200-201 Security Monitoring — 30 Questions

Question 1

During a security incident, a SOC analyst reviews NetFlow records and notices a single internal host communicating with a remote server on TCP port 443, sending 50 MB of data in 5 minutes, while the usual baseline for that host is 1 MB per hour. Which type of activity is most likely indicated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data exfiltration. The sudden spike in outbound data volume from a single internal host to a remote server over TCP port 443 (HTTPS) far exceeds the established baseline of 1 MB per hour, reaching 50 MB in just 5 minutes. This anomalous behavior is a classic indicator of data exfiltration, where an attacker is using encrypted HTTPS traffic to stealthily transfer stolen data out of the network without triggering typical signature-based alerts.

Answer

Denial of service attack

Answer

Port scan activity

Answer

Normal web browsing traffic

Question 2

While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?

Accepted Answer

Brute force attack. Repeated GET requests to /login.php with varying usernames from a single source IP, mostly returning 200 OK, is the signature of a brute force attack — the attacker is iterating credentials against the login endpoint. The consistent 200 OK responses suggest the server is processing each attempt (success or generic response) without rate-limiting.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 3

Which Wireshark display filter would an analyst use to view only HTTP packets that contain the word 'password' in the packet payload?

Accepted Answer

http contains "password". The `http contains "password"` display filter instructs Wireshark to match any HTTP packet whose payload includes the literal string 'password'. The `contains` operator performs a case-sensitive substring search across the entire HTTP protocol data (headers and body), which is exactly what an analyst needs to locate credentials or sensitive terms in HTTP traffic.

Answer

http.request.uri contains "password"

Answer

data contains "password"

Answer

tcp.port == 80 and frame contains "password"

Question 4

During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?

Accepted Answer

A false positive; the hash corresponds to an empty file.. The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Answer

An invalid hash; the file may be corrupt.

Answer

A known malicious executable that should be quarantined.

Answer

A hash of a benign system file.

Question 5

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

Accepted Answer

Prioritize alerts based on severity and asset criticality.. Option B is correct because prioritizing by severity and asset criticality ensures that the most impactful alerts—such as those targeting high-value servers or involving critical CVEs—are triaged first, which is essential when alert volume exceeds analyst capacity. Option C is correct because correlating alerts with threat intelligence feeds (e.g., known malicious IPs, domains, or file hashes from STIX/TAXII sources) helps distinguish true positives from benign noise, directly improving detection fidelity in a high-volume SIEM environment. Option E is correct because grouping alerts by source IP reveals attack patterns such as repeated failed logins (brute force) or sequential port probes (port scans), enabling analysts to consolidate many low-level events into a single higher-confidence incident. Option A is not appropriate because strictly chronological triage ignores severity and context, causing critical incidents to be buried under low-priority noise. Option D is not appropriate because automatically closing low-severity alerts without review risks missing stealthy or multi-stage attacks that rely on low-and-slow techniques to evade detection.

Answer

Investigate alerts in the order they were received.

Answer

Automatically close all low-severity alerts without review.

Question 6

During packet analysis, an analyst notices a TCP connection with a large number of SYN packets sent to various ports on a single host but no completed handshakes. This is characteristic of which activity?

Accepted Answer

Port scan reconnaissance. A port scan typically sends SYN packets to multiple ports; responses indicate open ports. The lack of completed handshakes suggests a scan, not an attack.

Answer

Normal web browsing behavior

Answer

SYN flood denial-of-service attack

Answer

Data exfiltration using FTP

Question 7

An analyst is reviewing DNS logs and sees a high volume of NXDOMAIN responses for a specific domain. Which TWO scenarios could this indicate?

Accepted Answer

DNS amplification attack. Option A (DNS amplification attack) is correct because attackers spoof the victim's source IP and send many queries for a domain that returns NXDOMAIN, causing the recursive resolver to flood the victim with responses; a high volume of NXDOMAIN replies is a common signature of this reflection/amplification abuse. Option B (Fast-flux DNS activity) is correct because fast-flux botnets rapidly rotate A records across many compromised hosts, and as records change or expire, resolvers frequently receive NXDOMAIN responses for the queried domain, producing a high NXDOMAIN volume. Option C (DNS tunneling) is not indicated here because tunneling typically uses TXT, NULL, or other record types with long encoded subdomains and successful responses, not primarily NXDOMAIN. Option D (Legitimate website misconfiguration) could cause NXDOMAIN, but it would not typically produce a high-volume, sustained pattern across many queries in the way an attack or fast-flux infrastructure does. Option E (Normal DNS caching behavior) is incorrect because caching reduces repeated queries and does not inherently generate a high volume of NXDOMAIN responses.

Answer

DNS tunneling

Answer

Legitimate website misconfiguration

Answer

Normal DNS caching behavior

Question 8

In Wireshark, a security analyst wants to display only packets with source IP 10.0.0.1 and destination port 80. Which display filter should be used?

Accepted Answer

ip.src == 10.0.0.1 and tcp.dstport == 80. It uses the standard display filter syntax with the `==` operator and correct field names (`ip.src` and `tcp.dstport`). Option B uses `eq`, which is a valid operator in Wireshark display filters, but the Cisco CyberOps curriculum expects the `==` operator for consistency. Therefore, option B is considered incorrect in this context. Options C and D use capture filter syntax, which is not appropriate for the Wireshark display filter bar.

Answer

ip.src eq 10.0.0.1 and tcp.dstport eq 80

Answer

src 10.0.0.1 and dst port 80

Answer

host 10.0.0.1 && port 80

Question 9

A security analyst needs to filter packets in Wireshark to capture only traffic on port 443. Which filter should be used?

Accepted Answer

tcp port 443. When capturing packets in Wireshark, a capture filter must be used. Capture filters use Berkeley Packet Filter (BPF) syntax. The filter 'tcp port 443' is the correct BPF syntax to capture only TCP traffic on port 443 (HTTPS). Option A uses Wireshark's display filter syntax, which is not used for capturing. Options B and C are also capture filters but B captures only destination port 443, and C captures both TCP and UDP on port 443, which is less specific.

Answer

tcp.port == 443

Answer

dst port 443

Answer

port 443

Question 10

In Snort, a rule is written as: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:to_server; content:"|ff|SMB"; nocase;). What does the 'flow:to_server' option indicate?

Accepted Answer

Apply to traffic from client to server. In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.

Answer

Apply to bidirectional traffic

Answer

Apply only to traffic from server to client

Answer

Ignore the direction of traffic

Question 11

A security analyst is reviewing web server logs and notices a high number of 404 errors for non-existent URLs. Which TWO of the following tools would best help investigate this anomaly?

Accepted Answer

Wireshark for packet-level analysis. Wireshark (C) is correct because it captures and inspects raw packets at the HTTP/TCP layer, letting the analyst reconstruct the exact requests generating the 404s, including source IPs, User-Agent strings, and request patterns that reveal scanning or enumeration activity. A SIEM (D) is correct because it aggregates and correlates web server logs with other data sources, enabling detection of patterns such as repeated 404s from a single source, alerting on thresholds, and pivoting across related events. Snort (A) is not the best fit here since it is a signature-based IDS focused on known attack patterns rather than analyzing HTTP 404 log anomalies. YARA (B) is for matching patterns in files or memory, not for investigating web request anomalies. NetFlow (E) provides flow-level metadata such as top talkers but lacks the HTTP request detail needed to investigate 404 errors.

Answer

Snort for IDS alerts

Answer

YARA for file scanning

Answer

NetFlow for top talkers

Question 12

An analyst detects an internal host communicating with an external IP known for malware distribution. Which THREE of the following are valid Indicators of Compromise (IoCs) that should be recorded?

Accepted Answer

Domain name used in the communication. Option A is correct because the domain name used in the communication is a classic network-based IoC—recording the FQDN allows defenders to block or hunt for that domain across DNS logs, proxies, and firewalls. Option C is correct because the external server's IP address is a host-based/network IoC that can be added to blocklists, SIEM correlation rules, and firewall deny rules to detect or prevent further callbacks. Option D is correct because the MD5 hash of a downloaded file is a file-based IoC that uniquely identifies the malicious payload, enabling hash-based detection in EDR, antivirus, and threat-intel platforms (noting MD5 is weaker than SHA-256 but still a valid IoC). Option B is not an IoC in this context—the user's email address identifies a person, not an artifact of the compromise, and is not directly tied to the malicious communication. Option E is not indicated by the scenario: no registry modification was described, so a registry key cannot be asserted as an IoC here without supporting evidence of persistence or configuration change.

Answer

Email address of the user

Answer

Registry key from the endpoint

Question 13

A SOC analyst is investigating a web server log and sees the following entry: 192.168.1.10 - - [15/May/2023:10:15:30 +0000] 'POST /login.php HTTP/1.1' 200 1245 'http://example.com/login.php' 'Mozilla/5.0'. Which observation is most suspicious?

Accepted Answer

The response code 200 indicates successful login. The log entry shows a successful HTTP 200 response to a POST request to a login page. While a single 200 is normal, it is the most suspicious observation among the options because it indicates a successful login, which could be part of a brute force or credential stuffing attack if many attempts preceded it. The correct answer is A.

Answer

The source IP is internal

Answer

The user-agent is generic

Answer

The POST method is used for login

Question 14

A security analyst is using Wireshark to capture traffic from a network segment. They want to see only packets that contain the string 'password' in the payload. Which type of filter should they apply?

Accepted Answer

Display filter using 'frame contains "password"'. Wireshark display filters use the syntax 'frame contains "password"' to match packets whose frame payload contains the specified string. Display filters are applied after capture to narrow the visible packet list, and 'contains' performs a case-sensitive substring match on the frame bytes. This is the correct filter type and syntax for payload string matching.

Answer

Display filter using 'tcp.port == 80'

Answer

Capture filter using 'port 80'

Answer

Capture filter using 'tcp contains password'

Question 15

During a security investigation, an analyst examines a PCAP file in Wireshark. The analyst wants to see only traffic between two specific IP addresses (192.168.1.10 and 10.0.0.5). Which display filter should be applied?

Accepted Answer

ip.addr==192.168.1.10 && ip.addr==10.0.0.5. The display filter 'ip.addr==192.168.1.10 && ip.addr==10.0.0.5' in Wireshark matches any packet where either the source or destination IP is 192.168.1.10 AND either the source or destination IP is 10.0.0.5. This effectively captures all traffic between the two hosts in both directions, because each packet will have one address as source and the other as destination. The '&&' operator ensures both conditions are met, and 'ip.addr' matches either source or destination.

Answer

tcp.port==80

Answer

ip.src==192.168.1.10 and ip.dst==10.0.0.5

Answer

ip.addr eq 192.168.1.10 or ip.addr eq 10.0.0.5

Question 16

Which log type would an analyst examine to see failed login attempts to a Windows server?

Accepted Answer

System logs. System logs (Event Logs) on a Windows server record security-related events, including failed login attempts under Event ID 4625 (Windows 10/Server 2012 R2 and later). An analyst would examine these logs in Event Viewer under 'Windows Logs > Security' to identify authentication failures, which are critical for detecting brute-force attacks or unauthorized access attempts.

Answer

DNS logs

Answer

Firewall logs

Answer

Web server logs

Question 17

A security analyst is using Zeek to monitor network traffic. The analyst wants to extract all files transferred over HTTP. Which Zeek script or package accomplishes this?

Accepted Answer

file_extraction.zeek. The file_extraction.zeek script is specifically designed to extract files from network streams, including HTTP transfers. Zeek's default HTTP logging (http.log) records metadata about HTTP sessions, but to actually capture and reassemble the transferred files (e.g., images, executables, documents), the file_extraction framework must be loaded via this script or package.

Answer

dns-logs.zeek

Answer

conn-logs.zeek

Answer

http-logs.zeek

Question 18

A SOC analyst observes a spike in DNS queries for long, random-looking subdomains under a single domain from an internal host. The responses are NXDOMAIN. Which type of activity is most likely indicated?

Accepted Answer

DNS tunneling. DNS tunneling encodes data inside DNS queries and responses, typically using long, high-entropy subdomain labels (e.g., base32/base64 chunks) under an attacker-controlled domain. The NXDOMAIN responses are expected because the authoritative server for the tunnel domain is not a real resolver — it just logs the encoded data and returns NXDOMAIN to keep the channel alive. The volume of random subdomains from one host is the signature of a DNS exfiltration or C2 tunnel.

Answer

DNS amplification attack

Answer

Normal DNS resolution for many websites

Answer

Misconfigured DNS server

Question 19

A SOC analyst is investigating a potential data exfiltration incident. Which TWO Indicators of Compromise (IoCs) would be most relevant for tracking the exfiltration of files over the network?

Accepted Answer

URLs. Option A (URLs) is correct because exfiltration over HTTP/HTTPS often targets specific endpoints, and URL strings in proxy, IDS/IPS, or web-server logs can reveal the destination path used to upload or beacon stolen data. Option E (File hashes, MD5/SHA-256) is correct because hashing known exfiltrated or staged files lets analysts identify those exact files on endpoints, in email attachments, or in captured traffic, and correlate them across the environment. Option B (IP addresses) is not marked correct here because, while useful, IPs are volatile and often shared or NATed, making them less specific to file exfiltration than URLs or file hashes in this scenario. Option C (Mutex names) is not marked correct because mutexes are host-based artifacts used for malware instance synchronization, not network file-transfer tracking. Option D (Registry keys) is not marked correct because registry keys are endpoint persistence/configuration artifacts and do not directly indicate files leaving the network.

Answer

IP addresses

Answer

Mutex names

Answer

Registry keys

Question 20

A security analyst is tuning a Snort IDS to reduce false positives. Which TWO Snort rule options should the analyst modify to make the rule more specific?

Accepted Answer

Set a 'threshold' to limit the number of alerts per time window. Option B is correct because Snort's 'threshold' option (e.g., 'threshold: type limit, track by_src, count 1, seconds 60') suppresses repeated alerts for the same event within a time window, directly reducing the volume of false-positive alerts generated by noisy rules. Option D is correct because adding a 'content' field (e.g., 'content:"specific string";') makes the rule match specific byte patterns in the payload, narrowing the detection criteria so only traffic containing those bytes triggers the rule, which increases specificity and cuts false positives. Option A is wrong because removing the destination port broadens the rule to match more traffic, making it less specific and increasing false positives. Option C is wrong because 'priority' only affects the severity label/ordering of alerts, not how many packets match the rule. Option E is wrong because changing the action from 'alert' to 'log' only changes how matched events are recorded, not the rule's matching specificity.

Answer

Remove the 'destination port' field

Answer

Increase the 'priority' value

Answer

Change the action from 'alert' to 'log'