200-201 Security Monitoring Practice Test 8 — 15 Questions

Question 1

A security analyst is reviewing network traffic and notices a high volume of small packets from an internal IP to a single external IP on port 53. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using small packets to evade detection. A high volume of small packets from an internal IP to a single external IP on port 53, without corresponding internal DNS server traffic, is a classic indicator of data exfiltration via DNS tunneling.

Answer

DNS amplification attack

Answer

Port scan

Answer

Normal DNS resolution

Question 2

A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?

Accepted Answer

tcp.port == 443. The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Answer

tcp.dstport == 443

Answer

https

Answer

port 443

Question 3

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

Accepted Answer

An SSH brute-force attack from the internal host. Multiple denied connection attempts from the same internal IP to the same external IP on port 22 (SSH) with different source ports indicates a brute-force SSH attack. The firewall is denying the connections, but the pattern is indicative of an attack.

Answer

DNS tunneling

Answer

A legitimate SSH session

Answer

A port scan from the external host

Question 4

An analyst notices a Zeek (Bro) connection log showing a single HTTP request from internal IP 192.168.1.10 to external IP 203.0.113.5 with a URI of '/files/secret.docx' and a response code of 200. The file size is unusually large (50 MB). What should the analyst suspect?

Accepted Answer

Data exfiltration. A large file download over HTTP from an internal host to an external IP, especially with a filename like 'secret.docx', suggests data exfiltration. The single request and response code 200 indicate successful transfer.

Answer

Phishing attempt

Answer

Malware download

Answer

Normal business activity

Question 5

Which OSI layer is targeted by a TCP SYN flood attack?

Accepted Answer

Layer 4 - Transport. A TCP SYN flood attack targets the Transport layer (Layer 4) because it exploits the TCP three-way handshake mechanism. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the server to allocate resources for half-open connections that never complete, exhausting its connection queue.

Answer

Layer 7 - Application

Answer

Layer 3 - Network

Answer

Layer 2 - Data Link

Question 6

A SIEM correlation rule triggers when it detects more than 10 failed login attempts from the same source IP within 1 minute. Which type of attack is this rule designed to detect?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated login attempts using many password guesses against a single account or a set of accounts. The SIEM rule correlates more than 10 failed login attempts from the same source IP within 1 minute, which is a classic signature of an automated password-guessing tool. This threshold-based detection is specifically designed to identify brute-force activity, not other attack types.

Answer

Port scan

Answer

DDoS attack

Answer

Privilege escalation

Question 7

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

Accepted Answer

Windows executable files. 0x5A4D is the MZ header for Windows executables (PE files). The rule looks for files starting with 'MZ' and less than 500KB, likely targeting small malware executables.

Answer

PDF files

Answer

JPEG images

Answer

Linux ELF files

Question 8

A SOC analyst is investigating a potential data exfiltration incident. Which TWO indicators from NetFlow/IPFIX analysis would most strongly suggest data exfiltration?

Accepted Answer

Connection to an IP address flagged as malicious in threat intelligence. The two strongest indicators of data exfiltration from NetFlow/IPFIX are: (1) a high volume of data transferred to a single external IP address (Option D), suggesting large-scale data theft; and (2) communication with an IP address flagged as malicious (Option B), which may indicate a command-and-control server or a known exfiltration destination. Option A (consistent traffic at regular intervals) is more characteristic of beaconing or keep-alive traffic, often associated with C2 but not directly exfiltration. Option C (multiple connection attempts to various ports) describes a port scan, which is reconnaissance activity, not exfiltration. Option E (low volume of traffic to multiple external IPs) is typical of normal browsing activity.

Answer

Consistent traffic at regular intervals to an external IP

Answer

Multiple connection attempts to various ports on the same external IP

Answer

Low volume of traffic to multiple external IPs

Question 9

A security analyst is configuring Snort IDS rules. Which TWO components are mandatory in a Snort rule header?

Accepted Answer

Action (e.g., alert, drop). In a Snort rule header, the mandatory components are the action (e.g., alert, drop) and the direction operator (-> or <>). While protocol is also a required field, it is not considered a separate mandatory component in the context of this question; the action and direction operator are the two components that are always required in the rule header. Options like msg and sid are part of the rule body and are optional.

Answer

Message (msg) option

Answer

Signature ID (sid) option

Answer

Protocol (e.g., tcp, udp, icmp)

Question 10

Which TWO protocols are commonly used for remote administration and should be monitored for unauthorized access?

Accepted Answer

SSH (port 22). SSH (port 22) is correct because it provides encrypted remote administration, making it a common target for brute-force attacks and unauthorized access attempts. RDP (port 3389) is correct because it is the primary protocol for remote GUI administration on Windows systems and is frequently exploited via credential stuffing or vulnerability scanning. Both protocols should be monitored for anomalous login patterns and unauthorized access.

Answer

Telnet (port 23)

Answer

SNMP (port 161/162)

Answer

FTP (port 20/21)

Question 11

An analyst is reviewing web server logs and sees the following entries: 'GET /admin/login.php HTTP/1.1' returning 404, followed by 'GET /admin/login.html' returning 404, then 'GET /admin/login.asp' returning 200. Which TWO observations are most relevant?

Accepted Answer

The attacker is probing for valid login page paths. The sequence of requests probing different file extensions for the login page suggests a directory traversal or file enumeration attack. The fact that the attacker tried multiple extensions and succeeded with .asp may indicate the web server is running ASP. The 200 response is the successful access.

Answer

The requests indicate a brute-force login attempt

Answer

The source IP is likely performing a SQL injection

Answer

The server is misconfigured to reveal directory listings

Question 12

Which THREE of the following are common Indicators of Compromise (IoCs) used in threat intelligence?

Accepted Answer

IP addresses. IP addresses are a primary Indicator of Compromise (IoC) because they directly identify the network location of a malicious host, such as a command-and-control (C2) server or a source of an attack. In threat intelligence, IP addresses are used to block traffic, enrich alerts, and correlate events across different data sources. They are a foundational IoC because they are observable in network logs, firewall logs, and IDS/IPS alerts.

Answer

User-agent strings

Answer

Port numbers

Question 13

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

Accepted Answer

Successful authentication event. A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.

Answer

Network share access event

Answer

Account creation event

Question 14

An analyst is using Zeek to monitor network traffic. Which THREE types of logs can Zeek generate to provide visibility into application-layer activity?

Accepted Answer

smtp.log. Zeek generates application-layer logs by parsing protocol-specific traffic. SMTP (Simple Mail Transfer Protocol) is an application-layer protocol, and Zeek's smtp.log captures email transactions, including sender, recipient, and message IDs, providing visibility into email-based activity.

Answer

conn.log

Answer

weird.log

Question 15

A security analyst is investigating a potential port scan. Which THREE patterns in NetFlow data would indicate a horizontal port scan?

Accepted Answer

Low number of packets per flow. A horizontal port scan targets the same port across multiple destination IPs. In NetFlow, each connection attempt typically involves a low number of packets (often just a SYN) because the scanner does not complete the TCP handshake. This pattern of low packet counts per flow is a strong indicator of scanning activity.

Answer

Multiple connection attempts from the same source IP to the same destination IP on different ports

Answer

Single source IP, multiple destination ports on one destination IP