200-201 Security Concepts Practice Test 8 — 15 Questions

Question 1

A security analyst is reviewing logs from a web server and notices a high volume of HTTP requests from a single IP address targeting the same login page within a short time frame. The analyst suspects a brute force attack. Which TWO actions are most appropriate to mitigate this type of attack? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement rate limiting on the login endpoint.. Option A is correct because rate limiting on the login endpoint directly throttles the high volume of repeated HTTP requests from a single IP address, which is the defining signature of the brute force attack observed in the logs. Option E is correct because account lockout after a certain number of failed attempts stops an attacker from making unlimited password guesses against a given account, complementing rate limiting by protecting the credential itself rather than just the request rate. Option B is not appropriate because disabling the login page entirely would deny legitimate users access and cause a self-inflicted denial of service. Option C is not the best mitigation because permanently blocking the offending IP address is brittle—attackers can rotate IPs, and legitimate users behind shared or dynamic addresses could be blocked—so it is not a sustainable control. Option D is not appropriate because increasing password complexity requirements is a preventive policy for credential strength and does not stop the ongoing high-volume request pattern of a brute force attack.

Answer

Disable the login page entirely.

Answer

Block all traffic from the offending IP address permanently.

Answer

Increase the password complexity requirements.

Question 2

An organization wants to ensure the integrity of software updates downloaded from its vendor's website. The vendor provides a hash value for each update. Which TWO properties of hashing algorithms make them suitable for integrity verification? (Choose two.)

Accepted Answer

The same input always produces the same hash.. Option A is correct because hashing is deterministic: for a given algorithm, the same input always produces the same hash value, so a recipient can recompute the hash of a downloaded update and compare it to the vendor-published hash to verify integrity. Option B is correct because of the avalanche effect, where even a one-bit change in the input produces a drastically different hash, making any tampering with the update immediately detectable. Option C is incorrect because hashing is a one-way function and cannot be reversed to recover the original data. Option D is incorrect because, while true for a given algorithm, fixed output length is not the property that enables integrity verification of the update content. Option E is incorrect because hashing does not require a secret key; keyed constructions like HMAC use a key, but plain hashing algorithms do not.

Answer

The hash can be reversed to obtain the original data.

Answer

The hash output is always the same length for a given algorithm.

Answer

Hashing requires a secret key to generate the hash.

Question 3

A security analyst is assessing the risks to a company's data. The analyst identifies a vulnerability in the web application that could allow SQL injection. Which TWO terms correctly describe the elements of this risk scenario? (Choose two.)

Accepted Answer

The SQL injection flaw in the application is a vulnerability.. Option C is correct because a SQL injection flaw is a weakness in the web application's code that can be leveraged to compromise the system, which is the definition of a vulnerability. Option E is correct because the possibility of an attacker exploiting that flaw represents a potential danger or adversary action, which is the definition of a threat. Option A is incorrect because the flaw itself is a vulnerability, not a threat; a threat is the actor or event that could exploit it. Option B is incorrect because an exploit is the specific technique or code that takes advantage of the vulnerability, not the combination of vulnerability and threat. Option D is incorrect because the possibility of exploitation describes a threat, not a vulnerability, which is the actual weakness.

Answer

The SQL injection flaw in the application is a threat.

Answer

The combination of the vulnerability and threat is the exploit.

Answer

The possibility of an attacker exploiting the SQL injection is a vulnerability.

Question 4

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer

Social engineering

Answer

WHOIS lookups

Question 5

A company needs to comply with regulations that protect personal data of EU citizens. Which TWO compliance frameworks are directly relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. GDPR (B) is directly relevant because the General Data Protection Regulation is the EU legal framework that governs the protection of personal data of EU citizens, imposing requirements on data controllers and processors regarding consent, data subject rights, breach notification, and cross-border transfers. ISO 27001 (C) is not correct because it is a voluntary international standard for establishing an Information Security Management System (ISMS), not a regulation that directly protects EU citizens' personal data. PCI DSS (A) is not correct because it applies specifically to organizations that store, process, or transmit cardholder data (payment card information), not to personal data of EU citizens generally. NIST Cybersecurity Framework (D) is not correct because it is a voluntary US-origin framework for managing cybersecurity risk rather than a data protection regulation aimed at EU personal data. HIPAA (E) is not correct because it governs protected health information in the United States, not the personal data of EU citizens.

Answer

PCI DSS

Answer

ISO 27001

Answer

NIST Cybersecurity Framework

Answer

HIPAA

Question 6

An analyst is investigating a malware infection on a workstation. The malware appears to be a trojan that downloads additional payloads and allows remote control. The analyst needs to classify the malware based on its behavior. Which THREE characteristics match this description? (Choose three.)

Accepted Answer

It provides unauthorized remote access to the system.. The scenario describes a trojan that downloads additional payloads and allows remote control, so the correct characteristics are A, B, and C. Option A is correct because allowing remote control is precisely unauthorized remote access, the defining behavior of a Remote Access Trojan (RAT). Option B is correct because downloading additional payloads is a dropper/downloader behavior, where the initial malware retrieves and installs further malicious software. Option C is correct because a trojan typically relies on social engineering or user execution (e.g., opening an attachment or running a file) to activate, unlike worms or exploits that can execute without interaction. Option D is incorrect because self-replication without user interaction describes a worm, not a trojan. Option E is incorrect because encrypting files and demanding ransom describes ransomware, which is not stated in this scenario.

Answer

It self-replicates without user interaction.

Answer

It encrypts files and demands ransom.

Question 7

A security analyst is reviewing a packet capture and notices that a host is sending TCP segments with the SYN flag set to a range of ports on a single target, but the source IP address in each segment is spoofed to a different random address. The target replies with SYN-ACK packets to those spoofed addresses, and the host never completes the handshake. Which type of attack is this host performing?

Accepted Answer

SYN flood. The traffic pattern shows TCP SYN segments with spoofed source addresses and no completed three-way handshakes. This exhausts the target's half-open connection resources, which is the defining behavior of a SYN flood. UDP floods, Smurf attacks, and ping of death use different protocols and packet structures.

Answer

Smurf attack

Answer

UDP flood

Answer

Ping of death

Question 8

A security analyst is reviewing network traffic and observes a large number of DNS queries for randomly generated domain names, such as 'a1b2c3d4e5f6g7h8.com', from a single internal host. The queries are followed by responses with very short TTL values. The analyst suspects the host is compromised. Which type of malicious activity is most likely occurring?

Accepted Answer

Domain generation algorithm (DGA) used by malware for command-and-control (C2) communication. The high volume of unique, random-looking domain queries with short TTLs from a single host is a classic indicator of a domain generation algorithm. Malware uses DGA to periodically generate many domain names and attempt to resolve them, hoping to find the one registered by the attacker for command and control. This evades static domain blocklists and makes takedown difficult.

Answer

Fast flux DNS used to hide the location of a botnet controller

Answer

DNS cache poisoning attack against the internal resolver

Answer

DNS tunneling used to exfiltrate sensitive data

Question 9

A security analyst is reviewing a packet capture and observes that a workstation is sending a large volume of TCP SYN packets to many different destination IP addresses on port 445, with no corresponding completed handshakes. The analyst suspects malware is performing reconnaissance. Which type of activity is this workstation most likely performing?

Accepted Answer

TCP port scanning of many hosts on port 445. The traffic pattern of many TCP SYN packets to numerous destination addresses on a single port, with no completed handshakes, is the signature of TCP SYN scanning. This is a reconnaissance technique used to identify live hosts and open services, commonly on port 445 for SMB. A SYN flood would focus on one target, and brute-force or man-in-the-middle activity would require established connections.

Answer

A man-in-the-middle attack intercepting SMB traffic

Answer

A SYN flood denial-of-service attack against a single target

Answer

A brute-force attack against SMB credentials

Question 10

A security team is implementing a defense-in-depth strategy and wants to ensure that even if an attacker compromises a web server, the attacker cannot easily move laterally to the internal database server. Which security principle is being applied when the team segments the network and restricts traffic between the web tier and the database tier?

Accepted Answer

Network segmentation. Segmenting the network and restricting traffic between the web and database tiers limits an attacker's ability to move laterally after compromising a web server. This is the principle of network segmentation, which reduces the attack surface and contains breaches within a zone.

Answer

Zero trust

Answer

Least privilege

Answer

Defense in depth

Question 11

A security analyst is reviewing a packet capture from the DMZ and sees a host at 203.0.113.45 sending a flood of TCP segments with the SYN flag set to many different destination ports on a single internal web server, all within a few seconds. The source IP never completes the three-way handshake. Which type of attack is this host most likely performing?

Accepted Answer

SYN flood denial-of-service attack. The observed traffic matches a SYN flood: a high volume of TCP SYN segments to many ports from one source, with no completed three-way handshakes. Each half-open connection consumes server resources until the backlog is exhausted, denying service to legitimate clients. This is a classic volumetric denial-of-service technique at Layer 4.

Answer

Cross-site scripting attack

Answer

UDP amplification attack

Answer

ARP spoofing attack

Question 12

A security analyst is examining a suspicious executable found on a user's workstation. The file appears to be a legitimate PDF document but when opened, it executes code that encrypts the user's files and demands payment. The analyst determines that the file is actually a malicious program disguised as a benign file. Which type of malware is this?

Accepted Answer

Trojan. The key indicator is the file masquerading as a legitimate PDF while actually being a malicious executable that encrypts files. This deception is the hallmark of a Trojan, which often delivers ransomware payloads. Unlike worms or viruses, Trojans rely on user execution and do not self-replicate.

Answer

Rootkit

Answer

Virus

Answer

Worm

Question 13

A security analyst is reviewing a packet capture of traffic entering the corporate network. The analyst notices a large number of TCP SYN packets sent to multiple destination ports on a single internal host, with no corresponding ACK packets. The source IP addresses are spoofed and vary across each packet. Which type of attack is this traffic MOST likely associated with?

Accepted Answer

SYN flood. The traffic pattern of numerous TCP SYN packets from spoofed sources without completing the three-way handshake is characteristic of a SYN flood. This attack exploits the TCP connection setup process to exhaust the target's resources, denying service to legitimate users. The other options involve different protocols or layers and do not match the observed packets.

Answer

UDP amplification

Answer

ARP poisoning

Answer

DNS tunneling

Question 14

A security team is reviewing the confidentiality, integrity, and availability (CIA) triad for a new file-sharing service. The service must ensure that data cannot be altered in transit by unauthorized parties. Which security principle is primarily addressed by implementing TLS for all connections?

Accepted Answer

Integrity. The requirement to prevent unauthorized alteration of data in transit directly addresses the integrity principle of the CIA triad. TLS provides integrity through message authentication codes, ensuring that any modification is detected. While TLS also offers confidentiality, the scenario's emphasis on preventing alteration makes integrity the primary principle.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 15

A security analyst is reviewing the organization's incident response plan. The plan currently defines containment, eradication, and recovery but does not include a formal step to determine the root cause of an incident. Which phase of the NIST SP 800-61 incident response lifecycle should the analyst add to address this gap?

Accepted Answer

Post-incident activity. The NIST SP 800-61 lifecycle includes preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Root cause analysis and lessons learned belong to the post-incident activity phase, which the plan lacks. Adding it ensures the organization systematically identifies why the incident occurred and improves future response.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Detection and analysis