200-201 Practice Test 22 — 15 Questions

Question 1

An organization's security policy specifies that all configuration changes must be approved through a change management process. An analyst discovers that a firewall rule was added without approval. What is the appropriate action?

Accepted Answer

Report the unauthorized change to management.. Option C is correct because reporting the unauthorized change is required by policy. Option A is too hasty without impact analysis. Option B might follow reporting. Option D violates policy. Option E is inappropriate.

Answer

Remove the rule immediately.

Answer

Change the policy to allow emergency changes without approval.

Answer

Document the change and ignore it.

Answer

Analyze the rule to see if it's needed, then either approve or remove.

Question 2

A security policy requires that all data at rest be encrypted. Which TWO of the following are considered best practices for implementing encryption?

Accepted Answer

Store encryption keys separately from the encrypted data.. Options A and C are correct. Option A: hardware-based encryption is more secure. Option C: separate key storage. Option B: same key weakens security. Option D: weak encryption is poor practice. Option E: encryption should be at multiple layers.

Answer

Implement encryption at the application layer only.

Answer

Use weak encryption algorithms to reduce performance impact.

Answer

Use the same key for all data to simplify management.

Question 3

A company's security policy requires that all firewall rule changes be approved through a change management process. An engineer notices an unauthorized rule that allows RDP from any external IP. What is the first step the engineer should take?

Accepted Answer

Remove the rule immediately and document the change after. Option A is correct because the rule represents an active threat, so immediate removal is justified as an emergency change, followed by documentation. Option B is wrong because waiting for approval delays protection. Option C is wrong because investigation can follow removal. Option D is wrong because blocking all RDP is too broad.

Answer

Wait for approval from the change management board

Answer

Investigate who added the rule

Answer

Block all RDP access to the network

Question 4

A network administrator is tasked with creating a security policy for handling sensitive data. Which of the following is the most critical element to include?

Accepted Answer

Data classification and handling procedures.. Data classification and handling procedures are fundamental to any data security policy. Topology, antivirus, and contacts are supporting but not the most critical.

Answer

Detailed network topology diagrams.

Answer

List of antivirus software versions.

Answer

Vendor contact information.

Question 5

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

Accepted Answer

Incident Response Procedure for evidence preservation. Incident response procedures typically require preserving volatile data before disconnecting. Option A is correct. Option B (chain of custody) is about evidence handling. Option C (forensic analysis) is a later step. Option D (escalation) is not the core issue.

Answer

Chain of Custody Procedure

Answer

Forensic Analysis Procedure

Answer

Escalation Procedure

Question 6

An organization's data classification policy defines four levels: Public, Internal, Confidential, and Restricted. An employee accidentally sends an email containing customer payment card information (PCI) to the entire company mailing list. The data should have been classified as which level?

Accepted Answer

Restricted. Option D is correct because PCI data is highly sensitive and legally protected, warranting Restricted classification. Option A is for non-sensitive data. Option B is for internal use but not as sensitive. Option C is sensitive but not as high as Restricted.

Answer

Public

Answer

Internal

Answer

Confidential

Question 7

Refer to the exhibit. A security analyst observes these syslog messages from an ASA firewall. Based on the messages, which type of activity is most likely occurring?

Accepted Answer

An external host scanning internal hosts for open port 80. Option B is correct. The messages show multiple connection attempts from the same source IP to the same destination IP and port, with increasing source ports. This pattern indicates a port scan, specifically a TCP port scan against port 80. Option A is about hosts inside initiating connections. Option C would show success. Option D is for DoS, which would involve many destinations or bandwidth.

Answer

An inside host attempting to access a web server on the outside

Answer

A denial of service attack flooding the firewall

Answer

Successful web traffic from an external client

Question 8

A security policy requires that all endpoints have host-based firewalls enabled. A user reports that an application stopped working after a recent update. What should the analyst do?

Accepted Answer

Create an exception rule for the application.. Option B is correct because creating an exception maintains firewall policy while allowing the app. Option A violates policy. Option C may revert security patches. Options D and E are less direct.

Answer

Escalate to the application vendor.

Answer

Roll back the update.

Answer

Disable the host firewall for that user.

Answer

Reinstall the application.

Question 9

A company's security policy requires that all system logs be retained for at least one year. A security analyst discovers that log files are being overwritten after 30 days. What is the most likely cause?

Accepted Answer

The log rotation policy is set to 30 days. Option C is correct because the log rotation setting is likely set to 30 days, causing overwrites. Option A is wrong while disk space may contribute, the direct cause is the rotation policy. Option B is wrong because malware is less likely. Option D is wrong because an administrator deleting logs would be a deliberate act.

Answer

Logs are being manually deleted by an administrator

Answer

Malware infection

Answer

Insufficient disk space

Question 10

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Accepted Answer

The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls. Option D is correct. The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.

Answer

The destination 'any' allows SSH to any external server, which is too permissive

Answer

The ACL permits SSH from unauthorized IP addresses

Answer

The ACL sequence is illogical; line 30 should be before lines 10 and 20

Question 11

An analyst is reviewing this configuration. What is the most significant security concern?

Accepted Answer

The access-list does not specify source IPs, allowing any source.. Option D is correct because allowing any source IP is a security risk; source restriction is missing. Option A is the purpose. Option B is present (deny any). Option C is a design choice. Option E is not recommended.

Answer

The access-list permits all traffic to 192.168.1.100 on ports 80 and 443.

Answer

The access-list is missing a rule to deny all other traffic.

Answer

The access-list only permits traffic to a single host.

Answer

The access-list should permit traffic to the entire subnet.

Question 12

A security policy requires that all remote access be authenticated using a one-time password (OTP) token. Which technology should be implemented?

Accepted Answer

RADIUS with token server. Option A is correct because RADIUS can integrate with an OTP token server. Option B is wrong because LDAP with password does not provide OTP. Option C is wrong because SSH keys are not OTP. Option D is wrong because pre-shared keys are not OTP.

Answer

SSH key pairs

Answer

LDAP with username and password

Answer

VPN with pre-shared key

Question 13

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

Accepted Answer

Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process. Option C is correct because creating a forensic copy with hashing preserves integrity and chain of custody. Option A lacks chain of custody. Option B is overkill for log files. Option D does not preserve integrity.

Answer

Export the logs to a CSV file and email them to the security team

Answer

Use a write-blocker to create a forensic image of the entire hard drive

Answer

Copy the audit logs to a USB drive and store it in a locked drawer

Question 14

A company's incident response policy defines four phases: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity. During an active ransomware outbreak, the IR team is unable to contain the spread because the containment plan did not account for the malware's use of PowerShell for lateral movement. Which phase had a deficiency?

Accepted Answer

Preparation. Option A is correct because Preparation should include threat modeling and playbooks for common TTPs. Options B, C, D are later phases that rely on preparation.

Answer

Containment Eradication & Recovery

Answer

None of the above

Answer

Post-Incident Activity

Answer

Detection & Analysis

Question 15

A company is implementing a new data classification policy. The policy defines three levels: Public, Internal, and Confidential. An employee accidentally emails a spreadsheet marked 'Confidential' to an external partner. The email system automatically encrypts all outbound emails containing 'Confidential' classification. Which security control is being demonstrated?

Accepted Answer

Data Loss Prevention (DLP). Option D is correct because the email system is automatically encrypting outbound emails based on classification, which is a type of data loss prevention (DLP). Option A is wrong because access control restricts who can access data, not how it is transmitted. Option B is wrong because encryption at rest occurs when data is stored. Option C is wrong because auditing records events but does not prevent data loss.

Answer

Auditing

Answer

Encryption at rest

Answer

Access control