200-201 Security Monitoring Practice Test 5 — 15 Questions

Question 1

A security analyst is monitoring network traffic and notices a large number of TCP SYN packets being sent to a single host on various ports. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves sending packets to multiple ports on a target to discover open ports. The description matches a TCP SYN scan.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 2

A network analyst notices that a host is sending a large volume of traffic to an external IP address on port 443 during non-business hours. The traffic volume is significantly higher than the established baseline. Which type of data exfiltration technique should be suspected?

Accepted Answer

HTTPS exfiltration. Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

Answer

HTTP post

Answer

ICMP tunneling

Answer

DNS tunneling

Question 3

A security analyst is reviewing Snort IDS alerts and sees the following rule triggered: alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:'Possible SQL Injection'; content:'UNION'; nocase; sid:1000001;). Which action will Snort take when it detects matching traffic?

Accepted Answer

Generate an alert. The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).

Answer

Log the packet only

Answer

Drop the packet

Answer

Reject the connection

Question 4

A SOC analyst is investigating a web server log and sees the following entry: 192.168.1.10 - - [15/May/2023:10:15:30 +0000] 'POST /login.php HTTP/1.1' 200 1245 'http://example.com/login.php' 'Mozilla/5.0'. Which observation is most suspicious?

Accepted Answer

The response code 200 indicates successful login. The log entry shows a successful HTTP 200 response to a POST request to a login page. While a single 200 is normal, it is the most suspicious observation among the options because it indicates a successful login, which could be part of a brute force or credential stuffing attack if many attempts preceded it. The correct answer is A.

Answer

The source IP is internal

Answer

The user-agent is generic

Answer

The POST method is used for login

Question 5

Which protocol and port combination is commonly used for secure remote administration of network devices?

Accepted Answer

SSH on port 22. SSH (Secure Shell) on port 22 is the correct answer because it provides encrypted, authenticated remote administration of network devices, replacing insecure protocols like Telnet. SSH uses public-key cryptography to establish a secure channel over an unsecured network, ensuring confidentiality and integrity of management traffic. This is the standard for secure CLI-based device management in enterprise environments.

Answer

Telnet on port 23

Answer

RDP on port 3389

Answer

HTTP on port 80

Question 6

A security analyst is using Wireshark to capture traffic from a network segment. They want to see only packets that contain the string 'password' in the payload. Which type of filter should they apply?

Accepted Answer

Display filter using 'frame contains "password"'. Display filters are applied after capture to filter packets based on criteria. A capture filter would limit packets captured, but the question implies after capture. The analyst wants to display only packets with 'password' in payload, which is a display filter.

Answer

Display filter using 'tcp.port == 80'

Answer

Capture filter using 'port 80'

Answer

Capture filter using 'tcp contains password'

Question 7

A SIEM correlation rule is configured to alert when there are 10 failed login attempts from the same source IP within 1 minute. An analyst receives an alert for source IP 10.0.0.5. Which type of attack is most likely being detected?

Accepted Answer

Brute force attack. Multiple failed logins from the same source IP in a short time indicates a brute force attack.

Answer

Man-in-the-middle attack

Answer

DDoS attack

Answer

SQL injection attempt

Question 8

An organization uses Zeek for network monitoring. An analyst wants to extract files transferred over HTTP from network traffic. Which Zeek script or functionality should they use?

Accepted Answer

Zeek's file extraction script. Zeek's file analysis framework can extract files from protocols like HTTP. The script 'file_extraction.zeek' or 'http_file_extraction.zeek' is used. However, the question likely expects 'Zeek's file extraction capability' or similar. Among options: 'HTTP::extract_files' is a Zeek event or script. The correct answer is that Zeek can extract files via its file analysis framework, and the specific script is often 'http_file_extraction.zeek'.

Answer

Zeek's connection log

Answer

Zeek's HTTP log

Answer

Zeek's DNS log

Question 9

Which of the following is an example of an Indicator of Compromise (IoC)?

Accepted Answer

A file hash (SHA-256). An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Answer

A SIEM dashboard

Answer

A firewall rule

Answer

A network baseline

Question 10

A network administrator is creating a baseline for normal traffic patterns. Which of the following should be considered typical for a web server during business hours?

Accepted Answer

High volume of TCP SYN packets to port 443. A web server typically receives HTTP/HTTPS traffic on ports 80/443. High volumes of SYN packets to port 443 are normal for web traffic.

Answer

High volume of DNS queries to external domains

Answer

High volume of SSH connections on port 22

Answer

High volume of ICMP echo requests

Question 11

A SOC analyst is reviewing a NetFlow record and sees that a single internal IP has communicated with multiple external IPs on port 445 (SMB) within a short time frame. Which type of activity is most likely indicated?

Accepted Answer

SMB scanning or worm propagation. Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.

Answer

Normal file sharing activity

Answer

Data exfiltration over SMB

Answer

DNS tunneling

Question 12

Which component of a SIEM is responsible for converting log data from various sources into a standard format?

Accepted Answer

Normalization. Normalization is the SIEM component that parses incoming log data from diverse sources (e.g., syslog, Windows Event Log, NetFlow) and maps the fields into a common, standardized schema. This process ensures that fields like source IP, destination IP, and timestamp are consistently named and formatted, enabling effective correlation and analysis across heterogeneous devices.

Answer

Aggregation

Answer

Alerting

Answer

Correlation

Question 13

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following network behaviors are indicators of data exfiltration?

Accepted Answer

Frequent DNS queries to a known malicious domain. Data exfiltration often involves large outbound transfers (volume anomaly) and communication with known malicious IPs. DNS tunneling can also be used, but it's not the only indicator. The two best are unusual large outbound traffic and connections to known malicious IPs.

Answer

A high number of ICMP echo requests

Answer

A single host scanning multiple internal IPs

Answer

Multiple successful login attempts from a single IP

Question 14

A SOC analyst is analyzing logs from multiple sources. Which THREE log types are most useful for detecting a brute force attack against a web application?

Accepted Answer

System authentication logs. System authentication logs (B) are critical because they record every login attempt, including failed ones, which directly reveals the repeated authentication failures characteristic of a brute force attack. Web server logs (C) capture HTTP request details such as source IP, URI, and response codes (e.g., 401 Unauthorized or 403 Forbidden), allowing an analyst to correlate many failed login requests from a single source. Firewall logs (E) show allowed and denied connections, enabling detection of high volumes of inbound traffic to the web application's port (e.g., TCP 443 or 80) from a specific IP, which is a common brute force pattern.

Answer

DNS logs

Answer

IDS/IPS alerts

Question 15

A network analyst is creating a baseline for normal network traffic. Which TWO metrics should be included to establish a baseline?

Accepted Answer

Average bandwidth usage over time. Baselines include average bandwidth usage and typical protocol distribution. Peak traffic times and unusual payload sizes are anomalies, not baseline metrics.

Answer

Excessive connection attempts from a single IP

Answer

Peak traffic times

Answer

Unusual payload sizes