200-201 Security Monitoring Practice Test 6 — 15 Questions

Question 1

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing decisions that determine the best path for data packets across interconnected networks. Protocols such as OSPF, BGP, and ICMP operate at this layer to manage routing tables and forward packets between different subnets or autonomous systems.

Answer

Application layer

Answer

Data link layer

Answer

Transport layer

Question 2

An analyst sees a Snort alert with the message 'ET POLICY Outbound connection to known malicious IP'. What does this indicate?

Accepted Answer

An internal host is connecting to an IP that is on a threat intelligence blacklist.. Snort signature-based IDS alerts on matching rules. This alert indicates a connection from an internal host to a known malicious IP address, likely a command-and-control server.

Answer

A malicious IP is connecting to an internal host.

Answer

The firewall blocked the connection.

Answer

The connection is encrypted and safe.

Question 3

Which log source would provide the most detailed information about HTTP requests, including URLs and user agents?

Accepted Answer

Web server logs. Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

Answer

DNS logs

Answer

Firewall logs

Answer

System logs

Question 4

A NetFlow report shows that host 10.0.0.5 has sent 1 GB of data to external IP 198.51.100.10 over port 443 in the last hour, while other hosts average 100 MB. This anomaly is most indicative of:

Accepted Answer

Data exfiltration. The sudden, disproportionate egress of 1 GB of data from a single host to an external IP over port 443 (HTTPS) is a classic indicator of data exfiltration. While HTTPS traffic is common, the volume anomaly—10x the average of other hosts—suggests unauthorized copying of sensitive data, as attackers often use encrypted channels to blend in with normal traffic.

Answer

Port scan activity

Answer

Normal video streaming

Answer

DNS amplification attack

Question 5

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An indicator of compromise is a forensic artifact that provides evidence a system or network has been breached. A file hash such as an MD5 (or SHA-1/SHA-256) uniquely identifies a malicious file and can be searched across endpoints and threat feeds, making it a canonical host-based IoC. Hashes, IP addresses, domain names, URLs, and registry keys are all standard IoC types used in detection and threat intelligence.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name

Question 6

A security analyst is reviewing logs to identify a potential brute force attack. Which TWO log entries would be most suspicious? (Choose TWO.)

Accepted Answer

Successful login from IP 10.0.0.9 after 50 failed attempts.. Option A is correct because a successful login immediately following 50 failed attempts from the same IP (10.0.0.9) indicates a probable successful brute force or password-guessing attack, where the attacker eventually guessed valid credentials. Option D is correct because 50 failed login attempts from a single IP (10.0.0.9) within only 2 minutes is a classic high-rate authentication failure pattern consistent with automated brute force tools. Option B is not suspicious because a single successful login from a known IP during business hours matches normal, expected user behavior. Option C is not suspicious on its own because a single failed login from an external IP at 3:00 AM could simply be a mistyped password or a legitimate off-hours attempt, lacking the volume or repetition of brute force. Option E is not suspicious because changing a password after a successful login is a routine, legitimate user action.

Answer

A single successful login from a known IP during business hours.

Answer

A failed login attempt from an external IP at 3:00 AM.

Answer

A user changing their password after a successful login.

Question 7

During packet analysis in Wireshark, which THREE findings are indicators of potential malicious activity? (Choose THREE.)

Accepted Answer

An unusually large ICMP echo request packet (e.g., 65,000 bytes).. Option B is correct because an ICMP echo request of roughly 65,000 bytes is abnormally large for a standard ping (normally 32–64 bytes of payload), indicating possible ICMP tunneling, data exfiltration, or a Ping of Death-style attack. Option C is correct because credentials transmitted in cleartext over HTTP can be captured by anyone sniffing the traffic, which is a clear sign of insecure and potentially malicious credential harvesting or a policy violation. Option E is correct because a flood of TCP SYN packets to multiple ports on a single host is the classic signature of a port scan (e.g., SYN scan), often a precursor to exploitation. Option A is not an indicator because HTTPS to a well-known website is normal, expected, encrypted traffic. Option D is not an indicator because a routine DNS query for a common domain is ordinary network behavior and not inherently suspicious.

Answer

An HTTPS connection to a well-known website.

Answer

A normal DNS query for a common domain.

Question 8

A security analyst is tuning a SIEM to detect lateral movement. Which THREE log sources would provide the most useful data for this purpose? (Choose THREE.)

Accepted Answer

Windows Event Logs showing network connections and process creation.. Option A is correct because Windows Event Logs such as Security Event ID 4688 (process creation) and Sysmon Event ID 3 (network connection) reveal suspicious process-to-network relationships that are hallmarks of lateral movement tools like PsExec or Cobalt Strike. Option D is correct because system logs capturing authentication events (e.g., Windows 4624/4625, Linux sshd and sudo entries) across multiple hosts expose pass-the-hash, credential reuse, and remote logon patterns central to lateral movement. Option E is correct because firewall logs showing internal-to-internal connections (east-west traffic) highlight anomalous host-to-host communication that would otherwise be invisible at the perimeter. Option B is not appropriate because web server logs for external requests focus on inbound client activity against a service, not host-to-host movement inside the network. Option C is not appropriate because DNS logs for external domain queries are more useful for command-and-control and exfiltration detection than for identifying lateral movement between internal hosts.

Answer

Web server logs for external requests.

Answer

DNS logs for external domain queries.

Question 9

Which OSI layer is associated with protocols such as HTTP, FTP, and SMTP, and is commonly targeted by application-layer attacks?

Accepted Answer

Layer 7 - Application. HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.

Answer

Layer 2 - Data Link

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Question 10

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

Accepted Answer

SSH brute force. Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Answer

HTTP flood

Answer

SMB exploit

Answer

DNS amplification

Question 11

An analyst suspects data exfiltration via DNS. Which log type would provide the most relevant information to confirm this?

Accepted Answer

DNS logs. DNS logs capture all DNS queries and responses, including the domain names being resolved. Data exfiltration via DNS often involves encoding stolen data into DNS queries (e.g., subdomains of a controlled domain). By examining DNS logs for unusual query patterns, high query volumes, or long, random-looking subdomains, an analyst can directly confirm exfiltration activity.

Answer

Web server logs

Answer

Firewall logs

Answer

IDS/IPS alerts

Question 12

A security analyst observes a NetFlow record showing a single internal IP communicating with many external IPs on port 445 within seconds. This pattern is indicative of:

Accepted Answer

SMB scanning. A single internal host contacting many external IPs on TCP/445 in a short window is the signature of SMB scanning — the host is enumerating SMB services across the internet or a target range. Port 445 is the SMB-over-TCP port, and the fan-out to many destinations distinguishes scanning from a single-target connection. This is often a precursor to SMB exploitation (EternalBlue, SMBGhost) or lateral movement.

Answer

DNS tunneling

Answer

Data exfiltration

Answer

Port scan

Question 13

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 14

Which port is used by RDP (Remote Desktop Protocol) and is a common target for brute force attacks?

Accepted Answer

3389. RDP (Remote Desktop Protocol) operates by default on TCP port 3389, a fact that makes it a prime target for brute force attacks because it provides direct interactive access to Windows systems. Attackers frequently scan for open 3389 ports and attempt credential stuffing or password spraying to gain unauthorized remote access. The other ports listed are associated with different services: 443 for HTTPS, 22 for SSH, and 1433 for Microsoft SQL Server.

Answer

443

Answer

22

Answer

1433

Question 15

A SIEM correlation rule triggers when more than 10 failed login attempts from a single source IP occur within 1 minute. This rule is designed to detect:

Accepted Answer

Brute force attack. A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

Answer

Privilege escalation

Answer

Malware infection

Answer

DDoS attack