3.7 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step an analyst should take when extracting a URL from a log for analysis?

   • APerform a DNS lookup on the domain
   • BCheck the URL's reputation
   • CDecode any URL-encoded characters
   • DCopy the URL exactly as it appears in the log
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is correlating events from a compromised Linux server. The auth.log shows a successful SSH login from an external IP at 02:00. The bash history shows a command to download a file from a URL at 02:05. The firewall log shows an outbound connection to the same external IP on port 443 at 02:06. The analyst also finds a cron job that runs a script every minute. Which conclusion is most defensible?

   • AThe outbound connection is legitimate because it uses port 443.
   • BThe cron job is the root cause of the outbound connection, and the SSH login is unrelated.
   • CThe bash history is not reliable evidence because it can be modified.
   • DThe SSH login, file download, and outbound connection are part of a single attack chain.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of a cryptographic hash function in the context of file integrity?

   • ATo compress the file to save storage space
   • BTo encrypt the file contents so they cannot be read
   • CTo convert the file into a human-readable format
   • DTo produce a fixed-size digest that uniquely represents the file's data
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which URL obfuscation technique uses hexadecimal or decimal representations of an IP address to hide the true destination?

   • AIP address obfuscation
   • BURL encoding
   • CDomain squatting
   • DRedirects
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is comparing two files to determine if they are identical. The analyst computes MD5 hashes for both files and they match. However, the analyst is concerned about the possibility of a collision attack. Which additional step would most effectively address this concern?

   • AUse the MD5 hash alone because it is sufficient for integrity checking.
   • BCheck the file creation timestamps to see if they match.
   • CCompare the file sizes to ensure they are the same.
   • DCompute SHA-256 hashes for both files and compare them.
   Reveal Solution Discussion Select an answer first