200-201 Security Monitoring Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. An administrator sees many alerts for DNS tunneling. The current DNS inspection policy is shown. What change would most likely help detect DNS tunneling?

Accepted Answer

Raise the message-length maximum to 4096 bytes.. DNS tunneling exploits the DNS protocol to exfiltrate data by encoding it in DNS queries and responses. Raising the message-length maximum to 4096 bytes allows the DNS inspection engine to inspect larger DNS payloads, which is necessary to detect tunneling attempts that use long TXT or other resource records to carry data. The current lower limit may allow tunneled data to pass undetected because the inspection engine truncates or ignores oversized messages.

Answer

Remove the dns-guard command.

Answer

Lower the message-length maximum to 128 bytes.

Answer

Disable DNS inspection entirely.

Question 2

Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?

Accepted Answer

The internal server is trying to access the router's web interface, which is blocked by an ACL.. The log messages show repeated TCP connection attempts from internal server 10.0.0.2 to the router's IP on port 443 (HTTPS) and port 80 (HTTP), which are denied by an ACL. Since the source is an internal server and the destination is the router's own IP, this indicates the server is trying to reach the router's web interface, but the ACL is blocking those packets. Option C correctly identifies this scenario.

Answer

An external host is scanning the router.

Answer

The router is under a brute-force attack on the HTTP server.

Answer

The router is infected with malware and generating traffic.

Question 3

A security analyst is reviewing logs from a Cisco Firepower Management Center and notices that many legitimate SSL connections are being blocked by the intrusion policy. Which configuration change should the analyst make to reduce false positives without compromising security?

Accepted Answer

Add the affected servers to a network analysis policy exception.. Adding the affected servers to a network analysis policy (NAP) exception allows the Firepower system to bypass intrusion inspection for traffic to and from those specific hosts while still performing SSL decryption and other security checks. This reduces false positives from legitimate SSL connections without completely disabling SSL inspection or weakening the overall security posture.

Answer

Increase the severity threshold for SSL-related rules.

Answer

Change the intrusion policy to "Connectivity Over Security".

Answer

Disable SSL inspection globally.

Question 4

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

Accepted Answer

The SPAN source does not include that VLAN.. A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Answer

The IDS interface is set to promiscuous mode.

Answer

The SPAN destination port is in trunk mode.

Answer

The IDS is in inline mode.

Question 5

A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?

Accepted Answer

Constant bit rate and consistent packet size.. Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.

Answer

Random destination ports.

Answer

High number of small packets.

Answer

Low number of bytes per flow.

Question 6

A Cisco ASA firewall is configured to send syslog messages to a SIEM. Which logging level includes 'informational' messages?

Accepted Answer

Level 6. C is correct because Cisco ASA syslog messages use the standard syslog severity levels defined in RFC 5424. 'Informational' messages correspond to severity Level 6, which provides normal operational information such as connection teardowns or configuration changes. This level is commonly used for monitoring without overwhelming the SIEM with debug-level data.

Answer

Level 5

Answer

Level 3

Answer

Level 0

Question 7

A Cisco Firepower sensor is generating an alert for a known benign application. The analyst has verified it is a false positive. What is the first step to suppress this alert?

Accepted Answer

Create a network analysis policy exception.. A network analysis policy (NAP) exception is the correct first step because it allows you to suppress alerts for specific benign applications without affecting the overall detection posture. In Cisco Firepower, NAP exceptions are applied before intrusion rules are evaluated, so they can filter out known false positives at the preprocessor level, preventing the rule from even triggering. This is more efficient than modifying the intrusion rule itself, as it avoids disabling detection for other traffic.

Answer

Increase the severity threshold.

Answer

Submit a false positive report to Talos.

Answer

Disable the intrusion rule globally.

Question 8

A Linux server is configured with auditd to monitor file access. Which audit rule will detect any attempt to read the /etc/shadow file?

Accepted Answer

-w /etc/shadow -p r. Option D is correct because the `-p r` flag in an auditd rule specifies that the rule should monitor for read access attempts. The `/etc/shadow` file contains hashed passwords, and reading it is a common post-exploitation reconnaissance step. The `-w` flag watches a file, and `-p r` triggers an audit event when the file is opened for reading.

Answer

-w /etc/shadow -p x

Answer

-w /etc/shadow -p a

Answer

-w /etc/shadow -p w

Question 9

A SIEM correlation rule triggers when a user account is created and then added to a privileged group within 10 minutes. Which activity does this rule detect?

Accepted Answer

Privileged account creation and elevation.. The SIEM rule specifically correlates the creation of a user account followed by its addition to a privileged group within a short time window. This sequence directly maps to the definition of privileged account creation and elevation, where a new account is granted administrative rights. The rule does not require any other malicious activity like data theft or lateral movement to trigger.

Answer

Malicious insider data theft.

Answer

Privilege escalation via token manipulation.

Answer

Lateral movement using pass-the-hash.

Question 10

A network administrator is using Cisco ISE to monitor endpoint authentication. Which report provides details on failed authentication attempts and the reasons?

Accepted Answer

RADIUS Authentication Report. The RADIUS Authentication Report in Cisco ISE specifically logs all authentication attempts, including failures, and provides detailed reasons for each failure (e.g., invalid credentials, user not found, or authorization policy mismatch). This report is the primary tool for troubleshooting failed authentications because it captures the RADIUS Access-Reject messages and the corresponding failure reasons from the ISE policy evaluation.

Answer

Endpoint Profiler Report

Answer

RADIUS Accounting Report

Answer

Active Session Report

Question 11

An organization must retain security logs for at least one year due to regulatory compliance. However, their SIEM storage is limited. Which strategy best balances compliance and storage?

Accepted Answer

Archive logs to compressed files after 30 days and retain for one year.. Option A is correct because archiving logs to compressed files after 30 days preserves data for compliance while saving storage space. Option B deletes logs too early; Option C loses raw data; Option D is expensive.

Answer

Delete logs after 30 days and rely on local log rotation.

Answer

Only store alerts and drop raw logs.

Answer

Increase SIEM storage without archiving.

Question 12

Based on the exhibit, which type of traffic is being denied?

Accepted Answer

UDP traffic from an internal host to an external DNS server.. The exhibit shows an access control list (ACL) entry that denies UDP traffic from any source to any destination with a destination port of 53, which is the standard port for DNS. Since the ACL is applied inbound on an interface facing the internal network, it specifically blocks UDP traffic originating from an internal host destined for an external DNS server. This matches option C exactly.

Answer

Traffic permitted by the access group.

Answer

TCP traffic to a DNS server.

Answer

ICMP traffic from an external host.

Question 13

Based on the exhibit, which traffic is permitted?

Accepted Answer

All HTTPS traffic to the host 198.51.100.10.. The exhibit shows an access control list (ACL) entry 'permit tcp any host 198.51.100.10 eq 443'. This permits TCP traffic with a destination port of 443 (HTTPS) to the specific host 198.51.100.10 from any source. Therefore, only HTTPS traffic destined to that host is permitted, making option D correct.

Answer

All IP traffic from the host 198.51.100.10.

Answer

Only HTTPS traffic from the host 198.51.100.10.

Answer

All TCP traffic from any host to any host.

Question 14

Based on the exhibit, what condition triggers an alert?

Accepted Answer

More than 1000 DNS queries from a single source within 60 seconds.. The exhibit shows a rule configured to trigger an alert when the number of DNS queries from a single source IP exceeds 1000 within a 60-second sliding window. This is a rate-based threshold designed to detect DNS amplification or tunneling attacks, where a single host generates an abnormally high volume of DNS requests. Option A correctly describes this condition.

Answer

A single DNS query to a known malicious domain.

Answer

Any UDP traffic to port 53 exceeding 1000 packets per second.

Answer

More than 1000 UDP connections to port 53 within 60 seconds.

Question 15

Which two are best practices for deploying network-based intrusion detection systems? (Choose two.)

Accepted Answer

Use tap or SPAN ports to ensure traffic visibility.. Options A and B are correct. Deploying sensors at network choke points ensures visibility of all traffic, and using tap or SPAN ports allows passive monitoring without introducing latency or failure points. Option C is not a best practice because placing sensors behind firewalls may miss attacks that never reach the firewall. Option D is not always appropriate as inline mode can introduce latency and is not required for detection. Option E would generate excessive false positives.

Answer

Place sensors behind firewalls to reduce false positives.

Answer

Enable all signatures to maximize detection.

Answer

Use inline mode for all sensors to enable blocking.

200-201 Security Monitoring Practice Test 4 — 15 Questions

Exhibit

200-201 Security Monitoring Practice Test 4 — 15 Questions

Exhibit