200-201 Hard Questions — 25 Difficult Questions

Question 1

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy

Question 2

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Accepted Answer

The ACL is not blocking traffic because the deny line has 0 matches.. Option B is correct because the ACL counters show 0 matches for the deny line that is intended to block traffic to the malicious host on port 443. This indicates that no traffic matching the deny condition has been processed by the ACL, meaning the rule is not being triggered. Since the ACL is applied inbound on the external interface, traffic from the external network destined for the malicious host should match the deny line if it is correctly configured; the 0 matches suggest the ACL is not blocking the intended traffic.

Answer

The ACL is working correctly; traffic to the malicious host is blocked.

Answer

The ACL needs to be applied outbound to work.

Answer

The ACL is blocking all traffic because the permit line is never used.

Question 3

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Accepted Answer

Regularly tune correlation rules based on feedback.. Option C is correct because SIEM correlation rules must be regularly tuned based on feedback from incident investigations and alert reviews. This iterative process adjusts thresholds, filters, and logic to match the actual threat landscape, reducing noise from benign events that match rule patterns but are not malicious.

Answer

Disable all alerts that generate more than 100 events per day.

Answer

Use a separate SIEM for each department.

Answer

Increase the number of log sources.

Question 4

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Accepted Answer

ICMP tunneling. ICMP tunneling encapsulates non-ICMP data (e.g., command-and-control traffic) within ICMP echo request/reply packets. The random payload data and larger-than-typical payload size are hallmarks of this technique, as the attacker uses the ICMP protocol to bypass firewalls and exfiltrate data or establish covert communication.

Answer

Ping of death

Answer

Traceroute

Answer

Smurf attack

Question 5

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. Option A is correct because the immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Answer

Analyze packet captures to determine the full extent of the compromise

Answer

Block all outbound HTTPS traffic from the network

Answer

Reimage the host immediately to remove the malware

Question 6

Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)

Accepted Answer

A business-critical application cannot function with the policy control.. Option D is correct because a business-critical application that cannot function with a security policy control represents a legitimate operational need that may require a temporary exception. Security policies should support business objectives, and if a control (e.g., a firewall rule, an antivirus exclusion, or an application whitelisting policy) prevents a critical application from running, an exception can be granted after a risk assessment and compensating controls are implemented. This aligns with the principle of balancing security with business continuity.

Answer

The employee finds the policy inconvenient.

Answer

The policy is too new and employees are not yet trained.

Answer

The employee is a senior executive.

Question 7

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Accepted Answer

Least privilege. Option D, least privilege, is correct because the design restricts access to the sensitive database to only the specific application server that requires it. This principle dictates that users, processes, or systems should be granted the minimum permissions necessary to perform their functions, thereby reducing the attack surface. By implementing network access control lists (ACLs) or firewall rules that permit traffic solely from the application server's IP address to the database port, the engineer enforces least privilege at the network layer.

Answer

Defense in depth

Answer

Separation of duties

Answer

Weakest link

Question 8

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Accepted Answer

The destination IP is listed in a threat intelligence feed as a known C2 server.. Option B is correct because a destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

Answer

The packet size is consistently 1452 bytes across multiple connections.

Answer

The source IP also connected to multiple other external IPs on port 443 within the same hour.

Answer

The traffic is using HTTPS (port 443) which is commonly used for covert channels.

Question 9

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Option C is correct because implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope

Question 10

Based on the exhibit, what is the most likely type of attack being observed?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses, causing the target to allocate resources for half-open connections until it exhausts its backlog queue and denies legitimate traffic. The exhibit likely shows a massive spike in SYN packets without corresponding SYN-ACK or ACK completions, which is the hallmark of this attack.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

Port scan

Question 11

A SOC analyst is tuning an IPS rule that detects SQL injection attempts. The rule currently generates a high number of alerts, most of which are false positives caused by legitimate web application traffic containing SQL-like keywords. The analyst wants to reduce false positives without missing actual attacks. Which approach is most effective?

Accepted Answer

Implement a whitelist of known good SQL queries from the application.. Option A is correct because implementing a whitelist of known good SQL queries from the application allows the IPS to ignore benign traffic that matches SQL-like patterns, reducing false positives while still alerting on any SQL injection attempt that deviates from the whitelist. This approach leverages application-specific knowledge to distinguish legitimate queries from malicious ones, maintaining detection coverage for actual attacks.

Answer

Reduce the rule's sensitivity to only match exact attack patterns.

Answer

Disable the rule and rely on web application firewall logs.

Answer

Exclude all HTTP GET requests from inspection.

Question 12

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Accepted Answer

powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.. PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.

Answer

svchost.exe (PID 1420) because it is connecting to an external IP on port 80.

Answer

cmd.exe (PID 2568) because it could be used to launch other processes.

Answer

notepad.exe (PID 2344) because it is not expecting to make any network connections.

Question 13

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

Accepted Answer

Command-and-control (C2) communication from malware on the server. A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Answer

Distributed denial-of-service (DDoS) attack from the server

Answer

Brute-force attack on the server's SSH service

Answer

SQL injection attack against the server

Question 14

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 15

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Accepted Answer

It allows MySQL traffic from DMZ to internal network and blocks all other traffic. The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Answer

It allows MySQL traffic from internal network to DMZ

Answer

It blocks all traffic from DMZ to internal network

Answer

It allows any traffic from DMZ to internal network

Question 16

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. Option A is correct because a DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server

Question 17

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

Accepted Answer

Fine-tune correlation rules and thresholds based on historical data.. Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.

Answer

Implement a ticketing system for alerts.

Answer

Disable all correlation rules except critical ones.

Answer

Increase the number of analysts on shift.

Question 18

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

Accepted Answer

NetFlow records from the border router.. NetFlow records from the border router provide aggregated metadata (source/destination IP, port, protocol, timestamps) that can reveal the periodic 60-second beaconing pattern to the malicious domain and the volume of outbound connections on port 443. Unlike DNS logs, NetFlow captures the actual connection attempts regardless of DNS resolution, making it ideal for identifying regular, repetitive outbound flows.

Answer

DNS logs from the internal DNS server.

Answer

Full packet capture of all outbound traffic.

Answer

Host-based firewall logs.

Question 19

You are a SOC analyst at a mid-sized company. The company uses a SIEM that ingests logs from firewalls, IDS, and endpoints. Over the past week, you've noticed a gradual increase in outbound traffic from several internal hosts to IP addresses in a foreign country during non-business hours. The traffic is primarily on port 443. The IDS has not generated any alerts. The firewall logs show the connections are established. You check the endpoints and find no unusual processes running. However, the outbound connections persist. What is the most likely explanation and the best next step?

Accepted Answer

Enable SSL decryption on the firewall to inspect the traffic content.. The gradual increase in outbound traffic on port 443 (HTTPS) to foreign IPs during non-business hours, without IDS alerts or suspicious processes, strongly suggests data exfiltration over encrypted channels. Since the traffic is encrypted, the IDS cannot inspect the payload, and endpoint checks may miss stealthy malware that uses legitimate processes (e.g., svchost.exe) for beaconing. Enabling SSL decryption on the firewall allows the SOC to decrypt and inspect the HTTPS traffic, revealing the actual content and confirming or ruling out exfiltration.

Answer

Assume the hosts are compromised and reimage them.

Answer

Ignore the traffic since the IDS and endpoints show no signs of compromise.

Answer

Immediately isolate all affected hosts from the network.

Question 20

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.