200-201 Practice Test 9 — 10 Questions

Question 1

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Option B, /var/spool/cron/crontabs/, is correct because attackers commonly establish persistence by adding malicious cron jobs here (per-user crontabs on Debian/Ubuntu systems), so unexpected entries provide direct evidence of attacker activity. Option D, /var/log/auth.log, is correct because it records authentication events such as SSH logins, sudo usage, and failed/successful password attempts, which can reveal unauthorized access or brute-force activity. Option E, /home/user/.bash_history, is correct because it preserves the commands a user (or an attacker operating under that account) executed, often exposing reconnaissance, privilege escalation, or data exfiltration commands. Option A, /proc/cpuinfo, is not relevant because it only exposes CPU hardware details from the kernel and contains no record of user or attacker actions. Option C, /etc/passwd, is not the best evidence of activity because it is a static account database listing users; while tampering (e.g., a rogue UID 0 account) could be suspicious, the file itself does not log activity, and the question asks for artifacts evidencing attacker activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 2

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The `tcp.stream` filter in Wireshark isolates a single TCP conversation by its stream index, allowing analysts to follow the entire bidirectional flow of that session. Once filtered, you can right-click and select Follow > TCP Stream to extract the full payload. This is the standard method for reconstructing application-layer data from a specific conversation in a PCAP.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 3

An analyst is reviewing Windows Event Logs and finds Event ID 4648. What does this event typically indicate?

Accepted Answer

A logon using explicit credentials. Windows Security Event ID 4648 is logged when a process attempts an explicit-credential logon — that is, when a user or service supplies alternate credentials (via runas, New-PSSession -Credential, or similar) rather than using the current session's token. It records the account that requested the logon and the account whose credentials were used.

Answer

A failed logon attempt

Answer

An account creation event

Answer

A successful logon event

Question 4

During a security assessment, an analyst uses the Shodan search engine to find exposed industrial control systems. Which phase of the attack lifecycle does this activity represent?

Accepted Answer

Reconnaissance. Using Shodan to search for exposed industrial control systems is a form of passive/active information gathering about the target's internet-facing assets — this is the Reconnaissance phase of the attack lifecycle (also called footprinting or information gathering). The attacker is mapping the attack surface before any exploitation, delivery, or command-and-control activity occurs. Shodan indexes banners from internet-connected devices, making it a classic reconnaissance tool.

Answer

Command and control

Answer

Delivery

Answer

Exploitation

Question 5

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 6

A Windows event log review shows Event ID 4625 multiple times from a single source IP. What does this event indicate, and which log contains it?

Accepted Answer

Failed logon; Security log. Event ID 4625 is a failed logon attempt, recorded in the Security log.

Answer

Successful logon; System log

Answer

Service start; System log

Answer

Account creation; Application log

Question 7

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 8

During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?

Accepted Answer

RST. In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.

Answer

ICMP Port Unreachable

Answer

ACK

Answer

SYN-ACK

Question 9

During the Containment, Eradication, and Recovery phase, the incident response team collects evidence from a compromised system. Which document is used to record the chain of custody?

Accepted Answer

Chain of custody form. Chain of custody documentation tracks who handled evidence from collection to court presentation.

Answer

Data classification policy

Answer

Acceptable Use Policy

Answer

Incident response plan

Question 10

A SOC Tier 3 analyst is performing advanced threat analysis. Which TWO activities are typical for this tier?

Accepted Answer

Forensic analysis of compromised systems. Forensic analysis of compromised systems (A) is a Tier 3 activity because it requires deep expertise in memory, disk, and artifact examination to reconstruct attacker actions and determine root cause. Threat hunting (E) is also typical for Tier 3, as it involves proactively searching for hidden adversaries using hypotheses, advanced analytics, and tools beyond routine alert handling. In contrast, correlating multiple alerts (B) and initial triage of alerts (D) are generally Tier 1 or Tier 2 responsibilities, and monitoring SIEM dashboards (C) is a routine Tier 1 monitoring task rather than advanced analysis.

Answer

Correlating multiple alerts

Answer

Monitoring SIEM dashboards

Answer

Initial triage of alerts