200-201 Security Monitoring Practice Test 9 — 15 Questions

Question 1

A security analyst is using NetFlow data to investigate a potential data exfiltration incident. Which NetFlow metric is most useful for identifying large volumes of data being transferred to an external IP address?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Bytes transferred. The 'Bytes transferred' metric in NetFlow directly quantifies the volume of data sent to a specific destination IP. In a data exfiltration scenario, an unusually high byte count to an external IP is a strong indicator of large-scale data transfer, whereas other metrics like source port or packet count do not directly measure data volume.

Answer

Source port

Answer

Destination IP

Answer

Packet count

Question 2

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

Accepted Answer

A compromised host attempting to communicate with a command-and-control server over encrypted traffic. The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Answer

A false positive due to a web browser accessing a secure site

Answer

An attacker scanning for open HTTPS ports on the internal network

Answer

A benign HTTPS connection to a legitimate website

Question 3

A security analyst is investigating an alert from a Windows system log that shows multiple failed logon attempts for the same user account within a short period, followed by a successful logon. Which type of attack does this pattern suggest?

Accepted Answer

Brute-force attack. A burst of failed logons for one account followed by a success is the classic signature of a brute-force (or password-spraying) attack that eventually guessed the correct credential. Windows Security log events 4625 (failed logon) repeated, then 4624 (successful logon), from the same source within a short window confirm this. The pattern indicates the attacker iterated passwords until one worked.

Answer

Pass-the-hash attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 4

A security analyst is examining web server logs and finds an entry with method 'POST', URL '/login.php', response code '200', and user-agent 'Mozilla/5.0'. The log shows 100 similar entries from the same IP within 5 seconds. What is the most likely activity?

Accepted Answer

A brute-force attack on the login form. Repeated POST requests to /login.php from a single IP at a rate of 100 in 5 seconds (20 requests/second) with a generic browser user-agent is the classic signature of an automated brute-force attack against a login form. The 200 response code indicates the server processed the requests, consistent with credential guessing rather than a single exploit attempt. High request rate plus authentication endpoint equals brute force.

Answer

A SQL injection attempt on the login page

Answer

A DDoS attack targeting the web server

Answer

A user repeatedly clicking the login button due to a slow connection

Question 5

A network baseline shows that a server typically sends 1-2 MB of data per hour to external IPs. Suddenly, the server sends 50 MB of data to an IP in a foreign country within 10 minutes. The traffic is encrypted. Which monitoring tool would best confirm data exfiltration?

Accepted Answer

NetFlow/IPFIX analysis comparing current traffic to baseline. NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Answer

Snort IDS with a rule to detect large file transfers

Answer

Wireshark packet capture with a display filter for the destination IP

Answer

Windows Event Logs for file access

Question 6

A security analyst is using a SIEM to create a correlation rule that triggers when more than 10 failed logins are detected from the same source IP within 1 minute. This rule is designed to detect which type of attack?

Accepted Answer

Brute-force attack. A correlation rule that fires on more than 10 failed logins from the same source IP within 1 minute is the textbook signature of a brute-force attack — an attacker rapidly guessing credentials against an authentication endpoint. The high frequency and single-source pattern distinguish it from slow, distributed password spraying. SIEM correlation rules are commonly tuned to this threshold to catch credential-guessing attempts in near real time.

Answer

Phishing attack

Answer

Privilege escalation

Answer

Man-in-the-middle attack

Question 7

A SOC analyst reviews a firewall log with the following entry: action=deny, source IP=192.168.1.100, destination IP=10.0.0.1, destination port=22. The analyst knows that 10.0.0.1 is an SSH server. What does this log entry indicate?

Accepted Answer

An attempted SSH connection that was blocked by the firewall. The log entry shows 'action=deny', which explicitly indicates the firewall blocked the packet. Since destination port 22 is the default port for SSH, this log entry represents an attempted SSH connection from 192.168.1.100 to 10.0.0.1 that was denied by the firewall. The analyst's knowledge that 10.0.0.1 is an SSH server confirms the nature of the traffic.

Answer

A DNS query resolved to 10.0.0.1

Answer

A successful SSH connection from 192.168.1.100 to 10.0.0.1

Answer

A misconfigured firewall allowing SSH traffic

Question 8

An analyst receives a YARA rule that includes the string 'MZ' at the beginning of a file. What does this indicator typically help identify?

Accepted Answer

Windows executable files. The string 'MZ' (0x4D 0x5A) is the magic number for the MS-DOS header, which is present at the very beginning of all Windows Portable Executable (PE) files, including .exe, .dll, and .sys files. A YARA rule that checks for 'MZ' at offset 0 is specifically targeting the PE file format, which is the standard executable format for Windows. This indicator helps an analyst quickly identify that a file is likely a Windows executable, regardless of its extension.

Answer

PDF files with embedded JavaScript

Answer

Linux ELF binaries

Answer

Malicious documents containing macros

Question 9

In the OSI model, which layer is primarily targeted by a SYN flood attack?

Accepted Answer

Transport Layer (Layer 4). A SYN flood attack targets the Transport Layer (Layer 4) by exploiting the TCP three-way handshake. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the target server to allocate resources for half-open connections that never complete, eventually exhausting its connection queue and denying service to legitimate users.

Answer

Network Layer (Layer 3)

Answer

Application Layer (Layer 7)

Answer

Data Link Layer (Layer 2)

Question 10

A security analyst is using Zeek to analyze network traffic. Which Zeek log would be most useful for identifying HTTP requests to a known malicious domain?

Accepted Answer

http.log. Zeek's http.log records all HTTP requests and responses, including the host header, URI, method, and user agent. To identify HTTP requests to a known malicious domain, the http.log is the most direct source because it contains the destination host and URL. Analysts can search this log for the malicious domain in the 'host' or 'uri' fields.

Answer

ssl.log

Answer

conn.log

Answer

dns.log

Question 11

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Accepted Answer

Frequent use of TXT record type in DNS queries. Option A is correct because DNS tunneling often abuses TXT records, which can carry arbitrary text payloads, to exfiltrate data or receive commands from a C2 server. Option B is correct because tunneling responses frequently contain encoded data, making DNS responses larger than the typical small A-record response. Option E is correct because a single host generating a high volume of DNS queries to one domain is a classic beaconing/tunneling indicator. Option C is not correct because high TTL values are not characteristic of DNS tunneling; tunneling often uses low or zero TTLs to avoid caching. Option D is not correct because queries to multiple well-known domains are common benign behavior and do not specifically indicate DNS tunneling.

Answer

DNS queries with TTL values greater than 86400

Answer

DNS queries for multiple well-known domains

Question 12

A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?

Accepted Answer

tcp.port == 443. The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Answer

tcp.dstport == 443

Answer

https

Answer

port 443

Question 13

Which OSI layer is targeted by a TCP SYN flood attack?

Accepted Answer

Layer 4 - Transport. A TCP SYN flood attack targets the Transport layer (Layer 4) because it exploits the TCP three-way handshake mechanism. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the server to allocate resources for half-open connections that never complete, exhausting its connection queue.

Answer

Layer 7 - Application

Answer

Layer 3 - Network

Answer

Layer 2 - Data Link

Question 14

A SIEM correlation rule triggers when it detects more than 10 failed login attempts from the same source IP within 1 minute. Which type of attack is this rule designed to detect?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated login attempts using many password guesses against a single account or a set of accounts. The SIEM rule correlates more than 10 failed login attempts from the same source IP within 1 minute, which is a classic signature of an automated password-guessing tool. This threshold-based detection is specifically designed to identify brute-force activity, not other attack types.

Answer

Port scan

Answer

DDoS attack

Answer

Privilege escalation

Question 15

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

Accepted Answer

Windows executable files. The condition 'uint16(0) == 0x5a4d' checks the first two bytes of a file for the hexadecimal value 0x5a4d, which corresponds to the ASCII characters 'MZ'. This 'MZ' signature is the magic number for DOS/Windows executable files (e.g., .exe, .dll). The additional constraint 'filesize < 500KB' further narrows the rule to small Windows executables. Therefore, the rule targets Windows executable files.

Answer

PDF files

Answer

JPEG images

Answer

Linux ELF files