200-201 Practice Test 20 — 15 Questions

Question 1

A company's security policy states that all network traffic must be inspected by an IPS. However, encrypted traffic (SSL/TLS) is bypassing inspection. The network team wants to implement SSL decryption. What is the primary policy consideration before implementing?

Accepted Answer

Obtain legal approval for decryption of user traffic.. Option B is correct because legal and policy approval for traffic decryption is paramount. Options A, C, E are technical steps after approval. Option D is important but secondary to legal approval.

Answer

Configure the firewall to block SSL traffic that cannot be decrypted.

Answer

Notify all users that their traffic will be inspected.

Answer

Create a certificate authority to issue certificates to all internal servers.

Answer

Ensure that the SSL decryption device has enough CPU capacity.

Question 2

An security auditor finds that the company's backup policy does not include offsite storage. The security policy requires that backups be stored in a geographically separate location. What should the company do?

Accepted Answer

Use encrypted cloud backup in a different region. Option D is correct because encrypted offsite cloud storage satisfies the geographical separation requirement. Option A is wrong because onsite storage is not geographically separate. Option B is wrong because increasing retention does not change location. Option C is wrong because RAID provides redundancy but not offsite storage.

Answer

Store backups in a fireproof safe on-site

Answer

Implement RAID on the backup server

Answer

Increase backup retention period

Question 3

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Options A, B, and D are correct hardening practices. Option C is wrong as default credentials are weak. Option E is wrong because Telnet is insecure.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 4

An organization's security policy requires that all traffic between the corporate network and the internet be inspected by an IPS. However, encrypted traffic (HTTPS) cannot be inspected without breaking encryption. Which solution best meets the policy requirement?

Accepted Answer

Implement SSL/TLS interception using a proxy with a trusted certificate. SSL/TLS interception using a trusted proxy allows inspection of encrypted traffic while maintaining security, though it requires careful implementation and user acceptance.

Answer

Allow all HTTPS traffic without inspection

Answer

Rely on endpoint security only

Answer

Disable HTTPS for internal users

Question 5

An analyst discovers that an employee has been using company-issued laptops to run a personal cryptocurrency mining software. Which policy violation has occurred?

Accepted Answer

Acceptable Use Policy. Cryptocurrency mining typically violates the Acceptable Use Policy (AUP) because it consumes company resources for non-work purposes. Option B is correct. Option A (data classification policy) is about labeling data. Option C (incident response policy) is about handling security events. Option D (change management policy) is about modifying systems.

Answer

Incident Response Policy

Answer

Change Management Policy

Answer

Data classification policy

Question 6

Which TWO activities are typically part of a security policy review cycle? (Choose two.)

Accepted Answer

Reviewing regulatory updates. Policy review includes identifying changes in regulatory requirements and periodic audits. Options A and B are correct. Option C (patching) is operational. Option D (user training) is part of awareness, not review. Option E (incident handling) is not review.

Answer

Delivering security awareness training

Answer

Handling a security incident

Answer

Applying system patches

Question 7

A security policy mandates that all employees complete annual security awareness training. Which of the following metrics best demonstrates the effectiveness of this training?

Accepted Answer

Decrease in security incidents attributed to user error. Option D is correct because a reduction in incidents caused by user error directly indicates improved awareness. Option A may reflect adherence but not effectiveness. Option B measures volume, not effectiveness. Option C could be due to other factors.

Answer

Results of a post-training quiz

Answer

Percentage of employees who completed the training

Answer

Number of help desk tickets related to phishing

Question 8

A security analyst notices repeated failed login attempts from an external IP. The company has a policy for account lockout after 5 failed attempts. However, the lockout is not triggering. What is the most likely cause?

Accepted Answer

The failed attempts are occurring on a legacy application that does not integrate with Active Directory.. Option B is correct because legacy applications may not integrate with Active Directory domain lockout policies. Option A is plausible but not specific to external IP. Option C is unlikely. Option D is possible but not given. Option E is irrelevant.

Answer

The lockout threshold is set to 10 attempts.

Answer

The lockout policy is applied to user accounts but not to administrative accounts.

Answer

The intrusion prevention system is blocking the lockout mechanism.

Answer

The firewall is allowing the traffic but not logging.

Question 9

An analyst is verifying a VPN configuration. Which of the following is true about this configuration?

Accepted Answer

The VPN uses AES-256 encryption and SHA-1 authentication.. Option A is correct because 'esp-aes 256' uses AES-256, and 'esp-sha-hmac' uses SHA-1. Option B uses DES/MD5. Option C uses 3DES/SHA-256. Option D uses AES-128/SHA-1. Option E uses AES-256/SHA-2, but SHA-2 is not specified.

Answer

The VPN uses AES-128 encryption and SHA-1 authentication.

Answer

The VPN uses AES-256 encryption and SHA-2 authentication.

Answer

The VPN uses 3DES encryption and SHA-256 authentication.

Answer

The VPN uses DES encryption and MD5 authentication.

Question 10

A user reports that they cannot access a file server. The security policy requires that all access be logged and monitored. What is the most likely reason for the access failure?

Accepted Answer

The user's IP address is not in the allowed list. Option C is correct because the user's IP address might not be in the allowed list per policy. Options A, B, and D are plausible but less directly related to the policy requirement.

Answer

The user's account is locked

Answer

The file server is down

Answer

The user's password has expired

Question 11

A company is implementing a security policy that requires all employees to use multi-factor authentication (MFA) when accessing corporate resources remotely. However, during a recent security audit, it was found that several employees have been using app passwords for legacy applications that do not support MFA. What is the best practice under this policy?

Accepted Answer

Create a separate policy for legacy applications with compensating controls.. Option C is correct because a separate policy with compensating controls (like network segmentation, monitoring) is appropriate. App passwords are not true MFA and can bypass security. Discontinuing legacy apps is too disruptive, allowing app passwords violates the policy, and VPN does not address the MFA requirement.

Answer

Allow app passwords as they provide a second factor.

Answer

Implement a VPN requirement for legacy application access.

Answer

Discontinue use of legacy applications until they support MFA.

Question 12

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Accepted Answer

MAC because it is more secure. MAC provides stricter, system-enforced controls based on classification, which is often adopted in higher-security environments. DAC relies on user discretion and is less secure.

Answer

DAC because it is more flexible

Answer

Both can coexist

Answer

A new hybrid model combining both

Question 13

A company's security policy states that all employees must use multi-factor authentication (MFA) when accessing the corporate network remotely. Which policy is being applied?

Accepted Answer

Access Control Policy. MFA is an authentication control, often part of an Access Control Policy. Option B is correct. Option A (remote access policy) is a subset but the stem directly says 'accessing the corporate network.' Option C (acceptable use) is about behavior. Option D (incident response) is about handling incidents.

Answer

Incident Response Policy

Answer

Remote Access Policy

Answer

Acceptable Use Policy

Question 14

Refer to the exhibit. A network administrator applied this ACL inbound on the external interface of a firewall. An attacker sends a TCP SYN packet with source IP 192.0.2.1 to destination 10.1.1.100 port 80. Which statement accurately describes the packet's treatment?

Accepted Answer

The packet is permitted by the first ACE. The ACL permits TCP to 10.1.1.100 on port 80, so the SYN packet is permitted. However, since it's inbound, the firewall will still check the state. But the ACL itself allows it. Option A is correct. Option B is incorrect because there is an explicit deny. Option C is incorrect because it is permitted by the first line. Option D is incorrect because it doesn't match deny before.

Answer

The packet is permitted because the ACL only denies non-TCP traffic

Answer

The packet is denied by the implicit deny at the end

Answer

The packet is denied because there is no permit for source 192.0.2.1

Question 15

A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?

Accepted Answer

Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy. Option C is correct because it acknowledges the vendor's need while insisting on compliance through technical controls (e.g., restricting to specific IPs within the subnet). Option A forces the vendor to comply without flexibility. Option B risks security. Option D allows non-compliance.

Answer

Amend the policy to allow entire subnets for vendors with multi-factor authentication

Answer

Accept the subnet as long as multi-factor authentication is used

Answer

Require the vendor to comply with the existing policy exactly as written