The ransomware was too sophisticated.

Answer

The analyst lacked proper training.

Answer

The analyst did not have proper authorization.

Question 5

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines the boundaries of the policy's applicability. Option C is correct because explicitly listing the systems and networks covered ensures that all stakeholders understand which assets fall under the policy's requirements, preventing gaps or overlaps in security controls.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 6

A company's security policy prohibits the use of shared accounts. However, a legacy application requires a shared administrative account to run. What is the best approach?

Accepted Answer

Use a privileged access management solution to control and monitor the shared account. A privileged access management (PAM) solution allows the shared administrative account to be used while enforcing security controls. PAM tools can vault the shared credentials, require check-in/check-out workflows, rotate passwords automatically, and provide full session recording and auditing. This satisfies the security policy's prohibition on shared accounts by eliminating direct shared access and replacing it with monitored, temporary, and revocable privileged sessions.

Answer

Create a policy exception

Answer

Disable the application

Answer

Ignore the policy because it's a legacy system

Question 7

An analyst needs to collect volatile data from a live host before performing a memory dump. Which data is most volatile?

Accepted Answer

Network connections. Network connections are the most volatile data because they change rapidly as packets flow and sessions are established or torn down. In live response, the current state of TCP/UDP connections (e.g., via netstat -ano) can be lost the instant the system is powered off or the network cable is pulled, making them more ephemeral than registry data, file system metadata, or event logs.

Answer

Registry data

Answer

File system metadata

Answer

Event logs

Question 8

A security analyst is reviewing IDS alerts and notices multiple TCP resets sent from an internal host with IP 10.10.10.25 to various external IPs on port 443. The alerts indicate that these resets occur immediately after the corresponding SYN-ACK from the external server, before any data exchange. The analyst suspects a TCP reset attack. Which action is most likely occurring?

Accepted Answer

An attacker is spoofing the client IP to send forged RST packets.. The described behavior—TCP RST packets sent immediately after the SYN-ACK, before any data exchange, from an internal host to multiple external IPs on port 443—is characteristic of a TCP reset attack. In this attack, an adversary spoofs the source IP of the legitimate client (10.10.10.25) and sends forged RST segments to the external servers, causing them to abort the TCP handshake prematurely. This prevents the completion of the three-way handshake and disrupts the connection before any application data can be exchanged.

Answer

A firewall is sending RST packets to block outbound traffic.

Answer

A client is properly closing a session after receiving data.

Answer

The client is retransmitting lost TCP segments.

Question 9

During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?

Accepted Answer

A false positive; the hash corresponds to an empty file.. The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Answer

An invalid hash; the file may be corrupt.

Answer

A known malicious executable that should be quarantined.

Answer

A hash of a benign system file.

Question 10

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location