200-201 Practice Test 9 — 10 Questions

Question 1

Which TWO of the following are best practices when configuring a SIEM for security monitoring?

Accepted Answer

Tune rules to reduce false positives.. Tuning SIEM rules to reduce false positives is a best practice because it improves the signal-to-noise ratio, ensuring that security analysts focus on genuine threats rather than being overwhelmed by irrelevant alerts. By adjusting thresholds, whitelisting known benign activity, or refining correlation logic, the SIEM becomes more efficient and reduces alert fatigue, which is critical for effective security monitoring.

Answer

Disable logging for low-security systems.

Answer

Use the same log source for all event types.

Answer

Enable all default correlation rules.

Question 2

An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?

Accepted Answer

Check the change management system to see if the modification was authorized. The registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.

Answer

Ignore the alert because it occurred during maintenance

Answer

Escalate the alert as a potential security incident

Answer

Immediately revert the registry change

Question 3

An analyst sees an alert from the IDS: 'ET TROJAN Possible Zeus Variant Outbound Connection'. What action should the analyst take first?

Accepted Answer

Investigate the source host for signs of compromise. The first priority when an IDS alerts on a possible Zeus variant (a known Trojan) is to investigate the source host to confirm or rule out compromise. Zeus is a credential-stealing Trojan that often establishes outbound C2 (command-and-control) traffic; blindly blocking the IP (A) could disrupt the investigation and may not stop the malware if it uses domain flux or multiple IPs. Reimaging (D) destroys forensic evidence, and ignoring the alert (B) is negligent given the severity of Zeus. The analyst must perform host-based analysis (e.g., check processes, registry, network connections) to validate the alert before taking containment actions.

Answer

Block the IP address on the firewall

Answer

Ignore the alert as a false positive

Answer

Reimage the host immediately

Question 4

During an incident, the analyst finds that an attacker modified system files. Which security principle was primarily violated?

Accepted Answer

Integrity. Integrity ensures that data and system files are not altered by unauthorized entities. When an attacker modifies system files, the trustworthiness and accuracy of those files are compromised, directly violating the integrity principle. This is distinct from confidentiality (unauthorized disclosure) or availability (denial of service).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 5

A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.

Accepted Answer

Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.. Isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.

Answer

Reboot the server to clear any suspicious processes from memory.

Answer

Immediately format the server's hard drive and reinstall the OS.

Answer

Restore the server from the most recent backup taken yesterday.

Question 6

During a security incident, a network engineer captures traffic with tcpdump and saves it to a pcap file. The analyst needs to extract all HTTP POST requests containing a specific string in the URI. Which command should be used?

Accepted Answer

tcpdump -r traffic.pcap 'tcp port 80' -A | grep 'POST' | grep 'string'. It uses tcpdump with the `-r` flag to read the pcap file, filters for TCP port 80 (HTTP), uses `-A` to print packet payloads in ASCII, and then pipes the output through two grep commands: first to isolate lines containing 'POST' (indicating HTTP POST requests) and second to filter for the specific string in the URI. This combination efficiently extracts only the relevant HTTP POST requests with the target string from the captured traffic.

Answer

tcpdump -r traffic.pcap -X | grep 'string'

Answer

ngrep -q -W byline 'POST.*string' port 80

Answer

tcpdump -r traffic.pcap -nn 'host 10.0.0.1'

Question 7

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The tcp.stream filter allows viewing a specific TCP stream by its number, which is useful for analysis.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 8

While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?

Accepted Answer

Brute force attack. Repeated login attempts with different usernames from the same IP is typical of a brute force attack against the login page.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 9

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Accepted Answer

netstat -anob. The `netstat -anob` command displays active network connections, listening ports, and the associated process IDs (PIDs) along with the executable name. This is critical for identifying unauthorized outbound connections or backdoor listeners that indicate compromise. Because network state and process-to-port mappings reside in volatile memory (RAM), they are lost on reboot, making this command essential for live forensic collection.

Answer

dir /s C:\Windows\System32\config

Answer

wevtutil qe System /c:10

Answer

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Question 10

Which THREE of the following are key elements of a security monitoring and analysis strategy? (Choose three.)

Accepted Answer

Establishing a feedback loop for continuous improvement. Establishing a feedback loop for continuous improvement (A) is a key element because security monitoring is not a static process; it requires iterative refinement based on lessons learned from incidents, false positives, and changes in the threat landscape. This loop ensures that detection rules, response playbooks, and monitoring configurations evolve to maintain effectiveness against new attack vectors and reduce noise over time.

Answer

Focusing only on network-based monitoring to reduce complexity

Answer

Automating all incident response decisions to eliminate human error