200-201 Network Intrusion Analysis Practice Test 2 — 15 Questions

Question 1

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. Option A is correct because the immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Answer

Analyze packet captures to determine the full extent of the compromise

Answer

Block all outbound HTTPS traffic from the network

Answer

Reimage the host immediately to remove the malware

Question 2

You are a security analyst for a medium-sized enterprise. You notice that the network monitoring system has flagged an unusual amount of traffic between two internal hosts: 192.168.1.10 (a file server) and 192.168.1.20 (a workstation in the sales department). The traffic is occurring on port 445 (SMB) and is happening outside of normal business hours. The volume of data transferred is significantly higher than typical usage. The file server logs show that the sales workstation has been accessing a large number of files in quick succession. The sales employee reports that they have been working late, but they cannot explain the high volume of file access. You have access to the file server logs, network flow data, and the workstation's event logs. The workstation has antivirus software installed that is up to date. What should you do FIRST?

Accepted Answer

Isolate the workstation from the network immediately. Option A is correct because the anomalous SMB traffic on port 445, occurring outside business hours with a high volume of file access in quick succession, strongly indicates a ransomware or data exfiltration attack. Isolating the workstation immediately contains the threat, preventing lateral movement and further encryption or exfiltration of sensitive data. This aligns with the first step in incident response: containment before analysis.

Answer

Reimage the workstation to ensure it is clean

Answer

Run a full antivirus scan on the workstation

Answer

Analyze network flow data to identify the destination of the data

Question 3

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

Accepted Answer

Command-and-control (C2) communication from malware on the server. A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Answer

Distributed denial-of-service (DDoS) attack from the server

Answer

Brute-force attack on the server's SSH service

Answer

SQL injection attack against the server

Question 4

An analyst needs to determine if a host is infected with malware that is attempting to contact a known malicious domain. Which log source is most appropriate for this analysis?

Accepted Answer

DNS server logs. DNS server logs are the most appropriate source because they record all DNS queries made by hosts on the network. If a host is attempting to contact a known malicious domain, the DNS query for that domain will appear in the logs, allowing the analyst to identify the infected host by its source IP address and the timestamp of the query.

Answer

Syslog from the host

Answer

NetFlow records

Answer

Data loss prevention (DLP) logs

Question 5

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Accepted Answer

A sudden increase in DNS queries to unknown domains from a single host. Option D is correct because a sudden spike in DNS queries to unknown domains from a single host is a classic sign of DNS tunneling or command-and-control (C2) activity. Attackers often use DNS to exfiltrate data or communicate with external servers by encoding data in DNS queries, bypassing traditional firewall rules that allow DNS traffic.

Answer

High bandwidth usage during business hours

Answer

A single failed login attempt from an internal user

Answer

Regular ICMP echo requests to external hosts

Question 6

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Accepted Answer

HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.. The ACL applied outbound on the external interface permits TCP traffic from the 192.168.1.0/24 network to any destination on ports 80 (HTTP) and 443 (HTTPS), and denies all other traffic, including SSH (port 22). Since the ACL has an implicit deny at the end, only HTTP and HTTPS are allowed; SSH is explicitly denied because it does not match any permit statement. Therefore, HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.

Answer

All outbound traffic is denied except HTTP and HTTPS.

Answer

Only HTTP and HTTPS traffic is allowed.

Answer

SSH traffic is only denied if it originates from the 192.168.1.0/24 network.

Question 7

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs.
- Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306.
- Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

Accepted Answer

Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.. The firewall logs show that outbound traffic from the web server (10.0.1.10) to the database server (10.0.2.10) on TCP 3306 is being denied, which causes the database errors. Since the web server initiates the connection to the database, a rule allowing this specific outbound traffic from the web server to the database server on port 3306 restores functionality while maintaining the default-deny posture. This is the most secure approach because it permits only the necessary traffic between the two specific hosts and port, without opening broader access.

Answer

Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.

Answer

Move the database server to the DMZ to avoid firewall restrictions.

Answer

Create a rule allowing all outbound traffic from the DMZ to the internal network.

Question 8

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Accepted Answer

Look for connections to known malicious IP addresses or domains.. Connections to known malicious IP addresses or domains are a strong indicator of data exfiltration, as attackers often use command-and-control (C2) servers to receive stolen data. This aligns with the principle of threat intelligence-based detection, where security feeds (e.g., Cisco Talos, AlienVault OTX) provide reputation scores for external hosts. Identifying such outbound connections helps confirm that data is being sent to an adversary-controlled destination.

Answer

Clear the network logs to ensure accurate analysis.

Answer

Focus exclusively on inbound traffic from external sources.

Answer

Immediately block all outbound traffic from the suspect host.

Question 9

Based on the exhibit, what is the most likely type of attack being observed?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses, causing the target to allocate resources for half-open connections until it exhausts its backlog queue and denies legitimate traffic. The exhibit likely shows a massive spike in SYN packets without corresponding SYN-ACK or ACK completions, which is the hallmark of this attack.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

Port scan

Question 10

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

Accepted Answer

Isolate the workstation by disconnecting it from the network immediately.. The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Answer

Block the external IP address on the firewall and continue monitoring.

Answer

Run a full forensic analysis on the workstation without disconnecting it.

Answer

Update the antivirus signatures and run a full scan on the workstation.

Question 11

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Question 12

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.

Question 13

Match each Linux command to its function.

Question 14

Match each analysis type to its description.

Question 15

A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?

Accepted Answer

Ping sweep. A ping sweep uses ICMP echo requests to discover live hosts; the observed high volume of ICMP echo replies from multiple internal hosts to a single external IP indicates that the external IP sent a flood of echo requests, and the internal hosts are responding. This is the classic signature of a ping sweep (or ICMP sweep) where an attacker probes a range of internal addresses to map the network.

Answer

ARP spoofing

Answer

Port scan

Answer

Smurf attack