200-201 Security Monitoring Practice Test 4 — 15 Questions

Question 1

Which OSI layer is associated with protocols such as HTTP, FTP, and SMTP, and is commonly targeted by application-layer attacks?

Accepted Answer

Layer 7 - Application. HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.

Answer

Layer 2 - Data Link

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Question 2

A security analyst needs to filter packets in Wireshark to capture only traffic on port 443. Which filter should be used?

Accepted Answer

tcp port 443. When capturing packets in Wireshark, a capture filter must be used. Capture filters use Berkeley Packet Filter (BPF) syntax. The filter 'tcp port 443' is the correct BPF syntax to capture only TCP traffic on port 443 (HTTPS). Option A uses Wireshark's display filter syntax, which is not used for capturing. Options B and C are also capture filters but B captures only destination port 443, and C captures both TCP and UDP on port 443, which is less specific.

Answer

tcp.port == 443

Answer

dst port 443

Answer

port 443

Question 3

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

Accepted Answer

SSH brute force. Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Answer

HTTP flood

Answer

SMB exploit

Answer

DNS amplification

Question 4

An analyst suspects data exfiltration via DNS. Which log type would provide the most relevant information to confirm this?

Accepted Answer

DNS logs. DNS logs capture all DNS queries and responses, including the domain names being resolved. Data exfiltration via DNS often involves encoding stolen data into DNS queries (e.g., subdomains of a controlled domain). By examining DNS logs for unusual query patterns, high query volumes, or long, random-looking subdomains, an analyst can directly confirm exfiltration activity.

Answer

Web server logs

Answer

Firewall logs

Answer

IDS/IPS alerts

Question 5

A security analyst observes a NetFlow record showing a single internal IP communicating with many external IPs on port 445 within seconds. This pattern is indicative of:

Accepted Answer

SMB scanning. Port 445 is used by SMB; a rapid series of connections to many IPs suggests a scan for vulnerable SMB services.

Answer

DNS tunneling

Answer

Data exfiltration

Answer

Port scan

Question 6

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 7

Which port is used by RDP (Remote Desktop Protocol) and is a common target for brute force attacks?

Accepted Answer

3389. RDP uses TCP port 3389 and is frequently targeted by attackers attempting to gain remote access.

Answer

443

Answer

22

Answer

1433

Question 8

A SIEM correlation rule triggers when more than 10 failed login attempts from a single source IP occur within 1 minute. This rule is designed to detect:

Accepted Answer

Brute force attack. A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

Answer

Privilege escalation

Answer

Malware infection

Answer

DDoS attack

Question 9

An analyst finds a YARA rule that matches a file containing the string 'MZ' at offset 0 and includes 'CreateRemoteThread'. This rule likely identifies:

Accepted Answer

A malicious executable. 'MZ' indicates a PE (Portable Executable) file, and 'CreateRemoteThread' is a common API used for process injection, suggesting malware.

Answer

A benign PDF

Answer

A network packet capture

Answer

A Linux ELF binary

Question 10

In Snort, a rule is written as: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:to_server; content:"|ff|SMB"; nocase;). What does the 'flow:to_server' option indicate?

Accepted Answer

Apply to traffic from client to server. In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.

Answer

Apply to bidirectional traffic

Answer

Apply only to traffic from server to client

Answer

Ignore the direction of traffic

Question 11

Which protocol and port combination is used by SNMP for receiving traps?

Accepted Answer

UDP 162. SNMP traps are unsolicited notifications sent from an SNMP agent to the network management system (NMS) to alert it of significant events. The correct protocol and port combination for receiving SNMP traps is UDP port 162, as defined in RFC 1157. UDP is used because traps are lightweight, connectionless messages where reliability is handled by the application layer if needed.

Answer

TCP 161

Answer

UDP 161

Answer

TCP 162

Question 12

An analyst uses 'tshark -r capture.pcap -Y "http.request.method == POST"' to display only HTTP POST requests. This is an example of a:

Accepted Answer

Display filter. The `-Y` flag in tshark applies a display filter, which operates on packets already read from the capture file. Display filters use a syntax based on protocol fields (e.g., `http.request.method == POST`) to show or hide packets in the output without altering the underlying capture data. This is distinct from capture filters, which discard packets at the kernel level before they are stored.

Answer

Statistical filter

Answer

Read filter

Answer

Capture filter

Question 13

A security analyst is reviewing web server logs and notices a high number of 404 errors for non-existent URLs. Which TWO of the following tools would best help investigate this anomaly?

Accepted Answer

Wireshark for packet-level analysis. Using SIEM for correlation and Wireshark for packet analysis on the server's traffic can help identify the source and nature of the requests.

Answer

Snort for IDS alerts

Answer

YARA for file scanning

Answer

NetFlow for top talkers

Question 14

An analyst detects an internal host communicating with an external IP known for malware distribution. Which THREE of the following are valid Indicators of Compromise (IoCs) that should be recorded?

Accepted Answer

Domain name used in the communication. The domain name used in the communication is a classic Indicator of Compromise (IoC). When an internal host contacts an external IP known for malware distribution, the domain name (e.g., via DNS query) provides a persistent, human-readable identifier that can be used to block or investigate the threat, even if the IP address changes. This aligns with the NIST definition of IoCs as forensic evidence of a potential intrusion.

Answer

Email address of the user

Answer

Registry key from the endpoint

Question 15

Which TWO of the following are functions of a SIEM system in security monitoring?

Accepted Answer

Correlation rule engine. SIEM aggregates logs from various sources and applies correlation rules to detect threats. Packet capture and port scanning are not core SIEM functions.

Answer

Packet capture and analysis

Answer

Firewall rule management

Answer

Vulnerability scanning