200-201 Security Monitoring Practice Test 13 — 15 Questions

Question 1

An analyst is investigating a potential data exfiltration incident. The only available data is NetFlow records from Cisco routers. Which NetFlow field would be most useful to identify large outbound transfers to an unusual external host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Destination IP address and byte count. NetFlow records capture metadata about flows, including source/destination IP, ports, protocol, and byte/packet counts. To detect large outbound transfers to an unusual external host, the analyst should focus on the destination IP address and the byte count. A high byte count from an internal host to an external IP that is not a known service indicates potential exfiltration. Other fields like source port, TCP flags, or interface information provide context but are not as directly useful for identifying data volume.

Answer

Input interface and output interface

Answer

Next-hop IP address and autonomous system number

Answer

Source port and TCP flags

Question 2

A junior analyst is asked to determine which log source would best reveal an attacker attempting to authenticate to a Windows file server with stolen credentials over the network. Which source should the analyst consult first?

Accepted Answer

Windows Security event log entries for logon events, including the logon type and source workstation fields.. Network authentication against a Windows file server is recorded in the Security log as logon events, which include the account, logon type, and originating address. Correlating successful and failed entries reveals password spraying, credential stuffing, or lateral movement with stolen credentials, making the Security log the correct first source for this question.

Answer

Application event log entries written by the installed line-of-business database engine.

Answer

Windows System event log entries generated by the Service Control Manager during service start and stop.

Answer

Windows Defender operational log entries recording scheduled scan completion status.

Question 3

A threat hunter reviews Cisco Stealthwatch flow data and sees an internal server sending periodic 300-byte outbound flows to an external IP every 60 seconds, with consistent packet sizes and no matching inbound response beyond TCP acknowledgments. The server's DNS queries for that IP resolve through a newly registered domain. Which monitoring approach best characterizes this activity as beaconing rather than normal application traffic?

Accepted Answer

Analyze flow periodicity and packet-size consistency over time. Beaconing is a behavioral pattern characterized by regular connection intervals and consistent payload sizes, often with minimal server response. Flow telemetry preserves the timing and byte counts needed to detect that cadence, so periodicity and size consistency analysis is the right approach. Volume ranking, blocklist matching, and patch verification do not evaluate the temporal pattern that separates automated C2 from normal traffic.

Answer

Compare the flow's byte count against the organization's top-talkers report

Answer

Check whether the destination IP appears on a threat intelligence blocklist

Answer

Verify that the server's operating system is fully patched and current

Question 4

A security analyst is reviewing NetFlow records exported from a Cisco router at the internet edge. During a suspected ransomware staging window, a single internal host shows a sustained outbound flow to one external IP on TCP 443 with 4.2 GB transferred over 40 minutes, while the host's normal baseline for that destination is under 5 MB per day. No corresponding proxy log entry exists for this session. Which conclusion is best supported by these records?

Accepted Answer

The records indicate probable data exfiltration or bulk upload over TLS, because the volume and duration are anomalous for that host and bypass the monitored proxy.. NetFlow provides metadata such as byte counts, duration, ports, and endpoints without payload. When one host suddenly sends gigabytes to a single external address far above its baseline and no proxy record exists, the strongest supported hypothesis is bulk outbound transfer, consistent with exfiltration or staged upload. The absence of proxy inspection suggests the session avoided the monitored path, reinforcing the need to escalate and correlate with endpoint and DNS telemetry.

Answer

The flow confirms a denial-of-service attack because large outbound transfers consume bandwidth and degrade availability.

Answer

The flow is normal because TCP 443 is reserved for HTTPS and traffic on that port is always legitimate business use.

Answer

The flow represents encrypted command-and-control beaconing because beaconing is identified by high byte volume on port 443.

Question 5

A SOC analyst is reviewing NetFlow records exported from a border router and notices a single internal host initiating outbound connections to more than 300 distinct external IP addresses on TCP port 443 within a five-minute window, with each flow carrying only a few hundred bytes. Which security monitoring conclusion is best supported by this evidence?

Accepted Answer

The host is likely performing a port scan or host sweep against external targets.. NetFlow captures metadata rather than payloads, but the metadata here is decisive: one internal host opening connections to hundreds of distinct external addresses on the same port with uniformly tiny byte counts is a host sweep. Beaconing would target few destinations; exfiltration would move large volumes to one destination; amplification would be inbound UDP. The fan-out pattern uniquely supports scanning activity.

Answer

The host is likely exfiltrating a large database to a single external cloud storage provider.

Answer

The host is likely the victim of a reflected DNS amplification attack.

Answer

The host is likely performing beaconing to a command-and-control server over HTTPS.

Question 6

A SOC analyst is reviewing firewall logs and sees repeated outbound connections from an internal server to an external IP on TCP port 443, but the traffic is not TLS. Packet capture shows a custom binary protocol with periodic small keepalives. Which type of malicious activity is most consistent with these findings?

Accepted Answer

Command-and-control beaconing over a non-standard protocol. The combination of outbound port 443, absence of TLS, a custom binary protocol, and periodic small keepalives strongly suggests command-and-control beaconing. Attackers commonly use port 443 to blend with normal web traffic while evading TLS inspection by not actually using TLS. The regular check-ins are designed to receive instructions or exfiltrate small amounts of data without drawing attention.

Answer

A misconfigured application using HTTPS on port 443

Answer

Data exfiltration over DNS

Answer

Lateral movement using SMB

Question 7

A SOC receives a threat intelligence feed indicating that a specific SHA-256 hash belongs to a trojan. An analyst searches the endpoint telemetry and finds no process with that hash, but the file name appears in several temporary directories. Which explanation best accounts for this result?

Accepted Answer

The malware mutates or is repacked on each execution, so the file content and therefore the hash differ while the name persists.. A SHA-256 value identifies exact file content, so the same malware name appearing with different bytes yields different hashes. Repacking, encryption, or packing layers can change content on every campaign or execution. The analyst should pivot from static hash matching to behavioural and name-based hunting, then capture a live sample to confirm the current variant.

Answer

The endpoint agent is not collecting file metadata, so hash matching cannot be performed.

Answer

The endpoint is using a different hash algorithm, so SHA-256 values cannot be compared.

Answer

The threat feed is stale and the hash was retired by the vendor before the analyst searched.

Question 8

An analyst is tuning a Cisco Firepower intrusion policy. A rule fires repeatedly with the message 'MALWARE-CNC Outbound connection to known malicious domain' against a marketing workstation. Packet capture shows the workstation resolving and connecting to a domain that the threat intelligence feed lists, but the endpoint shows no malicious process, no persistence, and the user states they clicked a link in a phishing email an hour earlier. Which action best reflects sound incident handling at this stage?

Accepted Answer

Treat the alert as a probable compromise: isolate the workstation, capture volatile data, and correlate the connection timing with the phishing email and any subsequent downloads.. Network evidence of a live connection to a threat-intelligence-listed domain, occurring shortly after a user clicked a phishing link, justifies treating the workstation as potentially compromised. Endpoint scans often miss fileless or in-memory activity, so a clean disk does not clear the host. The proportionate response is containment with evidence preservation, followed by correlation across email, DNS, proxy, and endpoint telemetry to establish scope and determine whether credentials or data were affected.

Answer

Suppress the rule permanently for the marketing subnet so analysts are not distracted by future alerts.

Answer

Close the ticket as a false positive because the endpoint security agent reported no malicious process on disk.

Answer

Block the domain at the DNS layer only and continue monitoring, since blocking prevents any further harm from the connection.

Question 9

A SOC analyst is tuning Cisco Firepower intrusion policies and reviewing alert metadata to prioritize response. Which TWO alert attributes most directly indicate that a detected event represents a successful compromise rather than a blocked attempt? (Choose two.)

Accepted Answer

Subsequent correlated events show the target initiating outbound connections to a known C2 server. Successful compromise is indicated by evidence that the target was actually affected, not merely targeted. An impact flag of Vulnerable shows the host matched the exploit's affected configuration, and later outbound connections to known C2 infrastructure demonstrate post-exploitation control. Blocked actions, severity levels, and traffic direction describe the attempt or its potential, but not confirmed success.

Answer

The alert action is recorded as 'Blocked'

Answer

The rule's signature is classified with a high severity level

Answer

The event's source is an external IP and the destination is an internal server

Question 10

An analyst is triaging an alert generated by Cisco Secure Network Analytics (Stealthwatch) showing a host inside the network communicating with a known command-and-control IP. The analyst wants to determine whether the communication has already resulted in data theft. Which additional telemetry source would provide the most direct evidence of successful exfiltration?

Accepted Answer

NetFlow records showing outbound byte volume from the internal host to the C2 address.. Confirming exfiltration requires evidence of data actually leaving the network. NetFlow byte counters toward the command-and-control address provide that measurement directly and can be compared against the host's normal egress baseline. Signature updates, DHCP leases, and authentication events are useful for context and attribution but cannot quantify outbound transfer volume, so they do not answer whether theft occurred.

Answer

DHCP lease logs showing the internal host renewed its IP address.

Answer

Authentication logs showing the user logged into the host via RDP.

Answer

Syslog entries from the host's antivirus agent showing a signature update occurred.

Question 11

An analyst is reviewing a Windows event log and sees Event ID 4625 repeated many times for the same user account from different source workstations within a short period. Which activity does this most likely indicate?

Accepted Answer

A brute-force or password-spraying attack against the account. Repeated Windows Event ID 4625 entries for one account from multiple source workstations indicate many failed logon attempts, which is the signature of a brute-force or password-spraying attack. Legitimate causes such as expired passwords or stale cached credentials would not produce this volume or diversity of source hosts, so the activity should be investigated as a credential attack.

Answer

A successful privilege escalation by a domain administrator

Answer

A user account lockout due to a stale cached credential

Answer

Normal user behavior when a password has expired

Question 12

A security analyst is reviewing Sysmon telemetry from a workstation that may be compromised. Which TWO event types should the analyst correlate first to identify suspicious process execution and persistence? (Choose two.)

Accepted Answer

Event ID 1, Process Create, which records the image path, command line, and parent process.. Process Create establishes what ran, from where, with which arguments, and under which parent, while Registry Value Set reveals the persistence the process installed. Correlating the two links a specific executable to a specific autorun or service entry, which is the fastest way to confirm suspicious execution and durable persistence on a Windows endpoint.

Answer

Event ID 22, DNS Query, which records name resolution requests made by processes.

Answer

Event ID 3, Network Connection, which records TCP and UDP connection attempts by processes.

Answer

Event ID 11, File Create, which records file creation and overwrite operations with their paths.

Question 13

A SOC analyst receives an alert that a user account successfully authenticated to the VPN from two geographically distant locations within four minutes. Both sessions remain active. The identity team confirms the user is traveling and has only one device. Which monitoring conclusion is most appropriate?

Accepted Answer

This is impossible-travel behavior consistent with credential theft, so the account should be treated as compromised pending verification.. Impossible travel detection compares authentication events across time and geography to find sessions that one person could not physically produce. Two concurrent VPN sessions from distant locations, with one confirmed device and one traveling user, indicate a second party using the same credentials. The appropriate action is to treat the account as compromised, verify with the user through an out-of-band channel, and review session activity for data access or lateral movement.

Answer

This indicates a split-tunnel misconfiguration, since split tunneling causes a user to appear from multiple source networks simultaneously.

Answer

This is expected behavior because VPN concentrators load-balance sessions and users commonly appear from multiple regions.

Answer

This is a low-severity event because both sessions authenticated successfully, and successful authentication rules out misuse.

Question 14

A security analyst is correlating network and endpoint telemetry to detect a host infected with malware that is attempting to establish persistence and communicate externally. Which TWO artifacts would best support this investigation? (Choose two.)

Accepted Answer

Sysmon Event ID 13 registry value set events for Run key modifications. To confirm both persistence and external communication, the analyst needs an endpoint artifact that shows the persistence mechanism and a network artifact that shows beaconing. Sysmon registry value set events reveal Run key modifications used for persistence, while NetFlow records expose periodic outbound connections to an external IP. Together they link the infected host's persistence to its command-and-control channel.

Answer

DHCP server logs showing IP address leases for the subnet

Answer

Antivirus scan reports from the previous quarter

Answer

Windows Event ID 4688 process creation events for every process on all hosts

Question 15

A network security analyst is configuring a SPAN session on a Cisco switch so that a Cisco Firepower sensor can inspect traffic between the internal user VLAN and the internet-facing router. The switch has a single physical uplink carrying that traffic. Which configuration goal must the analyst keep in mind to ensure the sensor receives complete sessions?

Accepted Answer

The SPAN source must include both transmit and receive directions of the monitored interface.. Session reassembly requires visibility into both directions of a conversation. When a SPAN source mirrors only one direction, the sensor sees SYN packets without replies or requests without responses, crippling detection and logging. Configuring the source to capture both transmit and receive traffic on the monitored interface ensures the sensor receives full bidirectional sessions for accurate analysis.

Answer

The sensor interface must be set to promiscuous mode and assigned an IP address on the monitored VLAN.

Answer

The SPAN session must be configured with the encapsulation replicate option to copy VLAN tags.

Answer

The SPAN destination port must be configured as a trunk carrying all VLANs.