200-201 Security Monitoring Practice Test 7 — 15 Questions

Question 1

During a security incident, a network engineer captures traffic with tcpdump and saves it to a pcap file. The analyst needs to extract all HTTP POST requests containing a specific string in the URI. Which command should be used?

Accepted Answer

tcpdump -r traffic.pcap 'tcp port 80' -A | grep 'POST' | grep 'string'. Option B is correct because it uses tcpdump with the `-r` flag to read the pcap file, filters for TCP port 80 (HTTP), uses `-A` to print packet payloads in ASCII, and then pipes the output through two grep commands: first to isolate lines containing 'POST' (indicating HTTP POST requests) and second to filter for the specific string in the URI. This combination efficiently extracts only the relevant HTTP POST requests with the target string from the captured traffic.

Answer

tcpdump -r traffic.pcap -X | grep 'string'

Answer

ngrep -q -W byline 'POST.*string' port 80

Answer

tcpdump -r traffic.pcap -nn 'host 10.0.0.1'

Question 2

A SOC analyst receives an alert from the SIEM indicating a high number of outbound DNS queries from an internal host to a domain known for malicious activity. The analyst reviews the logs and finds that the host is a DNS server. What should be the analyst's first action?

Accepted Answer

Isolate the DNS server from the network and escalate to incident response.. The correct first action is to isolate the DNS server from the network and escalate to incident response. A DNS server generating outbound DNS queries to a known malicious domain indicates a likely compromise (e.g., DNS tunneling or malware command-and-control), not normal recursive resolution. Immediate containment prevents further data exfiltration or lateral movement, aligning with incident response best practices.

Answer

Check the baseline of DNS traffic to confirm it is anomalous.

Answer

Block the domain at the firewall and close the alert.

Answer

Restart the DNS service on the server and monitor.

Question 3

An organization uses Cisco Stealthwatch for network traffic analysis. The analyst observes a sudden increase in traffic from a workstation to multiple external IPs on port 443. The traffic pattern shows consistent packet sizes of 1500 bytes, and the destination IPs are spread across different geographic regions. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via HTTPS.. The consistent 1500-byte packet size indicates maximum-sized TCP segments, which is atypical for interactive web browsing but common when data is being padded to fill MTU for efficient exfiltration. Cisco Stealthwatch detects this anomalous volumetric pattern to external IPs on HTTPS (port 443) as a sign of data exfiltration, where an internal host sends large, uniform chunks of data to multiple external destinations to evade detection.

Answer

VoIP call initiation.

Answer

Normal web browsing activity.

Answer

A DDoS attack originating from the workstation.

Question 4

A security analyst is configuring a new SIEM platform. The organization has multiple log sources, including Windows Event Logs, Linux syslog, and firewall logs. The analyst wants to ensure that logs are not lost if the SIEM becomes unavailable. Which approach best addresses this requirement?

Accepted Answer

Configure log sources to send logs to a centralized collector with local storage and forwarding capabilities.. Option B is correct because deploying a centralized collector with local storage and forwarding capabilities creates a buffer that ensures logs are not lost during SIEM unavailability. The collector receives logs from sources, stores them locally (e.g., on disk or in a queue), and forwards them to the SIEM when it becomes available again. This decouples log generation from SIEM ingestion, preventing data loss even during extended outages.

Answer

Configure the SIEM to pull logs from sources via Syslog over TCP.

Answer

Implement log replication between SIEM nodes.

Answer

Increase the storage capacity of the SIEM to hold more logs.

Question 5

An analyst is monitoring network traffic and notices a host sending ICMP echo requests to multiple hosts in the same subnet with a pattern of incrementing TTL values. What is the most likely purpose of this activity?

Accepted Answer

Traceroute to map the network topology.. The pattern of incrementing TTL values in ICMP echo requests is the hallmark of a traceroute operation. Traceroute works by sending packets with TTL=1, then TTL=2, etc., so each successive router along the path decrements the TTL to 0 and sends back an ICMP Time Exceeded message, revealing the hop-by-hop path. The target host responds with an ICMP Echo Reply when the TTL is high enough to reach it, confirming the final hop.

Answer

DNS resolution attempt.

Answer

Ping sweep to identify active hosts.

Answer

Denial of service attack against a specific host.

Question 6

A company uses Cisco Firepower NGFW with intrusion prevention. The security team notices that some legitimate traffic is being blocked by the IPS, causing application outages. The analyst reviews the IPS signature events and finds false positives. What is the best approach to handle this without reducing security posture?

Accepted Answer

Create a custom rule to exclude the affected traffic based on source/destination, while monitoring the signature for true positives.. Option C is correct because it allows the security team to selectively exclude only the specific legitimate traffic causing false positives, using source/destination criteria in a custom rule, while keeping the IPS signature active for all other traffic. This approach maintains the overall security posture by still detecting true positives from the same signature against other traffic flows. Disabling or lowering the signature's severity would globally reduce detection capability, and updating the database may not address a signature that is inherently too broad for the environment.

Answer

Lower the severity of the signature to informational.

Answer

Disable the IPS signature that is causing the false positives.

Answer

Update the IPS signature database to the latest version.

Question 7

An organization uses Cisco AMP for Endpoints. A file with a low prevalence score is executed on multiple endpoints, and AMP identifies it as malicious after behavioral analysis. The analyst needs to ensure that all endpoints are protected from this file. Which action should be taken?

Accepted Answer

Create a custom IOC for the file hash and apply it to an outbreak policy.. Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.

Answer

Isolate all endpoints that executed the file.

Answer

Disable cloud connectivity for AMP to prevent recurrence.

Answer

Run a scan on each endpoint using the local AMP engine.

Question 8

A SOC analyst is reviewing a firewall log and sees a large number of outbound connections from an internal server to a known command-and-control (C2) domain. The connections are on port 443, and the packets have irregular timing. What should the analyst do first?

Accepted Answer

Isolate the server from the network and escalate to incident response.. The irregular timing and outbound connections to a known C2 domain on port 443 strongly indicate a compromised host using HTTPS to blend in with normal traffic. Isolating the server first prevents further data exfiltration or lateral movement while preserving forensic evidence, which aligns with the NIST incident response framework. Escalating to incident response ensures proper handling and analysis.

Answer

Check the server's logs for signs of compromise.

Answer

Ignore the alert because port 443 is normal traffic.

Answer

Block the domain at the firewall immediately.

Question 9

Which TWO of the following are valid sources of security monitoring data in a Cisco security architecture?

Accepted Answer

Syslog messages. Syslog messages (C) are a standard protocol for logging events from network devices, servers, and applications, making them a primary source of security monitoring data. NetFlow records (E) provide IP traffic flow statistics, enabling network behavior analysis and anomaly detection. Both are explicitly listed as valid data sources in Cisco's security monitoring architecture.

Answer

RADIUS accounting

Answer

SNMP traps

Answer

WMI queries

Question 10

Which TWO of the following are best practices when configuring a SIEM correlation rule to detect lateral movement?

Accepted Answer

Include a time window to limit the correlation to a few minutes between events.. Option A is correct because including a time window (e.g., 5 minutes) in a SIEM correlation rule ensures that only events occurring within a short, defined interval are correlated. This is critical for detecting lateral movement, where an attacker must quickly pivot from one host to another; without a time window, the rule would match events that are too far apart in time, generating excessive false positives. The time window aligns with the typical speed of automated tools like PsExec or RDP brute-force scripts, which execute logons in rapid succession.

Answer

Exclude the source IP address from the correlation to focus on user identity.

Answer

Use only a single log source, such as domain controller logs, to simplify the rule.

Answer

Set the rule to trigger on any Event ID 4624 (successful logon) regardless of type.

Question 11

Which THREE of the following are common indicators of compromise (IOCs) that a security monitoring system might trigger on?

Accepted Answer

Unusual outbound network connections to unfamiliar IP addresses.. Unusual outbound network connections to unfamiliar IP addresses are a common indicator of compromise (IOC) because they often signal command-and-control (C2) communication, data exfiltration, or malware beaconing. Security monitoring systems analyze netflow or firewall logs to detect connections to IP addresses not in the organization's baseline or known threat intelligence feeds. This behavior deviates from normal traffic patterns and is a key trigger for alerts in SIEM or IDS/IPS systems.

Answer

High CPU usage on a server.

Answer

Successful logon from a domain administrator account.

Question 12

Your organization uses a SIEM solution (Cisco Secure Network Analytics and Cisco Secure Cloud Analytics) for monitoring. You are the lead analyst and receive multiple alerts: (1) A host on the internal network is making thousands of outbound connections to a known malicious IP on port 80 in a short time. (2) At the same time, there is a spike in DNS queries from the same host to a domain that is registered very recently. (3) The firewall logs show that the host is communicating with internal servers on high ports (e.g., 4444, 5555). The host is a Windows 10 workstation used by the finance department. The user reports it has been slow recently. You have access to Cisco AMP for Endpoints, Cisco Firepower NGFW, and Cisco Stealthwatch. The environment has 500 endpoints, and the network uses 802.1X authentication. What should be your first course of action?

Accepted Answer

Isolate the host from the network immediately and begin investigation.. Option D is correct because the combination of outbound connections to a known malicious IP, recent domain DNS queries, and internal C2-like traffic on high ports (4444, 5555) indicates a confirmed compromise. Immediate isolation via 802.1X or switch ACL stops lateral movement and data exfiltration while preserving forensic evidence. Cisco AMP for Endpoints can then be used to analyze the host offline without risking further spread.

Answer

Check the current baseline for the host to confirm it is anomalous.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Update the antivirus signatures on the host and run a full scan.

Question 13

A security analyst is monitoring network traffic and notices a sudden increase in outbound connections from a single workstation to multiple IP addresses on port 443 at regular intervals. The workstation is used for standard office applications. Which action should the analyst take first?

Accepted Answer

Correlate the connections with firewall logs and endpoint telemetry. Option A is correct because the sudden increase in outbound connections to multiple IPs on port 443 (HTTPS) from a single workstation could indicate command-and-control (C2) traffic, data exfiltration, or a compromised system. The first step should be to correlate these connections with firewall logs and endpoint telemetry to gather contextual evidence—such as process names, parent processes, and connection durations—before taking any disruptive action. This aligns with the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes containment.

Answer

Immediately block all outbound traffic from the workstation

Answer

Escalate to the incident response team immediately

Answer

Isolate the workstation from the network

Question 14

A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?

Accepted Answer

The threat intelligence feed contains a false positive for that domain. The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.

Answer

The Snort rule is misconfigured and should be disabled

Answer

The rule is too broad and matches all DNS queries

Answer

The Snort signature is too generic and should be tuned

Question 15

A Security Operations Center (SOC) uses Security Information and Event Management (SIEM) with event correlation. Analysts notice that alerts for a specific malware signature have decreased sharply after a new firewall rule was deployed. However, endpoint scans still show infections on several hosts. What is the most likely explanation for the decrease in SIEM alerts?

Accepted Answer

The firewall rule blocks the malware's C2 traffic, so SIEM no longer receives network alerts, but endpoint infections persist. The firewall rule specifically blocks command-and-control (C2) traffic, which is the network communication channel the malware uses to send data or receive instructions. Since the SIEM relies on network-based alerts (e.g., from intrusion detection systems or firewall logs) to detect this traffic, blocking the C2 traffic eliminates those network alerts. However, the malware remains on the endpoints because the firewall does not remove the infection; it only prevents outbound communication, so endpoint scans still detect the malware files or processes.

Answer

The SIEM correlation rules were accidentally disabled during the firewall update

Answer

The SIEM is not receiving logs from the endpoint detection and response (EDR) tool

Answer

The malware has mutated into a different variant that evades detection