3.7 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An analyst is correlating events from multiple sources to reconstruct an attack. The following events are observed: 09:00 - User receives a phishing email; 09:05 - User clicks a link; 09:10 - Host makes an outbound connection to a suspicious IP; 09:15 - A new scheduled task is created. Which event is the best indicator of persistence?

   • AThe outbound connection to the suspicious IP
   • BThe phishing email receipt
   • CThe user clicking the link
   • DThe new scheduled task creation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A firewall log shows a connection from an internal workstation to an external IP on TCP port 4444. The Windows Security log on the workstation shows a successful logon with a new account name that the analyst does not recognize. Which action is most appropriate?

   • ABlock the external IP immediately because the port is suspicious.
   • BIgnore the connection because port 4444 is commonly used for legitimate purposes.
   • CCheck the firewall log for the source port to determine the application.
   • DCorrelate the firewall log with the host log to determine if the connection is related to the unknown logon.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to centralize log collection from Windows workstations, Linux servers, and network firewalls for security analysis. The security team needs to correlate events across these sources. Which approach best meets this requirement?

   • AConfigure each device to send logs to a central SIEM platform.
   • BEnable Windows Event Forwarding only for Windows machines.
   • CUse a network packet capture tool to record all traffic instead of logs.
   • DStore logs locally on each device and only review them during incidents.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which hash algorithm is considered cryptographically broken and should not be used for security purposes, though it may still appear in legacy systems?

   • AMD5
   • BSHA-256
   • CSHA-3
   • DBLAKE2
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating a suspicious executable found on a Windows workstation. The analyst computes a SHA-256 hash of the file and compares it to the hash recorded in the organization's software inventory. The hashes match. However, the analyst notices that the file's creation timestamp is recent and the file is located in a user's Downloads folder, not the standard software deployment path. What is the most appropriate conclusion from this evidence?

   • AThe file content is identical to the inventoried file, but the deployment context is suspicious and should be investigated.
   • BThe hash match is irrelevant because SHA-256 can be spoofed by an attacker.
   • CThe file is definitely malicious because it is in the Downloads folder.
   • DThe file is confirmed as legitimate because its hash matches the inventory.
   Reveal Solution Discussion Select an answer first