200-201 Security Monitoring Practice Test 3 — 15 Questions

Question 1

A SOC analyst is reviewing a Cisco Firepower Management Center (FMC) intrusion event that shows an exploit attempt against a web server. The analyst wants to understand the vulnerability being targeted and whether a patch is available. Which field in the FMC event details provides this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Vulnerability' field that includes CVE ID and patch availability.. The Vulnerability field in Cisco FMC intrusion events provides the CVE identifier and patch availability, directly answering the analyst's need to understand the targeted vulnerability and remediation. Other fields like Rule, Impact, and Packet Data offer detection logic, severity, or raw data but do not supply patch information. This field is specifically designed to bridge detection with vulnerability management.

Answer

The 'Packet Data' section that shows the raw packet bytes.

Answer

The 'Rule' field that shows the Snort rule SID and message.

Answer

The 'Impact' field that indicates the severity of the event.

Question 2

An analyst is examining a PCAP in Wireshark and sees a TCP stream where the client sends a single packet with the PSH, ACK flags set and a payload containing a long base64 string, followed immediately by the server responding with an RST. Repeated streams show the same pattern to the same destination IP on port 443. Which conclusion is most defensible?

Accepted Answer

The client is attempting to send data to a service that is not listening or is rejecting the connection. An immediate RST from the server after a single payload-bearing packet means the destination is refusing the connection, typically because no service is listening on that port. The repeated pattern to the same endpoint suggests a client repeatedly attempting to reach an unavailable service, which is the most defensible conclusion from the capture.

Answer

The client is performing a port scan using TCP SYN packets

Answer

The traffic represents a successful TLS session with certificate pinning enabled

Answer

The server is under a denial-of-service attack from the client

Question 3

A security analyst is examining a packet capture of suspicious network traffic. The analyst observes the following: multiple TCP connections to various ports on a single external IP address from different source ports on the internal network, each connection lasting less than one second, and no data transfer after the TCP handshake. Which TWO of the following activities does this pattern MOST likely indicate? (Choose two.)

Accepted Answer

Port sweep. The pattern of multiple short-lived TCP connections to various ports on a single external IP address, with no data transfer, is classic for port scanning, specifically a port sweep or SYN scan. These activities are used for reconnaissance to identify open ports and services. Data exfiltration, DoS, and beaconing have different traffic characteristics, such as data transfer, high volume, or periodic intervals, which are not observed here.

Answer

Data exfiltration

Answer

Malware beaconing

Answer

Denial of service attack

Question 4

A SOC analyst is reviewing Cisco Firepower syslog events and notices a large number of connections from a single internal host to many different external IP addresses on port 443, with very small data transfers. Which type of malicious activity does this pattern most likely represent?

Accepted Answer

A botnet command-and-control beaconing pattern. The scenario describes a single internal host making numerous connections to many external IP addresses on port 443 with minimal data transfer. This matches the behavior of malware beaconing to command-and-control servers, often using HTTPS to blend in. DDoS would target fewer hosts with high volume, P2P would involve larger transfers, and a proxy would serve many internal clients. The correct answer is the botnet C2 beaconing pattern.

Answer

A peer-to-peer file-sharing application downloading large files

Answer

A web proxy server caching content for internal users

Answer

A distributed denial-of-service (DDoS) attack originating from the internal host

Question 5

A security analyst is examining a suspicious file and wants to determine if it is malicious. The analyst runs the file in a sandbox and observes that it creates a new service, modifies the registry to enable automatic startup, and attempts to connect to an external IP address on port 443. Which type of malware behavior is most consistent with these observations?

Accepted Answer

Backdoor. The observed behaviors—creating a service, modifying the registry for automatic startup, and connecting to an external IP—are hallmarks of a backdoor or RAT. These actions ensure the malware persists across reboots and maintains communication with a command-and-control server. Ransomware, worms, and adware have different primary objectives and would not typically exhibit this exact combination.

Answer

Ransomware

Answer

Adware

Answer

Worm

Question 6

A SOC analyst is reviewing DNS logs from the past 24 hours and notices a single internal host, 10.10.20.45, has made thousands of DNS queries for randomly generated subdomains such as a8f3k2.example.com, 9dj2m4.example.com, and q7x1z9.example.com. Each subdomain resolves to the same external IP address and the queries occur at a steady rate of one every few seconds. Which type of malicious activity is most likely indicated by this pattern?

Accepted Answer

Domain generation algorithm (DGA) beaconing. The combination of thousands of randomly generated subdomains, a steady query interval, and a single repeated destination IP is the signature of DGA-based command-and-control beaconing. Malware cycles through algorithmically generated names until one resolves, then maintains contact. Recognizing this in DNS logs enables rapid identification of the infected internal host and blocking of the C2 address.

Answer

DNS cache poisoning attack

Answer

Fast flux DNS hosting

Answer

DNS tunneling for data exfiltration

Question 7

A security analyst is examining a packet capture in Wireshark and notices several TCP streams that contain HTTP requests with unusually long User-Agent strings, base64-encoded data in cookies, and periodic connections to a domain that resolves to a dynamic DNS provider. Which TWO findings are most indicative of command-and-control (C2) communication? (Choose two.)

Accepted Answer

Periodic connections to a domain hosted on a dynamic DNS provider.. Base64-encoded data in cookies and periodic connections to dynamic DNS domains are strong indicators of C2 communication. Attackers use encoding to hide commands and dynamic DNS to maintain resilient infrastructure. These findings, when observed together, suggest malware beaconing and data exchange with a controller, warranting immediate investigation.

Answer

Multiple TCP streams to different external IP addresses on port 80.

Answer

Use of HTTP instead of HTTPS for web traffic.

Answer

Unusually long User-Agent strings.

Question 8

A security analyst is examining a suspicious executable found on a user's workstation. The file has a valid digital signature from a trusted vendor, but the analyst suspects it may be malicious. Which TWO characteristics would most strongly indicate that the file is likely malicious despite the valid signature? (Choose two.)

Accepted Answer

The file's hash matches a known malware sample in a threat intelligence feed. A valid digital signature does not guarantee safety. Attackers can abuse stolen certificates, or a legitimate signed binary can be trojanized. A hash match to known malware in a threat intelligence feed is a definitive indicator. A revoked certificate means the signing certificate is no longer trusted, often due to compromise. High entropy, scheduled tasks, and C2 connections are suspicious but can also be benign, so they are less definitive than the two selected characteristics.

Answer

The file attempts to connect to a known command-and-control server

Answer

The file creates a scheduled task to run at system startup

Answer

The file has a high entropy score, suggesting it is packed or encrypted

Question 9

A security analyst is investigating a potential insider threat. The analyst has access to various logs and wants to identify evidence of data exfiltration. Which TWO log sources would be most useful to correlate for detecting large-scale data transfers to an external destination? (Choose two.)

Accepted Answer

NetFlow records. Proxy logs and NetFlow records are the most useful for detecting large-scale data exfiltration. Proxy logs capture outbound web traffic with byte counts and URLs, while NetFlow records provide flow-level metadata with byte counts. Correlating these sources can reveal unusual large transfers to external destinations, which is critical for identifying insider threats.

Answer

DNS logs

Answer

Firewall logs

Answer

Authentication logs

Question 10

A junior analyst is reviewing Cisco Umbrella logs and sees a request from an internal host to 'malware-c2.example.com'. The domain is categorized as 'Malicious' by Umbrella. The analyst wants to quickly determine if other hosts on the network have attempted to resolve this domain. Which action should the analyst take?

Accepted Answer

Search the Umbrella Investigate console for the domain to see related requests and historical data.. Cisco Umbrella Investigate allows analysts to search for a domain and view all requests made to it across the organization, including which hosts queried it. This is the fastest way to scope the incident and identify other potentially compromised systems. Other methods are either limited in scope or technically ineffective for this purpose.

Answer

Check the firewall logs for any connections to the IP address associated with the domain.

Answer

Use Nmap to scan the network for hosts that have the domain in their DNS cache.

Answer

Run a packet capture on the internal host to look for DNS queries to the domain.

Question 11

A SOC analyst observes a sudden spike in DNS queries from a single internal host to random-looking subdomains under the same parent domain, each resolving to a different IP address. Which technique is most likely being used?

Accepted Answer

Fast flux DNS. The scenario describes a host resolving many random subdomains under one parent domain, each returning a different IP. This is characteristic of fast flux, where attackers rotate IP addresses across many compromised nodes to keep malicious infrastructure available and evade blocklists. The other techniques produce different DNS signatures, so fast flux is the best fit for the observed pattern.

Answer

Domain generation algorithm

Answer

DNS tunneling

Answer

DNS cache poisoning

Question 12

A security analyst is reviewing a packet capture in Wireshark and notices a series of TCP packets with the RST flag set, originating from various source IPs and targeting a single internal server on port 80. The server is not responding to any of these packets. What is the most likely explanation for this traffic pattern?

Accepted Answer

A port scan is being conducted using RST packets.. The traffic pattern of RST packets from multiple sources to a single server on port 80, with no response from the server, suggests a scanning technique or a spoofed RST attack. Attackers may send RST packets to disrupt connections or as part of reconnaissance. The server's silence could indicate it is filtering or ignoring the packets. This pattern is not typical of a SYN flood or simple DoS.

Answer

A SYN flood attack is in progress.

Answer

The server is experiencing a denial-of-service attack from a botnet.

Answer

The server is misconfigured and sending RST packets to all incoming connections.

Question 13

A SOC analyst is examining a security alert from Cisco AMP for Endpoints. The alert indicates that a file named 'invoice.pdf.exe' was executed on a user's workstation. The file was downloaded from an email attachment. The analyst observes that the file created a scheduled task named 'Updater' and established a connection to an external IP on port 443. Which of the following best describes the next step in the incident response process?

Accepted Answer

Document the findings and escalate to the incident response team for containment and eradication.. The analyst has already performed initial analysis and identified clear indicators of compromise: a malicious executable, persistence via scheduled task, and C2 communication. The next step in the incident response process is to escalate to the incident response team for containment and eradication. This ensures that proper procedures are followed and evidence is preserved.

Answer

Run a full antivirus scan on the workstation to remove any additional malware.

Answer

Immediately isolate the workstation from the network and begin forensic analysis.

Answer

Delete the scheduled task and quarantine the file, then continue monitoring.

Question 14

A junior analyst is asked to configure a Cisco Firepower access control policy to log all connections from the guest wireless VLAN to external destinations while still allowing them. Which action setting accomplishes this with the least disruption to guest users?

Accepted Answer

Allow. The access control rule must permit the guest traffic while producing connection logs. An Allow action with logging enabled achieves both, keeping guest users online and generating the connection events needed for monitoring. Block with reset disrupts users, Trust skips logging, and Monitor belongs to intrusion policy rather than access control rule actions.

Answer

Block with reset

Answer

Trust

Answer

Monitor

Question 15

A SOC analyst is reviewing Cisco Firepower intrusion events and sees an alert for a TCP session where the client sent a single packet with the PSH, ACK, and FIN flags set, followed by no further packets. The destination port is 443, and the payload contains a valid TLS ClientHello. Which explanation best describes this traffic?

Accepted Answer

A TLS handshake attempt where the client closed the connection immediately after sending ClientHello. The packet contains a valid TLS ClientHello and uses PSH, ACK, and FIN together, indicating the client sent application data and then closed the connection in the same segment. This is not a scan or flood but an aborted TLS handshake. Firepower may alert on the unusual flag combination, but the payload confirms it is a TLS attempt that was terminated early.

Answer

A malformed packet caused by a broken TCP stack

Answer

A TCP FIN scan used to enumerate open ports

Answer

A TCP SYN flood attack targeting the web server