200-201 Security Concepts — Timed 15 Questions

Question 1

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

Accepted Answer

Confidentiality, integrity, and availability (CIA). The organization's goal is to classify data based on sensitivity and impact if disclosed, which directly aligns with the confidentiality component of the CIA triad. Confidentiality ensures that sensitive information is accessed only by authorized individuals, and classification is the foundational step to enforce this principle. The CIA triad (Confidentiality, Integrity, Availability) is the core security model that governs how data is protected based on its value and risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Data loss prevention

Question 2

A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?

Accepted Answer

Password spraying. Password spraying (C) is correct because the attack involves a single IP address attempting the same common password against multiple user accounts. This technique avoids account lockout policies that typically trigger after a few failed attempts on a single account, making it distinct from brute force attacks that target one account with many passwords.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Man-in-the-middle attack

Question 3

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 4

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is fundamental to the principle of least privilege because it assigns permissions based on job functions rather than individual users, ensuring users receive only the access necessary for their roles. The 'need-to-know' concept restricts access to information strictly required for a user's tasks, directly enforcing least privilege by limiting data exposure. Together, RBAC provides a scalable framework for access management, while need-to-know ensures granular data-level control.

Answer

Mandatory access control (MAC)

Answer

Separation of duties

Answer

Defense in depth

Question 5

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. Option A is correct because a DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server

Question 6

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Accepted Answer

Continuous monitoring of security events. Option A is correct because continuous monitoring of security events is a primary goal of a SOC, ensuring real-time detection of threats through log aggregation and analysis from sources like firewalls, IDS/IPS, and endpoints. This aligns with the SOC's responsibility to maintain situational awareness and identify indicators of compromise (IoCs) as part of the NIST incident response lifecycle.

Answer

Managing user passwords

Answer

Developing software applications

Answer

Performing penetration tests

Question 7

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Accepted Answer

An attacker is performing a port scan on internal hosts from the outside. The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

Answer

The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic

Answer

A malware is trying to phone home to an external C2 server

Answer

A user is trying to access internal web servers legitimately but is blocked by ACL

Question 8

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Accepted Answer

It allows MySQL traffic from DMZ to internal network and blocks all other traffic. The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Answer

It allows MySQL traffic from internal network to DMZ

Answer

It blocks all traffic from DMZ to internal network

Answer

It allows any traffic from DMZ to internal network

Question 9

Refer to the exhibit. A Windows security log shows several events with Event ID 4625 (failed logon). What type of attack is indicated?

Accepted Answer

Brute force attack. Event ID 4625 indicates a failed logon attempt. A high volume of these events in a short period is characteristic of a brute force attack, where an attacker systematically tries multiple username/password combinations to gain unauthorized access. This is a direct indicator of repeated authentication failures, not a more sophisticated attack.

Answer

Pass-the-hash attack

Answer

Kerberos golden ticket attack

Answer

Man-in-the-middle attack

Question 10

You are a security analyst at a financial institution. The network consists of three segments: internal corporate network (10.0.0.0/24), DMZ (192.168.1.0/24) hosting a web server and an email server, and a guest wireless network (172.16.0.0/24). The firewall is configured with the following rules: (1) permit inbound HTTP/HTTPS to the web server from any; (2) permit inbound SMTP to the email server from any; (3) deny all other inbound traffic; (4) permit all outbound traffic from internal network; (5) deny all outbound traffic from guest network to internal and DMZ, but permit to internet. Recently, an employee reported that sensitive files on an internal file server (10.0.0.10) were accessed without authorization. Logs show that the access originated from an IP address in the guest network (172.16.0.50) at 3:00 AM. The guest network is open (no authentication required). The internal file server is not directly accessible from the guest network per rule (5). However, the attacker used the web server as a pivot: they compromised the web server via an unpatched vulnerability, then from the web server they connected to the internal file server. Which of the following actions would BEST prevent this type of attack in the future?

Accepted Answer

Add a firewall rule that permits only necessary traffic from the DMZ to specific internal servers, and deny all other DMZ-to-internal traffic. Option D is correct because the attack leveraged the DMZ web server as a pivot to reach the internal file server. By implementing a firewall rule that permits only necessary traffic from the DMZ to specific internal servers (e.g., only allow the web server to communicate with a database server on TCP/3306) and denies all other DMZ-to-internal traffic, you enforce a least-privilege segmentation policy. This would block the web server from initiating arbitrary connections to the internal file server (10.0.0.10), even if the web server is compromised, directly preventing the pivot attack.

Answer

Implement a firewall rule that denies all traffic from the DMZ to the internal network

Answer

Move the web server to the internal network and place a reverse proxy in the DMZ

Answer

Apply a patch to the web server and require authentication on the guest network

Question 11

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Accepted Answer

Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5. The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.

Answer

Apply a software patch to the web application to fix the SQL injection vulnerability

Answer

Restore the web server from a known good backup

Answer

Shut down the database server to prevent further data loss

Question 12

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been sent to an external IP address over port 443 during non-business hours. The company uses a proxy server that logs all outbound connections. Which action should the analyst take first to validate the suspicion?

Accepted Answer

Check the proxy logs to see the destination IP and user agent string.. Option C is correct because proxy logs contain the destination IP and user agent string, which are critical for validating whether the external IP is legitimate or malicious. By checking these logs first, the analyst can correlate the outbound connection with known threat intelligence or anomalous user agents without disrupting operations or consuming resources on unnecessary packet captures.

Answer

Immediately block the external IP address at the firewall.

Answer

Run a packet capture on the internal server to analyze the payload.

Answer

Notify the security team lead and wait for further instructions.

Question 13

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Accepted Answer

Least privilege. Option D, least privilege, is correct because the design restricts access to the sensitive database to only the specific application server that requires it. This principle dictates that users, processes, or systems should be granted the minimum permissions necessary to perform their functions, thereby reducing the attack surface. By implementing network access control lists (ACLs) or firewall rules that permit traffic solely from the application server's IP address to the database port, the engineer enforces least privilege at the network layer.

Answer

Defense in depth

Answer

Separation of duties

Answer

Weakest link

Question 14

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Accepted Answer

A sudden increase in traffic from a single source IP address. Option D is correct because a sudden increase in traffic from a single source IP address is a classic indicator of a direct DoS attack, where the attacker uses a single compromised host to flood the target with packets, overwhelming its resources. This contrasts with a distributed denial-of-service (DDoS) attack, which uses multiple sources. The abrupt spike in volume from one IP is a clear anomaly that network monitoring tools flag as a potential DoS event.

Answer

A low level of network utilization on the target server

Answer

A gradual increase in traffic from multiple geographic locations

Answer

A high number of DNS queries from diverse source IPs

Question 15

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Accepted Answer

The deny statement with logging may generate excessive logs, potentially masking attacks.. The ACL has a single permit statement for traffic from 192.168.1.0/24 to 10.10.10.10 on port 443, followed by an implicit deny all that is logged. This means every packet that does not match the permit rule generates a log entry. In a production environment, even normal background noise (e.g., scans, broadcast traffic) can produce thousands of log messages per second, overwhelming syslog storage and masking malicious activity. The core issue is that logging on the deny-all can cause log flooding, not that the permit lacks logging.

Answer

The ACL is applied inbound on the outside interface, which could allow external traffic.

Answer

The permit statement does not have logging enabled, so traffic is not monitored.

Answer

The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.