200-201 Security Monitoring Practice Test 12 — 15 Questions

Question 1

A SOC analyst reviewing Cisco Firepower intrusion events notices that a single internal host generated hundreds of alerts for the same signature within a five-minute window, each with a different destination port on the same external IP. The analyst wants to reduce noise before escalating. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Correlate the events by source IP and destination IP to determine whether this is a port sweep or a single exploit attempt.. When many alerts share a source and destination but vary in port, the analyst should correlate them to identify the pattern. Grouping by IP pairs reveals whether the activity is a port sweep, a multi-vector exploit, or benign scanning. This context is essential before deciding on containment or tuning.

Answer

Export the raw packet captures to a CSV file and archive them for compliance purposes.

Answer

Immediately block the internal host's IP address at the perimeter firewall to stop the activity.

Answer

Disable the signature that is generating the alerts because it is clearly producing false positives.

Question 2

An analyst is reviewing Cisco Firepower intrusion events and sees an alert for a TCP connection to an internal web server on port 80 with the rule message 'SERVER-WEBAPP Apache Struts2 remote code execution attempt'. The packet payload contains the string 'Content-Type: %{(#_='multipart/form-data')'. The server is running Apache Struts2 version 2.3.15. What should the analyst do next?

Accepted Answer

Check the web server logs and file system for signs of compromise, and verify whether the server was patched.. The alert shows a remote code execution attempt against a known vulnerable Apache Struts2 version. The analyst must verify whether the exploit succeeded by examining server logs, processes, and files. This is critical because the traffic reached the internal server, and the payload matches a known exploit. Proper incident response requires validation and scoping before containment.

Answer

Ignore the alert because the server is behind a firewall and the attack is not likely to succeed.

Answer

Block the source IP address at the firewall and consider the incident resolved.

Answer

Update the Snort signature to detect the specific payload string and wait for the next alert.

Question 3

An analyst is reviewing DNS logs and sees repeated queries from an internal workstation to randomly generated subdomains of a single domain, such as a1b2c3.example.com, d4e5f6.example.com, and so on. The responses are consistently NXDOMAIN. Which technique is most consistent with this pattern?

Accepted Answer

Domain generation algorithm (DGA) used by malware for command-and-control resolution.. Randomly generated subdomains under a single domain with mostly NXDOMAIN responses are a hallmark of a domain generation algorithm. Malware uses DGAs to evade static blocklists by cycling through many candidate C2 domains, and DNS logs are the primary place to detect this behavior.

Answer

Fast flux DNS used to rotate IP addresses for a botnet.

Answer

DNS cache poisoning attempt against the internal resolver.

Answer

DNS tunneling used to exfiltrate data through TXT record queries.

Question 4

While analyzing a packet capture in Wireshark, an analyst observes a series of TCP packets with the PSH, ACK flags set and a payload containing the string 'cmd.exe /c whoami'. The destination port is 4444. Which type of activity is most likely indicated?

Accepted Answer

A reverse shell established by malware. The packet capture shows TCP traffic to port 4444 with a payload containing a Windows command. This is a classic indicator of a reverse shell, where malware on a compromised host connects back to an attacker-controlled listener. SSH would be encrypted and on port 22, web traffic would be HTTP on standard ports, and DNS tunneling would use port 53. The correct answer is the reverse shell.

Answer

A DNS tunneling session exfiltrating data

Answer

A web server serving content on a non-standard port

Answer

A legitimate remote administration session using SSH

Question 5

A junior analyst is asked to identify which type of log would best show whether a Windows workstation attempted to authenticate to a file share on another server. Which log source should the analyst consult?

Accepted Answer

Windows Security event log on the workstation, looking for logon events.. Windows Security event logs on the workstation capture logon events, including network logons to remote shares. Events like 4624 with logon type 3 show that an account authenticated over the network. This is the most direct evidence of an authentication attempt to a file share.

Answer

DHCP server logs showing IP address leases.

Answer

Firewall logs showing allowed outbound TCP port 445 traffic.

Answer

Syslog from the core switch showing interface status changes.

Question 6

A SOC analyst is investigating a Windows workstation that has been exhibiting unusual outbound connections. Reviewing Sysmon Event ID 3 (Network Connection) logs, the analyst notices a process named svchost.exe with a parent process of cmd.exe initiating connections to an external IP on port 4444. On a healthy system, svchost.exe is normally spawned by services.exe. Which conclusion is most strongly supported by these log entries?

Accepted Answer

Malware is masquerading as svchost.exe to blend in while communicating with a command-and-control server. The strongest conclusion is process masquerading for command-and-control. Legitimate svchost.exe always has services.exe as its parent, so a cmd.exe parent reveals either a renamed malicious executable or code injected into a spawned process. Combined with an outbound connection to port 4444, a well-known reverse-shell and C2 port, the analyst should treat the host as compromised and begin containment and forensic triage.

Answer

A legitimate Windows service is making routine update connections

Answer

A scheduled task is running a legitimate administrative script

Answer

The system is experiencing a memory corruption issue causing process misattribution

Question 7

A network analyst is examining a packet capture and notices a series of TCP packets where the client sends a SYN, the server responds with SYN-ACK, and the client never sends an ACK. The client repeats this for many destination ports on the same server. Which conclusion is most accurate?

Accepted Answer

The client is performing a TCP SYN scan to discover open ports on the server.. The pattern of SYN, SYN-ACK, and no ACK repeated across many ports is a TCP SYN scan. This technique, often called half-open scanning, allows an attacker to discover open ports without completing connections, making it harder to log on the target. It is a common reconnaissance method.

Answer

The client is using a legitimate application that only requires half-open connections.

Answer

The server is misconfigured and is dropping all incoming connections.

Answer

The client is experiencing network congestion causing packet loss of the final ACK.

Question 8

A network security analyst is reviewing NetFlow records from a perimeter router and observes that an internal server at 172.16.5.20 has transferred approximately 4.5 GB to an external IP address in country X over the past three hours, all during non-business hours. The destination IP has no prior communication history with the organization and the traffic uses port 443. Which analysis approach would best confirm whether this represents data exfiltration?

Accepted Answer

Capture full packet data for the transfer and perform content inspection to identify the data being sent. To confirm exfiltration, the analyst must determine what data is leaving, not just how much. Full packet capture with content inspection, or decrypted proxy and TLS logs where available, reveals file types, protocols, and payloads. NetFlow establishes the anomaly—large volume, unusual destination, off-hours timing—but content-level visibility converts suspicion into confirmation and supports incident response decisions.

Answer

Check the router's interface error counters for packet loss

Answer

Review the server's antivirus scan history for the past week

Answer

Verify the server's operating system patch level

Question 9

A SOC analyst is reviewing proxy logs and wants to identify indicators of potential data exfiltration over HTTP. Which two patterns should the analyst treat as suspicious? (Choose two.)

Accepted Answer

Large outbound POST requests to a single external IP address at regular intervals.. Exfiltration over HTTP often appears as large outbound uploads, especially to new or untrusted destinations. Regular large POST requests and high-volume uploads to newly registered domains both indicate data leaving the environment in a manner inconsistent with normal business traffic. These patterns warrant deeper investigation.

Answer

HTTP 404 errors generated by users mistyping URLs in the browser.

Answer

Repeated GET requests to the same internal web server for static images.

Answer

Downloading software updates from a known vendor's HTTPS site.

Question 10

A SOC analyst is reviewing NetFlow records exported from the border router. A single internal workstation is generating a steady stream of outbound sessions to dozens of unique external IP addresses on TCP port 443, each lasting only a few seconds, every day at 02:00. No corresponding firewall denies are logged. Which security monitoring conclusion is most appropriate?

Accepted Answer

The workstation is most likely beaconing to a command-and-control infrastructure and should be escalated for endpoint triage.. Periodic outbound sessions to many distinct external hosts on a single port, occurring at a fixed hour, match the behavioural profile of malware beaconing rather than normal user or update traffic. NetFlow alone cannot confirm payload, so the analyst should pivot to DNS and endpoint data, but the pattern itself justifies escalation as a suspected command-and-control channel.

Answer

The router is misconfigured and is exporting duplicate flow records, which inflates the session count.

Answer

This is expected behaviour for a patched workstation receiving software updates from a content delivery network.

Answer

The traffic is a port scan launched from the internet against the workstation and should be blocked inbound.

Question 11

A SOC analyst is correlating multiple data sources after a suspected web application compromise on an internet-facing server. The analyst has access to web server logs, firewall logs, and endpoint detection and response (EDR) telemetry. Which TWO log sources or record types would most directly help identify the initial exploitation attempt and the subsequent post-exploitation activity? (Choose two.)

Accepted Answer

Web server access logs containing HTTP request methods, URIs, status codes, and user-agent strings. Web server access logs expose the initial malicious HTTP request and its parameters, while EDR process and command-line telemetry reveals the resulting execution on the host, such as spawned shells or web shell activity. Together they connect the attack vector to post-exploitation behavior. Firewall, DHCP, and interface statistics provide useful context but lack the application and endpoint detail required to attribute and reconstruct the intrusion.

Answer

DHCP lease logs from the corporate network

Answer

Firewall logs showing allowed and denied connections between the internet and the DMZ

Answer

Switch port mirroring statistics showing interface utilization

Question 12

An analyst is triaging a host that antivirus flagged for a file named svchost.exe running from C:\Users\Public\Downloads. The file has a valid digital signature issued to a legitimate software publisher, and the hash matches a known-good installer component. The process is making outbound SMB connections to several internal servers. Which action best reflects sound security monitoring practice?

Accepted Answer

Escalate for investigation because a signed binary executing from a user-writable path and initiating internal SMB sessions is anomalous.. Signature validity and hash reputation address integrity, not intent or context. A trusted binary in a user-writable directory that opens SMB sessions to multiple internal servers is a behavioural red flag consistent with abuse for lateral movement, so the analyst should escalate, preserve evidence, and determine scope rather than dismiss or prematurely remediate the alert.

Answer

Close the alert as a false positive because the signature and hash both verify as trusted.

Answer

Ignore the alert because the process name matches a legitimate Windows system binary.

Answer

Immediately delete the file and the user profile, then document the incident as remediated.

Question 13

A network security analyst is reviewing firewall logs and sees repeated denied inbound connection attempts from various external IP addresses to TCP port 3389 on several internal hosts. Which type of activity does this most likely represent?

Accepted Answer

A brute-force attack against Remote Desktop Protocol. Port 3389 is the default for Microsoft RDP. Multiple external IPs attempting to connect to this port on internal hosts, with the firewall denying the connections, is a classic sign of an RDP brute-force or scanning attack. Legitimate administrative sessions would come from trusted sources and likely succeed. DoS would involve higher volume from fewer sources, and database connections would use different ports. The correct answer is a brute-force attack against RDP.

Answer

A denial-of-service attack targeting the RDP service

Answer

A misconfigured application attempting to connect to a database

Answer

A legitimate remote administration session from an IT administrator

Question 14

A Cisco Firepower analyst notices repeated syslog messages from an ASA firewall showing TCP connections to 203.0.113.55:4444 that are reset immediately after the three-way handshake. The source hosts are internal workstations running an outdated browser plugin. Which security monitoring data source would best confirm whether these workstations established a command-and-control channel?

Accepted Answer

Endpoint process and network connection telemetry from the workstations. Confirming a command-and-control channel requires linking network activity to the responsible process on the host. Endpoint process and socket telemetry provides that link, showing the vulnerable browser plugin initiating connections to the external address. Flow, packet capture, and proxy logs can corroborate network behavior, but they lack process attribution and, for encrypted or direct traffic, may not reveal enough to confirm C2.

Answer

Full packet capture from the internal segment, analyzed in Wireshark

Answer

NetFlow records exported from the ASA to a collector

Answer

Proxy web logs recording HTTP CONNECT requests and user agents

Question 15

A junior SOC analyst receives an alert indicating that a workstation attempted to resolve a domain associated with a known malware family. The analyst wants to determine whether the workstation actually connected to the malicious domain or if the resolution attempt was blocked. Which data source would most directly answer this question?

Accepted Answer

DNS server response logs showing query results and response codes. DNS server response logs capture the outcome of each query, including successful answers, NXDOMAIN responses, and blocks from protective DNS filtering. This directly determines whether the workstation received an address for the malicious domain. Following up with firewall or proxy logs confirms whether an outbound connection actually occurred, allowing the analyst to decide whether endpoint containment is required.

Answer

The organization's password policy configuration

Answer

The workstation's local hosts file

Answer

The endpoint's installed application inventory