200-201 Security Monitoring — 20 Questions

Question 1

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Accepted Answer

Search the SIEM for events with destination port 22 and source IP.. Option A is correct because a SIEM indexes and correlates log data from multiple sources, allowing an analyst to quickly filter events by destination port 22 (SSH) and source IP without manually sifting through raw logs. This approach leverages the SIEM's search capabilities to retrieve only relevant events from the past hour, making it the most efficient method for targeted threat hunting.

Answer

Review all firewall logs for the past hour.

Answer

Run a packet capture on the server's network interface.

Answer

Check the server's auth.log file manually.

Question 2

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

Accepted Answer

Disable or modify signatures causing false positives.. Option C is correct because false positives occur when IPS signatures incorrectly match legitimate traffic. The most direct and effective tuning approach is to disable or modify the specific signatures causing the false positives, which reduces unnecessary blocking without compromising overall security posture.

Answer

Change the IPS to fail-open mode.

Answer

Increase the number of IPS sensors.

Answer

Reduce the IPS sensitivity level to lower.

Question 3

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

Accepted Answer

NetFlow records from the border router.. NetFlow records from the border router provide aggregated metadata (source/destination IP, port, protocol, timestamps) that can reveal the periodic 60-second beaconing pattern to the malicious domain and the volume of outbound connections on port 443. Unlike DNS logs, NetFlow captures the actual connection attempts regardless of DNS resolution, making it ideal for identifying regular, repetitive outbound flows.

Answer

DNS logs from the internal DNS server.

Answer

Full packet capture of all outbound traffic.

Answer

Host-based firewall logs.

Question 4

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

Accepted Answer

Isolate the host from the network.. The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.

Answer

Escalate to a senior analyst.

Answer

Run a full antivirus scan.

Answer

Delete the file immediately.

Question 5

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

Accepted Answer

The correlation rule threshold is set too high.. A SIEM correlation rule for brute-force attacks typically triggers when the number of failed login attempts from a single source exceeds a defined threshold within a specific time window. If the threshold is set too high, the rule will not fire even though failed logins are occurring, because the count never reaches the required value. This is the most direct and common cause for a correlation rule not triggering when expected.

Answer

The SIEM is receiving too many logs and dropping events.

Answer

The SIEM time zone is misconfigured.

Answer

The log source is not sending syslog data.

Question 6

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

Accepted Answer

Windows Security Event Logs (Event ID 4624, 4625).. Windows Security Event Logs with Event ID 4624 (successful logon) and 4625 (failed logon) are the authoritative source for interactive and remote logon events on a Windows system. They record the target user account (jsmith), the source IP address of the remote connection, and the timestamp, making them the direct and most reliable log source to determine if a specific user account was used from a remote IP during a breach window.

Answer

NetFlow records from the core switch.

Answer

VPN concentrator logs.

Answer

File server audit logs.

Question 7

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

Accepted Answer

Fine-tune correlation rules and thresholds based on historical data.. Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.

Answer

Implement a ticketing system for alerts.

Answer

Disable all correlation rules except critical ones.

Answer

Increase the number of analysts on shift.

Question 8

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

Accepted Answer

The email was sent from a domain that looks like 'arnazon.com'.. The most definitive indicator of a phishing attempt is a spoofed sender domain that mimics a legitimate company (e.g., 'arnazon.com' instead of 'amazon.com'). This is a classic typosquatting technique used to deceive users into trusting the email's origin. While other elements like logos or PDF attachments can be part of a phishing campaign, they are not inherently malicious and are commonly used in legitimate business communications.

Answer

The email has a company logo.

Answer

The attachment is a PDF file.

Answer

The email was sent during business hours.

Question 9

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

Accepted Answer

The monitor session source interface is incorrectly specified.. The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.

Answer

The IDS is in a different subnet.

Answer

The SPAN destination interface is not connected to the IDS.

Answer

The server is using VLAN tagging.

Question 10

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

Accepted Answer

DNS tunneling for data exfiltration.. The sudden spike in DNS queries to random subdomains of a legitimate domain (e.g., randomstring.google.com) is a classic indicator of DNS tunneling. This technique encodes data into DNS query names and exfiltrates it through the DNS protocol, bypassing network security controls that allow DNS traffic.

Answer

HTTP beaconing to a C2 server.

Answer

DNS amplification attack.

Answer

Port scanning using DNS.

Question 11

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 12

Which TWO are common indicators of a compromised host? (Choose two.)

Accepted Answer

Unusual spikes in outbound network traffic at odd hours.. Unusual spikes in outbound network traffic at odd hours (Option C) are a common indicator of a compromised host because they often signal data exfiltration, command-and-control (C2) beaconing, or botnet activity. Attackers frequently schedule malicious traffic during off-peak hours to evade detection, and the abnormal volume or timing relative to baseline behavior is a key anomaly in security monitoring.

Answer

User logging in during business hours.

Answer

Scheduled tasks running at regular intervals.

Answer

Antivirus updates occurring daily.

Question 13

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Accepted Answer

Defined incident response procedures.. Defined incident response procedures (Option C) are essential because they provide a structured, repeatable workflow for detecting, analyzing, and containing security incidents. Without pre-defined procedures, a security team cannot consistently execute the 'Respond' phase of the NIST SP 800-61 incident response lifecycle, leading to delayed containment and increased dwell time.

Answer

Antivirus software on all endpoints.

Answer

Data encryption at rest.

Question 14

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Accepted Answer

Regularly tune correlation rules based on feedback.. Option C is correct because SIEM correlation rules must be regularly tuned based on feedback from incident investigations and alert reviews. This iterative process adjusts thresholds, filters, and logic to match the actual threat landscape, reducing noise from benign events that match rule patterns but are not malicious.

Answer

Disable all alerts that generate more than 100 events per day.

Answer

Use a separate SIEM for each department.

Answer

Increase the number of log sources.

Question 15

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 16

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Accepted Answer

The ACL is not blocking traffic because the deny line has 0 matches.. Option B is correct because the ACL counters show 0 matches for the deny line that is intended to block traffic to the malicious host on port 443. This indicates that no traffic matching the deny condition has been processed by the ACL, meaning the rule is not being triggered. Since the ACL is applied inbound on the external interface, traffic from the external network destined for the malicious host should match the deny line if it is correctly configured; the 0 matches suggest the ACL is not blocking the intended traffic.

Answer

The ACL is working correctly; traffic to the malicious host is blocked.

Answer

The ACL needs to be applied outbound to work.

Answer

The ACL is blocking all traffic because the permit line is never used.

Question 17

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal web server and was blocked.. The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Answer

The access-group 'OUTSIDE_IN' permitted the traffic.

Answer

An internal host attempted to connect to an external web server.

Answer

The ASA allowed the connection because it is a stateful firewall.

Question 18

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Accepted Answer

The process path is in the Downloads folder.. The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Answer

The user is 'jsmith'.

Answer

The parent process is explorer.exe.

Answer

The event type is 'Process Creation'.

Question 19

You are a SOC analyst at a mid-sized company. The company uses a SIEM that ingests logs from firewalls, IDS, and endpoints. Over the past week, you've noticed a gradual increase in outbound traffic from several internal hosts to IP addresses in a foreign country during non-business hours. The traffic is primarily on port 443. The IDS has not generated any alerts. The firewall logs show the connections are established. You check the endpoints and find no unusual processes running. However, the outbound connections persist. What is the most likely explanation and the best next step?

Accepted Answer

Enable SSL decryption on the firewall to inspect the traffic content.. The gradual increase in outbound traffic on port 443 (HTTPS) to foreign IPs during non-business hours, without IDS alerts or suspicious processes, strongly suggests data exfiltration over encrypted channels. Since the traffic is encrypted, the IDS cannot inspect the payload, and endpoint checks may miss stealthy malware that uses legitimate processes (e.g., svchost.exe) for beaconing. Enabling SSL decryption on the firewall allows the SOC to decrypt and inspect the HTTPS traffic, revealing the actual content and confirming or ruling out exfiltration.

Answer

Assume the hosts are compromised and reimage them.

Answer

Ignore the traffic since the IDS and endpoints show no signs of compromise.

Answer

Immediately isolate all affected hosts from the network.

Question 20

You are a security administrator for a company with 500 employees. The company uses a SIEM with basic correlation rules. Recently, the HR department reported that several employees received phishing emails with a link to a fake login page. The emails bypassed the spam filter. You want to detect if any employees clicked the link. You have access to web proxy logs, DNS logs, and endpoint antivirus logs. The phishing link is 'http://malicious-login.com/verify'. Which action should you take first to identify affected users?

Accepted Answer

Query the web proxy logs for HTTP requests containing the URL.. The web proxy logs record all HTTP requests made by clients, including the full URL path. Querying for 'http://malicious-login.com/verify' directly shows which employees clicked the link, because the proxy captures the exact destination and timestamp of each request. This is the most direct and reliable evidence of user interaction with the phishing link.

Answer

Run a vulnerability scan on all employee workstations.

Answer

Search DNS logs for queries to 'malicious-login.com'.

Answer

Search endpoint logs for any malware detections.