200-201 Security Monitoring Practice Test 6 — 15 Questions

Question 1

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Answer

DNS amplification

Answer

ARP poisoning

Answer

SYN flood

Question 2

During a security investigation, an analyst examines a PCAP file in Wireshark. The analyst wants to see only traffic between two specific IP addresses (192.168.1.10 and 10.0.0.5). Which display filter should be applied?

Accepted Answer

ip.addr==192.168.1.10 && ip.addr==10.0.0.5. The correct display filter uses 'ip.addr' to match either direction. The syntax 'ip.addr==192.168.1.10 && ip.addr==10.0.0.5' shows packets where both addresses appear, which is correct for traffic between them.

Answer

tcp.port==80

Answer

ip.src==192.168.1.10 and ip.dst==10.0.0.5

Answer

ip.addr eq 192.168.1.10 or ip.addr eq 10.0.0.5

Question 3

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

Accepted Answer

The workstation is infected with malware attempting to spread via SMB. Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Answer

The user is browsing the web and the firewall is blocking HTTP

Answer

The workstation is performing a DNS lookup

Answer

The workstation is performing a legitimate file transfer using FTP

Question 4

A NetFlow analysis shows that a single internal IP sent 10 GB of data to an external IP within one hour, whereas the baseline for that host is typically 100 MB per day. Which type of activity does this indicate?

Accepted Answer

Data exfiltration. A sudden large volume of outbound data from a host that normally sends little is a classic indicator of data exfiltration.

Answer

Denial of service attack

Answer

Network scanning

Answer

Normal business activity

Question 5

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

Accepted Answer

alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;). The rule 'alert tcp any any -> any 80' matches HTTP traffic, and 'content:"POST"' detects the method. The 'pcre' option can match the long User-Agent. The other options are incorrect because they don't specify port 80 or use wrong protocols.

Answer

alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Question 6

Which log type would an analyst examine to see failed login attempts to a Windows server?

Accepted Answer

System logs. System logs (Event Logs) on a Windows server record security-related events, including failed login attempts under Event ID 4625 (Windows 10/Server 2012 R2 and later). An analyst would examine these logs in Event Viewer under 'Windows Logs > Security' to identify authentication failures, which are critical for detecting brute-force attacks or unauthorized access attempts.

Answer

DNS logs

Answer

Firewall logs

Answer

Web server logs

Question 7

A SIEM correlation rule is designed to detect a brute-force attack. The rule triggers when an event includes 10 or more failed logins from the same source IP within 1 minute. An analyst sees an alert for 12 failed logins from IP 10.0.0.1 in 2 minutes. Why did the rule not trigger?

Accepted Answer

The time window is too short; the rule requires 10 failures in 1 minute, but this occurred over 2 minutes. The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Answer

The source IP is not in the watch list

Answer

The rule only counts successful logins

Answer

The alert severity is too low

Question 8

An analyst is investigating a potential data exfiltration via DNS. In Zeek DNS logs, the analyst sees many queries for subdomains like 'a1b2c3.malicious.com', 'd4e5f6.malicious.com' etc. from an internal host. Which technique is likely being used?

Accepted Answer

DNS tunneling. The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 9

In Wireshark, an analyst follows a TCP stream and sees plaintext usernames and passwords. Which protocol is likely in use?

Accepted Answer

FTP. FTP transmits credentials in plaintext. Other protocols (HTTPS, SSH, SFTP) encrypt traffic.

Answer

HTTPS

Answer

SFTP

Answer

SSH

Question 10

An analyst is reviewing IDS alerts and sees an alert with signature name 'ET POLICY Suspicious inbound to MySQL port 3306'. The source IP is external and destination is an internal database server. What is the best immediate action?

Accepted Answer

Block the external IP at the firewall. An inbound connection from an external IP to a MySQL server (port 3306) is highly suspicious — MySQL is a database service that should never be exposed directly to the internet. The immediate best action is to block the external IP at the firewall to prevent potential exploitation, data exfiltration, or brute-force attacks. This aligns with the principle of least privilege and defense-in-depth, as database servers should only accept connections from trusted internal hosts.

Answer

Allow the traffic because it is a legitimate database query

Answer

Ignore the alert as it is a false positive

Answer

Disable the signature to reduce noise

Question 11

A security analyst is using Zeek to monitor network traffic. The analyst wants to extract all files transferred over HTTP. Which Zeek script or package accomplishes this?

Accepted Answer

file_extraction.zeek. The file_extraction.zeek script is specifically designed to extract files from network streams, including HTTP transfers. Zeek's default HTTP logging (http.log) records metadata about HTTP sessions, but to actually capture and reassemble the transferred files (e.g., images, executables, documents), the file_extraction framework must be loaded via this script or package.

Answer

dns-logs.zeek

Answer

conn-logs.zeek

Answer

http-logs.zeek

Question 12

Which protocol is used by SNMP to send traps from network devices to the management station?

Accepted Answer

UDP port 162. SNMP traps are sent from agents to managers using UDP port 162. SNMP uses UDP, not TCP.

Answer

TCP port 162

Answer

TCP port 161

Answer

UDP port 161

Question 13

An analyst is investigating a potential compromise using Indicators of Compromise (IoCs). Which TWO of the following are valid types of IoCs?

Accepted Answer

IP address. IP addresses are a fundamental type of Indicator of Compromise (IoC) because they directly identify the network location of a malicious host, such as a command-and-control (C2) server or a source of an attack. Security analysts use IP addresses in threat intelligence feeds and SIEM queries to correlate logs and detect inbound or outbound connections to known malicious hosts.

Answer

User name

Answer

Geographic location

Answer

Protocol name

Question 14

A SOC analyst is tuning a SIEM correlation rule to detect port scanning. The rule should generate an alert when a single source IP connects to many different destination ports on multiple hosts within a short time. Which THREE conditions should be included in the rule?

Accepted Answer

Count of unique destination IPs > threshold. Port scanning involves multiple ports on multiple hosts from one source. Unique destination ports and unique destination IPs are key. Low packet count per connection is typical of scans (e.g., SYN scans).

Answer

Destination port is well-known

Answer

Average packet count per connection is high (e.g., >100)

Question 15

A security analyst is creating a network baseline for normal traffic patterns. Which TWO metrics should be included to detect anomalies?

Accepted Answer

Average bandwidth usage per hour. Average bandwidth usage per hour is correct because it establishes a baseline of typical traffic volume over time, allowing the analyst to detect sudden spikes or drops that may indicate anomalies such as DDoS attacks or data exfiltration. Number of connections per host is correct because it provides a per-device baseline for connection counts, enabling detection of unusual behavior like port scans, botnet activity, or compromised hosts generating excessive outbound connections.

Answer

Geolocation of source IPs

Answer

MAC addresses of devices

Answer

CPU utilization of servers