200-201 Security Monitoring Practice Test 2 — 15 Questions

Question 1

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

Accepted Answer

SMB. Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Answer

HTTPS

Answer

DNS

Answer

HTTP

Question 2

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location

Question 3

An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?

Accepted Answer

Display filter. Display filters in Wireshark allow filtering of already captured packets based on criteria like packet content.

Answer

Protocol filter

Answer

Capture filter

Answer

BPF filter

Question 4

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service

Question 5

Which OSI layer is responsible for logical addressing and routing, and is commonly targeted by IP spoofing attacks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Answer

Application layer

Answer

Transport layer

Answer

Data Link layer

Question 6

A security analyst is reviewing firewall logs and notices a rule that denies traffic from source IP 10.0.0.5 to destination port 3389. What service is being blocked?

Accepted Answer

RDP. Port 3389 is the default port for Remote Desktop Protocol (RDP), which is used for remote graphical desktop access to Windows systems. The firewall rule denying traffic from 10.0.0.5 to this port blocks RDP connections, preventing that host from initiating remote desktop sessions.

Answer

SNMP

Answer

SMTP

Answer

SSH

Question 7

During packet analysis, an analyst notices a TCP connection with a large number of SYN packets sent to various ports on a single host but no completed handshakes. This is characteristic of which activity?

Accepted Answer

Port scan reconnaissance. A port scan typically sends SYN packets to multiple ports; responses indicate open ports. The lack of completed handshakes suggests a scan, not an attack.

Answer

Normal web browsing behavior

Answer

SYN flood denial-of-service attack

Answer

Data exfiltration using FTP

Question 8

A SOC analyst is analyzing NetFlow data and notices a sudden spike in outbound traffic from a single internal host to an external IP address during non-business hours. The traffic volume is significantly higher than the baseline. Which suspicion is most likely?

Accepted Answer

Data exfiltration is occurring. A sudden increase in outbound traffic to a single external IP, especially outside business hours, often indicates data exfiltration.

Answer

The host is running a backup to cloud storage

Answer

The host is part of a botnet performing DDoS attack

Answer

The host is performing legitimate software updates

Question 9

Which log type would an analyst examine to view details about HTTP methods (GET, POST), response codes, and user-agent strings?

Accepted Answer

Web server logs. Web server logs record HTTP requests and responses, including methods, URLs, response codes, and user-agent information.

Answer

System logs

Answer

Firewall logs

Answer

DNS logs

Question 10

An IDS/IPS alert shows a signature named 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' with severity high. What is the most likely next step for an analyst?

Accepted Answer

Investigate the source IP and user-agent for malicious activity. The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.

Answer

Immediately block the source IP on the firewall

Answer

Reset the IDS/IPS signature database

Answer

Ignore the alert as it is not a critical signature

Question 11

During an incident response, an analyst extracts a file from network traffic using Zeek's file analysis feature. The file has a SHA-256 hash that matches a known malware indicator. Which type of IoC is this?

Accepted Answer

File-based IoC. A file hash is a file-based IoC that uniquely identifies a malicious file.

Answer

Behavioral IoC

Answer

Network-based IoC

Answer

Host-based IoC

Question 12

An analyst needs to establish a normal traffic pattern baseline for the network. Which activity is most appropriate for this purpose?

Accepted Answer

Capture traffic over a period of normal operation, such as a week. Establishing a baseline requires capturing traffic during a period of normal operation, typically over a week, to account for daily and weekly usage patterns. This baseline represents the typical volume, protocol mix, and flow characteristics, enabling the analyst to later detect deviations that may indicate security incidents. Using a representative sample from normal conditions is the foundational step in anomaly-based monitoring.

Answer

Capture traffic during a known attack to identify anomalies

Answer

Use only firewall logs as they are the most reliable

Answer

Average traffic from multiple different organizations

Question 13

An analyst is reviewing DNS logs and sees a high volume of NXDOMAIN responses for a specific domain. Which TWO scenarios could this indicate?

Accepted Answer

DNS amplification attack. High NXDOMAIN responses may indicate a DNS amplification attack (using resolvers to amplify traffic) or fast-flux DNS (rapidly changing IPs for malicious domains).

Answer

DNS tunneling

Answer

Legitimate website misconfiguration

Answer

Normal DNS caching behavior

Question 14

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

Accepted Answer

Execution of commands with sudo. Privilege escalation often involves account creation with elevated rights, changes to user privileges, and successful use of 'sudo' commands.

Answer

Multiple failed login attempts

Answer

Successful SSH login from a remote IP

Question 15

An analyst is tuning Snort IDS rules and wants to reduce false positives. Which TWO rule options can be adjusted to decrease sensitivity?

Accepted Answer

Add a 'suppress' rule to ignore traffic from known benign IPs. Setting a higher threshold (e.g., detection_filter) reduces alerts for low-frequency events. Enabling 'suppress' can ignore specific sources or destinations that generate false positives.

Answer

Change the rule action from 'alert' to 'drop'

Answer

Change protocol from TCP to UDP

Answer

Increase the rule priority from low to high