200-201 Timed Practice Test 2 — 10 Questions

Question 1

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

10 minute time limit — choose an answer to begin.

Accepted Answer

SMB brute force. Pass-the-hash uses NTLM hashes for authentication, and SMB brute force involves trying multiple passwords or hashes. Both can produce multiple failed attempts then success.

Answer

SQL injection

Answer

ARP spoofing

Answer

DNS tunnelling

Question 2

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Accepted Answer

MAC because it is more secure. MAC provides stricter, system-enforced controls based on classification, which is often adopted in higher-security environments. DAC relies on user discretion and is less secure.

Answer

DAC because it is more flexible

Answer

Both can coexist

Answer

A new hybrid model combining both

Question 3

A company's security policy requires that all system logs be retained for at least one year. A security analyst discovers that log files are being overwritten after 30 days. What is the most likely cause?

Accepted Answer

The log rotation policy is set to 30 days. The log rotation setting is likely set to 30 days, causing overwrites. Option A is wrong while disk space may contribute, the direct cause is the rotation policy. Option B is wrong because malware is less likely. Option D is wrong because an administrator deleting logs would be a deliberate act.

Answer

Logs are being manually deleted by an administrator

Answer

Malware infection

Answer

Insufficient disk space

Question 4

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Accepted Answer

HTTP and HTTPS traffic only. The ACL permits TCP traffic from 10.0.0.0/8 to any destination on ports 80 (HTTP) and 443 (HTTPS). Option B is wrong because only these two ports are permitted. Option C is wrong because it permits only HTTP and HTTPS. Option D is wrong because both HTTP and HTTPS are allowed.

Answer

All TCP traffic

Answer

All IP traffic from 10.0.0.0/8

Answer

Only HTTP traffic

Question 5

A security policy mandates that all administrative access to network devices must be encrypted. Which of the following protocols should be used to comply with this policy?

Accepted Answer

SSH. SSH (Secure Shell) encrypts all traffic, including authentication credentials and commands, between an administrator and a network device. This satisfies the policy requirement for encrypted administrative access, unlike Telnet which sends everything in plaintext.

Answer

Telnet

Answer

TFTP

Answer

SNMPv2c

Question 6

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Accepted Answer

Monitor DNS query sizes and frequencies. DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.

Answer

Disable recursive DNS on the internal DNS server

Answer

Implement DNSSEC

Answer

Block all DNS queries to external servers

Question 7

An analyst receives a syslog message with facility 'authpriv' and severity '3'. What does severity 3 indicate?

Accepted Answer

Error. Syslog severity levels range from 0 (Emergency) to 7 (Debug). Severity 3 corresponds to 'Error', which indicates error conditions that require attention but are not immediately critical. This is defined in RFC 5424, where level 3 is explicitly labeled 'Error' and is used for conditions such as configuration failures or service degradation.

Answer

Emergency

Answer

Critical

Answer

Alert

Question 8

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

Accepted Answer

A compromised host attempting to communicate with a command-and-control server over encrypted traffic. The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Answer

A false positive due to a web browser accessing a secure site

Answer

An attacker scanning for open HTTPS ports on the internal network

Answer

A benign HTTPS connection to a legitimate website

Question 9

An analyst needs to establish a normal traffic pattern baseline for the network. Which activity is most appropriate for this purpose?

Accepted Answer

Capture traffic over a period of normal operation, such as a week. Establishing a baseline requires capturing traffic during a period of normal operation, typically over a week, to account for daily and weekly usage patterns. This baseline represents the typical volume, protocol mix, and flow characteristics, enabling the analyst to later detect deviations that may indicate security incidents. Using a representative sample from normal conditions is the foundational step in anomaly-based monitoring.

Answer

Capture traffic during a known attack to identify anomalies

Answer

Use only firewall logs as they are the most reliable

Answer

Average traffic from multiple different organizations

Question 10

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy