3.7 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security analyst is investigating a URL that bypassed the web filter: http://www.example.com@10.10.10.10/evil.exe. The web filter only inspects the hostname portion of the URL. Why did the filter fail to block this request?

   • AThe filter only blocks HTTPS URLs
   • BThe filter ignored the IP address after the '@' symbol
   • CThe filter did not decode the URL-encoded characters
   • DThe filter does not inspect HTTP traffic
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   An analyst downloads a software installer from a vendor's website. Which action best verifies that the file has not been tampered with during download?

   • ARun the file in a sandbox and observe its behavior
   • BCheck the file's size and modification date
   • COpen the file in a text editor and look for suspicious strings
   • DCompare the file's SHA-256 hash to the hash published on the vendor's official site
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which part of a URL specifies the protocol used to access the resource?

   • AHost
   • BScheme
   • CQuery
   • DPath
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of an application-level log source?

   • AWeb server access log
   • BSyslog from a router
   • CKernel ring buffer
   • DWindows Security Event Log
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is triaging a suspicious file found on an endpoint. The analyst computes an MD5 hash and queries a local threat intelligence feed, which returns no results. The analyst then computes a SHA-1 hash and queries the same feed, also no results. Finally, the analyst computes a SHA-256 hash and queries the feed, which returns a hit for a known Trojan. What is the most likely reason for the initial misses?

   • AThe SHA-256 hash is more likely to match because it is longer.
   • BThe MD5 and SHA-1 hashes were computed incorrectly.
   • CThe threat intelligence feed only indexes SHA-256 hashes.
   • DThe file is not malicious because MD5 and SHA-1 did not match.
   Reveal Solution Discussion Select an answer first