200-201 Security Concepts — Timed 20 Questions

Question 1

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

Accepted Answer

Confidentiality, integrity, and availability (CIA). The organization's goal is to classify data based on sensitivity and impact if disclosed, which directly aligns with the confidentiality component of the CIA triad. Confidentiality ensures that sensitive information is accessed only by authorized individuals, and classification is the foundational step to enforce this principle. The CIA triad (Confidentiality, Integrity, Availability) is the core security model that governs how data is protected based on its value and risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Data loss prevention

Question 2

A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?

Accepted Answer

Password spraying. Password spraying (C) is correct because the attack involves a single IP address attempting the same common password against multiple user accounts. This technique avoids account lockout policies that typically trigger after a few failed attempts on a single account, making it distinct from brute force attacks that target one account with many passwords.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Man-in-the-middle attack

Question 3

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 4

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is fundamental to the principle of least privilege because it assigns permissions based on job functions rather than individual users, ensuring users receive only the access necessary for their roles. The 'need-to-know' concept restricts access to information strictly required for a user's tasks, directly enforcing least privilege by limiting data exposure. Together, RBAC provides a scalable framework for access management, while need-to-know ensures granular data-level control.

Answer

Mandatory access control (MAC)

Answer

Separation of duties

Answer

Defense in depth

Question 5

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. Option A is correct because a DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server

Question 6

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Accepted Answer

Continuous monitoring of security events. Option A is correct because continuous monitoring of security events is a primary goal of a SOC, ensuring real-time detection of threats through log aggregation and analysis from sources like firewalls, IDS/IPS, and endpoints. This aligns with the SOC's responsibility to maintain situational awareness and identify indicators of compromise (IoCs) as part of the NIST incident response lifecycle.

Answer

Managing user passwords

Answer

Developing software applications

Answer

Performing penetration tests

Question 7

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Accepted Answer

An attacker is performing a port scan on internal hosts from the outside. The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

Answer

The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic

Answer

A malware is trying to phone home to an external C2 server

Answer

A user is trying to access internal web servers legitimately but is blocked by ACL

Question 8

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Accepted Answer

It allows MySQL traffic from DMZ to internal network and blocks all other traffic. The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Answer

It allows MySQL traffic from internal network to DMZ

Answer

It blocks all traffic from DMZ to internal network

Answer

It allows any traffic from DMZ to internal network

Question 9

Refer to the exhibit. A Windows security log shows several events with Event ID 4625 (failed logon). What type of attack is indicated?

Accepted Answer

Brute force attack. Event ID 4625 indicates a failed logon attempt. A high volume of these events in a short period is characteristic of a brute force attack, where an attacker systematically tries multiple username/password combinations to gain unauthorized access. This is a direct indicator of repeated authentication failures, not a more sophisticated attack.

Answer

Pass-the-hash attack

Answer

Kerberos golden ticket attack

Answer

Man-in-the-middle attack

Question 10

You are a security analyst at a financial institution. The network consists of three segments: internal corporate network (10.0.0.0/24), DMZ (192.168.1.0/24) hosting a web server and an email server, and a guest wireless network (172.16.0.0/24). The firewall is configured with the following rules: (1) permit inbound HTTP/HTTPS to the web server from any; (2) permit inbound SMTP to the email server from any; (3) deny all other inbound traffic; (4) permit all outbound traffic from internal network; (5) deny all outbound traffic from guest network to internal and DMZ, but permit to internet. Recently, an employee reported that sensitive files on an internal file server (10.0.0.10) were accessed without authorization. Logs show that the access originated from an IP address in the guest network (172.16.0.50) at 3:00 AM. The guest network is open (no authentication required). The internal file server is not directly accessible from the guest network per rule (5). However, the attacker used the web server as a pivot: they compromised the web server via an unpatched vulnerability, then from the web server they connected to the internal file server. Which of the following actions would BEST prevent this type of attack in the future?

Accepted Answer

Add a firewall rule that permits only necessary traffic from the DMZ to specific internal servers, and deny all other DMZ-to-internal traffic. Option D is correct because the attack leveraged the DMZ web server as a pivot to reach the internal file server. By implementing a firewall rule that permits only necessary traffic from the DMZ to specific internal servers (e.g., only allow the web server to communicate with a database server on TCP/3306) and denies all other DMZ-to-internal traffic, you enforce a least-privilege segmentation policy. This would block the web server from initiating arbitrary connections to the internal file server (10.0.0.10), even if the web server is compromised, directly preventing the pivot attack.

Answer

Implement a firewall rule that denies all traffic from the DMZ to the internal network

Answer

Move the web server to the internal network and place a reverse proxy in the DMZ

Answer

Apply a patch to the web server and require authentication on the guest network

Question 11

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Accepted Answer

Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5. The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.

Answer

Apply a software patch to the web application to fix the SQL injection vulnerability

Answer

Restore the web server from a known good backup

Answer

Shut down the database server to prevent further data loss

Question 12

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been sent to an external IP address over port 443 during non-business hours. The company uses a proxy server that logs all outbound connections. Which action should the analyst take first to validate the suspicion?

Accepted Answer

Check the proxy logs to see the destination IP and user agent string.. Option C is correct because proxy logs contain the destination IP and user agent string, which are critical for validating whether the external IP is legitimate or malicious. By checking these logs first, the analyst can correlate the outbound connection with known threat intelligence or anomalous user agents without disrupting operations or consuming resources on unnecessary packet captures.

Answer

Immediately block the external IP address at the firewall.

Answer

Run a packet capture on the internal server to analyze the payload.

Answer

Notify the security team lead and wait for further instructions.

Question 13

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Accepted Answer

Least privilege. Option D, least privilege, is correct because the design restricts access to the sensitive database to only the specific application server that requires it. This principle dictates that users, processes, or systems should be granted the minimum permissions necessary to perform their functions, thereby reducing the attack surface. By implementing network access control lists (ACLs) or firewall rules that permit traffic solely from the application server's IP address to the database port, the engineer enforces least privilege at the network layer.

Answer

Defense in depth

Answer

Separation of duties

Answer

Weakest link

Question 14

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Accepted Answer

A sudden increase in traffic from a single source IP address. Option D is correct because a sudden increase in traffic from a single source IP address is a classic indicator of a direct DoS attack, where the attacker uses a single compromised host to flood the target with packets, overwhelming its resources. This contrasts with a distributed denial-of-service (DDoS) attack, which uses multiple sources. The abrupt spike in volume from one IP is a clear anomaly that network monitoring tools flag as a potential DoS event.

Answer

A low level of network utilization on the target server

Answer

A gradual increase in traffic from multiple geographic locations

Answer

A high number of DNS queries from diverse source IPs

Question 15

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Accepted Answer

The deny statement with logging may generate excessive logs, potentially masking attacks.. The ACL has a single permit statement for traffic from 192.168.1.0/24 to 10.10.10.10 on port 443, followed by an implicit deny all that is logged. This means every packet that does not match the permit rule generates a log entry. In a production environment, even normal background noise (e.g., scans, broadcast traffic) can produce thousands of log messages per second, overwhelming syslog storage and masking malicious activity. The core issue is that logging on the deny-all can cause log flooding, not that the permit lacks logging.

Answer

The ACL is applied inbound on the outside interface, which could allow external traffic.

Answer

The permit statement does not have logging enabled, so traffic is not monitored.

Answer

The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.

Question 16

You are a security analyst for a mid-sized company with a flat network topology. The company uses a single firewall for internet access and has no internal segmentation. Recently, the IT team deployed a new file server running Windows Server 2019. The server was configured with default settings and placed in the same subnet as all user workstations. Two weeks later, the helpdesk receives multiple complaints about slow network performance. Upon investigation, you notice the file server's network interface is sending a high volume of broadcast traffic. Additionally, you find that the server's firewall is disabled and it is running an outdated SMBv1 protocol. The CEO is concerned about potential data loss and asks for immediate remediation. Which of the following is the most effective and immediate course of action to address the most critical security vulnerability?

Accepted Answer

Disable SMBv1 on the file server using PowerShell or Registry.. D is correct because the most critical security vulnerability is the outdated SMBv1 protocol, which is known to be exploited by ransomware like WannaCry and EternalBlue. Disabling SMBv1 immediately removes this attack vector, addressing the CEO's concern about potential data loss. While the broadcast traffic and disabled firewall are issues, SMBv1 poses a direct and severe risk to data integrity and confidentiality.

Answer

Enable the Windows Firewall on the file server and create rules to allow only essential traffic.

Answer

Configure the switch to block broadcast traffic on the file server's port.

Answer

Create VLANs to segment the file server from user workstations.

Question 17

Drag and drop the steps to configure SSH access on a Cisco IOS switch into the correct order.

Question 18

Drag and drop the steps to perform a password recovery on a Cisco IOS router into the correct order.

Question 19

Match each security tool to its primary purpose.

Question 20

Match each cybersecurity framework/standard to its focus.