200-201 Security Monitoring Practice Test 6 — 15 Questions

Question 1

A SOC analyst is reviewing alerts from a network-based intrusion detection system (NIDS). An alert indicates a potential SQL injection attempt, but the destination server is a web application that accepts SQL queries as part of its normal function. What should the analyst do?

Accepted Answer

Correlate with web server logs to determine if the request was malicious.. Option D is correct because the NIDS alert alone cannot confirm malicious intent when the destination server legitimately accepts SQL queries. Correlating with web server logs allows the analyst to examine the full HTTP request (e.g., parameters, payload, referrer) to distinguish between a benign feature usage and an actual SQL injection attack, such as detecting unexpected SQL keywords or syntax in input fields that should not contain them.

Answer

Disable the alert to reduce noise.

Answer

Tune the NIDS signature to ignore that server.

Answer

Immediately block the source IP.

Question 2

A company uses a SIEM that collects logs from firewalls, servers, and endpoints. The SIEM is generating a high volume of low-priority events, causing analysts to miss critical alerts. Which approach would best improve the signal-to-noise ratio?

Accepted Answer

Implement event filtering and correlation rules to reduce false positives.. The SIEM's high volume of low-priority events indicates a poor signal-to-noise ratio, where benign or irrelevant events drown out critical alerts. Implementing event filtering and correlation rules directly reduces false positives by discarding known noise (e.g., repeated benign scans) and grouping related events into meaningful alerts, allowing analysts to focus on genuine threats. This is the standard approach in SIEM tuning to improve detection fidelity without adding resources or data.

Answer

Deploy additional sensors to collect more data.

Answer

Hire more analysts to review all events.

Answer

Increase the storage capacity of the SIEM.

Question 3

An analyst is monitoring network traffic and sees a sudden spike in outbound data transfer from an internal server to an external IP that is known to be malicious. What is the most likely scenario?

Accepted Answer

Data exfiltration.. A sudden spike in outbound data transfer from an internal server to a known malicious external IP is a classic indicator of data exfiltration. Attackers often use compromised servers to siphon sensitive data (e.g., credentials, databases) to a command-and-control (C2) server. This behavior aligns with the post-compromise phase of an attack, where the goal is to extract data without triggering immediate alarms.

Answer

Software update.

Answer

User downloading a large file.

Answer

Normal backup operation.

Question 4

A security analyst is investigating an alert from a host-based intrusion detection system (HIDS) that detected a file modification in the system32 directory. Which log source should the analyst check first to understand the process that made the change?

Accepted Answer

Windows Event Logs.. Windows Event Logs (specifically Security Event ID 4656 or 4663) record detailed information about file operations, including the process that initiated the modification. Since the HIDS detected a file change in system32, the Event Logs provide the process name, user account, and timestamp needed to trace the source of the modification.

Answer

Firewall logs.

Answer

NetFlow data.

Answer

DNS logs.

Question 5

During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?

Accepted Answer

Configure the firewall to queue logs locally and forward when connectivity is restored.. Option C is correct because configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.

Answer

Restart the SIEM collector service.

Answer

Manually monitor the firewall console.

Answer

Ignore the gap because logs are not critical.

Question 6

Which of the following is a common indicator of a brute-force attack on an SSH server?

Accepted Answer

Repeated login attempts with different usernames and passwords in a short period.. A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.

Answer

A single failed login attempt.

Answer

Multiple successful logins from the same user.

Answer

High CPU usage on the server.

Question 7

A security analyst is reviewing logs from a web proxy and sees that a user's machine is making frequent connections to a domain that is registered recently and has a low reputation score. What is the best action?

Accepted Answer

Check if the user has a legitimate need to access the domain.. The best action is to check if the user has a legitimate need to access the domain because a recently registered domain with a low reputation score is a strong indicator of potential malicious activity, but it could also be a false positive or a legitimate new service. Security analysts must validate the context through user inquiry or additional log correlation before taking irreversible actions like blocking or disabling access. This aligns with the principle of least disruption and evidence-based decision-making in security monitoring.

Answer

Disable the user's network access.

Answer

Block the domain immediately.

Answer

Ignore because it might be a false positive.

Question 8

A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?

Accepted Answer

Centralized logging from all cloud services and on-premises.. Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.

Answer

Encrypting all logs at rest.

Answer

Reducing log retention to save cost.

Answer

Using only native cloud monitoring tools.

Question 9

Which TWO of the following are common sources of security events used in security monitoring?

Accepted Answer

Firewall logs. Firewall logs (B) are a primary source of security events because they record allowed and denied traffic based on access control lists (ACLs), providing critical data on attempted intrusions, policy violations, and reconnaissance scans. DNS query logs (E) are equally vital as they capture domain resolution requests, enabling detection of malware command-and-control (C2) communication, DNS tunneling, and connections to known malicious domains. Both are standard inputs for SIEM systems and security monitoring platforms.

Answer

Employee attendance records

Answer

Marketing campaign results

Answer

Company newsletter subscriptions

Question 10

Which TWO of the following are best practices when configuring a SIEM for security monitoring?

Accepted Answer

Tune rules to reduce false positives.. Tuning SIEM rules to reduce false positives is a best practice because it improves the signal-to-noise ratio, ensuring that security analysts focus on genuine threats rather than being overwhelmed by irrelevant alerts. By adjusting thresholds, whitelisting known benign activity, or refining correlation logic, the SIEM becomes more efficient and reduces alert fatigue, which is critical for effective security monitoring.

Answer

Disable logging for low-security systems.

Answer

Use the same log source for all event types.

Answer

Enable all default correlation rules.

Question 11

Which THREE of the following are indicators that a network may be compromised by a botnet?

Accepted Answer

Unusual outbound traffic to known command-and-control servers.. Option A is correct because botnet-infected systems typically communicate with command-and-control (C2) servers to receive instructions or exfiltrate data. Unusual outbound traffic to known C2 IPs or domains is a strong indicator of botnet activity, as legitimate traffic rarely targets these addresses. Security monitoring tools often use threat intelligence feeds to flag such connections.

Answer

High volume of ICMP echo requests.

Answer

Increase in legitimate business traffic.

Question 12

Refer to the exhibit. What type of activity does this log represent?

Accepted Answer

Brute force SSH attack.. The log shows repeated SSH connection attempts with 'Failed password' messages from the same source IP (10.10.0.5) to the same destination IP (10.10.0.3) for user 'admin'. This pattern of multiple failed authentication attempts in a short time window is characteristic of a brute force SSH attack, where an attacker systematically tries different passwords to gain unauthorized access.

Answer

Man-in-the-middle attack.

Answer

Denial-of-service (DoS) attack.

Answer

Port scan.

Question 13

Refer to the exhibit. An analyst observes that the router's ACL is allowing all traffic to the web server at 192.168.1.100 on ports 80 and 443, but blocking all other TCP ports below 1024. However, the web server is also running an SSH service on port 22. What will happen to SSH traffic from the outside?

Accepted Answer

SSH will be denied because of the deny line range.. The ACL denies all TCP ports below 1024 except ports 80 and 443, which are explicitly permitted. Since SSH uses TCP port 22, which falls within the denied range (below 1024) and is not explicitly permitted, it is blocked by the deny line. The last line 'permit ip any any' only applies to traffic not already denied, but SSH traffic is already denied by the earlier rule, so it never reaches that permit statement.

Answer

SSH will be permitted because of the last line 'permit ip any any'.

Answer

SSH will be denied because the ACL does not have an explicit permit for SSH.

Answer

SSH will be permitted because it is not blocked by any rule.

Question 14

Refer to the exhibit. An analyst sees repeated denied TCP connections from the same source to the same destination web server. Which of the following actions should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. Repeated denied TCP connections from the same source to the same destination web server are a classic indicator of a potential reconnaissance or attack pattern, such as a port scan or brute-force attempt. The first priority in security monitoring is to investigate the source IP for malicious activity (Option C) to determine intent and scope before taking any irreversible action. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Increase the logging level to get more details.

Answer

Create a permit rule for the source IP to allow legitimate traffic.

Answer

Block the source IP globally.

Question 15

A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?

Accepted Answer

The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.. Option B is correct because the SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.

Answer

The SIEM is not receiving logs from the authentication server.

Answer

The analyst is monitoring the wrong log source.

Answer

The SIEM correlation rule requires a minimum of 15 failed attempts.