200-201 Practice Questions

A.  

An insider threat compromised the service account to delete sensitive data.

B.  

External attackers gained access and are exfiltrating data stealthily.

C.  

A ransomware attack is underway, encrypting files and deleting originals.

D.  

A misconfigured backup process malfunctioned, causing unexpected file changes.

A.  

Rule-based detection is effective with fewer false positives, and behavioral adapts over time.

B.  

Behavioral detection is easier to deploy without rules, and rule-based needs historical data.

C.  

Behavioral detection is adaptive to deviations, and rule-based detection uses static rules.

D.  

Rule-based detection excels at APT hunts with updates, and behavioral focuses on anomalies.

A.  

A policy violation is active for host 10.10.101.24.

B.  

A host on the network is sending a DDoS attack to another inside host.

C.  

There are two active data exfiltration alerts.

D.  

A policy violation is active for host 10.201.3.149.

A.  

A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised

B.  

A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring

C.  

A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

D.  

A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.

A.  

password cracking DoS attack on Windows endpoint

B.  

brute force attack on Windows from 10.10.10.10

C.  

regular Linux log and 10.10.10.10 is legitimate host

D.  

brute force attack on Linux from 10.10.10.10

A.  

swap files

B.  

temporary files

C.  

login sessions

D.  

dump files

E.  

free space

A.  

corroborative evidence

B.  

primary evidence

C.  

circumstantial evidence

D.  

secondary evidence

A.  

insert TCP subdissectors

B.  

extract a file from a packet capture

C.  

disable TCP streams

D.  

unfragment TCP

A.  

66

B.  

b4:2a0ef227 83

C.  

7c:5c:f8:9f:d1:fc

D.  

57813

A.  

Statistical detection involves the evaluation of events, and rule-based detection requires an evaluated set of events to function.

B.  

Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules

C.  

Rule-based detection involves the evaluation of events, and statistical detection requires an evaluated set of events to function Rule-based detection defines

D.  

legitimate data over a period of time, and statistical detection works on a predefined set of rules