200-201 Practice Test 8 — 10 Questions

Question 1

An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

False positive. A false positive occurs when an alert is triggered but the activity is actually benign. Here, the SQL injection attempt was a benign test and the application is not vulnerable, so the alert is a false positive. This classification is correct because the detection system incorrectly flagged legitimate activity as malicious.

Answer

True negative

Answer

False negative

Answer

True positive

Question 2

An organization's security policy requires that all traffic between the corporate network and the internet be inspected by an IPS. However, encrypted traffic (HTTPS) cannot be inspected without breaking encryption. Which solution best meets the policy requirement?

Accepted Answer

Implement SSL/TLS interception using a proxy with a trusted certificate. SSL/TLS interception using a proxy with a trusted certificate allows the IPS to decrypt, inspect, and re-encrypt HTTPS traffic. The proxy acts as a man-in-the-middle, presenting a certificate trusted by internal clients, so the IPS can apply security policies to the decrypted content before forwarding it to the internet.

Answer

Allow all HTTPS traffic without inspection

Answer

Rely on endpoint security only

Answer

Disable HTTPS for internal users

Question 3

An analyst is investigating a PCAP file and wants to reconstruct a conversation between two hosts. Which Wireshark filter would be most appropriate to follow the entire TCP stream?

Accepted Answer

tcp.stream eq 0. The filter 'tcp.stream eq 0' is used in Wireshark to follow a specific TCP stream. When you right-click on a packet and select 'Follow TCP Stream', Wireshark automatically applies this filter with the appropriate stream index. This filter displays all packets belonging to that particular TCP conversation, allowing the analyst to reconstruct the entire session between the two hosts. Other filters like 'ip.addr' show all traffic to/from an IP, which may include multiple streams, and 'http.request' only shows HTTP requests, not the full stream.

Answer

dns.qry.name

Answer

ip.addr == 10.0.0.1

Answer

http.request

Question 4

In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?

Accepted Answer

Reverse shell payload. A reverse shell payload is the correct answer because it establishes an interactive shell session where the target machine connects back to the attacker's machine, allowing the attacker to execute commands. In a PCAP, this appears as a TCP session with irregular command prompts and responses, often with small packet sizes and interactive timing. The traffic may not follow standard protocol patterns, and the commands/responses are human-readable or encoded.

Answer

File transfer tool

Answer

Port scanner

Answer

SQL injection tool

Question 5

A Windows system's security log shows Event ID 4720 followed by 4726 for the same username within minutes. What does this sequence indicate?

Accepted Answer

An account was created and then deleted, possibly for short-term unauthorized access.. Event ID 4720 indicates a user account was created, and 4726 indicates it was deleted. The short interval suggests the account was created for temporary access, possibly malicious, and then removed to cover tracks.

Answer

A user changed their password.

Answer

The account was successfully logged on.

Answer

A group membership was changed.

Question 6

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Windows Security Event ID 4720 is logged when a user account is created. It is a key indicator for detecting unauthorized account creation, which attackers use for persistence and privilege escalation. This directly matches the question.

Answer

4726

Answer

4648

Answer

4624

Question 7

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. The Preparation phase of NIST SP 800-61 Rev 2 covers establishing the incident response capability, including developing the IR plan, acquiring tools, training staff, and exercising the plan through tabletop and functional exercises. Exercising the plan before an incident occurs is explicitly a Preparation activity, not something done during or after an event.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 8

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 9

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption with AES transforms plaintext into ciphertext using a shared secret key, so an attacker who intercepts the data over the internet cannot read it without the key. AES is the standard, NIST-approved symmetric cipher (FIPS 197) used in TLS, VPNs, and disk encryption. This directly satisfies the requirement that intercepted data cannot be read.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 10

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Option A (/var/spool/cron/crontabs/) is correct because this is the directory where per-user crontab files are stored on Debian/Ubuntu-style systems, and attackers commonly drop a crontab entry here to run a payload under a specific user account at scheduled intervals. Option C (/etc/crontab) is correct because it is the system-wide crontab file that supports the extra user field and is a frequent target for persistence, since a malicious line added here executes with the specified user's privileges on a recurring schedule. Option B (/etc/init.d/) is not cron-based; it holds SysV init scripts for service startup, not scheduled jobs. Option D (/var/log/cron) is a log file recording cron activity, useful for detection but not a persistence location. Option E (/etc/systemd/system/) is for systemd unit files, a separate persistence mechanism from cron.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/