200-201 Timed Practice Test 1 — 10 Questions

Question 1

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

10 minute time limit — choose an answer to begin.

Accepted Answer

Successful authentication event. A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.

Answer

Network share access event

Answer

Account creation event

Question 2

A network engineer is configuring a Cisco Firepower IPS. To reduce false positives from legitimate updates, which action should be taken?

Accepted Answer

Enable adaptive profile. Enabling adaptive profile allows the IPS to learn normal traffic patterns and reduce false positives. Whitelisting is also useful but adaptive profiles are specifically designed to reduce false positives dynamically.

Answer

Use a whitelist for the update server

Answer

Disable the signature

Answer

Set the signature to generate only alert

Question 3

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Accepted Answer

powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.. PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.

Answer

svchost.exe (PID 1420) because it is connecting to an external IP on port 80.

Answer

cmd.exe (PID 2568) because it could be used to launch other processes.

Answer

notepad.exe (PID 2344) because it is not expecting to make any network connections.

Question 4

A network intrusion detection system (NIDS) generates an alert for a known exploit against a web server. The analyst verifies that the server is patched. What is the next best step?

Accepted Answer

Investigate if the exploit was actually attempted. Even if the server is patched, the exploit attempt may indicate a broader attack or reconnaissance. Investigating the attempt helps determine intent and identify other compromised systems.

Answer

Reconfigure the NIDS to block the traffic

Answer

Tune the signature to ignore the server

Answer

Dismiss the alert as a false positive

Question 5

During a security awareness training session, an employee reports they clicked a link in a phishing email but did not enter credentials. Which policy violation is most likely involved?

Accepted Answer

Incident reporting policy. Clicking a suspected phishing link without reporting it violates the incident reporting policy. Option A is wrong because the employee did not enter credentials, so password policy is intact. Option B is wrong because the link itself is not necessarily prohibited by AUP unless it involves inappropriate content. Option D is wrong because data classification policy is about handling data, not email links.

Answer

Data classification policy

Answer

Acceptable use policy

Answer

Password policy

Question 6

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 7

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

Accepted Answer

Windows executable files. 0x5A4D is the MZ header for Windows executables (PE files). The rule looks for files starting with 'MZ' and less than 500KB, likely targeting small malware executables.

Answer

PDF files

Answer

JPEG images

Answer

Linux ELF files

Question 8

A security analyst is creating a policy for handling sensitive customer data. The policy must ensure data is encrypted at rest and in transit. Which type of policy most directly addresses this requirement?

Accepted Answer

Data Protection Policy. A data protection policy specifically covers encryption, storage, and transmission controls. Option B is correct. Option A (access control) is about permissions. Option C (incident response) is about breaches. Option D (physical security) is about facilities.

Answer

Incident Response Policy

Answer

Access Control Policy

Answer

Physical Security Policy

Question 9

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

Accepted Answer

Isolate the workstation by disconnecting it from the network immediately.. The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Answer

Block the external IP address on the firewall and continue monitoring.

Answer

Run a full forensic analysis on the workstation without disconnecting it.

Answer

Update the antivirus signatures and run a full scan on the workstation.

Question 10

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Accepted Answer

The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls. The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.

Answer

The destination 'any' allows SSH to any external server, which is too permissive

Answer

The ACL permits SSH from unauthorized IP addresses

Answer

The ACL sequence is illogical; line 30 should be before lines 10 and 20