200-201 Security Monitoring Practice Test 1 — 15 Questions

Question 1

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Accepted Answer

Search the SIEM for events with destination port 22 and source IP.. Option A is correct because a SIEM indexes and correlates log data from multiple sources, allowing an analyst to quickly filter events by destination port 22 (SSH) and source IP without manually sifting through raw logs. This approach leverages the SIEM's search capabilities to retrieve only relevant events from the past hour, making it the most efficient method for targeted threat hunting.

Answer

Review all firewall logs for the past hour.

Answer

Run a packet capture on the server's network interface.

Answer

Check the server's auth.log file manually.

Question 2

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

Accepted Answer

Disable or modify signatures causing false positives.. Option C is correct because false positives occur when IPS signatures incorrectly match legitimate traffic. The most direct and effective tuning approach is to disable or modify the specific signatures causing the false positives, which reduces unnecessary blocking without compromising overall security posture.

Answer

Change the IPS to fail-open mode.

Answer

Increase the number of IPS sensors.

Answer

Reduce the IPS sensitivity level to lower.

Question 3

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

Accepted Answer

NetFlow records from the border router.. NetFlow records from the border router provide aggregated metadata (source/destination IP, port, protocol, timestamps) that can reveal the periodic 60-second beaconing pattern to the malicious domain and the volume of outbound connections on port 443. Unlike DNS logs, NetFlow captures the actual connection attempts regardless of DNS resolution, making it ideal for identifying regular, repetitive outbound flows.

Answer

DNS logs from the internal DNS server.

Answer

Full packet capture of all outbound traffic.

Answer

Host-based firewall logs.

Question 4

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

Accepted Answer

Isolate the host from the network.. The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.

Answer

Escalate to a senior analyst.

Answer

Run a full antivirus scan.

Answer

Delete the file immediately.

Question 5

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

Accepted Answer

The correlation rule threshold is set too high.. A SIEM correlation rule for brute-force attacks typically triggers when the number of failed login attempts from a single source exceeds a defined threshold within a specific time window. If the threshold is set too high, the rule will not fire even though failed logins are occurring, because the count never reaches the required value. This is the most direct and common cause for a correlation rule not triggering when expected.

Answer

The SIEM is receiving too many logs and dropping events.

Answer

The SIEM time zone is misconfigured.

Answer

The log source is not sending syslog data.

Question 6

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

Accepted Answer

Windows Security Event Logs (Event ID 4624, 4625).. Windows Security Event Logs with Event ID 4624 (successful logon) and 4625 (failed logon) are the authoritative source for interactive and remote logon events on a Windows system. They record the target user account (jsmith), the source IP address of the remote connection, and the timestamp, making them the direct and most reliable log source to determine if a specific user account was used from a remote IP during a breach window.

Answer

NetFlow records from the core switch.

Answer

VPN concentrator logs.

Answer

File server audit logs.

Question 7

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

Accepted Answer

Fine-tune correlation rules and thresholds based on historical data.. Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.

Answer

Implement a ticketing system for alerts.

Answer

Disable all correlation rules except critical ones.

Answer

Increase the number of analysts on shift.

Question 8

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

Accepted Answer

The email was sent from a domain that looks like 'arnazon.com'.. The most definitive indicator of a phishing attempt is a spoofed sender domain that mimics a legitimate company (e.g., 'arnazon.com' instead of 'amazon.com'). This is a classic typosquatting technique used to deceive users into trusting the email's origin. While other elements like logos or PDF attachments can be part of a phishing campaign, they are not inherently malicious and are commonly used in legitimate business communications.

Answer

The email has a company logo.

Answer

The attachment is a PDF file.

Answer

The email was sent during business hours.

Question 9

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

Accepted Answer

The monitor session source interface is incorrectly specified.. The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.

Answer

The IDS is in a different subnet.

Answer

The SPAN destination interface is not connected to the IDS.

Answer

The server is using VLAN tagging.

Question 10

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

Accepted Answer

DNS tunneling for data exfiltration.. The sudden spike in DNS queries to random subdomains of a legitimate domain (e.g., randomstring.google.com) is a classic indicator of DNS tunneling. This technique encodes data into DNS query names and exfiltrates it through the DNS protocol, bypassing network security controls that allow DNS traffic.

Answer

HTTP beaconing to a C2 server.

Answer

DNS amplification attack.

Answer

Port scanning using DNS.

Question 11

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 12

Which TWO are common indicators of a compromised host? (Choose two.)

Accepted Answer

Unusual spikes in outbound network traffic at odd hours.. Unusual spikes in outbound network traffic at odd hours (Option C) are a common indicator of a compromised host because they often signal data exfiltration, command-and-control (C2) beaconing, or botnet activity. Attackers frequently schedule malicious traffic during off-peak hours to evade detection, and the abnormal volume or timing relative to baseline behavior is a key anomaly in security monitoring.

Answer

User logging in during business hours.

Answer

Scheduled tasks running at regular intervals.

Answer

Antivirus updates occurring daily.

Question 13

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Accepted Answer

Defined incident response procedures.. Defined incident response procedures (Option C) are essential because they provide a structured, repeatable workflow for detecting, analyzing, and containing security incidents. Without pre-defined procedures, a security team cannot consistently execute the 'Respond' phase of the NIST SP 800-61 incident response lifecycle, leading to delayed containment and increased dwell time.

Answer

Antivirus software on all endpoints.

Answer

Data encryption at rest.

Question 14

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Accepted Answer

Regularly tune correlation rules based on feedback.. Option C is correct because SIEM correlation rules must be regularly tuned based on feedback from incident investigations and alert reviews. This iterative process adjusts thresholds, filters, and logic to match the actual threat landscape, reducing noise from benign events that match rule patterns but are not malicious.

Answer

Disable all alerts that generate more than 100 events per day.

Answer

Use a separate SIEM for each department.

Answer

Increase the number of log sources.

Question 15

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.