200-201 Security Monitoring Practice Test 2 — 15 Questions

Question 1

Which log type would an analyst examine to see failed login attempts to a Windows server?

Accepted Answer

System logs. System logs (Event Logs) on a Windows server record security-related events, including failed login attempts under Event ID 4625 (Windows 10/Server 2012 R2 and later). An analyst would examine these logs in Event Viewer under 'Windows Logs > Security' to identify authentication failures, which are critical for detecting brute-force attacks or unauthorized access attempts.

Answer

DNS logs

Answer

Firewall logs

Answer

Web server logs

Question 2

A security analyst is using Zeek to monitor network traffic. The analyst wants to extract all files transferred over HTTP. Which Zeek script or package accomplishes this?

Accepted Answer

file_extraction.zeek. The file_extraction.zeek script is specifically designed to extract files from network streams, including HTTP transfers. Zeek's default HTTP logging (http.log) records metadata about HTTP sessions, but to actually capture and reassemble the transferred files (e.g., images, executables, documents), the file_extraction framework must be loaded via this script or package.

Answer

dns-logs.zeek

Answer

conn-logs.zeek

Answer

http-logs.zeek

Question 3

A SOC analyst observes a spike in DNS queries for long, random-looking subdomains under a single domain from an internal host. The responses are NXDOMAIN. Which type of activity is most likely indicated?

Accepted Answer

DNS tunneling. DNS tunneling encodes data inside DNS queries and responses, typically using long, high-entropy subdomain labels (e.g., base32/base64 chunks) under an attacker-controlled domain. The NXDOMAIN responses are expected because the authoritative server for the tunnel domain is not a real resolver — it just logs the encoded data and returns NXDOMAIN to keep the channel alive. The volume of random subdomains from one host is the signature of a DNS exfiltration or C2 tunnel.

Answer

DNS amplification attack

Answer

Normal DNS resolution for many websites

Answer

Misconfigured DNS server

Question 4

A SOC analyst is investigating a potential data exfiltration incident. Which TWO Indicators of Compromise (IoCs) would be most relevant for tracking the exfiltration of files over the network?

Accepted Answer

URLs. Option A (URLs) is correct because exfiltration over HTTP/HTTPS often targets specific endpoints, and URL strings in proxy, IDS/IPS, or web-server logs can reveal the destination path used to upload or beacon stolen data. Option E (File hashes, MD5/SHA-256) is correct because hashing known exfiltrated or staged files lets analysts identify those exact files on endpoints, in email attachments, or in captured traffic, and correlate them across the environment. Option B (IP addresses) is not marked correct here because, while useful, IPs are volatile and often shared or NATed, making them less specific to file exfiltration than URLs or file hashes in this scenario. Option C (Mutex names) is not marked correct because mutexes are host-based artifacts used for malware instance synchronization, not network file-transfer tracking. Option D (Registry keys) is not marked correct because registry keys are endpoint persistence/configuration artifacts and do not directly indicate files leaving the network.

Answer

IP addresses

Answer

Mutex names

Answer

Registry keys

Question 5

A security analyst is tuning a Snort IDS to reduce false positives. Which TWO Snort rule options should the analyst modify to make the rule more specific?

Accepted Answer

Set a 'threshold' to limit the number of alerts per time window. Option B is correct because Snort's 'threshold' option (e.g., 'threshold: type limit, track by_src, count 1, seconds 60') suppresses repeated alerts for the same event within a time window, directly reducing the volume of false-positive alerts generated by noisy rules. Option D is correct because adding a 'content' field (e.g., 'content:"specific string";') makes the rule match specific byte patterns in the payload, narrowing the detection criteria so only traffic containing those bytes triggers the rule, which increases specificity and cuts false positives. Option A is wrong because removing the destination port broadens the rule to match more traffic, making it less specific and increasing false positives. Option C is wrong because 'priority' only affects the severity label/ordering of alerts, not how many packets match the rule. Option E is wrong because changing the action from 'alert' to 'log' only changes how matched events are recorded, not the rule's matching specificity.

Answer

Remove the 'destination port' field

Answer

Increase the 'priority' value

Answer

Change the action from 'alert' to 'log'

Question 6

A security analyst is reviewing network traffic and notices a high volume of small packets from an internal IP to a single external IP on port 53. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using small packets to evade detection. A high volume of small packets from an internal IP to a single external IP on port 53, without corresponding internal DNS server traffic, is a classic indicator of data exfiltration via DNS tunneling.

Answer

DNS amplification attack

Answer

Port scan

Answer

Normal DNS resolution

Question 7

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

Accepted Answer

An SSH brute-force attack from the internal host. The logs show repeated denied TCP connections from a single internal host (10.0.0.5) to the same external IP (203.0.113.1) on port 22 (SSH), with incrementing source ports (49152, 49153). This pattern of rapid, sequential connection attempts to a single service port is characteristic of an SSH brute-force attack, where an attacker tries multiple username/password combinations. The internal host is likely compromised and being used to attack the external SSH server.

Answer

DNS tunneling

Answer

A legitimate SSH session

Answer

A port scan from the external host

Question 8

An analyst notices a Zeek (Bro) connection log showing a single HTTP request from internal IP 192.168.1.10 to external IP 203.0.113.5 with a URI of '/files/secret.docx' and a response code of 200. The file size is unusually large (50 MB). What should the analyst suspect?

Accepted Answer

Data exfiltration. A large file download over HTTP from an internal host to an external IP, especially with a filename like 'secret.docx', suggests data exfiltration. The single request and response code 200 indicate successful transfer.

Answer

Phishing attempt

Answer

Malware download

Answer

Normal business activity

Question 9

A security analyst is configuring Snort IDS rules. Which TWO components are mandatory in a Snort rule header?

Accepted Answer

Action (e.g., alert, drop). The Snort rule header is composed of the action, protocol, source IP/port, direction operator, and destination IP/port, so option B (Action such as alert or drop) is mandatory because it tells Snort what to do when the rule matches, and option D (Direction operator such as -> or <>) is mandatory because it defines the traffic flow between source and destination. The protocol field (option E) is also part of the header, but the question asks for the two components among the listed choices that are mandatory header elements; in standard Snort rule syntax the header requires action, protocol, source, direction, and destination, and the direction operator is one of those required header tokens. Option A (msg) is a rule option that belongs in the rule body within parentheses, not the header, and option C (sid) is also a rule option in the body, required for a valid rule but not part of the header itself.

Answer

Message (msg) option

Answer

Signature ID (sid) option

Answer

Protocol (e.g., tcp, udp, icmp)

Question 10

Which TWO protocols are commonly used for remote administration and should be monitored for unauthorized access?

Accepted Answer

SSH (port 22). SSH (port 22) is correct because it is the standard encrypted protocol for secure remote command-line administration of servers and network devices, making it a prime target for brute-force and credential-stuffing attacks that should be monitored. RDP (port 3389) is correct because it provides graphical remote administration of Windows systems and is frequently exploited for unauthorized access, ransomware entry, and lateral movement, so its connections and authentication events must be audited. Telnet (port 23) is not correct because, although it is a remote administration protocol, it is legacy and unencrypted, so it is not commonly used in modern secure environments. SNMP (port 161/162) is not correct because it is used for network monitoring and management data collection rather than interactive remote administration. FTP (port 20/21) is not correct because it is a file transfer protocol, not a remote administration protocol.

Answer

Telnet (port 23)

Answer

SNMP (port 161/162)

Answer

FTP (port 20/21)

Question 11

A security analyst is investigating a potential port scan. Which THREE patterns in NetFlow data would indicate a horizontal port scan?

Accepted Answer

Low number of packets per flow. A horizontal port scan targets the same port across many hosts, so option E (single source IP, same destination port, multiple destination IPs) is the defining pattern and is correct. Option A (low number of packets per flow) is correct because scan probes are typically single-packet or very short flows, producing a low packet count per flow. Option B (flows with SYN flag set but no subsequent SYN-ACK or RST) is correct because unanswered SYNs to closed or filtered ports are the hallmark of scanning activity. Option C describes a vertical scan (same source and destination, different ports), and option D describes a single-host port sweep (one source, one destination, multiple ports), so neither matches the horizontal pattern.

Answer

Multiple connection attempts from the same source IP to the same destination IP on different ports

Answer

Single source IP, multiple destination ports on one destination IP

Question 12

A security analyst is investigating a potential brute-force attack on an SSH server. Which TWO of the following log sources would provide the most relevant evidence for detecting and confirming this attack? (Choose two.)

Accepted Answer

System logs (authentication events). Option B (System logs with authentication events) is correct because SSH authentication failures and successes are recorded by the SSH daemon via syslog/auth.log (e.g., sshd entries showing 'Failed password for ... from <IP> port ...'), which directly reveals repeated login attempts, usernames targeted, and whether any attempt succeeded — the core evidence of a brute-force attack. Option C (Firewall logs showing allow/deny by source IP/port) is correct because it captures the connection attempts to TCP port 22, letting the analyst confirm the volume, frequency, and source IPs of inbound SSH traffic, and correlate them with the authentication failures seen in system logs. Option A (IDS/IPS alerts) can be useful context but only provides signature-based detection rather than the authoritative authentication evidence needed to confirm the attack. Option D (Web server logs) is irrelevant because SSH is not an HTTP service, so HTTP methods, URLs, and response codes would not reflect SSH brute-force activity. Option E (DNS logs) is also irrelevant, since DNS query types and domains do not record inbound SSH connection or authentication attempts.

Answer

IDS/IPS alerts (signature name, severity)

Answer

Web server logs (HTTP method, URL, response code)

Answer

DNS logs (query type, domain queried)

Question 13

During a security monitoring exercise, an analyst observes a series of NetFlow records showing a single internal host communicating with multiple external IP addresses on port 445 (SMB) within a short time window. The traffic volumes are small but consistent. Which THREE of the following should the analyst consider as possible explanations? (Choose three.)

Accepted Answer

The host is infected with malware that propagates via SMB (e.g., EternalBlue).. Option C is correct because outbound SMB (TCP 445) connections to many external IPs in a short window is a classic signature of SMB-propagating worms such as EternalBlue/WannaCry, which spread by exploiting vulnerable hosts. Option D is correct because low, consistent volumes to multiple external destinations on port 445 can indicate data exfiltration over SMB, where an attacker trickles small amounts of data to several endpoints to avoid volume-based detection. Option E is correct because a single internal host touching many external IPs on 445 is consistent with internet-wide SMB vulnerability scanning, and the small, steady traffic fits scan probes rather than bulk transfers. Option A does not belong because video streaming uses UDP/TCP media protocols (e.g., RTP, HTTP/HTTPS, QUIC) on high ports, not SMB/445. Option B does not belong because SMB is a LAN file-sharing protocol and is not normally exposed to external partners; legitimate internal file sharing would stay inside the network and not fan out to many external IPs on 445.

Answer

The host is streaming video content.

Answer

The host is engaging in normal internal file sharing with external partners.

Question 14

A SOC analyst is reviewing a Firepower Management Center (FMC) event dashboard and sees many events with the message 'File blocked' from the file policy. The analyst wants to identify the SHA-256 hash of the blocked file for threat hunting. Which FMC feature should the analyst use?

Accepted Answer

Network File Trajectory. Network File Trajectory is the dedicated FMC feature for tracking files across the network. It aggregates file events and provides metadata such as SHA-256 hash, file name, and transfer direction. This allows analysts to quickly obtain the hash for threat hunting or further analysis, unlike other dashboards that focus on connections or intrusions.

Answer

Malware Events dashboard

Answer

Intrusion Events dashboard

Answer

Connection Events dashboard

Question 15

An analyst is reviewing a PCAP and observes a series of TCP packets where the client sends a SYN, receives a SYN-ACK, sends an ACK, and then immediately sends a RST. This pattern repeats multiple times to different destination ports on the same server. Which conclusion is most accurate?

Accepted Answer

The client is performing a TCP connect scan, which completes the handshake before resetting each connection.. The full handshake followed by an immediate RST is the signature of a TCP connect scan, where the scanner completes the connection and then tears it down. This differs from a SYN stealth scan, which never sends the final ACK. The repeated attempts to different ports confirm scanning activity against the server.

Answer

The client is performing a TCP port scan to identify open ports on the server.

Answer

The client is experiencing network connectivity issues causing premature connection resets.

Answer

The client is using a TCP SYN stealth scan and the RST is sent by the server.