200-201 Practice Test 10 — 10 Questions

Question 1

A company's security policy states that all remote access must be through a VPN. An employee complains that the VPN is too slow and asks for an exception to access a specific internal server directly over the internet. What should the security analyst recommend?

Accepted Answer

Investigate the VPN performance issue and optimize if possible.. Option D is correct because the security policy mandates VPN for all remote access, and bypassing it would violate the principle of least privilege and expose the internal server directly to the internet. The analyst should first investigate the VPN performance issue—common causes include MTU mismatch, high latency, or encryption overhead—and optimize it (e.g., adjusting MTU, using split tunneling, or upgrading hardware) rather than granting an exception that undermines security.

Answer

Configure a separate VPN profile with lower encryption.

Answer

Allow direct access but only from the employee's home IP.

Answer

Grant the exception temporarily and monitor the connection.

Question 2

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 3

A company is developing a new security policy for cloud storage. Which principle should be the foundation of the policy to ensure data confidentiality and integrity?

Accepted Answer

All data must be encrypted at rest and in transit.. Option C is correct because encryption at rest and in transit directly protects data confidentiality and integrity by rendering data unreadable without the proper decryption keys and by ensuring data is not tampered with during transmission. In cloud storage, encryption at rest (e.g., AES-256) safeguards data stored on disk, while encryption in transit (e.g., TLS 1.2/1.3) prevents interception or modification during upload/download. This dual-layer approach is the foundational security control for meeting confidentiality and integrity objectives, as defined in the CIA triad.

Answer

Access logs must be retained for at least one year.

Answer

Only authorized users can access the cloud storage.

Answer

Data must be backed up daily.

Question 4

Refer to the exhibit. A security analyst observes a SIEM alert and a firewall log. The firewall allowed the traffic. According to the company's security policy, which action should the analyst take first?

Accepted Answer

Create a firewall rule to block the source IP.. The correct answer is D because the firewall log shows the traffic was allowed, and the SIEM alert indicates a security event. According to the security policy, the immediate action is to block the source IP to prevent further potential malicious activity. Creating a firewall rule to block the source IP is a direct and effective response to mitigate the threat.

Answer

Check if the firewall blocked the traffic.

Answer

Investigate the user's recent activity.

Answer

Ignore the alert as it is a false positive.

Question 5

Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?

Accepted Answer

The process is a legitimate Windows service host. The 'tasklist /svc /fi "PID eq 1234"' command filters for a specific PID and displays the associated services. The output shows 'svchost.exe' with the service 'DcomLaunch', which is a core Windows component responsible for launching COM and DCOM services. This confirms the process is a legitimate Windows service host, not a third-party application or malware.

Answer

The process is a third-party application

Answer

The process is using excessive CPU resources

Answer

The process is likely malware masquerading as svchost.exe

Question 6

Refer to the exhibit. A network administrator notices that remote SSH logins to the router succeed, but the router is not sending accounting records. Based on the configuration, what is the most likely cause?

Accepted Answer

The accounting command references a TACACS+ group that is not defined.. The correct answer is D because the `accounting exec default` command references a TACACS+ server group named 'tacacs_server_group' that is not defined in the configuration. Without a defined server group, the router cannot send accounting records to any TACACS+ server, even though SSH authentication succeeds via the local database.

Answer

The AAA authorization method is set to local, not TACACS+.

Answer

The TACACS+ server key is not configured correctly.

Answer

The AAA authentication method uses local database instead of TACACS+.

Question 7

A security analyst is investigating an alert that indicates a host is sending a large number of DNS queries to an external domain. The analyst wants to determine if the traffic is malicious and if it is using a DNS tunnel. Which type of analysis should the analyst perform to confirm the presence of a DNS tunnel?

Accepted Answer

Analyze the payload size and query frequency of the DNS packets to detect anomalous patterns.. Option A is correct because DNS tunneling typically involves encoding data within DNS queries or responses, resulting in abnormally large payload sizes and unusual query frequencies. By analyzing these specific packet attributes, an analyst can detect the anomalous patterns characteristic of a DNS tunnel, such as high query rates to a single domain or payloads exceeding standard DNS message sizes (e.g., >512 bytes for UDP). This direct inspection of DNS packet content is the most reliable method to confirm tunneling activity.

Answer

Check the volume of DNS traffic from the host to identify any increase over baseline.

Answer

Examine the source IP addresses of the DNS queries to see if they originate from multiple hosts.

Answer

Review the firewall logs to identify any blocked DNS queries to the external domain.

Question 8

An analyst is investigating a host that is suspected of being compromised. The host's security logs show multiple failed login attempts followed by a successful login from an unusual IP address, and then a series of outbound connections to known malicious destinations. Which TWO actions should the analyst take immediately? (Choose two.)

Accepted Answer

Isolate the host from the network. Option B is correct because isolating the host from the network immediately stops the outbound connections to known malicious destinations, preventing further data exfiltration, lateral movement, or command-and-control (C2) communication. This containment step is critical in incident response to limit the blast radius before any other investigative or remediation actions are taken.

Answer

Delete the malicious files found on the host

Answer

Reboot the host to clear any malware from memory

Answer

Run a full antivirus scan on the host

Question 9

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

Accepted Answer

Acceptable Use Policy violation. Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Answer

Remote Access Policy violation

Answer

Incident Response Policy violation

Answer

Data Classification Policy violation

Question 10

A security policy requires that all changes to firewall rules be approved by two administrators. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement that two administrators must approve firewall rule changes enforces separation of duties, a security principle that prevents any single individual from having exclusive control over a critical operation. This reduces the risk of unauthorized or malicious rule modifications by ensuring collusion or independent review is required. In firewall management, this is often implemented via change management workflows with distinct approval and implementation roles.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege