200-201 Security Monitoring Practice Test 7 — 15 Questions

Question 1

A security analyst is reviewing a Wireshark capture and notices a large number of TCP SYN packets sent to multiple ports on a single host from the same source IP. Which type of network activity is most likely being observed?

Accepted Answer

Port scan. A port scan is characterized by multiple connection attempts to different ports on a target host, often using SYN packets.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

Man-in-the-middle attack

Question 2

A security analyst is using NetFlow data to investigate a potential data exfiltration incident. Which NetFlow metric is most useful for identifying large volumes of data being transferred to an external IP address?

Accepted Answer

Bytes transferred. Option C is correct because the 'Bytes transferred' metric in NetFlow directly quantifies the volume of data sent to a specific destination IP. In a data exfiltration scenario, an unusually high byte count to an external IP is a strong indicator of large-scale data transfer, whereas other metrics like source port or packet count do not directly measure data volume.

Answer

Source port

Answer

Destination IP

Answer

Packet count

Question 3

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

Accepted Answer

A compromised host attempting to communicate with a command-and-control server over encrypted traffic. The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Answer

A false positive due to a web browser accessing a secure site

Answer

An attacker scanning for open HTTPS ports on the internal network

Answer

A benign HTTPS connection to a legitimate website

Question 4

A security analyst is investigating an alert from a Windows system log that shows multiple failed logon attempts for the same user account within a short period, followed by a successful logon. Which type of attack does this pattern suggest?

Accepted Answer

Brute-force attack. Multiple failed logons followed by a success indicates a brute-force attack where the attacker eventually guessed the correct password.

Answer

Pass-the-hash attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 5

A SOC analyst observes a spike in DNS queries for long, random-looking subdomains under a single domain from an internal host. The responses are NXDOMAIN. Which type of activity is most likely indicated?

Accepted Answer

DNS tunneling. Random subdomain queries with NXDOMAIN responses are typical of a DNS tunneling attempt used for data exfiltration or C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for many websites

Answer

Misconfigured DNS server

Question 6

A security analyst is examining web server logs and finds an entry with method 'POST', URL '/login.php', response code '200', and user-agent 'Mozilla/5.0'. The log shows 100 similar entries from the same IP within 5 seconds. What is the most likely activity?

Accepted Answer

A brute-force attack on the login form. Multiple POST requests to a login page from a single IP in a short time suggests a brute-force password guessing attack.

Answer

A SQL injection attempt on the login page

Answer

A DDoS attack targeting the web server

Answer

A user repeatedly clicking the login button due to a slow connection

Question 7

A network baseline shows that a server typically sends 1-2 MB of data per hour to external IPs. Suddenly, the server sends 50 MB of data to an IP in a foreign country within 10 minutes. The traffic is encrypted. Which monitoring tool would best confirm data exfiltration?

Accepted Answer

NetFlow/IPFIX analysis comparing current traffic to baseline. NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Answer

Snort IDS with a rule to detect large file transfers

Answer

Wireshark packet capture with a display filter for the destination IP

Answer

Windows Event Logs for file access

Question 8

A security analyst is using a SIEM to create a correlation rule that triggers when more than 10 failed logins are detected from the same source IP within 1 minute. This rule is designed to detect which type of attack?

Accepted Answer

Brute-force attack. The rule detects multiple failed logins in a short time, which is characteristic of a brute-force attack.

Answer

Phishing attack

Answer

Privilege escalation

Answer

Man-in-the-middle attack

Question 9

A SOC analyst reviews a firewall log with the following entry: action=deny, source IP=192.168.1.100, destination IP=10.0.0.1, destination port=22. The analyst knows that 10.0.0.1 is an SSH server. What does this log entry indicate?

Accepted Answer

An attempted SSH connection that was blocked by the firewall. The log entry shows 'action=deny', which explicitly indicates the firewall blocked the packet. Since destination port 22 is the default port for SSH, this log entry represents an attempted SSH connection from 192.168.1.100 to 10.0.0.1 that was denied by the firewall. The analyst's knowledge that 10.0.0.1 is an SSH server confirms the nature of the traffic.

Answer

A DNS query resolved to 10.0.0.1

Answer

A successful SSH connection from 192.168.1.100 to 10.0.0.1

Answer

A misconfigured firewall allowing SSH traffic

Question 10

An analyst receives a YARA rule that includes the string 'MZ' at the beginning of a file. What does this indicator typically help identify?

Accepted Answer

Windows executable files. The string 'MZ' (0x4D 0x5A) is the magic number for the MS-DOS header, which is present at the very beginning of all Windows Portable Executable (PE) files, including .exe, .dll, and .sys files. A YARA rule that checks for 'MZ' at offset 0 is specifically targeting the PE file format, which is the standard executable format for Windows. This indicator helps an analyst quickly identify that a file is likely a Windows executable, regardless of its extension.

Answer

PDF files with embedded JavaScript

Answer

Linux ELF binaries

Answer

Malicious documents containing macros

Question 11

In the OSI model, which layer is primarily targeted by a SYN flood attack?

Accepted Answer

Transport Layer (Layer 4). A SYN flood attack targets the Transport Layer (Layer 4) by exploiting the TCP three-way handshake. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the target server to allocate resources for half-open connections that never complete, eventually exhausting its connection queue and denying service to legitimate users.

Answer

Network Layer (Layer 3)

Answer

Application Layer (Layer 7)

Answer

Data Link Layer (Layer 2)

Question 12

A security analyst is using Zeek to analyze network traffic. Which Zeek log would be most useful for identifying HTTP requests to a known malicious domain?

Accepted Answer

http.log. Zeek's HTTP log records details of HTTP requests, including the host header (domain).

Answer

ssl.log

Answer

conn.log

Answer

dns.log

Question 13

A SOC analyst is investigating a potential data exfiltration incident. Which TWO Indicators of Compromise (IoCs) would be most relevant for tracking the exfiltration of files over the network?

Accepted Answer

URLs. URLs are correct because they can indicate the destination of exfiltrated data, such as a cloud storage endpoint or a command-and-control server. File hashes (MD5/SHA-256) are correct because they uniquely identify the specific files being transferred, allowing the analyst to track known malicious or sensitive files across the network.

Answer

IP addresses

Answer

Mutex names

Answer

Registry keys

Question 14

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Accepted Answer

Frequent use of TXT record type in DNS queries. DNS tunneling often uses high query volumes, TXT records to encode data, and large response sizes.

Answer

DNS queries with TTL values greater than 86400

Answer

DNS queries for multiple well-known domains

Question 15

A security analyst is tuning a Snort IDS to reduce false positives. Which TWO Snort rule options should the analyst modify to make the rule more specific?

Accepted Answer

Set a 'threshold' to limit the number of alerts per time window. Option B is correct because setting a 'threshold' in Snort limits the number of alerts generated for a given rule within a specified time window, which directly reduces false positives by suppressing repeated alerts from benign traffic that matches the rule pattern. Option D is correct because adding a 'content' field forces the rule to match specific bytes in the packet payload, making the rule more precise and less likely to trigger on unrelated traffic.

Answer

Remove the 'destination port' field

Answer

Increase the 'priority' value

Answer

Change the action from 'alert' to 'log'