200-201 Practice Test 21 — 15 Questions

Question 1

A company's security policy requires that all network devices be managed using SSHv2. An auditor finds that some older switches are still using Telnet. The network team claims they cannot upgrade due to budget constraints. What is the best immediate action to mitigate risk?

Accepted Answer

Implement an ACL to restrict Telnet access to only the management subnet.. Option A is correct because an ACL restricting Telnet to the management subnet reduces exposure. Option B is impractical for remote management. Option C still uses Telnet. Option D uses insecure SSHv1. Option E is unrelated.

Answer

Use SSHv1 as a compromise.

Answer

Create a VLAN for management and enforce Telnet only on that VLAN.

Answer

Implement port security on the switches.

Answer

Disable Telnet and rely on console access only.

Question 2

An organization's security policy requires that all security incidents be reported within 1 hour. A system administrator discovers a potential data breach but delays reporting by 3 hours because they were trying to contain it. Which TWO are the most likely consequences of this delay?

Accepted Answer

The incident response team loses valuable time for analysis.. Options A and D are correct. Option A: lost time for analysis. Option D: potential regulatory fines. Option B: termination is possible but not most likely. Option C: escalation due to lack of containment (delay may worsen, but not a direct consequence of delay itself). Option E: incident will not be automatically closed.

Answer

The incident will be automatically closed.

Answer

The administrator will be terminated.

Answer

The breach may escalate due to lack of containment.

Question 3

An organization is developing a new cloud-based application. The security policy requires that all data be encrypted in transit and at rest. Which combination of controls meets this requirement?

Accepted Answer

Use HTTPS and encrypt the database with TDE. Option D is correct because HTTPS encrypts data in transit and TDE encrypts data at rest. Option A is wrong because HTTPS alone does not encrypt data at rest. Option B is wrong because database encryption alone does not encrypt in transit. Option C is wrong because VPN encrypts in transit but not at rest.

Answer

Use a VPN for all connections

Answer

Encrypt the database using Transparent Data Encryption (TDE)

Answer

Use HTTPS for all communication

Question 4

A security policy mandates that all network devices must have logging enabled and that logs must be reviewed regularly. Which TWO practices are essential for effective log review?

Accepted Answer

Aggregating logs from all devices into a central server.. Automated log analysis (A) and central aggregation (E) are essential for effective and efficient log review. Retention (B) and format (C) are supporting but not core to review process. Reactive review (D) is not effective.

Answer

Reviewing logs only when an incident occurs.

Answer

Storing logs for at least one year.

Answer

Ensuring logs are in a common format like Syslog.

Question 5

A company's security policy mandates data encryption at rest. Which TWO of the following are acceptable methods to meet this requirement? (Choose two.)

Accepted Answer

Database encryption. Full disk encryption and file-level encryption both protect data at rest. Database encryption also does, but only two are needed. Encryption of network traffic protects data in transit, not at rest.

Answer

File-level encryption

Answer

Hashing

Answer

Encryption of network traffic (TLS)

Question 6

An organization's security policy requires data classification labels to be applied to all documents. A manager sends a spreadsheet containing employee PII (personally identifiable information) to the entire company without labeling. Which policy has been violated?

Accepted Answer

Data Classification Policy. The data classification policy requires proper labeling. Sending unlabeled PII violates that policy. Option A is correct. Option B (acceptable use) might be relevant but labeling is the core. Option C (incident response) is for after detection. Option D (remote access) is not relevant.

Answer

Acceptable Use Policy

Answer

Remote Access Policy

Answer

Incident Response Policy

Question 7

A company's security policy states that employees must not use corporate laptops for personal web browsing. An employee is found to have streamed video during work hours, consuming significant bandwidth. What is the best course of action?

Accepted Answer

Report the violation to HR for disciplinary action per the existing policy. Option C is correct because the policy is clear, and a violation should be addressed consistently, typically through HR for disciplinary action. Option A is too harsh for a first offense. Option B bypasses policy enforcement. Option D ignores the policy violation entirely.

Answer

Give a verbal warning and take no further action

Answer

Update the policy to allow streaming under certain conditions

Answer

Immediately terminate the employee

Question 8

Which THREE of the following are common types of security policies that organizations typically implement?

Accepted Answer

Data Classification Policy. Options A, C, and D are correct. Acceptable use policy (A), data classification policy (C), and password policy (D) are standard. Option B is a procedure, not a policy. Option E is a specific framework, not a policy type.

Answer

ISO 27001 Standard

Answer

Patch Management Procedure

Question 9

A security policy requires that all remote access be through a VPN using strong authentication. A user calls the help desk saying they cannot connect to the VPN. The analyst checks and sees that the user's token is not synchronized. What should the analyst do?

Accepted Answer

Reset the user's token and have them re-sync.. Option A is correct because resetting the token is standard procedure. Option B is too severe. Option C compromises strong auth. Option D violates policy. Option E is unnecessary.

Answer

Disable VPN access for the user.

Answer

Provide a temporary static password.

Answer

Escalate to the security team.

Answer

Have the user connect without a token.

Question 10

An organization's security policy requires that all data at rest on laptops be encrypted. An employee reports that their laptop was stolen. Which control would most likely prevent data exposure?

Accepted Answer

Full disk encryption. Option B is correct because full disk encryption ensures data cannot be read from the drive. Option A is wrong because remote wipe requires network connectivity. Option C is wrong because screen lock only protects while unattended. Option D is wrong because biometric authentication does not encrypt data.

Answer

Remote wipe

Answer

Biometric authentication

Answer

Screen lock with password

Question 11

An incident response plan includes steps to contain a ransomware outbreak. Which TWO actions are typically performed during the containment phase? (Select two.)

Accepted Answer

Disconnect infected systems from the network. Options A and D are correct containment actions: disconnecting infected systems and quarantining malware. Option B is recovery, not containment. Option C is analysis. Option E is a post-incident action.

Answer

Notify law enforcement

Answer

Identify the initial infection vector

Answer

Restore data from backups

Question 12

A company's security policy requires that all changes to firewall rules must be approved by the change advisory board (CAB). Which THREE of the following are valid reasons to bypass this process?

Accepted Answer

Troubleshooting a network connectivity issue causing downtime.. Emergency fixes for critical vulnerabilities (A), connectivity issues causing downtime (C), and pre-approved penetration tests (D) are common exceptions. Planned additions (B) and removals (E) should follow standard change management.

Answer

Removing a rule for a decommissioned application during maintenance.

Answer

Adding a new server to the DMZ for a planned project.

Question 13

During a security audit, an analyst finds that a third-party vendor has access to sensitive customer data beyond what is necessary for their services. Which principle of least privilege should the policy enforce?

Accepted Answer

Enforce a data classification and access control policy. The principle of least privilege means granting only the minimum rights needed. The policy should enforce a data classification and access control policy that restricts vendor access to only required data sets. Option C is correct. Option A (end-user license agreement) is between vendor and customer. Option B (SLA) defines service levels. Option D (incident response) is after-the-fact.

Answer

Implement an incident response plan for data leaks

Answer

Update the end-user license agreement

Answer

Invoke a service-level agreement

Question 14

Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?

Accepted Answer

The user enters user EXEC mode but is denied enable access due to missing enable secret. The configuration uses 'enable' authentication for enable mode, which means it uses the enable password (not set) or if not set, the local user database? Actually 'enable' method uses the enable secret/password. Since no enable secret is configured, authentication fails. However, the user must first log in to user EXEC mode. For user EXEC, it uses local-case authentication, so 'admin' with password 'cisco123' works there. But for enable, it uses 'enable' method, which requires the enable password. Since no enable password is set, the user is denied enable access. Option D is correct. Option A is wrong because user EXEC works. Option B is wrong because enable access fails. Option C is wrong because the user cannot even enter enable mode.

Answer

The user is granted access to user EXEC mode only

Answer

The user is denied all access because no enable secret is set

Answer

The user is granted full privileged EXEC access

Question 15

A change management policy requires that all network configuration changes be approved by a change advisory board (CAB) before implementation. An urgent security vulnerability requires an immediate firewall rule change to block an active exploit. What should the network administrator do?

Accepted Answer

Apply the change immediately and then submit an emergency change request for post-approval. Option A is correct because emergency change procedures should allow immediate action with retroactive approval. Option B violates policy. Option C is unnecessary if emergency procedure exists. Option D is unrealistic for an urgent fix.

Answer

Convene an emergency CAB meeting before making the change

Answer

Ignore the vulnerability until the next scheduled CAB meeting

Answer

Wait for CAB approval to ensure compliance with policy