200-201 Security Monitoring Practice Test 4 — 15 Questions

Question 1

A SOC analyst is investigating a potential security incident and needs to determine if a host is beaconing to a command-and-control server. Which two data sources would provide the most direct evidence of beaconing behavior? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NetFlow records showing periodic connections to the same external IP with similar byte counts. Proxy logs and NetFlow records both capture outbound network connections with timestamps and destination information. Regular intervals to the same external IP, especially with consistent byte counts, are direct indicators of beaconing. These data sources are not encrypted and provide the pattern needed to confirm command-and-control communication. Other logs may support the investigation but do not directly show the beaconing behavior.

Answer

Endpoint process logs showing a single process making repeated network connections

Answer

DNS query logs showing a high volume of NXDOMAIN responses

Answer

Windows Security event logs showing successful user logons

Question 2

An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?

Accepted Answer

SYN flood attack. A large volume of TCP SYN packets to a single host across various ports with no SYN-ACK replies is the classic signature of a SYN flood attack. The attacker sends many SYN packets (often with spoofed source IPs) to exhaust the target's half-open connection table, preventing legitimate connections from completing the TCP three-way handshake.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

ICMP flood attack

Question 3

A security engineer is setting up a Snort rule to detect FTP traffic where the source IP is not from the internal network. Which Snort rule header correctly specifies the action, protocol, source, and destination?

Accepted Answer

alert tcp !$HOME_NET any -> any 21. The rule header alert tcp !$HOME_NET any -> any 21 correctly specifies: action (alert), protocol (tcp), source (!$HOME_NET, i.e., NOT the internal network), source port (any), direction (->), destination (any), and destination port (21, FTP). The ! negation operator inverts the HOME_NET variable, so the rule fires only when the source is external — exactly what the engineer wants.

Answer

alert tcp $HOME_NET any -> any 21

Answer

alert tcp any any -> any 21

Answer

alert udp any any -> any 21

Question 4

An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?

Accepted Answer

An internal host attempted to establish an SMB connection to an external IP and was blocked.. The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.

Answer

A DNS query was made from an internal host to an external server.

Answer

An external host attempted to access an internal SMB server on port 445 and was blocked.

Answer

An internal host successfully connected to an external server on port 445.

Question 5

A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?

Accepted Answer

Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.. A brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

Answer

Alert when a single failed SSH login occurs.

Answer

Alert when successful SSH logins occur outside business hours.

Answer

Alert when multiple failed SSH logins from various IPs occur in one hour.

Question 6

A security analyst is reviewing Zeek connection logs and sees the following entry: '192.168.1.10:12345 > 10.0.0.1:80 (tcp) duration 0.001 sec, service http, bytes 60, state S0'. Based on the state 'S0', what does this indicate about the connection?

Accepted Answer

A SYN packet was sent but no reply was received.. In Zeek, S0 indicates that a SYN packet was sent but no SYN-ACK was received (connection attempt without completion). This could be part of a port scan or a half-open connection.

Answer

Data was transferred successfully and the connection closed normally.

Answer

The connection was established successfully.

Answer

The connection was reset by the remote host.

Question 7

An analyst receives an IDS alert with signature name 'ET TROJAN Win32.Zeus Checkin' and severity 'high'. The alert shows source IP 192.168.1.50 and destination IP 198.51.100.20 on port 443. Which action should the analyst take FIRST?

Accepted Answer

Isolate the source host from the network to prevent further communication.. The alert indicates a high-severity Zeus Trojan check-in, which is a known malware communicating with a command-and-control (C2) server. The first priority is to contain the threat by isolating the source host (192.168.1.50) to prevent further data exfiltration or lateral movement. Even though the traffic is encrypted over port 443 (HTTPS), the signature confirms malicious activity, so immediate isolation is the correct initial response per incident response best practices.

Answer

Check the host's web browsing history for suspicious websites.

Answer

Immediately block the destination IP on the firewall.

Answer

Ignore the alert because the traffic is encrypted over port 443.

Question 8

An analyst is reviewing a web server log and sees the following entry: '192.168.1.1 - - [25/Oct/2023:10:15:30 -0400] "GET /admin/index.php?cmd=id HTTP/1.1" 200 1532 "-" "Mozilla/5.0"'. What potential attack does this log entry suggest?

Accepted Answer

Command injection. The presence of 'cmd=id' in the URL suggests an attempt to execute the 'id' command via a web shell or command injection vulnerability. The response code 200 indicates success, which is concerning.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 9

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

Accepted Answer

Create a suppression rule to ignore the specific source IP or application.. A suppression rule is the correct tuning action because it preserves the signature's detection capability for all other traffic while filtering out the known-good source IP or application that generates the false positives. This is the standard IDS/IPS tuning practice: narrow the exception rather than removing the detection entirely. It maintains visibility into genuine attacks using the same signature from other sources.

Answer

Disable the signature entirely.

Answer

Increase the severity of the signature to get more attention.

Answer

Change the signature action to 'alert' instead of 'drop'.

Question 10

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following are common indicators that data exfiltration may be occurring over DNS? (Choose two.)

Accepted Answer

High volume of DNS queries to a single domain not normally visited. Option C is correct because DNS tunneling and exfiltration tools typically generate a high volume of queries to a single attacker-controlled domain that is not normally seen in the environment, as the malware encodes stolen data into the query names and needs many requests to move the data out. Option D is correct because DNS TXT records can carry arbitrary payloads, so unusually large TXT responses are a classic sign of data being returned or acknowledged over DNS, often used by tunneling utilities like iodine or dnscat2. Options A, B, and E are not valid indicators: multiple IP addresses in a response is normal for load balancing or round-robin DNS, AAAA queries from an IPv4-only network are common on dual-stack clients and OS resolvers, and high TTL values simply reflect caching policy and have no direct relationship to exfiltration.

Answer

DNS responses with a large number of IP addresses

Answer

DNS queries for AAAA records (IPv6) from an IPv4-only network

Answer

DNS query responses with high TTL values

Question 11

Which TWO of the following are examples of Indicators of Compromise (IoCs) used in network security monitoring? (Choose two.)

Accepted Answer

MD5 hash of a malicious executable. Option A is correct because an MD5 hash of a malicious executable is a classic host-based/file-based IoC: the cryptographic digest uniquely identifies known malware and can be matched against threat-intelligence feeds or SIEM/file-integrity rules. Option B is correct because IP addresses of known command-and-control (C2) servers are network-based IoCs that can be detected via firewall logs, IDS/IPS signatures, or NetFlow analysis of outbound connections. Option C is not an IoC, since the time of day is merely contextual metadata and not an artifact indicating compromise. Option D is not an IoC, as a company's stock price has no bearing on security telemetry. Option E is not an IoC, because employee headcount is an organizational metric, not evidence of malicious activity.

Answer

The current time of day

Answer

The company's stock price

Answer

The number of employees in the company

Question 12

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

Accepted Answer

SMB. Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Answer

HTTPS

Answer

DNS

Answer

HTTP

Question 13

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location

Question 14

An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?

Accepted Answer

Display filter. A Wireshark display filter is applied after capture to narrow what is shown from already-captured packets, and it supports string matching operators like contains. The filter frame contains "password" (or tcp contains "password") is a display filter that shows only packets whose payload includes that string. Capture filters use BPF syntax and cannot perform arbitrary string matching on payload content.

Answer

Protocol filter

Answer

Capture filter

Answer

BPF filter

Question 15

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service