200-201 Multiple Select — 30 Questions

Question 1

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 2

An analyst is investigating a Windows host that likely has malware persistence via the registry. Which TWO registry hives are commonly used to store Run keys for user logon persistence? (Select 2)

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run are standard locations where Windows executes programs automatically at user logon. Malware commonly writes entries to these keys to achieve persistence, making them critical for host-based analysis.

Answer

HKEY_CLASSES_ROOT\*\shell

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 3

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 4

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Option A is correct because implementing access control lists (ACLs) on routers and switches restricts which traffic is permitted to reach the management plane and transit the device, enforcing least-privilege filtering as a core hardening control. Option B is correct because disabling unused services (for example, CDP, LLDP, HTTP server, or unused routing protocols) reduces the attack surface by eliminating unnecessary listening ports and daemons that could be exploited. Option E is correct because SNMPv3 with strong authentication (authNoPriv or authPriv using SHA and AES) replaces insecure SNMPv1/v2c community strings with encrypted, authenticated management traffic. Option C is not a hardening practice because Telnet transmits credentials and session data in cleartext; SSH should be used instead. Option D is not a hardening practice because default credentials are widely known and must be changed immediately during initial setup.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 5

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer

Social engineering

Answer

WHOIS lookups

Question 6

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Option B is correct because verifying a critical alert against other sources (such as SIEM logs, EDR telemetry, IDS/IPS events, or host-based logs) confirms whether the alert represents a true positive before committing resources, reducing the risk of acting on a false positive. Option C is correct because once a critical alert is validated, the analyst should escalate it to the incident response team so that containment, eradication, and recovery follow the organization's documented IR process and chain-of-custody requirements. Option A is wrong because deleting alerts destroys evidence and audit trails and could mask a real compromise. Option D, while sometimes useful for context, is not one of the two primary actions required at the moment a critical alert fires. Option E is wrong because powering off a system can destroy volatile evidence in memory and may violate incident response procedures; isolation is preferred over shutdown.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 7

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Question 8

A SOC analyst is reviewing proxy logs and wants to identify indicators of potential data exfiltration over HTTP. Which two patterns should the analyst treat as suspicious? (Choose two.)

Accepted Answer

Large outbound POST requests to a single external IP address at regular intervals.. Exfiltration over HTTP often appears as large outbound uploads, especially to new or untrusted destinations. Regular large POST requests and high-volume uploads to newly registered domains both indicate data leaving the environment in a manner inconsistent with normal business traffic. These patterns warrant deeper investigation.

Answer

HTTP 404 errors generated by users mistyping URLs in the browser.

Answer

Repeated GET requests to the same internal web server for static images.

Answer

Downloading software updates from a known vendor's HTTPS site.

Question 9

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Option A (/var/spool/cron/crontabs/) is correct because this is the directory where per-user crontab files are stored on Debian/Ubuntu-style systems, and attackers commonly drop a crontab entry here to run a payload under a specific user account at scheduled intervals. Option C (/etc/crontab) is correct because it is the system-wide crontab file that supports the extra user field and is a frequent target for persistence, since a malicious line added here executes with the specified user's privileges on a recurring schedule. Option B (/etc/init.d/) is not cron-based; it holds SysV init scripts for service startup, not scheduled jobs. Option D (/var/log/cron) is a log file recording cron activity, useful for detection but not a persistence location. Option E (/etc/systemd/system/) is for systemd unit files, a separate persistence mechanism from cron.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/

Question 10

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Option B, /var/spool/cron/crontabs/, is correct because attackers commonly establish persistence by adding malicious cron jobs here (per-user crontabs on Debian/Ubuntu systems), so unexpected entries provide direct evidence of attacker activity. Option D, /var/log/auth.log, is correct because it records authentication events such as SSH logins, sudo usage, and failed/successful password attempts, which can reveal unauthorized access or brute-force activity. Option E, /home/user/.bash_history, is correct because it preserves the commands a user (or an attacker operating under that account) executed, often exposing reconnaissance, privilege escalation, or data exfiltration commands. Option A, /proc/cpuinfo, is not relevant because it only exposes CPU hardware details from the kernel and contains no record of user or attacker actions. Option C, /etc/passwd, is not the best evidence of activity because it is a static account database listing users; while tampering (e.g., a rogue UID 0 account) could be suspicious, the file itself does not log activity, and the question asks for artifacts evidencing attacker activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 11

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 12

A SOC Tier 3 analyst is performing advanced threat analysis. Which TWO activities are typical for this tier?

Accepted Answer

Forensic analysis of compromised systems. Forensic analysis of compromised systems (A) is a Tier 3 activity because it requires deep expertise in memory, disk, and artifact examination to reconstruct attacker actions and determine root cause. Threat hunting (E) is also typical for Tier 3, as it involves proactively searching for hidden adversaries using hypotheses, advanced analytics, and tools beyond routine alert handling. In contrast, correlating multiple alerts (B) and initial triage of alerts (D) are generally Tier 1 or Tier 2 responsibilities, and monitoring SIEM dashboards (C) is a routine Tier 1 monitoring task rather than advanced analysis.

Answer

Correlating multiple alerts

Answer

Monitoring SIEM dashboards

Answer

Initial triage of alerts

Question 13

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Accepted Answer

Look for connections to known malicious IP addresses or domains.. Option A is correct because correlating observed connections against threat-intelligence lists of known malicious IP addresses and domains is a standard way to flag command-and-control or exfiltration endpoints during traffic analysis. Option E is correct because data exfiltration typically manifests as anomalously large outbound transfers (high byte counts, long-duration sessions, or off-hours uploads) to external hosts, making volume and destination analysis essential. Option B is wrong because clearing network logs destroys the very evidence needed for analysis and violates forensic preservation principles. Option C is wrong because exfiltration is outbound by nature, so focusing exclusively on inbound traffic would miss the activity being investigated. Option D is wrong because immediately blocking all outbound traffic from the suspect host is a containment/remediation action, not an analysis step, and it can tip off the attacker or disrupt evidence collection.

Answer

Clear the network logs to ensure accurate analysis.

Answer

Focus exclusively on inbound traffic from external sources.

Answer

Immediately block all outbound traffic from the suspect host.

Question 14

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

Accepted Answer

Visibility into local system events such as file system changes and registry modifications.. Option B is correct because a HIDS agent runs directly on the endpoint and monitors local activity such as file integrity changes, registry modifications, log entries, and process behavior, giving it deep host-level visibility that a NIDS, which only sees network packets, cannot provide. Option C is correct because a HIDS can inspect data after it has been decrypted on the host, so it can analyze encrypted traffic (e.g., TLS/HTTPS sessions) at the endpoint, whereas a NIDS typically sees only ciphertext on the wire and cannot decrypt it. Option A is wrong because protecting many devices simultaneously is a strength of NIDS, which can monitor a whole network segment from a central sensor, while HIDS requires an agent per host. Option D is wrong because HIDS agents run on the host and are themselves exposed to host-based attacks (e.g., tampering, rootkits), making them more—not less—susceptible. Option E is wrong because lower latency in detecting network attacks is characteristic of NIDS, which inspects traffic in real time on the network path, not of HIDS.

Answer

Better suited for protecting a large number of devices simultaneously.

Answer

Less susceptible to host-based attacks.

Answer

Lower latency in detecting network attacks.

Question 15

A security analyst is reviewing logs to identify a potential brute force attack. Which TWO log entries would be most suspicious? (Choose TWO.)

Accepted Answer

Successful login from IP 10.0.0.9 after 50 failed attempts.. Option A is correct because a successful login immediately following 50 failed attempts from the same IP (10.0.0.9) indicates a probable successful brute force or password-guessing attack, where the attacker eventually guessed valid credentials. Option D is correct because 50 failed login attempts from a single IP (10.0.0.9) within only 2 minutes is a classic high-rate authentication failure pattern consistent with automated brute force tools. Option B is not suspicious because a single successful login from a known IP during business hours matches normal, expected user behavior. Option C is not suspicious on its own because a single failed login from an external IP at 3:00 AM could simply be a mistyped password or a legitimate off-hours attempt, lacking the volume or repetition of brute force. Option E is not suspicious because changing a password after a successful login is a routine, legitimate user action.

Answer

A single successful login from a known IP during business hours.

Answer

A failed login attempt from an external IP at 3:00 AM.

Answer

A user changing their password after a successful login.

Question 16

Which TWO of the following are valid reasons to use a proxy server for security monitoring? (Choose two.)

Accepted Answer

To inspect encrypted traffic by acting as a man-in-the-middle with SSL decryption. Option C is correct because a proxy can terminate TLS connections and perform SSL/TLS inspection (SSL decryption or break-and-inspect), decrypting traffic so it can be examined for malicious content before re-encrypting it to the destination. Option D is correct because a forward proxy sits inline on outbound traffic and can enforce access-control policies, URL/domain filtering, and block connections to known malicious destinations via threat-intelligence feeds. Option A is not a security-monitoring reason and proxies typically add latency rather than reduce it. Option B is inaccurate because a proxy only logs traffic that is routed through it, not all network traffic, so it cannot provide a complete forensic record. Option E is wrong because a proxy does not replace endpoint anti-malware; host-based protection is still required for local threats.

Answer

To reduce network latency for monitored traffic

Answer

To provide a complete log of all network traffic for forensics

Answer

To replace the need for endpoint anti-malware software

Question 17

An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)

Accepted Answer

SMB relay. SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.

Answer

Kerberoasting

Answer

Brute force

Answer

Golden ticket

Question 18

Which TWO are common sources of security event data in a Security Information and Event Management (SIEM) system?

Accepted Answer

NetFlow records. NetFlow records (B) are a common SIEM data source because they provide flow-level metadata—source/destination IP, ports, protocol, byte/packet counts, and timestamps—that SIEMs use for traffic analysis, anomaly detection, and threat hunting. Syslog from network devices (D) is also a core source, as routers, switches, and firewalls send event messages (e.g., RFC 5424/3164 format) to a SIEM for correlation and alerting. SMTP logs (A) are email-server logs and, while they can be ingested, they are not a common primary SIEM source category in the same way as flow and syslog data. SNMP traps (C) are asynchronous device notifications used mainly for network management/monitoring, not a standard SIEM event-data source. DNS queries (E) can be logged and analyzed for security (e.g., DNS tunneling), but they are a specialized telemetry type rather than one of the two common sources identified here.

Answer

SMTP logs

Answer

SNMP traps

Answer

DNS queries

Question 19

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Accepted Answer

Smart card. Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Answer

IP address whitelist

Answer

Password

Answer

Security question

Question 20

A security analyst is collecting evidence from a compromised system for legal proceedings. Which TWO actions are critical to preserve the integrity of the evidence?

Accepted Answer

Compute a cryptographic hash of the original drive before imaging. Option B is correct because computing a cryptographic hash (e.g., SHA-256 or MD5) of the original drive before imaging establishes a verifiable baseline value that can later be compared against the hash of the forensic image to prove the copy is bit-for-bit identical and unaltered, which is essential for evidence admissibility. Option E is correct because a hardware or software write-blocker prevents any write operations from reaching the source drive during imaging, ensuring the original evidence is not modified and preserving its integrity for legal proceedings. Option A is wrong because storing evidence in a public folder exposes it to tampering, unauthorized access, and contamination, destroying the chain of custody. Option C is wrong because deleting files alters the original evidence and constitutes spoliation. Option D is wrong because running the system normally modifies the drive and volatile state, contaminating the evidence rather than preserving it.

Answer

Store the evidence in a public folder for easy access

Answer

Delete any sensitive files to protect privacy

Answer

Run the system normally to capture volatile data