200-201 Security Monitoring Practice Test 10 — 15 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. Which TWO indicators from NetFlow/IPFIX analysis would most strongly suggest data exfiltration?

Accepted Answer

Connection to an IP address flagged as malicious in threat intelligence. Option B is correct because a NetFlow/IPFIX record showing a connection to an IP address flagged as malicious by threat intelligence directly ties the flow to known adversary infrastructure, which is a strong contextual indicator of exfiltration (or command-and-control) rather than benign traffic. Option D is correct because a high volume of data transferred outbound to a single external IP address is a classic exfiltration signature — large byte/packet counts in one direction toward an external destination indicate bulk data movement, consistent with stolen data being sent to an attacker-controlled host. Option A is not the strongest indicator here because consistent traffic at regular intervals more typically suggests beaconing/C2 check-ins than bulk exfiltration, and it can also reflect legitimate scheduled traffic. Option C does not belong because multiple connection attempts to various ports on the same external IP is characteristic of port scanning or reconnaissance, not data exfiltration. Option E does not belong because low-volume traffic to multiple external IPs is more consistent with normal web browsing or DNS activity and lacks the volume and concentration expected in exfiltration.

Answer

Consistent traffic at regular intervals to an external IP

Answer

Multiple connection attempts to various ports on the same external IP

Answer

Low volume of traffic to multiple external IPs

Question 2

An analyst is reviewing web server logs and sees the following entries: 'GET /admin/login.php HTTP/1.1' returning 404, followed by 'GET /admin/login.html' returning 404, then 'GET /admin/login.asp' returning 200. Which TWO observations are most relevant?

Accepted Answer

The attacker is probing for valid login page paths. Option A is correct because the sequence of GET requests for /admin/login.php, /admin/login.html, and /admin/login.asp shows the source systematically trying different file extensions to discover a valid login page path, which is classic forced-browsing or path enumeration behavior. Option E is correct because the final request returned HTTP 200, meaning the server successfully served /admin/login.asp, so the attacker did reach a valid login page. Option B is not supported because brute-force attacks involve repeated authentication attempts with credential guesses, not simple GET requests for different filenames. Option C is not supported because SQL injection would require malicious input in parameters or payloads, and none is shown in these URLs. Option D is not supported because a 404 response indicates the requested resource was not found, not that directory listings were exposed.

Answer

The requests indicate a brute-force login attempt

Answer

The source IP is likely performing a SQL injection

Answer

The server is misconfigured to reveal directory listings

Question 3

Which THREE of the following are common Indicators of Compromise (IoCs) used in threat intelligence?

Accepted Answer

IP addresses. IP addresses (A) are a classic network-based IoC because threat intelligence feeds track malicious or command-and-control (C2) infrastructure by IP, allowing defenders to block or alert on traffic to known-bad hosts. Domain names (D) are equally common IoCs, used to identify malicious domains, C2 servers, and phishing sites via DNS monitoring, sinkholing, or blocklists. File hashes such as MD5 and SHA-256 (E) are host-based IoCs that uniquely identify known malicious files, enabling endpoint and antivirus tools to detect malware by exact signature. User-agent strings (B) can be suspicious artifacts but are not typically standalone IoCs since they are trivially spoofed and highly variable, and port numbers (C) are not reliable IoCs on their own because legitimate and malicious services frequently share the same ports (e.g., 80, 443).

Answer

User-agent strings

Answer

Port numbers

Question 4

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

Accepted Answer

Successful authentication event. The scenario describes a classic brute-force-then-compromise pattern, so the three events that must be correlated are C, the failed authentication events, which indicate repeated unsuccessful login attempts against the same account; A, the successful authentication event, which shows the attacker eventually guessed or cracked the credentials and gained access; and B, the privilege escalation event, which reveals that the compromised account was then used to obtain higher-level rights, confirming the attack progressed beyond initial access. Correlating these three in sequence (many failures → one success → escalation) is what distinguishes a real intrusion from benign failed logins. D (network share access) and E (account creation) are not part of the described sequence and, while potentially suspicious in other contexts, are not the events the analyst should correlate here to detect this specific attack chain.

Answer

Network share access event

Answer

Account creation event

Question 5

An analyst is using Zeek to monitor network traffic. Which THREE types of logs can Zeek generate to provide visibility into application-layer activity?

Accepted Answer

smtp.log. Zeek generates smtp.log (B) to record SMTP transactions, including sender/recipient envelopes, subjects, and mail server responses, giving application-layer visibility into email traffic. dns.log (D) captures DNS queries and responses at the application layer, logging query names, record types, and answers. http.log (E) records HTTP requests and replies, including methods, URIs, host headers, user agents, and status codes, which is classic application-layer visibility. conn.log (A) is a transport/network-layer connection summary (IPs, ports, protocol, bytes, duration) and does not describe application-layer activity, while weird.log (C) logs protocol anomalies and unexpected behavior rather than normal application-layer transactions.

Answer

conn.log

Answer

weird.log

Question 6

A SOC analyst notices that a workstation is generating NetFlow records showing repeated outbound connections to 203.0.113.45 on port 443 at regular 60-second intervals, with each flow transferring approximately 4 KB. The destination IP has no reputation data. Which analysis approach would best determine whether this traffic represents C2 beaconing?

Accepted Answer

Correlate the flow timestamps with DNS query logs and endpoint process telemetry to identify the initiating process and any associated domain resolutions.. The regular 60-second interval and small, consistent transfers are classic beaconing indicators. NetFlow shows the pattern but not the cause. Correlating flow timestamps with DNS logs and endpoint process telemetry identifies the initiating process and any resolved domains, providing definitive evidence of C2 and enabling proper containment.

Answer

Block all outbound traffic to 203.0.113.45 at the perimeter firewall and monitor for any user complaints about lost connectivity.

Answer

Run a full antivirus scan on the workstation and review the scan results for any detected malware signatures.

Answer

Increase the NetFlow sampling rate on the router to capture every packet and then analyze the payload contents for malicious strings.

Question 7

A SOC analyst is reviewing Cisco Firepower intrusion event logs and notices a signature that fired with the message 'OS-COMMAND' on traffic destined to an internal web server on TCP port 80. Which type of activity does this signature most likely indicate?

Accepted Answer

A remote command injection attempt against a web application. An OS-COMMAND signature on HTTP traffic to a web server indicates an application-layer command injection attempt, where an attacker embeds operating system commands in a request to execute them on the target. The port and signature category align with this interpretation, making the remote command injection scenario the correct reading of the alert.

Answer

A DNS tunneling session exfiltrating data to an external resolver

Answer

A brute-force authentication attempt against the web server's SSH service

Answer

A normal software update check initiated by the web server

Question 8

A network security analyst is examining a packet capture in Wireshark and notices a series of TCP packets with the PSH, ACK flags set, and a payload containing the string 'cmd.exe /c whoami'. The packets are destined to port 445 on an internal server. Which type of malicious activity is most likely indicated?

Accepted Answer

SMB lateral movement and command execution. The presence of SMB traffic on port 445 carrying a command shell payload such as 'cmd.exe /c whoami' is a strong indicator of lateral movement and remote command execution. Attackers often use SMB to move between systems and execute commands, making this the most likely malicious activity in the scenario.

Answer

DNS tunneling for data exfiltration

Answer

SMTP email-based malware delivery

Answer

HTTP command-and-control communication

Question 9

A SOC analyst is reviewing Cisco Firepower Intrusion Event logs and notices a high volume of alerts for the signature 'SERVER-WEBAPP Apache Struts2 remote code execution attempt' coming from a single internal host to external web servers. The analyst needs to determine if this is a true positive or a false positive. Which of the following actions would BEST help make that determination?

Accepted Answer

Examine the full packet capture associated with the alert to verify if the exploit payload was actually sent and if a response indicating compromise was received.. The most reliable way to determine if an intrusion alert is a true positive is to inspect the raw packets that triggered it. By analyzing the packet capture, the analyst can see the exact payload and the server's response, which provides definitive evidence of whether the exploit attempt was successful or benign. Correlating with other logs or checking reputations can provide supporting context but does not directly confirm the nature of the event.

Answer

Correlate the alert with NetFlow records to see if the internal host successfully established a connection and transferred data.

Answer

Check the reputation of the external web servers using Cisco Talos Intelligence.

Answer

Review the Snort rule that triggered the alert to understand its detection logic and potential for false positives.

Question 10

A security analyst is investigating a potential security incident and needs to correlate events across multiple data sources. Which two Cisco CyberOps tools or features would provide network flow data and intrusion event details respectively? (Choose two.)

Accepted Answer

Cisco Stealthwatch for network flow analysis. Cisco Stealthwatch is purpose-built for network flow analysis using NetFlow and other telemetry, while Firepower Management Center is the central console for intrusion events from Firepower sensors. Together, they provide the flow and intrusion data needed to correlate a security incident. The other tools focus on DNS, identity, or endpoint, which are not the requested data types.

Answer

Cisco Identity Services Engine for authentication logs

Answer

Cisco Umbrella for DNS security

Answer

Cisco Advanced Malware Protection for endpoint

Question 11

A security analyst is examining a suspicious executable found on a compromised host. The analyst runs the command 'strings malware.exe' and sees the string 'cmd.exe /c net user hacker P@ssw0rd /add'. What is the most likely intent of this command?

Accepted Answer

Create a new user account named 'hacker' with a specified password.. The command 'net user hacker P@ssw0rd /add' is a classic Windows command to create a new local user account. The '/add' switch is the key indicator of account creation. This technique is often used by attackers for persistence, allowing them to regain access even if other malware is removed. The other options describe different actions that would require different syntax or switches.

Answer

Add the user 'hacker' to the local administrators group.

Answer

Modify the password of an existing user account named 'hacker'.

Answer

Delete the user account named 'hacker'.

Question 12

A security analyst is examining a suspicious executable and wants to extract readable strings to identify potential C2 domains or file paths. The analyst has the file on a Windows workstation and needs to use a built-in or commonly available tool. Which approach is most appropriate?

Accepted Answer

Use the Windows Command Prompt to run 'strings.exe' if Sysinternals Suite is installed, then search the output for domain-like patterns.. Sysinternals strings.exe is a standard, reliable tool for extracting ASCII and Unicode strings from binaries on Windows. It allows analysts to quickly identify potential C2 domains, file paths, and other indicators without requiring a full disassembler. Searching the output for domain-like patterns is an efficient triage step.

Answer

Open the file in Notepad and visually scan for readable text that resembles domain names.

Answer

Rename the file extension to .txt and open it in a web browser to view the text.

Answer

Use the 'type' command in Command Prompt to display the file contents and pipe to 'findstr' for domain patterns.

Question 13

An analyst is investigating a potential security incident and reviews the Cisco ASA firewall logs. The logs show the following entry: 'Deny tcp src outside:203.0.113.5/443 dst inside:10.1.1.10/3389'. Which of the following does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal host on RDP, but the connection was blocked by the firewall.. The Cisco ASA log entry shows a denied TCP connection from an external IP address to an internal IP address on port 3389, which is the default port for RDP. The 'Deny' action indicates the firewall blocked the attempt. This is a common scenario where an external host tries to exploit RDP, but the firewall prevents it. Understanding log format, including source/destination and port numbers, is essential for incident analysis.

Answer

An external host successfully connected to an internal host on RDP.

Answer

An internal host attempted to connect to an external host on RDP, but the connection was blocked.

Answer

An internal host attempted to connect to an external host on HTTPS, but the connection was blocked.

Question 14

A Cisco Firepower analyst inspects an inline intrusion policy event where the packet was dropped but only a partial payload was captured. The analyst wants to confirm whether the attack was successful on the target host. Which data source should be correlated with the Firepower event?

Accepted Answer

Endpoint security product telemetry from the target host. When an intrusion event shows a partial payload capture, the network sensor can confirm the attempt but not the outcome on the host. Endpoint telemetry supplies process, file, and registry evidence that ties the network event to actual execution. Correlating the Firepower timestamp and addresses with endpoint records determines whether the attack succeeded, which is the analyst's stated goal.

Answer

NetFlow records exported from the Firepower device

Answer

Syslog messages generated by the Firepower management center

Answer

Full packet capture stored on the Firepower device

Question 15

A security analyst is examining a suspicious file and wants to determine its reputation and threat score. Which Cisco security solution should the analyst use to query the file's SHA-256 hash and get a verdict?

Accepted Answer

Cisco Threat Grid. Cisco Threat Grid is designed for malware analysis and threat intelligence, allowing analysts to submit file hashes and receive a threat score and behavioral report. The other options focus on DNS security, identity management, or network flow analysis, none of which provide file hash reputation.

Answer

Cisco Umbrella

Answer

Cisco Identity Services Engine

Answer

Cisco Stealthwatch