200-201 Security Concepts Practice Test 10 — 15 Questions

Question 1

A security analyst is reviewing a packet capture and notices that an attacker is sending a large number of SYN packets to a web server from spoofed source IP addresses. The server's connection table is filling up, and legitimate users cannot connect. Which type of attack is being described?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending numerous SYN requests with spoofed source addresses. The server allocates resources for each half-open connection, eventually exhausting its backlog queue and denying service to legitimate clients. The scenario's description of spoofed SYNs and a full connection table confirms this attack.

Answer

Smurf attack

Answer

Ping of death

Answer

UDP flood

Question 2

A security operations center (SOC) analyst is investigating a security incident where an attacker gained initial access to a corporate network. The analyst suspects the attacker used a technique that involves exploiting a vulnerability in a public-facing web server to execute arbitrary code. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Exploitation. The Cyber Kill Chain phase of exploitation involves taking advantage of a vulnerability to execute code on a target system. The scenario describes an attacker exploiting a web server vulnerability to run arbitrary code, which fits the exploitation phase. Reconnaissance and weaponization are preparatory, while installation is a later step for maintaining access.

Answer

Weaponization

Answer

Installation

Answer

Reconnaissance

Question 3

A security analyst at a retail company is reviewing DNS logs and notices a workstation repeatedly resolving random-looking subdomains such as a8f3k2.example-bad.com, followed by a long TXT record response containing encoded data. No user reported visiting any website. Which technique is most likely occurring?

Accepted Answer

DNS tunneling used for command-and-control or data exfiltration. Random subdomains plus oversized TXT replies from a single workstation indicate DNS tunneling, a covert channel that abuses port 53 to move data or commands past egress controls. Because DNS is almost always permitted, attackers use it for command-and-control and exfiltration. The analyst should isolate the host, capture full DNS traffic, and inspect the resolver logs for the encoded payload pattern.

Answer

Cache poisoning of the local resolver to redirect the workstation to a malicious site

Answer

A domain generation algorithm used only for load balancing legitimate traffic

Answer

A DNS amplification attack targeting the internal recursive resolver

Question 4

A security analyst is examining a suspicious executable found on a compromised host. The analyst runs the file in a sandbox and observes that it creates a mutex named 'Global\MyMutex123', attempts to connect to an external IP address on port 443, and modifies the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Which type of analysis is the analyst performing?

Accepted Answer

Dynamic analysis. Dynamic analysis is the process of executing malware in a controlled environment and observing its behavior, such as network connections, registry changes, and mutex creation. The analyst's actions in the sandbox directly match this definition. Static analysis, memory forensics, and log analysis do not involve running the sample and monitoring its runtime effects.

Answer

Static analysis

Answer

Memory forensics

Answer

Log analysis

Question 5

A security analyst is reviewing a recent security incident where an attacker gained unauthorized access to a server. The analyst needs to determine which factors contributed to the incident by examining the vulnerability, threat, and risk. Which TWO of the following best describe the relationship between these concepts in this scenario? (Choose two.)

Accepted Answer

A vulnerability is a weakness in the server's software that the attacker exploited.. A vulnerability is a weakness that can be exploited, and a threat is the potential cause that exploits it. Together, they create risk, which is the potential for loss. The correct options define vulnerability and threat accurately in the context of the incident, while the others either misdefine terms or are too narrow.

Answer

Risk is the same as vulnerability and can be used interchangeably.

Answer

Risk is the potential for loss or damage when a threat exploits a vulnerability.

Answer

A threat is always a deliberate attack by a human actor.

Question 6

A security analyst is examining a network capture and observes that an attacker is sending a large volume of SYN packets to a web server with spoofed source IP addresses. The server's connection table is filling up, and legitimate users cannot connect. Which type of attack is the analyst observing?

Accepted Answer

A TCP SYN flood, which exhausts the server's connection table with half-open connections.. The capture shows many SYN packets with spoofed sources, and the server's connection table is exhausted, blocking legitimate users. This is the classic signature of a TCP SYN flood, a denial-of-service attack that abuses the TCP three-way handshake. Smurf uses ICMP, DNS amplification uses resolvers, and man-in-the-middle intercepts traffic, so none match the observed half-open connection exhaustion.

Answer

A DNS amplification attack, which uses open resolvers to send large responses to a victim.

Answer

A man-in-the-middle attack, which intercepts and relays traffic between two parties.

Answer

A Smurf attack, which uses ICMP echo requests with a spoofed source to amplify traffic.

Question 7

An analyst is examining a suspicious executable recovered from a compromised host. Static analysis shows it is packed, and dynamic analysis in a sandbox reveals it creates a mutex, modifies registry Run keys, and attempts to connect to a hardcoded IP address on port 443. The file also contains a section with high entropy. Which characteristic most strongly suggests the file is packed or encrypted?

Accepted Answer

A section with high entropy. High entropy in a section is a classic static indicator of packing or encryption, because compressed or encrypted data lacks the patterns of normal executable code. Packers use this to hide the original code and evade signature-based detection. The other observed behaviors are runtime actions related to persistence and command-and-control, not structural evidence of packing.

Answer

Connection to a hardcoded IP on port 443

Answer

Modification of registry Run keys

Answer

Creation of a mutex

Question 8

A security analyst is investigating a recent security breach. The analyst discovers that an attacker gained access to the network by exploiting a vulnerability in an unpatched web server. After gaining access, the attacker moved laterally to other systems and exfiltrated sensitive data. The organization wants to improve its security posture to prevent similar incidents. Which security concept best describes the attacker's actions after initial compromise?

Accepted Answer

Lateral movement. After exploiting the web server, the attacker moved to other systems, which is lateral movement. This phase is about expanding access within the network. Privilege escalation, persistence, and reconnaissance are different phases of an attack. Lateral movement is a key concept in understanding how attackers spread and compromise additional assets.

Answer

Reconnaissance

Answer

Persistence

Answer

Privilege escalation

Question 9

A security analyst is reviewing the cryptographic mechanisms used to protect data in transit and at rest. The organization wants to ensure confidentiality and integrity for sensitive files stored on a server and for data sent over a VPN. Which TWO of the following mechanisms provide both confidentiality and integrity for data? (Choose two.)

Accepted Answer

AES-256 in CBC mode with HMAC-SHA256. AES-256 in GCM mode and AES-256 in CBC mode combined with HMAC-SHA256 both provide confidentiality and integrity. GCM is an authenticated encryption mode that includes an integrity tag, while CBC with HMAC uses separate encryption and authentication. SHA-256 and HMAC-SHA256 alone lack confidentiality, and RSA-2048 encryption alone lacks inherent integrity.

Answer

HMAC-SHA256

Answer

SHA-256 hashing

Answer

RSA-2048 encryption

Question 10

A security analyst is evaluating the risk of a new vulnerability in a web application. The vulnerability has a CVSS base score of 9.8 and is remotely exploitable without authentication. The application is internet-facing and processes sensitive customer data. Which risk response strategy is MOST appropriate according to risk management principles?

Accepted Answer

Risk mitigation. The vulnerability is critical and remotely exploitable, posing a high risk to sensitive data. Mitigating the risk through patching or other controls is the most appropriate response. Risk acceptance, transference, or avoidance are less suitable because they do not directly reduce the technical exposure in a timely manner.

Answer

Risk transference

Answer

Risk avoidance

Answer

Risk acceptance

Question 11

A security analyst is evaluating the organization's use of cryptographic algorithms. The analyst must identify which TWO algorithms are symmetric encryption algorithms that can be used for bulk data encryption. (Choose two.)

Accepted Answer

3DES. Symmetric encryption algorithms use a single shared key for both encryption and decryption and are efficient for bulk data. AES and 3DES are both symmetric block ciphers suitable for this purpose. RSA and ECDSA are asymmetric, and SHA-256 is a hash function, so they do not meet the criteria.

Answer

ECDSA

Answer

SHA-256

Answer

RSA

Question 12

An organization is implementing a new security control that will verify the integrity of critical system files by comparing their current hash values against known good baseline values. Which security concept does this control primarily address?

Accepted Answer

Integrity. Integrity is the security principle that ensures data remains accurate and unaltered. By comparing current hash values to a baseline, the organization can detect unauthorized modifications to critical files. This control directly supports integrity, as any change would produce a different hash. Confidentiality, availability, and non-repudiation are separate concerns not addressed by hash comparison.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 13

A security analyst is reviewing the organization's defense-in-depth strategy. The analyst must recommend TWO controls that specifically reduce the risk of successful phishing attacks against employees. Which two controls should the analyst recommend? (Choose two.)

Accepted Answer

Implementing email filtering that blocks messages with malicious attachments and links.. Email filtering and security awareness training are both direct anti-phishing controls. Filtering blocks malicious messages before delivery, while training helps users recognize and avoid phishing attempts that bypass filters. Together they form a layered defense. The other options address different threats such as web application attacks, data-at-rest protection, and lateral movement containment.

Answer

Configuring network segmentation to isolate the finance department from the rest of the network.

Answer

Deploying a web application firewall (WAF) to inspect HTTP traffic to the company's public website.

Answer

Enabling full-disk encryption on all employee laptops.

Question 14

A security analyst is reviewing an incident in which an attacker gained initial access to a corporate workstation by exploiting a vulnerability in a browser plugin. After gaining access, the attacker moved laterally to a file server and exfiltrated data. The analyst must map these activities to the cyber kill chain. Which phase of the kill chain does the browser plugin exploitation represent?

Accepted Answer

Exploitation, because the attacker took advantage of the vulnerability to execute code on the workstation.. The browser plugin vulnerability was leveraged to gain code execution and initial access on the workstation. In the cyber kill chain, that action is exploitation, which follows reconnaissance and weaponization and precedes actions such as command and control, lateral movement, and exfiltration. The later lateral movement and data theft are separate phases, so the exploitation itself maps to the exploitation phase.

Answer

Command and control, because the attacker established a channel to manage the compromised host.

Answer

Weaponization, because the attacker prepared an exploit payload for the browser plugin.

Answer

Reconnaissance, because the attacker gathered information about the target before the attack.

Question 15

A security analyst is classifying security controls for a new data center. Which TWO of the following are examples of physical controls? (Choose two.)

Accepted Answer

Bollards installed at the building entrance. Physical controls are measures that protect tangible assets, facilities, and people. Bollards and security guards both operate in the physical world: bollards block vehicle access, and guards control and monitor entry. Access control lists, full-disk encryption, and awareness training are technical or administrative controls because they address logical access, data protection, or human behavior rather than physical barriers or presence. Only the two physical measures fit the requested category.

Answer

Security awareness training for staff

Answer

Full-disk encryption on employee laptops

Answer

Access control lists on the core router