200-201 Security Concepts Practice Test 11 — 15 Questions

Question 1

A security analyst is reviewing the organization's incident response plan and wants to ensure it aligns with the NIST incident response lifecycle. Which two phases are part of the NIST incident response lifecycle? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preparation. The NIST incident response lifecycle consists of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation and Detection and Analysis are two of these phases, while vulnerability scanning, risk assessment, and penetration testing are separate security activities.

Answer

Vulnerability Scanning

Answer

Penetration Testing

Answer

Risk Assessment

Question 2

A security analyst is reviewing a suspicious email reported by a user. The email appears to come from the CEO and requests an urgent wire transfer. The analyst examines the email headers and notices that the 'From' address is spoofed and the 'Reply-To' address is different from the 'From' address. The email also contains a link to a credential-harvesting page. Which type of attack is this?

Accepted Answer

Business email compromise (BEC). The email impersonates the CEO and requests an urgent wire transfer, which is the hallmark of business email compromise (BEC). BEC attacks often involve spoofed sender addresses and may include links to credential-harvesting sites. While it is a form of phishing, BEC specifically targets financial transactions and is a distinct category.

Answer

Spear phishing

Answer

Whaling

Answer

Phishing

Question 3

A security analyst is investigating an incident where an attacker gained initial access to a corporate network. The analyst finds that the attacker sent a phishing email with a link to a malicious website that exploited a vulnerability in the user's browser. Which phase of the Cyber Kill Chain does the browser exploitation represent?

Accepted Answer

Exploitation. The Cyber Kill Chain phases are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. When a user visits a malicious website that exploits a browser vulnerability, that action is Exploitation. It follows Delivery (the phishing email with the link) and precedes Installation of any persistent payload.

Answer

Weaponization

Answer

Installation

Answer

Reconnaissance

Question 4

A security analyst is reviewing a vulnerability scan report and sees a finding labeled 'CVE-2021-44228' with a CVSS score of 10.0. The analyst needs to prioritize remediation. Which factor does the CVSS score primarily represent?

Accepted Answer

The severity of the vulnerability based on its technical impact and exploitability. CVSS is a standardized framework for rating the severity of security vulnerabilities. The base score, such as 10.0, reflects intrinsic characteristics like exploitability and impact. It does not predict exploitation likelihood, business-specific impact, or remediation time. Analysts use CVSS alongside other factors to prioritize remediation.

Answer

The likelihood that the vulnerability will be exploited in the wild within the next 30 days

Answer

The amount of time required to patch the vulnerability

Answer

The business impact of the vulnerability specific to the organization's assets

Question 5

A security analyst is evaluating the security posture of a new web application. The analyst needs to identify which TWO of the following are examples of security controls that fall under the category of technical controls. (Choose two.)

Accepted Answer

Intrusion prevention system (IPS). Technical controls are security measures implemented through technology, such as hardware, software, or firmware. An intrusion prevention system and router access control lists both use technical mechanisms to enforce security policies. Security awareness training, policy documents, and background checks are administrative controls that rely on human processes rather than technical enforcement.

Answer

Background checks for new hires

Answer

Security awareness training for employees

Answer

Security policy document

Question 6

A security analyst is assessing the risk profile of a new cloud-based collaboration application that employees want to adopt. The analyst must identify which factors contribute to the overall risk of introducing this application into the environment. (Choose two.)

Accepted Answer

The likelihood that a threat will exploit a vulnerability in the application or its supporting infrastructure.. Risk assessment combines the likelihood that a threat will exploit a vulnerability with the impact that exploitation would have on the organization. These two factors produce the overall risk rating for the collaboration application. User demand, UI color schemes, and vendor stock price do not measure security risk, so likelihood and impact are the two factors the analyst must evaluate.

Answer

The marketing team's preferred color scheme for the application's user interface.

Answer

The number of employees who have requested access to the application for productivity purposes.

Answer

The vendor's stock price over the past fiscal quarter.

Question 7

A company wants to ensure that only authorized employees can enter the server room. Which type of control is a badge reader at the door?

Accepted Answer

Preventive physical control. A badge reader restricts entry to a physical space by requiring valid credentials, so it functions as a preventive physical control. Preventive controls stop incidents before they happen, which matches the goal of allowing only authorized employees into the server room. Detective controls identify events after the fact, corrective controls restore operations, and compensating controls substitute for other measures. Administrative and logical controls address policies and data rather than physical door access.

Answer

Detective technical control

Answer

Corrective administrative control

Answer

Compensating logical control

Question 8

A company wants to protect its web application from injection attacks by ensuring that user-supplied input is not interpreted as code by the backend database. Which control should be implemented?

Accepted Answer

Parameterized queries. Parameterized queries ensure that user input is passed as data and never concatenated into the SQL statement, so the database cannot interpret it as code. This is the most effective and fundamental defense against SQL injection, unlike input validation, output encoding, or a WAF.

Answer

Web application firewall

Answer

Output encoding

Answer

Input validation

Question 9

A security analyst is investigating a potential data exfiltration incident. The analyst observes that a large amount of data is being transferred from an internal database server to an external IP address during non-business hours. The transfer is using an encrypted channel that is not typical for the server's normal operations. Which type of threat is this activity most likely associated with?

Accepted Answer

Advanced persistent threat (APT). An advanced persistent threat is a prolonged and targeted attack where an intruder gains access to a network and remains undetected to steal data. The scenario's characteristics—large data transfer to an external IP, encrypted channel, and non-business hours—are typical of APT exfiltration. DDoS, ransomware, and phishing do not match the observed behavior of stealthy outbound data transfer.

Answer

Phishing

Answer

Ransomware

Answer

Distributed denial of service (DDoS)

Question 10

A security operations center is building detection rules for man-in-the-middle attacks on its internal network. The team wants to identify techniques an attacker on the same Layer 2 segment could use to intercept or redirect traffic between two hosts. (Choose two.)

Accepted Answer

On-path routing manipulation using forged ICMP redirect messages. ARP spoofing and forged ICMP redirects both manipulate how a host forwards traffic so the attacker becomes an on-path device, enabling interception and modification. ARP spoofing targets the mapping of IP to MAC on the local segment, while ICMP redirect manipulation alters the next-hop decision. Both are detectable through switch features such as dynamic ARP inspection and through monitoring for unexpected redirect messages.

Answer

DNS cache poisoning to redirect a victim to an attacker-controlled server

Answer

VLAN hopping by double-tagging 802.1Q frames to reach another segment

Answer

MAC flooding to overflow the switch CAM table and force hub-like flooding

Question 11

A hospital's security team discovers that a network device is silently forwarding copies of all traffic to an internal host that no administrator recognizes. The device is a managed switch that connects the radiology VLAN to the core. Which attack has most likely been implemented against this switch?

Accepted Answer

SPAN port misconfiguration. A SPAN session on a managed switch replicates traffic from a source interface or VLAN to a destination port. When a rogue administrator or attacker with device access creates such a session aimed at an unknown internal host, every frame on the radiology VLAN is duplicated there while normal forwarding continues unaffected. The other techniques either degrade forwarding, enable cross-VLAN access, or manipulate host caches rather than producing a sustained, targeted copy of one VLAN's traffic.

Answer

ARP cache poisoning

Answer

MAC flooding

Answer

VLAN hopping via double tagging

Question 12

An analyst is investigating an incident and needs to determine the source of a piece of malware. The analyst finds that the malware uses a domain generation algorithm to contact command-and-control servers. Which term best describes this capability?

Accepted Answer

Command and control. A domain generation algorithm creates a large set of pseudo-random domain names that malware periodically queries to find an active command-and-control server. This technique helps the malware evade static blocklists and takedown attempts, because defenders cannot easily predict or block every possible domain. The scenario states the malware contacts command-and-control servers, so the capability is command and control. Persistence, privilege escalation, and lateral movement describe different phases or objectives of an intrusion.

Answer

Persistence

Answer

Lateral movement

Answer

Privilege escalation

Question 13

A security analyst is reviewing a suspicious file recovered from a compromised endpoint. The file contains a macro that, when opened, launches PowerShell to download a second-stage payload from a remote server. The analyst wants to classify this file based on its behavior. Which classification is most accurate?

Accepted Answer

A dropper that delivers a malicious payload onto the system. The macro document functions as a dropper: its sole purpose is to execute and pull a second-stage payload onto the host. Droppers are common initial-access vehicles, and classifying by function helps the analyst understand the infection chain and prioritize response. The delivered payload may later exhibit other behaviors, but the file in hand is a dropper.

Answer

A rootkit because it hides the PowerShell process

Answer

Fileless malware because it uses a scripting engine

Answer

A logic bomb because it triggers on a specific event

Question 14

An organization is reviewing its exposure to attack surface. A security architect notes that employees routinely install browser extensions from unapproved sources, and several internal web applications accept unsanitized input. Which concept do these findings primarily describe?

Accepted Answer

Vulnerabilities that expand the attack surface and may be exploited by threat actors. The findings are vulnerabilities that enlarge the attack surface. Unsanitized input enables injection flaws, and unapproved extensions introduce untrusted code with broad browser privileges. Both give threat actors additional entry points and increase the likelihood of compromise. Reducing the attack surface requires application input validation, extension allowlisting, and endpoint policy enforcement, which directly address the weaknesses identified.

Answer

A compliance violation of the Payment Card Industry Data Security Standard

Answer

A social engineering campaign targeting employees through malicious extensions

Answer

A denial-of-service condition caused by excessive extension usage

Question 15

A security analyst is investigating a breach where an attacker gained access to a server by exploiting a vulnerability in a web application. The analyst needs to determine the type of attack that was used. The server logs show that the attacker sent a specially crafted HTTP request that caused the server to execute arbitrary code. Which type of attack is this?

Accepted Answer

Remote code execution (RCE). The attacker exploited a web application vulnerability to execute arbitrary code on the server. This is the definition of remote code execution (RCE). XSS and CSRF are client-side attacks, and SQL injection is a specific type of injection that may not always lead to code execution. The scenario clearly points to RCE as the attack type.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)