200-201 Timed Practice Test 4 — 10 Questions

Question 1

Based on the exhibit, what is the most likely type of attack being observed?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses, causing the target to allocate resources for half-open connections until it exhausts its backlog queue and denies legitimate traffic. The exhibit likely shows a massive spike in SYN packets without corresponding SYN-ACK or ACK completions, which is the hallmark of this attack.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

Port scan

Question 2

A security analyst receives an alert that an employee's workstation is generating outbound traffic to a known malware command-and-control IP address at 3:00 AM. According to the company's incident response policy, what is the FIRST action the analyst should take?

Accepted Answer

Isolate the workstation from the network by disabling the switch port.. The first action is to isolate the workstation from the network by disabling the switch port. This immediately stops the outbound command-and-control (C2) traffic, preventing data exfiltration and further compromise, while preserving the system state for forensic analysis. According to the incident response policy, containment takes precedence over eradication or recovery to limit damage.

Answer

Reimage the workstation immediately to remove the malware.

Answer

Apply the latest security patches to the workstation.

Answer

Call the employee to ask if they are working late.

Question 3

Match each security tool to its primary purpose.

Question 4

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been sent to an external IP address over port 443 during non-business hours. The company uses a proxy server that logs all outbound connections. Which action should the analyst take first to validate the suspicion?

Accepted Answer

Check the proxy logs to see the destination IP and user agent string.. Option C is correct because proxy logs contain the destination IP and user agent string, which are critical for validating whether the external IP is legitimate or malicious. By checking these logs first, the analyst can correlate the outbound connection with known threat intelligence or anomalous user agents without disrupting operations or consuming resources on unnecessary packet captures.

Answer

Immediately block the external IP address at the firewall.

Answer

Run a packet capture on the internal server to analyze the payload.

Answer

Notify the security team lead and wait for further instructions.

Question 5

A network security monitoring analyst is analyzing firewall logs and sees the following traffic: Source IP 10.1.1.50 to Destination IP 203.0.113.5 on port 443, protocol TCP, with a large amount of data transferred in both directions during business hours. The analyst suspects data exfiltration. Which TWO additional indicators would most strongly support this suspicion? (Choose two.)

Accepted Answer

The traffic uses TLS encryption with a self-signed certificate.. Option A is correct because a self-signed TLS certificate is often used by attackers to encrypt exfiltrated data without the overhead of obtaining a legitimate certificate from a trusted CA. Legitimate services typically use certificates signed by a recognized CA, so a self-signed certificate in traffic to an external IP on port 443 is a strong indicator of malicious activity, especially when combined with large data transfers.

Answer

The destination IP belongs to a cloud storage provider commonly used for backups.

Answer

The data transfer rate is consistently high for several hours.

Answer

The destination port is used by a well-known web service.

Question 6

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Accepted Answer

netstat -anob. The `netstat -anob` command displays active network connections, listening ports, and the associated process IDs (PIDs) along with the executable name. This is critical for identifying unauthorized outbound connections or backdoor listeners that indicate compromise. Because network state and process-to-port mappings reside in volatile memory (RAM), they are lost on reboot, making this command essential for live forensic collection.

Answer

dir /s C:\Windows\System32\config

Answer

wevtutil qe System /c:10

Answer

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Question 7

Match each Cisco CyberOps concept to its description.

Question 8

Match each Linux command to its function.

Question 9

Match each network device to its primary function.

Question 10

Match each network attack type to its description.

200-201 Timed Practice Test 4 — 10 Questions

Exhibit

200-201 Timed Practice Test 4 — 10 Questions

Exhibit