200-201 Multiple Select — 10 Questions

Question 1

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Successful authentication event. A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.

Answer

Network share access event

Answer

Account creation event

Question 2

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 3

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

Accepted Answer

SMB brute force. Pass-the-hash uses NTLM hashes for authentication, and SMB brute force involves trying multiple passwords or hashes. Both can produce multiple failed attempts then success.

Answer

SQL injection

Answer

ARP spoofing

Answer

DNS tunnelling

Question 4

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Accepted Answer

Monitor DNS query sizes and frequencies. DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.

Answer

Disable recursive DNS on the internal DNS server

Answer

Implement DNSSEC

Answer

Block all DNS queries to external servers

Question 5

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 6

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

Accepted Answer

Visibility into local system events such as file system changes and registry modifications.. HIDS are installed directly on a host and have direct access to the host's operating system, allowing them to monitor local system events such as file system changes, registry modifications, and process activity. This granular visibility is a key advantage over NIDS, which only sees network traffic and cannot inspect internal host state.

Answer

Better suited for protecting a large number of devices simultaneously.

Answer

Less susceptible to host-based attacks.

Answer

Lower latency in detecting network attacks.

Question 7

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Accepted Answer

Transport Layer Security (TLS). Symmetric encryption, asymmetric encryption, and TLS (which uses both) provide confidentiality. Hashing does not.

Answer

Digital signature

Answer

Hashing

Question 8

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 9

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

Accepted Answer

Event ID 8 (CreateRemoteThread). Sysmon Event ID 8 (CreateRemoteThread) is directly associated with code injection because it logs when a thread is created in a remote process, a common technique used by malware to inject malicious code into a legitimate process. Event ID 10 (ProcessAccess) is also critical as it records when a process opens a handle to another process, often a precursor to injecting code via APIs like OpenProcess and WriteProcessMemory.

Answer

Event ID 3 (Network connect)

Answer

Event ID 1 (Process creation)

Answer

Event ID 7 (Image loaded)

Question 10

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

Accepted Answer

Large DNS response packets. Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.

Answer

Use of standard DNS ports

Answer

DNSSEC enabled

Answer

Frequent DNS query retransmissions