200-201 Timed Practice Test 3 — 10 Questions

Question 1

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Accepted Answer

ICMP tunneling. ICMP tunneling encapsulates non-ICMP data (e.g., command-and-control traffic) within ICMP echo request/reply packets. The random payload data and larger-than-typical payload size are hallmarks of this technique, as the attacker uses the ICMP protocol to bypass firewalls and exfiltrate data or establish covert communication.

Answer

Ping of death

Answer

Traceroute

Answer

Smurf attack

Question 2

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. Option A is correct because the immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Answer

Analyze packet captures to determine the full extent of the compromise

Answer

Block all outbound HTTPS traffic from the network

Answer

Reimage the host immediately to remove the malware

Question 3

Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)

Accepted Answer

A business-critical application cannot function with the policy control.. Option D is correct because a business-critical application that cannot function with a security policy control represents a legitimate operational need that may require a temporary exception. Security policies should support business objectives, and if a control (e.g., a firewall rule, an antivirus exclusion, or an application whitelisting policy) prevents a critical application from running, an exception can be granted after a risk assessment and compensating controls are implemented. This aligns with the principle of balancing security with business continuity.

Answer

The employee finds the policy inconvenient.

Answer

The policy is too new and employees are not yet trained.

Answer

The employee is a senior executive.

Question 4

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines the boundaries of the policy's applicability. Option C is correct because explicitly listing the systems and networks covered ensures that all stakeholders understand which assets fall under the policy's requirements, preventing gaps or overlaps in security controls.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 5

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Accepted Answer

Least privilege. Option D, least privilege, is correct because the design restricts access to the sensitive database to only the specific application server that requires it. This principle dictates that users, processes, or systems should be granted the minimum permissions necessary to perform their functions, thereby reducing the attack surface. By implementing network access control lists (ACLs) or firewall rules that permit traffic solely from the application server's IP address to the database port, the engineer enforces least privilege at the network layer.

Answer

Defense in depth

Answer

Separation of duties

Answer

Weakest link

Question 6

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Accepted Answer

Smart card. Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Answer

IP address whitelist

Answer

Password

Answer

Security question

Question 7

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Accepted Answer

The destination IP is listed in a threat intelligence feed as a known C2 server.. Option B is correct because a destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

Answer

The packet size is consistently 1452 bytes across multiple connections.

Answer

The source IP also connected to multiple other external IPs on port 443 within the same hour.

Answer

The traffic is using HTTPS (port 443) which is commonly used for covert channels.

Question 8

Which TWO of the following are essential components of an effective security policy framework according to Cisco best practices?

Accepted Answer

A high-level security policy that defines management's intent.. A high-level security policy is essential because it defines management's intent, establishes the organization's security philosophy, and provides the authoritative foundation for all subordinate policies, standards, and procedures. According to Cisco best practices, this top-tier document must be approved by senior leadership and sets the strategic direction for the entire security program, ensuring alignment with business objectives and regulatory requirements.

Answer

A network diagram showing all security devices.

Answer

A password policy that specifies minimum length and complexity.

Answer

A log analysis procedure for detecting anomalies.

Question 9

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Accepted Answer

Look for connections to known malicious IP addresses or domains.. Connections to known malicious IP addresses or domains are a strong indicator of data exfiltration, as attackers often use command-and-control (C2) servers to receive stolen data. This aligns with the principle of threat intelligence-based detection, where security feeds (e.g., Cisco Talos, AlienVault OTX) provide reputation scores for external hosts. Identifying such outbound connections helps confirm that data is being sent to an adversary-controlled destination.

Answer

Clear the network logs to ensure accurate analysis.

Answer

Focus exclusively on inbound traffic from external sources.

Answer

Immediately block all outbound traffic from the suspect host.

Question 10

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Option C is correct because implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope