200-201 Security Monitoring Practice Test 3 — 15 Questions

Question 1

A security analyst is monitoring network traffic and notices a high volume of TCP SYN packets sent to various ports on a single host. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan uses TCP SYN packets to probe for open ports on a target host. Excessive SYN packets to multiple ports indicate a port scan.

Answer

DNS amplification

Answer

Smurf attack

Answer

ARP spoofing

Question 2

A SIEM correlation rule triggers an alert when more than 10 failed login attempts from the same source IP occur within 60 seconds. Which attack is this rule designed to detect?

Accepted Answer

Brute force attack. This SIEM rule detects a brute force attack by correlating a high volume of failed login attempts (more than 10) from the same source IP within a short time window (60 seconds). Brute force attacks rely on rapid, repeated authentication attempts to guess credentials, and this threshold-based correlation is a classic detection method for such behavior.

Answer

Phishing attack

Answer

Man-in-the-middle

Answer

SQL injection

Question 3

An analyst captures traffic and sees a high number of DNS queries for random subdomains under a single domain, all returning NXDOMAIN. This pattern is typical of which malicious activity?

Accepted Answer

Domain generation algorithm (DGA) activity. D is correct because a high volume of DNS queries for random subdomains under a single domain, all returning NXDOMAIN, is a classic indicator of Domain Generation Algorithm (DGA) activity. Malware uses DGA to generate thousands of pseudo-random domain names to contact a command-and-control (C2) server; the NXDOMAIN responses indicate that the generated domains are not yet registered or have been sinkholed.

Answer

DNS cache poisoning

Answer

DNS amplification attack

Answer

DNS tunneling

Question 4

Which protocol and port pair is commonly used for secure web traffic?

Accepted Answer

HTTPS 443. HTTPS (HTTP Secure) uses port 443 for encrypted web traffic.

Answer

FTP 21

Answer

HTTP 80

Answer

SSH 22

Question 5

In Wireshark, a security analyst wants to display only packets with source IP 10.0.0.1 and destination port 80. Which display filter should be used?

Accepted Answer

ip.src == 10.0.0.1 and tcp.dstport == 80. It uses the standard display filter syntax with the `==` operator and correct field names (`ip.src` and `tcp.dstport`). Option B uses `eq`, which is a valid operator in Wireshark display filters, but the Cisco CyberOps curriculum expects the `==` operator for consistency. Therefore, option B is considered incorrect in this context. Options C and D use capture filter syntax, which is not appropriate for the Wireshark display filter bar.

Answer

ip.src eq 10.0.0.1 and tcp.dstport eq 80

Answer

src 10.0.0.1 and dst port 80

Answer

host 10.0.0.1 && port 80

Question 6

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

Accepted Answer

The internal host attempted to access a secure web server but was blocked.. The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.

Answer

The connection was successfully encrypted.

Answer

The firewall allowed the connection.

Answer

The external host attempted to access the internal host.

Question 7

A Zeek connection log shows a high number of connections from a single internal IP to many different external IPs on port 25, with small payload sizes. Which behavior is most likely indicated?

Accepted Answer

Spam email campaign or SMTP scanning. Port 25 is the default SMTP port used for email transmission. A high volume of connections from a single internal IP to many different external IPs on port 25, with small payload sizes, is characteristic of a spam email campaign or SMTP scanning. This pattern suggests the host is either sending bulk spam emails or probing external mail servers for open relay or user enumeration.

Answer

DNS tunneling

Answer

Secure web browsing

Answer

Data exfiltration using FTP

Question 8

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing decisions that determine the best path for data packets across interconnected networks. Protocols such as OSPF, BGP, and ICMP operate at this layer to manage routing tables and forward packets between different subnets or autonomous systems.

Answer

Application layer

Answer

Data link layer

Answer

Transport layer

Question 9

An analyst sees a Snort alert with the message 'ET POLICY Outbound connection to known malicious IP'. What does this indicate?

Accepted Answer

An internal host is connecting to an IP that is on a threat intelligence blacklist.. Snort signature-based IDS alerts on matching rules. This alert indicates a connection from an internal host to a known malicious IP address, likely a command-and-control server.

Answer

A malicious IP is connecting to an internal host.

Answer

The firewall blocked the connection.

Answer

The connection is encrypted and safe.

Question 10

Which log source would provide the most detailed information about HTTP requests, including URLs and user agents?

Accepted Answer

Web server logs. Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

Answer

DNS logs

Answer

Firewall logs

Answer

System logs

Question 11

A NetFlow report shows that host 10.0.0.5 has sent 1 GB of data to external IP 198.51.100.10 over port 443 in the last hour, while other hosts average 100 MB. This anomaly is most indicative of:

Accepted Answer

Data exfiltration. The sudden, disproportionate egress of 1 GB of data from a single host to an external IP over port 443 (HTTPS) is a classic indicator of data exfiltration. While HTTPS traffic is common, the volume anomaly—10x the average of other hosts—suggests unauthorized copying of sensitive data, as attackers often use encrypted channels to blend in with normal traffic.

Answer

Port scan activity

Answer

Normal video streaming

Answer

DNS amplification attack

Question 12

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An IoC is any artifact observed on a network or system that indicates a potential intrusion. File hashes (MD5/SHA-256) are commonly used IoCs.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name

Question 13

A security analyst is reviewing logs to identify a potential brute force attack. Which TWO log entries would be most suspicious? (Choose TWO.)

Accepted Answer

Successful login from IP 10.0.0.9 after 50 failed attempts.. A successful login immediately following 50 failed attempts from the same IP is a classic indicator of a brute force attack that eventually succeeded. This pattern shows an attacker systematically trying credentials until one works, which is a high-severity security event requiring immediate investigation.

Answer

A single successful login from a known IP during business hours.

Answer

A failed login attempt from an external IP at 3:00 AM.

Answer

A user changing their password after a successful login.

Question 14

During packet analysis in Wireshark, which THREE findings are indicators of potential malicious activity? (Choose THREE.)

Accepted Answer

An unusually large ICMP echo request packet (e.g., 65,000 bytes).. An unusually large ICMP echo request packet, such as 65,000 bytes, exceeds the maximum allowed size for a standard ICMP packet (typically 65,535 bytes total including headers, but the data payload should not exceed 65,527 bytes). This oversized packet is a classic indicator of a 'Ping of Death' attack, where the attacker sends a malformed packet that causes a buffer overflow on the target system, leading to a crash or remote code execution. In Wireshark, such an anomaly stands out against normal ICMP traffic, which usually has a small payload (e.g., 32 or 56 bytes).

Answer

An HTTPS connection to a well-known website.

Answer

A normal DNS query for a common domain.

Question 15

A security analyst is tuning a SIEM to detect lateral movement. Which THREE log sources would provide the most useful data for this purpose? (Choose THREE.)

Accepted Answer

Windows Event Logs showing network connections and process creation.. Lateral movement often involves internal network connections, authentication events, and endpoint logs. Firewall logs show internal connections, system logs show authentication, and Windows Event Logs track process creation and network connections.

Answer

Web server logs for external requests.

Answer

DNS logs for external domain queries.