200-201 Security Concepts Practice Test 9 — 15 Questions

Question 1

A security analyst at a mid-sized company is reviewing the organization's risk management strategy. The CIO asks the analyst to describe the primary purpose of a vulnerability assessment. Which statement best describes this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It identifies, quantifies, and prioritizes vulnerabilities in a system.. A vulnerability assessment is a systematic review that identifies, quantifies, and prioritizes security weaknesses in an environment. It differs from a penetration test because it does not exploit flaws or simulate an attacker; instead, it produces a list of vulnerabilities ranked by severity so that remediation efforts can be planned. This makes it a foundational risk management activity.

Answer

It automatically applies patches to all discovered software flaws without human intervention.

Answer

It actively exploits vulnerabilities to determine the level of access an attacker could achieve.

Answer

It provides a real-time dashboard of all security incidents occurring on the network.

Question 2

A security analyst at a mid-sized company is reviewing a packet capture from the DMZ and notices a series of TCP SYN packets sent to multiple ports on a single internal web server, all originating from the same external IP address within a 3-second window. None of the SYN packets are followed by a completed three-way handshake. The analyst must classify this activity to determine the appropriate response. Which type of attack is most consistent with this traffic pattern?

Accepted Answer

SYN flood denial-of-service attack. The traffic pattern of many TCP SYN packets to multiple ports from a single source without completed handshakes is the hallmark of a SYN flood. This attack consumes server resources by leaving connections half-open, preventing legitimate users from establishing sessions. Recognizing this pattern allows the analyst to apply mitigations such as SYN cookies or rate limiting.

Answer

UDP amplification attack

Answer

ARP poisoning attack

Answer

DNS tunneling attack

Question 3

A security analyst at a financial services company is reviewing the organization's security program. The CISO wants to ensure that the confidentiality, integrity, and availability of information assets are protected by administrative, physical, and technical controls. Which security concept is the CISO describing?

Accepted Answer

The CIA triad, which defines the three core objectives of information security that controls must protect.. The scenario names confidentiality, integrity, and availability as the properties controls must protect. These three objectives form the CIA triad, the foundational model of information security. Administrative, physical, and technical controls are all implemented to preserve these properties, so the concept described is the CIA triad rather than an access framework, a network model, or a single control principle.

Answer

The AAA framework, which governs authentication, authorization, and accounting for user access.

Answer

The OSI model, which defines seven layers of network communication used to design secure protocols.

Answer

The principle of least privilege, which restricts users to only the access required to perform their jobs.

Question 4

A security analyst is investigating an alert about a workstation that is repeatedly resolving domain names for known malicious command-and-control servers. The analyst wants to determine whether the workstation is infected with malware that uses DNS for communication. Which type of malware behavior is most likely occurring?

Accepted Answer

DNS tunneling. DNS tunneling is a technique where malware encodes command-and-control or data exfiltration traffic inside DNS queries and responses. Repeated resolutions of known malicious domains from a single workstation strongly suggest this behavior. The other options describe different attack types that do not match the DNS-centric evidence in the scenario.

Answer

SQL injection

Answer

Cross-site scripting

Answer

ARP spoofing

Question 5

A security analyst is evaluating the risk of a new web application that will store customer credit card data. The analyst needs to determine the likelihood and impact of a data breach. Which risk analysis approach involves assigning numerical values to assets, threats, and vulnerabilities to calculate an annualized loss expectancy (ALE)?

Accepted Answer

Quantitative risk analysis. Quantitative risk analysis uses numerical values for assets, threats, and vulnerabilities to calculate annualized loss expectancy, enabling cost-benefit comparisons for security investments. Qualitative analysis uses descriptive ratings, while BIA and threat modeling serve different purposes. For credit card data, the quantitative approach provides the financial justification for controls.

Answer

Qualitative risk analysis

Answer

Threat modeling

Answer

Business impact analysis (BIA)

Question 6

During an incident, an analyst finds a workstation that is beaconing to an external IP every 60 seconds using DNS TXT queries. The queries contain long, base64-encoded subdomains. The endpoint has no other suspicious network connections. Which technique is most likely being used?

Accepted Answer

DNS tunneling for command-and-control. The combination of regular beaconing, TXT record use, and base64-encoded subdomains strongly indicates DNS tunneling for command-and-control. Attackers use DNS because it is widely allowed through firewalls and rarely inspected deeply. Detecting it requires monitoring for anomalous query volume, unusually long labels, and consistent timing to a single external resolver.

Answer

Domain generation algorithm for ransomware

Answer

Fast flux DNS for phishing

Answer

DNS cache poisoning for redirection

Question 7

An analyst is reviewing network traffic and observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by large TXT record responses. The queries occur at regular intervals and the volume is unusually high. Which type of attack is most likely indicated?

Accepted Answer

DNS tunneling. The use of long, random-looking subdomains under one domain with large TXT record responses and regular intervals is characteristic of DNS tunneling. Attackers use DNS to exfiltrate data or maintain command-and-control because DNS is often allowed through firewalls. This pattern is not consistent with cache poisoning, amplification, or DGA, which have different traffic profiles.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

Domain generation algorithm

Question 8

A security analyst is reviewing a suspicious file found on a user's workstation. The file has a .docx extension but when the analyst inspects its header bytes, the file begins with the magic number for a Windows Portable Executable. The user reports the file arrived as an email attachment. Which type of malware delivery technique does this describe?

Accepted Answer

A file masquerading as a document but actually an executable. The file's extension claims it is a Word document, but its header bytes match a Windows Portable Executable. This is a classic masquerading technique where malware is disguised as a benign file type to trick users into executing it. The mismatch between the expected file signature and the actual content is the key indicator, distinguishing it from macro viruses, polymorphic code, or rootkits.

Answer

A rootkit that hides its presence on the system

Answer

A polymorphic virus that changes its own code to evade detection

Answer

A macro virus embedded in a legitimate document

Question 9

A security administrator is reviewing the company's incident response plan and wants to ensure that the team understands the difference between a vulnerability, a threat, and a risk. During a tabletop exercise, the administrator presents a scenario: a web server has an unpatched Apache Struts vulnerability, and a known exploit exists publicly. Which term best describes the unpatched Apache Struts vulnerability in this context?

Accepted Answer

Vulnerability. The unpatched Apache Struts issue is a software flaw that can be leveraged by an attacker, making it a vulnerability. Understanding this distinction is crucial for risk assessment: vulnerabilities are weaknesses, threats are actors or events that can exploit them, and risk is the potential impact. Correctly identifying the vulnerability helps prioritize remediation such as patching.

Answer

Threat

Answer

Exploit

Answer

Risk

Question 10

A security analyst is reviewing the access control strategy for a research and development department. The department handles highly sensitive intellectual property, and the organization wants to ensure that employees can only access information strictly necessary for their current project tasks, even if they have previously worked on other projects. Which access control principle is being enforced?

Accepted Answer

Need to know. The need-to-know principle ensures that access to information is granted only to individuals whose current responsibilities require that specific information. In this scenario, the organization wants to restrict access to intellectual property based on project tasks, which directly reflects need-to-know. Least privilege is about minimum permissions, but need-to-know is more granular and focuses on information relevance to the task.

Answer

Mandatory access control

Answer

Separation of duties

Answer

Least privilege

Question 11

A security analyst is investigating a recent security incident and needs to determine the extent of the compromise. The analyst wants to understand which systems were affected and what data may have been accessed. Which phase of the incident response process is the analyst currently performing?

Accepted Answer

Detection and analysis. The detection and analysis phase of incident response involves validating incidents, determining their scope, and identifying affected systems and data. The analyst's investigation into which systems were compromised and what data was accessed is a textbook example of this phase, which must be completed before containment and eradication can be effectively planned.

Answer

Post-incident activity

Answer

Preparation

Answer

Containment, eradication, and recovery

Question 12

A security operations center analyst is reviewing a vulnerability scan report for a web server. The report identifies that the server is running an outdated version of Apache HTTP Server with a known remote code execution vulnerability. The analyst needs to classify this finding. Which term best describes this vulnerability?

Accepted Answer

A known software vulnerability, because it is a documented flaw in the Apache code that can be exploited.. The scan reveals an outdated Apache version with a published remote code execution flaw. That is a known software vulnerability: a documented weakness in code for which a fix typically exists. It is not a configuration error, an unknown zero-day, or a human-focused social engineering technique, so the appropriate classification is a known software vulnerability requiring patch or upgrade remediation.

Answer

A software misconfiguration, because the server is running an unsupported version.

Answer

A social engineering attack, because the attacker could trick users into visiting a malicious site.

Answer

A zero-day exploit, because the vulnerability allows remote code execution.

Question 13

A security analyst is examining a suspicious executable found on a compromised host. Static analysis reveals that the file contains a packer and obfuscated strings. When run in a sandbox, it attempts to connect to an external IP address and modifies registry keys for persistence. Which stage of the cyber kill chain does the registry modification represent?

Accepted Answer

Installation. Registry modification for persistence is part of the Installation stage of the cyber kill chain, where the attacker ensures the malware survives reboots. The other stages such as Delivery, Exploitation, and Command and Control occur at different points. The sandbox observation of registry changes indicates the malware is establishing a foothold.

Answer

Command and Control

Answer

Exploitation

Answer

Delivery

Question 14

A security team is designing a defense-in-depth strategy. They want to add a control that inspects the actual content of network traffic for known attack signatures and can block or alert on malicious payloads in real time. Which technology best meets this requirement?

Accepted Answer

Intrusion prevention system (IPS). An IPS is designed for inline deep packet inspection, matching traffic against signatures and behavioral rules and taking action to block or alert. Because it sits in the traffic path, it can stop attacks in real time, unlike passive detection or simple filtering controls. This makes it the best fit for content inspection with active response.

Answer

Virtual private network (VPN) concentrator

Answer

Load balancer

Answer

Host-based firewall

Question 15

A security analyst is examining a memory dump from a compromised host and finds a small piece of code that resides only in memory, has no corresponding file on disk, and injects itself into a running legitimate process. The code does not replicate to other systems. Which type of malware best describes this?

Accepted Answer

A fileless malware that operates in memory and injects into processes. Fileless malware operates entirely in memory, often by injecting into legitimate processes, and leaves no file on disk. This makes it difficult to detect with traditional file-based antivirus. The absence of a disk file and the process injection behavior are the defining characteristics, distinguishing it from worms, trojans, and rootkits, which typically involve files or kernel modifications.

Answer

A worm that spreads across the network

Answer

A rootkit that hides its presence by modifying the kernel

Answer

A trojan that disguises itself as legitimate software