200-201 Security Monitoring Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Accepted Answer

The ACL is not blocking traffic because the deny line has 0 matches.. Option B is correct because the ACL counters show 0 matches for the deny line that is intended to block traffic to the malicious host on port 443. This indicates that no traffic matching the deny condition has been processed by the ACL, meaning the rule is not being triggered. Since the ACL is applied inbound on the external interface, traffic from the external network destined for the malicious host should match the deny line if it is correctly configured; the 0 matches suggest the ACL is not blocking the intended traffic.

Answer

The ACL is working correctly; traffic to the malicious host is blocked.

Answer

The ACL needs to be applied outbound to work.

Answer

The ACL is blocking all traffic because the permit line is never used.

Question 2

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal web server and was blocked.. The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Answer

The access-group 'OUTSIDE_IN' permitted the traffic.

Answer

An internal host attempted to connect to an external web server.

Answer

The ASA allowed the connection because it is a stateful firewall.

Question 3

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Accepted Answer

The process path is in the Downloads folder.. The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Answer

The user is 'jsmith'.

Answer

The parent process is explorer.exe.

Answer

The event type is 'Process Creation'.

Question 4

You are a SOC analyst at a mid-sized company. The company uses a SIEM that ingests logs from firewalls, IDS, and endpoints. Over the past week, you've noticed a gradual increase in outbound traffic from several internal hosts to IP addresses in a foreign country during non-business hours. The traffic is primarily on port 443. The IDS has not generated any alerts. The firewall logs show the connections are established. You check the endpoints and find no unusual processes running. However, the outbound connections persist. What is the most likely explanation and the best next step?

Accepted Answer

Enable SSL decryption on the firewall to inspect the traffic content.. The gradual increase in outbound traffic on port 443 (HTTPS) to foreign IPs during non-business hours, without IDS alerts or suspicious processes, strongly suggests data exfiltration over encrypted channels. Since the traffic is encrypted, the IDS cannot inspect the payload, and endpoint checks may miss stealthy malware that uses legitimate processes (e.g., svchost.exe) for beaconing. Enabling SSL decryption on the firewall allows the SOC to decrypt and inspect the HTTPS traffic, revealing the actual content and confirming or ruling out exfiltration.

Answer

Assume the hosts are compromised and reimage them.

Answer

Ignore the traffic since the IDS and endpoints show no signs of compromise.

Answer

Immediately isolate all affected hosts from the network.

Question 5

You are a security administrator for a company with 500 employees. The company uses a SIEM with basic correlation rules. Recently, the HR department reported that several employees received phishing emails with a link to a fake login page. The emails bypassed the spam filter. You want to detect if any employees clicked the link. You have access to web proxy logs, DNS logs, and endpoint antivirus logs. The phishing link is 'http://malicious-login.com/verify'. Which action should you take first to identify affected users?

Accepted Answer

Query the web proxy logs for HTTP requests containing the URL.. The web proxy logs record all HTTP requests made by clients, including the full URL path. Querying for 'http://malicious-login.com/verify' directly shows which employees clicked the link, because the proxy captures the exact destination and timestamp of each request. This is the most direct and reliable evidence of user interaction with the phishing link.

Answer

Run a vulnerability scan on all employee workstations.

Answer

Search DNS logs for queries to 'malicious-login.com'.

Answer

Search endpoint logs for any malware detections.

Question 6

A security analyst is reviewing logs from multiple network devices and notices that a large number of ICMP echo requests with a payload size of 65507 bytes are being sent to a single server from various external IP addresses. The server is becoming unresponsive. Which type of attack is most likely occurring?

Accepted Answer

ICMP flood. D is correct because an ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request packets, consuming bandwidth and processing resources. The large payload size (65507 bytes) is a characteristic of a crafted ICMP packet, but the key indicator here is the sheer volume from multiple sources causing the server to become unresponsive, which aligns with a volumetric ICMP flood rather than a single malformed packet.

Answer

Ping of death

Answer

SYN flood

Answer

Smurf attack

Question 7

A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?

Accepted Answer

Increase the threshold to 15 failed logins within a 10-minute window.. Option D is correct because increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.

Answer

Whitelist all external IP addresses that belong to business partners.

Answer

Reduce the time window to 2 minutes to catch attacks faster.

Answer

Change the rule to block the source IP after 5 failed attempts.

Question 8

A SOC analyst is tuning an IPS rule that detects SQL injection attempts. The rule currently generates a high number of alerts, most of which are false positives caused by legitimate web application traffic containing SQL-like keywords. The analyst wants to reduce false positives without missing actual attacks. Which approach is most effective?

Accepted Answer

Implement a whitelist of known good SQL queries from the application.. Option A is correct because implementing a whitelist of known good SQL queries from the application allows the IPS to ignore benign traffic that matches SQL-like patterns, reducing false positives while still alerting on any SQL injection attempt that deviates from the whitelist. This approach leverages application-specific knowledge to distinguish legitimate queries from malicious ones, maintaining detection coverage for actual attacks.

Answer

Reduce the rule's sensitivity to only match exact attack patterns.

Answer

Disable the rule and rely on web application firewall logs.

Answer

Exclude all HTTP GET requests from inspection.

Question 9

A network security monitoring analyst is analyzing firewall logs and sees the following traffic: Source IP 10.1.1.50 to Destination IP 203.0.113.5 on port 443, protocol TCP, with a large amount of data transferred in both directions during business hours. The analyst suspects data exfiltration. Which TWO additional indicators would most strongly support this suspicion? (Choose two.)

Accepted Answer

The traffic uses TLS encryption with a self-signed certificate.. Option A is correct because a self-signed TLS certificate is often used by attackers to encrypt exfiltrated data without the overhead of obtaining a legitimate certificate from a trusted CA. Legitimate services typically use certificates signed by a recognized CA, so a self-signed certificate in traffic to an external IP on port 443 is a strong indicator of malicious activity, especially when combined with large data transfers.

Answer

The destination IP belongs to a cloud storage provider commonly used for backups.

Answer

The data transfer rate is consistently high for several hours.

Answer

The destination port is used by a well-known web service.

Question 10

You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?

Accepted Answer

A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.. The alert is triggered by a correlation rule that detects more than 30 failed authentication attempts from a single source IP within 10 minutes. The observed pattern—exactly 6 attempts per minute, every 5 seconds—is highly regular and mechanical, which is characteristic of an automated script or misconfigured process, not human behavior. Since the partner company locks accounts after 3 failed attempts, a human user would be locked out quickly and could not sustain 30+ attempts; only a script ignoring the lockout policy or using a cached incorrect password could produce this pattern.

Answer

The user 'john.doe' has forgotten his password and is repeatedly trying to log in.

Answer

A man-in-the-middle attack is replaying captured authentication packets.

Answer

The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.

Question 11

A security analyst is investigating an alert that indicates a host is sending a large number of DNS queries to an external domain. The analyst wants to determine if the traffic is malicious and if it is using a DNS tunnel. Which type of analysis should the analyst perform to confirm the presence of a DNS tunnel?

Accepted Answer

Analyze the payload size and query frequency of the DNS packets to detect anomalous patterns.. Option A is correct because DNS tunneling typically involves encoding data within DNS queries or responses, resulting in abnormally large payload sizes and unusual query frequencies. By analyzing these specific packet attributes, an analyst can detect the anomalous patterns characteristic of a DNS tunnel, such as high query rates to a single domain or payloads exceeding standard DNS message sizes (e.g., >512 bytes for UDP). This direct inspection of DNS packet content is the most reliable method to confirm tunneling activity.

Answer

Check the volume of DNS traffic from the host to identify any increase over baseline.

Answer

Examine the source IP addresses of the DNS queries to see if they originate from multiple hosts.

Answer

Review the firewall logs to identify any blocked DNS queries to the external domain.

Question 12

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Accepted Answer

The destination IP is listed in a threat intelligence feed as a known C2 server.. Option B is correct because a destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

Answer

The packet size is consistently 1452 bytes across multiple connections.

Answer

The source IP also connected to multiple other external IPs on port 443 within the same hour.

Answer

The traffic is using HTTPS (port 443) which is commonly used for covert channels.

Question 13

You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?

Accepted Answer

Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.. Option B is correct because the presence of a legitimate svchost.exe with a valid Microsoft signature does not rule out DLL sideloading or injection. By listing all DLLs loaded by the process, you can identify suspicious non-Microsoft DLLs that may be executing malicious code within the trusted svchost.exe context, which is a common technique used by malware to evade detection.

Answer

Perform a full system reimage of the workstation to ensure the malware is removed.

Answer

Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.

Answer

Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.

Question 14

Drag and drop the steps for the TCP three-way handshake into the correct order.

Question 15

Drag and drop the steps to analyze a packet capture for suspicious activity into the correct order.

200-201 Security Monitoring Practice Test 2 — 15 Questions

Exhibit

200-201 Security Monitoring Practice Test 2 — 15 Questions

Exhibit