200-201 Security Monitoring — 25 Questions

Question 1

An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?

Accepted Answer

SYN flood attack. A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting resources. The lack of SYN-ACK replies indicates the target is overwhelmed.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

ICMP flood attack

Question 2

A security engineer is setting up a Snort rule to detect FTP traffic where the source IP is not from the internal network. Which Snort rule header correctly specifies the action, protocol, source, and destination?

Accepted Answer

alert tcp !$HOME_NET any -> any 21. The correct Snort rule header format is: alert tcp !$HOME_NET any -> any 21. It alerts on TCP traffic from any IP not in $HOME_NET to any destination on port 21 (FTP).

Answer

alert tcp $HOME_NET any -> any 21

Answer

alert tcp any any -> any 21

Answer

alert udp any any -> any 21

Question 3

During a security incident, a SOC analyst reviews NetFlow records and notices a single internal host communicating with a remote server on TCP port 443, sending 50 MB of data in 5 minutes, while the usual baseline for that host is 1 MB per hour. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration. The sudden spike in outbound data volume from a single internal host to a remote server over TCP port 443 (HTTPS) far exceeds the established baseline of 1 MB per hour, reaching 50 MB in just 5 minutes. This anomalous behavior is a classic indicator of data exfiltration, where an attacker is using encrypted HTTPS traffic to stealthily transfer stolen data out of the network without triggering typical signature-based alerts.

Answer

Denial of service attack

Answer

Port scan activity

Answer

Normal web browsing traffic

Question 4

An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?

Accepted Answer

An internal host attempted to establish an SMB connection to an external IP and was blocked.. The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.

Answer

A DNS query was made from an internal host to an external server.

Answer

An external host attempted to access an internal SMB server on port 445 and was blocked.

Answer

An internal host successfully connected to an external server on port 445.

Question 5

While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?

Accepted Answer

Brute force attack. Repeated login attempts with different usernames from the same IP is typical of a brute force attack against the login page.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 6

A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?

Accepted Answer

Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.. Option B is correct because a brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

Answer

Alert when a single failed SSH login occurs.

Answer

Alert when successful SSH logins occur outside business hours.

Answer

Alert when multiple failed SSH logins from various IPs occur in one hour.

Question 7

A security analyst is reviewing Zeek connection logs and sees the following entry: '192.168.1.10:12345 > 10.0.0.1:80 (tcp) duration 0.001 sec, service http, bytes 60, state S0'. Based on the state 'S0', what does this indicate about the connection?

Accepted Answer

A SYN packet was sent but no reply was received.. In Zeek, S0 indicates that a SYN packet was sent but no SYN-ACK was received (connection attempt without completion). This could be part of a port scan or a half-open connection.

Answer

Data was transferred successfully and the connection closed normally.

Answer

The connection was established successfully.

Answer

The connection was reset by the remote host.

Question 8

An analyst receives an IDS alert with signature name 'ET TROJAN Win32.Zeus Checkin' and severity 'high'. The alert shows source IP 192.168.1.50 and destination IP 198.51.100.20 on port 443. Which action should the analyst take FIRST?

Accepted Answer

Isolate the source host from the network to prevent further communication.. The alert indicates a high-severity Zeus Trojan check-in, which is a known malware communicating with a command-and-control (C2) server. The first priority is to contain the threat by isolating the source host (192.168.1.50) to prevent further data exfiltration or lateral movement. Even though the traffic is encrypted over port 443 (HTTPS), the signature confirms malicious activity, so immediate isolation is the correct initial response per incident response best practices.

Answer

Check the host's web browsing history for suspicious websites.

Answer

Immediately block the destination IP on the firewall.

Answer

Ignore the alert because the traffic is encrypted over port 443.

Question 9

Which Wireshark display filter would an analyst use to view only HTTP packets that contain the word 'password' in the packet payload?

Accepted Answer

http contains "password". Option A is correct because the `http contains "password"` display filter instructs Wireshark to match any HTTP packet whose payload includes the literal string 'password'. The `contains` operator performs a case-sensitive substring search across the entire HTTP protocol data (headers and body), which is exactly what an analyst needs to locate credentials or sensitive terms in HTTP traffic.

Answer

http.request.uri contains "password"

Answer

data contains "password"

Answer

tcp.port == 80 and frame contains "password"

Question 10

During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?

Accepted Answer

A false positive; the hash corresponds to an empty file.. The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Answer

An invalid hash; the file may be corrupt.

Answer

A known malicious executable that should be quarantined.

Answer

A hash of a benign system file.

Question 11

An analyst is reviewing a web server log and sees the following entry: '192.168.1.1 - - [25/Oct/2023:10:15:30 -0400] "GET /admin/index.php?cmd=id HTTP/1.1" 200 1532 "-" "Mozilla/5.0"'. What potential attack does this log entry suggest?

Accepted Answer

Command injection. The presence of 'cmd=id' in the URL suggests an attempt to execute the 'id' command via a web shell or command injection vulnerability. The response code 200 indicates success, which is concerning.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 12

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

Accepted Answer

Create a suppression rule to ignore the specific source IP or application.. To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

Answer

Disable the signature entirely.

Answer

Increase the severity of the signature to get more attention.

Answer

Change the signature action to 'alert' instead of 'drop'.

Question 13

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following are common indicators that data exfiltration may be occurring over DNS? (Choose two.)

Accepted Answer

High volume of DNS queries to a single domain not normally visited. Option C is correct because a high volume of DNS queries to a single domain that is not normally visited is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS query subdomains. This behavior creates an abnormal query pattern that stands out in baseline traffic analysis.

Answer

DNS responses with a large number of IP addresses

Answer

DNS queries for AAAA records (IPv6) from an IPv4-only network

Answer

DNS query responses with high TTL values

Question 14

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

Accepted Answer

Prioritize alerts based on severity and asset criticality.. Prioritizing by severity, correlating with threat intelligence, and checking for associated IoCs help focus on important alerts. Alert fatigue leads to missed incidents; automation and triage are key.

Answer

Investigate alerts in the order they were received.

Answer

Automatically close all low-severity alerts without review.

Question 15

Which TWO of the following are examples of Indicators of Compromise (IoCs) used in network security monitoring? (Choose two.)

Accepted Answer

MD5 hash of a malicious executable. An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a network or system. The MD5 hash of a malicious executable is a file-based IoC that allows security monitoring tools to detect known malware by comparing file hashes against threat intelligence feeds. This is a standard IoC used in signature-based detection systems like Snort or YARA.

Answer

The current time of day

Answer

The company's stock price

Answer

The number of employees in the company

Question 16

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

Accepted Answer

SMB. Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Answer

HTTPS

Answer

DNS

Answer

HTTP

Question 17

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location

Question 18

An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?

Accepted Answer

Display filter. Display filters in Wireshark allow filtering of already captured packets based on criteria like packet content.

Answer

Protocol filter

Answer

Capture filter

Answer

BPF filter

Question 19

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service

Question 20

Which OSI layer is responsible for logical addressing and routing, and is commonly targeted by IP spoofing attacks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Answer

Application layer

Answer

Transport layer

Answer

Data Link layer