200-201 Security Monitoring Practice Test 8 — 15 Questions

Question 1

A SOC analyst is analyzing logs from multiple sources. Which THREE log types are most useful for detecting a brute force attack against a web application?

Accepted Answer

System authentication logs. System authentication logs (B) are correct because they record login attempts and failures (e.g., Windows Security Event ID 4625 or Linux /var/log/auth.log entries), which directly reveal repeated failed authentications characteristic of brute force attacks. Web server logs (C) are correct because they capture HTTP POST requests to login endpoints with status codes like 401 or 403, showing the source IP, user-agent, and request patterns of credential-guessing attempts against the application. Firewall logs (E) are correct because they record connection attempts and can reveal high-volume or repeated traffic from a single source IP to the web server's authentication port, helping identify the brute force source and rate. DNS logs (A) are not typically useful here since brute force attacks target authentication mechanisms directly and do not necessarily generate distinctive DNS queries. IDS/IPS alerts (D) may detect some brute force activity, but they are derived alerts rather than raw log types and are not among the three most directly useful log sources for this scenario.

Answer

DNS logs

Answer

IDS/IPS alerts

Question 2

A network analyst is creating a baseline for normal network traffic. Which TWO metrics should be included to establish a baseline?

Accepted Answer

Average bandwidth usage over time. Option A (Average bandwidth usage over time) is correct because a traffic baseline must capture the normal volume of data traversing the network, and averaging utilization over representative periods establishes the expected throughput level against which anomalies can be measured. Option D (Typical protocol distribution, e.g., HTTP vs DNS) is correct because a baseline should document which protocols normally appear and in what proportions, so deviations such as unexpected SMB, IRC, or DNS tunneling traffic become detectable. Options B (Excessive connection attempts from a single IP) and E (Unusual payload sizes) describe anomalies or attack indicators rather than normal-behavior metrics, so they are things a baseline helps you identify, not components used to define the baseline itself. Option C (Peak traffic times) is a useful contextual detail but is not one of the two core metrics for establishing a normal-traffic baseline in this scenario.

Answer

Excessive connection attempts from a single IP

Answer

Peak traffic times

Answer

Unusual payload sizes

Question 3

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Answer

DNS amplification

Answer

ARP poisoning

Answer

SYN flood

Question 4

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

Accepted Answer

The workstation is infected with malware attempting to spread via SMB. Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Answer

The user is browsing the web and the firewall is blocking HTTP

Answer

The workstation is performing a DNS lookup

Answer

The workstation is performing a legitimate file transfer using FTP

Question 5

A NetFlow analysis shows that a single internal IP sent 10 GB of data to an external IP within one hour, whereas the baseline for that host is typically 100 MB per day. Which type of activity does this indicate?

Accepted Answer

Data exfiltration. The massive outbound transfer of 10 GB from an internal host to an external IP, far exceeding the 100 MB/day baseline, is a classic indicator of data exfiltration. Exfiltration involves unauthorized data transfer from inside the network to an external destination, often after a compromise. The volume and direction (internal to external) align with this activity, not with inbound flooding or scanning.

Answer

Denial of service attack

Answer

Network scanning

Answer

Normal business activity

Question 6

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

Accepted Answer

alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;). The rule must alert on TCP traffic to port 80 because HTTP POST requests use TCP, and Apache web servers typically listen on port 80 for unencrypted HTTP. The content match for 'POST' and the PCRE regex looking for a User-Agent string of 200 or more characters correctly targets the described exploit. This combination of protocol, port, and payload inspection is the most appropriate Snort rule.

Answer

alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Question 7

A SIEM correlation rule is designed to detect a brute-force attack. The rule triggers when an event includes 10 or more failed logins from the same source IP within 1 minute. An analyst sees an alert for 12 failed logins from IP 10.0.0.1 in 2 minutes. Why did the rule not trigger?

Accepted Answer

The time window is too short; the rule requires 10 failures in 1 minute, but this occurred over 2 minutes. The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Answer

The source IP is not in the watch list

Answer

The rule only counts successful logins

Answer

The alert severity is too low

Question 8

An analyst is investigating a potential data exfiltration via DNS. In Zeek DNS logs, the analyst sees many queries for subdomains like 'a1b2c3.malicious.com', 'd4e5f6.malicious.com' etc. from an internal host. Which technique is likely being used?

Accepted Answer

DNS tunneling. The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 9

In Wireshark, an analyst follows a TCP stream and sees plaintext usernames and passwords. Which protocol is likely in use?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including login credentials, in cleartext over TCP. When an analyst follows a TCP stream in Wireshark and sees plaintext usernames and passwords, it indicates that no encryption is applied. HTTPS, SFTP, and SSH all encrypt their payloads, so credentials would not be visible in plaintext. Therefore, FTP is the likely protocol.

Answer

HTTPS

Answer

SFTP

Answer

SSH

Question 10

An analyst is reviewing IDS alerts and sees an alert with signature name 'ET POLICY Suspicious inbound to MySQL port 3306'. The source IP is external and destination is an internal database server. What is the best immediate action?

Accepted Answer

Block the external IP at the firewall. An inbound connection from an external IP to a MySQL server (port 3306) is highly suspicious — MySQL is a database service that should never be exposed directly to the internet. The immediate best action is to block the external IP at the firewall to prevent potential exploitation, data exfiltration, or brute-force attacks. This aligns with the principle of least privilege and defense-in-depth, as database servers should only accept connections from trusted internal hosts.

Answer

Allow the traffic because it is a legitimate database query

Answer

Ignore the alert as it is a false positive

Answer

Disable the signature to reduce noise

Question 11

Which protocol is used by SNMP to send traps from network devices to the management station?

Accepted Answer

UDP port 162. SNMP traps are sent from agents to managers using UDP port 162. SNMP uses UDP, not TCP.

Answer

TCP port 162

Answer

TCP port 161

Answer

UDP port 161

Question 12

An analyst is investigating a potential compromise using Indicators of Compromise (IoCs). Which TWO of the following are valid types of IoCs?

Accepted Answer

IP address. Option B (IP address) is a valid IoC because a specific IP address associated with command-and-control (C2) servers, malicious scanning, or exfiltration traffic is a concrete, observable network artifact that analysts can search for in firewall, IDS/IPS, and proxy logs. Option D (File hash (MD5)) is a valid IoC because a cryptographic hash such as an MD5 digest uniquely identifies a known malicious file, allowing endpoint and antivirus tools to detect that exact sample without relying on its filename. By contrast, option A (User name) is generally not an IoC by itself, since usernames are not inherently malicious and are too common to serve as reliable compromise indicators. Option C (Geographic location) is not a valid IoC type on its own, as geolocation is a derived attribute of an IP address rather than a distinct indicator. Option E (Protocol name) is not a valid IoC, because protocols like HTTP or DNS are legitimate, ubiquitous communication methods and only become suspicious in specific contexts, not as standalone indicators.

Answer

User name

Answer

Geographic location

Answer

Protocol name

Question 13

A SOC analyst is tuning a SIEM correlation rule to detect port scanning. The rule should generate an alert when a single source IP connects to many different destination ports on multiple hosts within a short time. Which THREE conditions should be included in the rule?

Accepted Answer

Count of unique destination IPs > threshold. Option A is correct because a port scan is characterized by one source touching many distinct targets, so counting unique destination IPs above a threshold captures the horizontal spread across multiple hosts required by the rule. Option C is correct because the scenario specifies a single source IP, and grouping or filtering on that single source is what ties the many connections together as one scanning event rather than unrelated traffic. Option E is correct because counting unique destination ports above a threshold detects the vertical sweep of many ports, which is the defining signature of port scanning. Option B is not required because scans can target any port range, not just well-known ports, so restricting to well-known ports would miss scans of high or ephemeral ports. Option D is not appropriate because port scans typically involve small, often single-packet connections, so a high average packet count per connection would indicate data transfer or a different behavior, not scanning.

Answer

Destination port is well-known

Answer

Average packet count per connection is high (e.g., >100)

Question 14

A security analyst is creating a network baseline for normal traffic patterns. Which TWO metrics should be included to detect anomalies?

Accepted Answer

Average bandwidth usage per hour. Average bandwidth usage per hour (A) is correct because establishing a normal throughput baseline per time interval lets the analyst spot deviations such as traffic spikes, data exfiltration, or denial-of-service conditions that exceed the expected range. Number of connections per host (C) is correct because connection counts per host reveal abnormal session behavior, such as scanning, beaconing, or worm propagation, that would stand out against the established norm. Geolocation of source IPs (B) is useful context for investigating suspicious traffic but is not itself a traffic-pattern metric for a baseline. MAC addresses of devices (D) are Layer 2 identifiers used for asset inventory or access control, not for measuring normal traffic patterns. CPU utilization of servers (E) is a host performance metric, not a network traffic baseline metric.

Answer

Geolocation of source IPs

Answer

MAC addresses of devices

Answer

CPU utilization of servers

Question 15

A security analyst is reviewing a Wireshark capture and notices a large number of TCP SYN packets sent to multiple ports on a single host from the same source IP. Which type of network activity is most likely being observed?

Accepted Answer

Port scan. A port scan is characterized by multiple connection attempts to different ports on a target host, often using SYN packets.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

Man-in-the-middle attack