Security Monitoring (25%)

200-201 · 75 questions

• At a retailer, staff close an unused remote-desktop port on the registers, while a missing patch remains on the file server. What did closing that port reduce?
• At a bank, the internet-facing VPN appliance is powered on and reachable from outside the bank, and no specific software flaw has been named. What is that exposure called?
• At a hospital, the imaging server cannot be reached from the guest network, and that server still runs an unpatched service. Which statement is the vulnerability?
• At a manufacturer, an analyst needs the payload bytes of one plant-floor transfer, not a summary of the conversation. Which source contains those bytes?
• At a hotel, a firewall log shows an allowed TCP session from a guest laptop to port 443 and says nothing about the website or the application. Which source produces a record limited to that connection?
• At a logistics hub, a record shows source, destination, ports, packet counts, and byte counts, and it contains no URL and no file contents. Which source type is that record?
• At a university, a lab page lists every URL the research portal accepts, and a separate note says one parameter is not sanitized. Which statement describes the vulnerability?
• At a bank, a log names the application, the user, and an intrusion verdict, in addition to the port. Which technology produced that log?
• Engineers at a SaaS company can name the application on a flow even when the traffic uses a port that is not the well-known port for that application. Which technology supplies the application name?
• A retailer is comparing a new next-generation firewall with the older stateful firewall already in the store. What does the next-generation firewall add that the older one does not already provide?
• A hospital analyst has three records for three different questions: a packet capture, an exported flow record, and a mail-filter verdict. Which record can recover a file from an unencrypted download?
• At an agency, a workstation browsed a site and the only saved record is a web-filter line that contains the URL and a category. What can that saved line not show?
• An agency record shows the sender, the recipient, the attachment name, and a phishing verdict. Which source produced that record?
• A university report lists a URL category and states whether the campus filter allowed the request. Which source produces a report in that form?
• An MSSP customer wants byte counts for a conversation that ended yesterday, and nobody saved the packets. Which source can still show those counts?
• A retailer kept the full packet capture for a checkout session, and the file body inside that session is unreadable while the session uses TLS. What is the monitoring impact?
• Hotel firewall logs on the outside show one public address in use by many front-desk PCs at the same time. What is required to name the specific inside PC for one of those sessions?
• A manufacturer wants the category of a website that a plant workstation requested, and the team does not need a copy of the packets. Which source holds that category?
• An agency workstation sends its web browsing into an anonymity overlay, and the local proxy log records only the first hop into that overlay. Which technology accounts for that limited record?
• At a bank, a sensor inside the data center never sees scan packets that the edge access list drops before they enter the data center. What visibility impact does that filtering have?
• At a university, traffic that looks like DNS carries a second protocol inside it, and the intrusion-detection rule for that inner protocol never fires. What is the visibility impact?
• The same bank transfer appears as four summary lines in one monitoring note. Which line describes the impact of NAT rather than the impact of encryption?
• At a logistics hub, a GRE-style wrapper carries an inner conversation whose addresses are not the addresses on the outer header a sensor indexed. What is the monitoring impact?
• At a SaaS company, one client session is split across several web servers, and any single server log is missing most of the URLs from that session. What is the monitoring impact?
• At an MSSP, a customer ACL log shows denies, and the IDS placed behind that ACL has no events for the same traffic. What is the correct reading of those two records?
• At a university, student traffic is wrapped in an extra IP header before it leaves a research tunnel, and the outside sensor shows a tunnel address rather than the student's address. What visibility impact explains that result?
• At a manufacturer, two hosts exchange files with a peer-to-peer protocol, and those transfers never appear in the web proxy log. Why is the web proxy the wrong place to look?
• At a hospital, legal staff need the contents of an unencrypted file that a workstation downloaded. Which data type should the analyst retrieve to supply those contents?
• Leadership at a logistics hub wants to know whether tonight's outbound volume is unusual for that site. Which data type answers the question?
• At a retailer, an analyst needs only who talked to whom, when they talked, and how many bytes moved, for one flow from last week. Which data type answers that request?
• An agency record lists a file hash, a file size, and the mailbox that sent the file, and the record does not include the file body. What data type is that record?
• At a university, an analyst needs the DNS name that was queried and the answer code that came back, not the packets surrounding the lookup. Which data type supplies those two fields?
• At a bank, a monitoring tool has already decided that one flow matches a known beacon and has attached a signature name to that decision. Which type of security data is this record?
• At a manufacturer, the plant has an alert that a signature fired on one flow, and no packets were saved for that flow. What can that alert not answer?
• An MSSP customer forwards only alerts and does not include session records. Which question can those alerts answer that session data cannot answer on its own?
• At a retailer, one host sends a huge number of TCP SYN packets to the payment server, and legitimate clients can no longer complete a connection. Which attack class fits this traffic?
• At a bank, a workstation answers ARP for the gateway address and then starts receiving frames that were meant for the gateway. What class of attack is this behavior?
• At a SaaS company, support wants proof of what was in a response body, but the security team has only metadata and session data for that exchange. What is missing?
• At a hotel, an analyst has four records from last night's guest traffic and must pick the one that is transaction data rather than session data. Which record is transaction data?
• Dozens of outside addresses send the same request to a university, and the public campus website becomes unreachable for students. Which attack class fits?
• Hotel guests still reach the network, yet a device on the path rewrites DNS answers so browsers open a look-alike booking site. Which attack class is this?
• At a manufacturer, one crafted packet abuses a parser in an industrial protocol and crashes the listener on a plant controller. Which attack class is this?
• At a university, a lab form passes a student-supplied field into a server shell command, and the page returns a directory listing from that server. Which attack produced the listing?
• On a retailer product-search page, a parameter contains a quote and a database keyword, and the response includes rows that belong to a different customer. Which attack is this?
• A logistics hub sees two SYN floods on its tracking site, one from a single address and one from many addresses using the same request pattern. Which flood is distributed?
• At a bank, a person calls the wire desk, pretends to be a known executive, and demands an urgent transfer, and there is no malware on the call. Which attack is this?
• At a hospital, a patient-portal page places input from a clicked link into the HTML returned to that same person, and the response shows no database error. Which attack fits?
• At a SaaS company, a comment field stores a script, and that script runs later in the browsers of other users who open the same comment. Which attack is this?
• At an agency, a reviewer treats a script that runs in the victim browser as if it were a statement that runs in the database. What is the correction?
• At a bank, reviewers compare several probes against one web application from the same afternoon. Which probe is command injection?
• At an agency, an email matches the director's writing, cites a real project, and asks for a password. A phone call to the director shows the director did not send the email. What did that second channel stop?
• At a retailer, a program copies more data into a fixed buffer than that buffer can hold, and the process then runs attacker-controlled instructions. Which attack is this?
• At a bank, after the initial infection, a host calls the same rare address every few minutes and receives tasking back. Which attack stage is that repeating exchange?
• At a university, students say they can spot fake mail by grammar, but a lure arrives with perfect grammar and a real course name and asks for a course password. What is the better check?
• At a hotel, one guest emails the manager a link, and a different guest makes the same request by phone. What do those two contacts have in common?
• At an MSSP, a customer wants a control for AI-written mail that has no attachment and no malicious URL and only asks to change a payment account. Which control fits that request?
• At a manufacturer, a voicemail sounds like the plant manager and asks maintenance to email a badge export, but the manager is in a meeting and did not call. What pattern is this?
• At a hospital, an unwanted program with a known-bad hash is resident on a clinical PC, has not encrypted any files, and is not a document lure. Which attack category fits that program?
• At a university, a lab PC is slow, no files on it are encrypted, and a process has been injected into a signed binary. Which broad attack category fits?
• At a manufacturer, files on a design share are renamed and a note demands payment before those files can be restored. Which endpoint-attack category fits that outcome?
• At a bank, an intrusion rule looks for a string inside HTTP bodies. The same string is then sent inside TLS and the rule does not fire. Which evasion explains the miss?
• At an agency, malware traffic is wrapped inside DNS, and a detection rule that looks for the malware's own port stays quiet. Which evasion technique is in use?
• At a logistics hub, analysts must separate command and control from ransomware and from other endpoint activity. Which event is the command-and-control activity?
• After a SaaS company TLS handshake, application data is encrypted with a symmetric key both sides derived. Why is that bulk data not encrypted with the server long-term private key?
• A hospital clinic trusts a station only after the station certificate chains to a hospital authority. What is that certificate chain for?
• A retailer host is blocked from direct internet access, so it sends that traffic to an internal proxy that is allowed outbound, and the outside log shows the proxy rather than the host. What evasion is in use?
• A hotel analyst compares a TLS session that encrypts HTTP with a DNS session whose payload is another protocol. Which session is tunneling rather than encryption?
• During a bank TLS handshake the server certificate crosses the network, and the server long-term private key does not. Which of these is supposed to stay off the wire?
• An MSSP customer reports that the attacker used a proxy, encryption, and a tunnel, and the path to the sensor is direct. Which technique hides the bytes from deep inspection?
• An agency analyst captures the server certificate during a TLS handshake and reports that the private key was stolen because that certificate crossed the network. What correction should the SOC lead give?
• A bank proxy log shows one session that negotiated TLS 1.2 and a second session that negotiated TLS 1.3. What differs between those two sessions?
• A university analyst inspects an object that shows a subject, an issuer, validity dates, and a subject alternative name, and the object does not include a private key. Which format family is this?
• At a manufacturer, a TLS handshake agrees on a fresh shared secret by using ephemeral values, while the long-term private key only signs that exchange. Which piece is the analyst looking at?
• A SaaS company holds a password-wrapped file that contains a certificate and its private key, ready to import onto a server. Which PKCS flavor is that file?
• A retailer TLS log records the string TLSAES128GCMSHA256 for a completed connection to the payment application. What is that string naming?