Free 200-201 practice test: 30 questions with answers

Event ID 4624 records a successful logon. Event 4625 records a failed logon, 4688 records process creation when auditing is enabled, and 1102 shows that the audit log was cleared.

Any byte change alters the hash, so comparing against a trusted baseline reveals modification. Timestamps can be altered or left unchanged, and application associations and icons do not reflect file contents.

Scheduled tasks and Run registry keys can restart a program at logon or on a timer, which is how malware persists. Wallpaper, printer fonts and keyboard layouts are rarely used for persistence.

auth.log records authentication events, including SSH logins and sudo activity, on Debian-based systems. The passwd file stores account data, the apt cache holds packages, and the boot directory holds loader files.

Sysmon Event ID 1 records process creation with parent and command-line details, which is useful for tracing suspicious child processes. Event 4625 records failed logons, print spooler logs cover printing, and the DHCP lease table lists addresses.

RAM changes constantly and is lost at power-off, so it is collected first. Disk images and archives persist, and backup tapes are static.

Syslog severity 0 is emergency, the highest priority. Notice is level 5, warning is level 4, and debug is level 7, the lowest priority.

Flow records summarise conversations by address, port and protocol without the payload. Full packet capture keeps every packet, web server logs record HTTP requests, and host event logs come from endpoints.

An inline IPS sits in the traffic path and can block packets based on signatures or policy. A passive IDS only alerts from a copy of the traffic, a tap copies without acting, and an analyser only records.

Many failures from one source, whether against one account or many accounts, is the core pattern of brute force and spraying. A single approved login, hardware specifications and firmware timestamps do not indicate password guessing.

The content keyword matches a byte or text pattern in the payload. The msg option sets the alert text, sid gives a unique signature ID, and classtype groups alerts by category.

This display filter matches connection-initiation packets by their TCP flags. Port 80 alone does not test flags, the IP filter has no flag logic, and frame contains searches raw bytes for text.

Integrity means data is accurate and cannot be altered without authorisation. Availability concerns access when needed, confidentiality limits disclosure, and non-repudiation proves who performed an action.

A matching hash shows the file bytes are unchanged from the published version. It does not prove who signed the file or that the file is free of malware, and a hash is not encryption.

Symmetric encryption uses one shared key and is efficient for large volumes of data. Public and private key pairs and certificates belong to asymmetric schemes, and symmetric encryption alone does not prove who sent a message.

A vulnerability is the weakness in the system. An exploit is the code or method that takes advantage of it, a threat actor is the party behind an attack, and a risk register records risks.

NAT maps internal addresses to external ones at the boundary, which hides the internal addressing. DHCP assigns addresses, DNS resolves names, and ARP maps IP addresses to MAC addresses on a local segment.

Diffie-Hellman lets two parties derive a shared secret over an open channel. AES encrypts data with an existing key, SHA-512 is a one-way hash, and Base64 is an encoding rather than encryption.

SYN, SYN-ACK and ACK is the TCP three-way handshake that opens a connection. TLS negotiation starts after TCP is established, DNS uses query and response messages, and ICMP echo is the ping exchange.

Tunnelling encodes data into long random subdomain labels and often uses TXT or NULL records to carry responses. A single lookup, normal HTTP success and DHCP renewals are routine traffic.

A tautology such as OR 1=1 changes the logic of a SQL query, which is the signature of SQL injection. Cross-site scripting injects script into pages, directory traversal uses path sequences, and port scanning probes ports rather than parameters.

Regular, similar-sized callbacks to one external host are a classic beacon pattern used by malware to receive commands. Browsing is bursty, backups go to known destinations on a schedule, and DHCP renewals stay on the local network.

RST aborts a connection immediately, which commonly happens when no service is listening on the port. FIN closes gracefully, URG marks urgent data, and PSH asks for prompt delivery.

403 Forbidden means the request was understood but access is denied. A 301 indicates a permanent redirect, 503 means the service is unavailable, and 400 indicates a malformed request.

Detection and Analysis covers confirming an incident and determining its scope and impact. Preparation builds capability before incidents, Recovery restores systems, and Post-incident activity captures lessons learned.

A chain of custody records each handler, time and purpose so the evidence stays credible and admissible. A final report alone leaves gaps, tool preference is irrelevant, and copying the evidence does not replace documenting each transfer.

A change management policy defines approval paths and records for emergency changes. A topology diagram shows layout, a brochure is not a governance document, and a test script checks functionality.

Evidence records and defined roles keep the response coordinated and defensible. Publishing before containment, deleting logs and inconsistent evidence formats all damage the response or its legal value.

GDPR governs personal data of individuals in the EU and includes breach notification duties. PCI DSS covers payment card data, HIPAA covers US health information, and SOX covers financial reporting controls.

Rules of engagement define scope, timing and permitted methods so the test stays authorised and controlled. Capture filters, firewall exports and price lists are operational or commercial documents.