200-201 Practice Test 18 — 15 Questions

Question 1

A security analyst is investigating a potential data breach. Which two actions are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Searching for employee information on LinkedIn. Passive reconnaissance involves gathering information without directly interacting with the target. WHOIS lookups and searching job postings are passive. Port scanning and social engineering are active.

Answer

Performing a port scan on the company's web server

Answer

Using a ping sweep to identify live hosts

Answer

Sending a phishing email to employees

Question 2

A security team is analyzing a malware infection. Which two characteristics are typical of a worm? (Choose two.)

Accepted Answer

Exploits vulnerabilities to spread without user interaction. Worms are self-replicating and spread across networks without human intervention. They do not require a host file and often exploit vulnerabilities.

Answer

Requires a host file to propagate

Answer

Disguises itself as a legitimate program

Answer

Attaches to an email to spread

Question 3

A security analyst discovers that an attacker is using a vulnerability scanning tool to identify open ports on the company's network. Which type of attack is being performed?

Accepted Answer

Active reconnaissance. Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.

Answer

Social engineering

Answer

Passive reconnaissance

Answer

Denial of Service

Question 4

A company processes credit card payments and must comply with a framework that mandates specific security controls for protecting cardholder data. Which compliance framework applies?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, mandatory for entities handling credit card information.

Answer

ISO 27001

Answer

GDPR

Answer

HIPAA

Question 5

Which compliance framework is specifically designed to protect the privacy and security of electronic health information in the United States?

Accepted Answer

HIPAA. HIPAA governs protected health information (PHI) in the US.

Answer

GDPR

Answer

ISO 27001

Answer

PCI DSS

Question 6

Which type of malware is characterized by self-replication and spreading to other systems without user interaction, often causing network congestion?

Accepted Answer

Worm. A worm is self-replicating and spreads automatically, unlike a virus which requires a host file.

Answer

Ransomware

Answer

Trojan

Answer

Virus

Question 7

Which security concept describes the potential for a threat to exploit a vulnerability, and is often expressed as a combination of likelihood and impact?

Accepted Answer

Risk. Risk is the probability and potential damage from a threat exploiting a vulnerability.

Answer

Exploit

Answer

Threat

Answer

Vulnerability

Question 8

A security analyst is investigating an incident where an attacker successfully altered DNS records to redirect users to a fake website. Which attack occurred?

Accepted Answer

DNS poisoning. DNS poisoning corrupts DNS resolver caches to redirect traffic to malicious sites.

Answer

ARP spoofing

Answer

Man-in-the-Middle

Answer

Pharming

Question 9

An organization needs to ensure that a document has not been altered and to verify the sender's identity. Which combination of cryptographic techniques should be used?

Accepted Answer

Digital signature and hashing. Hashing ensures integrity (detects changes), and digital signatures (asymmetric) provide authentication and non-repudiation.

Answer

Digital signature and symmetric encryption

Answer

Symmetric encryption and hashing

Answer

Asymmetric encryption and hashing

Question 10

During a security assessment, an analyst uses the Shodan search engine to find exposed industrial control systems. Which phase of the attack lifecycle does this activity represent?

Accepted Answer

Reconnaissance. Reconnaissance involves gathering information about targets. Shodan is a passive reconnaissance tool that indexes device information without direct interaction.

Answer

Command and control

Answer

Delivery

Answer

Exploitation

Question 11

Which phase of the NIST Cybersecurity Framework involves actions to limit the impact of a cybersecurity incident?

Accepted Answer

Respond. The Respond phase includes activities to contain, mitigate, and respond to incidents.

Answer

Protect

Answer

Identify

Answer

Detect

Question 12

An organization is implementing a security policy to protect sensitive data. Which three are considered compliance frameworks that could guide this effort? (Choose three.)

Accepted Answer

HIPAA. PCI DSS, HIPAA, and GDPR are well-known compliance frameworks. NIST CSF is a framework but not a compliance standard; ISO 27001 is a standard but the question asks for compliance frameworks.

Answer

NIST Cybersecurity Framework

Answer

ISO 27001

Question 13

A security analyst discovers that a server's configuration allows users to access files outside of their intended directory. In security terminology, what is this weakness called?

Accepted Answer

Vulnerability. A vulnerability is a weakness that can be exploited.

Answer

Exploit

Answer

Threat

Answer

Risk

Question 14

Which of the following is an example of a symmetric encryption algorithm?

Accepted Answer

AES. Symmetric encryption uses the same key for encryption and decryption. AES and 3DES are symmetric algorithms.

Answer

SHA-256

Answer

RSA

Answer

ECC

Question 15

A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?

Accepted Answer

Passive reconnaissance. Reconnaissance attacks involve gathering information to identify vulnerabilities. Passive reconnaissance uses publicly available sources like social media.

Answer

Active reconnaissance

Answer

Denial of Service

Answer

Social engineering