200-201 Security Concepts Practice Test 5 — 15 Questions

Question 1

What is the effect of this configuration on a Cisco device?

Accepted Answer

Users are authenticated using the local database.. The configuration shown (not provided in the question, but implied by the correct answer) is a typical local authentication setup, such as 'aaa authentication login default local' or a username/password defined in the device's local database. This means the device uses its own stored credentials to authenticate users, not an external server. Option C is correct because local authentication is explicitly configured, bypassing any external AAA server.

Answer

Users are authenticated using a TACACS+ server.

Answer

Authorization is done via RADIUS.

Answer

No authentication is required.

Question 2

Which type of traffic is most prominent in this NetFlow data?

Accepted Answer

HTTP. HTTP traffic is most prominent because the NetFlow data shows a high volume of packets and bytes on TCP port 80, which is the default port for HTTP. NetFlow records summarize traffic flows, and the large number of flows and bytes on port 80 indicates that HTTP is the dominant protocol in the captured data.

Answer

SSH

Answer

DNS

Answer

HTTPS

Question 3

Which TWO of the following are symmetric encryption algorithms? (Choose two.)

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. It is widely adopted due to its strong security and efficiency, with key sizes of 128, 192, or 256 bits. 3DES (Triple Data Encryption Standard) is also symmetric, applying the DES cipher three times to each data block, effectively increasing key length and security over single DES.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECC

Question 4

Which TWO of the following are common network security protocols? (Choose two.)

Accepted Answer

IPsec. IPsec is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a data stream. It operates at the network layer (Layer 3) and is commonly used in VPNs to provide confidentiality, integrity, and authentication. This makes it a fundamental network security protocol.

Answer

FTP

Answer

HTTP

Answer

SNMP

Question 5

Which THREE of the following are key principles of zero trust security? (Choose three.)

Accepted Answer

Least privilege. Least privilege is a core principle of zero trust because it ensures users, devices, and applications are granted only the minimum permissions necessary to perform their functions. This limits the blast radius of a potential compromise by restricting lateral movement and access to sensitive resources. In zero trust, least privilege is enforced through granular policies, often using micro-segmentation and identity-based access controls, rather than relying on network location.

Answer

Perimeter-based security

Answer

Implicit trust

Question 6

A small business uses a cloud-based email service. The IT administrator wants to protect against phishing attacks that target employees. Which security control should be implemented first?

Accepted Answer

Deploy a web application firewall (WAF). A Web Application Firewall (WAF) is the correct first control because it can inspect and filter HTTP/HTTPS traffic to the cloud-based email service, blocking malicious links, scripts, and known phishing payloads before they reach users. Since phishing attacks often rely on deceptive URLs and web-based content, a WAF provides a proactive, network-layer defense that reduces the attack surface immediately, without requiring user behavior changes or endpoint configuration.

Answer

Conduct weekly security awareness training

Answer

Install antivirus software on all endpoints

Answer

Enable multi-factor authentication (MFA) on email accounts

Question 7

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a server is sending encrypted data to an external IP address during non-business hours. The server is supposed to only communicate with internal systems. What is the best immediate action?

Accepted Answer

Disconnect the server from the network. Option A is correct because disconnecting the server from the network immediately stops the potential data exfiltration by severing all communication paths. This is the fastest way to contain the threat and prevent further data loss, aligning with the first step in incident response: containment. In a suspected exfiltration scenario, preserving the system state for forensic analysis is secondary to stopping the active data transfer.

Answer

Block the external IP address at the firewall

Answer

Notify the server's administrator

Answer

Capture a packet capture (PCAP) of the traffic for analysis

Question 8

An organization has implemented a security information and event management (SIEM) system. The SOC analyst receives an alert indicating a high number of failed login attempts from a single IP address targeting a critical server. The analyst checks the server logs and finds that the server is configured to lock the account after 5 failed attempts. However, the alert shows thousands of attempts. Which of the following explains this discrepancy?

Accepted Answer

The failed attempts are against different usernames, not the same account. The account lockout policy (5 failed attempts) applies per individual username, not per source IP address. If the attacker is attempting to authenticate with many different usernames from the same IP, each username can fail up to 5 times before being locked, allowing thousands of total failed attempts across different accounts. The SIEM aggregates all failed authentication events from that IP, while the server's lockout mechanism only triggers per user, explaining the discrepancy.

Answer

The attacker is using a brute-force tool that bypasses account lockout

Answer

The server's logging is not capturing all authentication events

Answer

The SIEM alert is a false positive due to a misconfiguration

Question 9

A company is deploying a new web application and wants to ensure it is secure against common web attacks. Which of the following is the most effective approach to validate the security of the application before going live?

Accepted Answer

Conduct a penetration test by an external firm. A penetration test by an external firm provides a comprehensive, real-world assessment of security vulnerabilities.

Answer

Run a vulnerability scanner against the application

Answer

Implement a web application firewall (WAF)

Answer

Perform a code review with static analysis tools

Question 10

Which TWO of the following are characteristics of an advanced persistent threat (APT)?

Accepted Answer

Operates with low and slow tactics to avoid detection. An advanced persistent threat (APT) is characterized by its use of low-and-slow tactics to evade detection over long periods. This involves spreading malicious activity across many small, seemingly benign actions to avoid triggering threshold-based alerts in security monitoring systems. APTs are also defined by their targeted nature, focusing on specific organizations for espionage or data theft rather than opportunistic, broad-scale attacks.

Answer

Is typically financially motivated

Answer

Uses only commodity malware

Answer

Attacks are short-lived and quickly detected

Question 11

Which THREE of the following are common security controls used to defend against ransomware?

Accepted Answer

Implementing application whitelisting. Application whitelisting is a security control that prevents unauthorized executables, scripts, and macros from running. By default allowing only approved software, it blocks ransomware payloads that arrive as unknown or untrusted files, even if a user inadvertently executes them.

Answer

Allowing macros in office documents

Answer

Disabling user accounts after 3 failed attempts

Question 12

A hospital's network security team has received reports from nurses that the patient record system has become unresponsive. Upon investigation, the IT administrator finds that the database server is experiencing extremely high disk I/O and the system logs show repeated failed login attempts from an internal IP address that belongs to a medical imaging device. The imaging device is known to run an outdated embedded OS that cannot be patched. The device is isolated on its own VLAN, but the VLAN is allowed to communicate with the database server on TCP port 1433 for legitimate purposes. The attack logs show that the database server is being targeted with a dictionary attack using the default 'sa' account. What should the security analyst do first to contain the incident without disrupting critical medical operations?

Accepted Answer

Change the database server's 'sa' account password and implement account lockout policies.. Option D is correct because the immediate priority is to stop the ongoing dictionary attack against the database server's 'sa' account without disrupting critical medical operations. Changing the 'sa' password and implementing account lockout policies directly mitigates the brute-force attack at the authentication layer, while leaving the imaging device and its VLAN operational so that legitimate medical imaging traffic can continue. This containment step buys time for a more permanent solution, such as replacing or further isolating the vulnerable device.

Answer

Block the imaging device's IP address at the core firewall.

Answer

Take the imaging device offline immediately and isolate it from the network.

Answer

Disable the VLAN allowing communication between the imaging device and the database server.

Question 13

A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?

Accepted Answer

Disconnect the POS terminal from the network immediately.. Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.

Answer

Reset the password for the new user account and disable it.

Answer

Install antivirus software on the terminal and run a full scan.

Answer

Contact the cloud provider to block the outbound IP address.

Question 14

A manufacturing company's ICS network was infected with ransomware that encrypted files on the file server. The company has offline backups and restores the files. However, during the investigation, the security analyst finds that the ransomware entered through an RDP connection from an infected workstation on the corporate network. The corporate network and ICS network are separated by a firewall that allows RDP from specific corporate IPs to the ICS file server. The analyst wants to prevent a recurrence. Which of the following is the most effective long-term control?

Accepted Answer

Require multi-factor authentication for all RDP connections.. Requiring multi-factor authentication for all RDP connections adds a critical layer of security, making it much harder for attackers to gain access even if credentials are compromised.

Answer

Disable RDP on the ICS file server and use a jump box.

Answer

Implement network segmentation with a DMZ for file transfers.

Answer

Install antivirus on all corporate workstations.

Question 15

A SOC analyst is monitoring network traffic and notices a large amount of data being transferred from the HR file server to an external IP address during off-hours. The server is supposed to be used only during business hours. The analyst checks the server logs and sees that a user account named 'backup_service' has been active and copying files. The 'backup_service' account is a service account that is normally used for automated backups, but the backup schedule is set to run at midnight, and the current time is 3 AM. The analyst suspects credential theft. Which of the following should the analyst do first?

Accepted Answer

Capture a memory dump of the server for forensic analysis.. Option A is correct because capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory credentials) that is critical for forensic analysis of a suspected credential theft incident. This aligns with the NIST SP 800-86 forensic process, where memory acquisition is prioritized before any system shutdown or network changes to avoid losing evidence of the attacker's active session or malicious code.

Answer

Disable the 'backup_service' account immediately.

Answer

Take the HR file server offline.

Answer

Block the external IP address at the firewall.

200-201 Security Concepts Practice Test 5 — 15 Questions

Exhibit

200-201 Security Concepts Practice Test 5 — 15 Questions

Exhibit