200-201 Practice Test 3 — 10 Questions

Question 1

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 2

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.

Answer

Rootkit

Answer

Worm

Answer

Trojan horse

Question 3

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

Accepted Answer

Visibility into local system events such as file system changes and registry modifications.. HIDS are installed directly on a host and have direct access to the host's operating system, allowing them to monitor local system events such as file system changes, registry modifications, and process activity. This granular visibility is a key advantage over NIDS, which only sees network traffic and cannot inspect internal host state.

Answer

Better suited for protecting a large number of devices simultaneously.

Answer

Less susceptible to host-based attacks.

Answer

Lower latency in detecting network attacks.

Question 4

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Accepted Answer

Transport Layer Security (TLS). Symmetric encryption, asymmetric encryption, and TLS (which uses both) provide confidentiality. Hashing does not.

Answer

Digital signature

Answer

Hashing

Question 5

A security policy requires that all email attachments be scanned for malware. An employee receives a legitimate PDF from a customer that is flagged as malicious. What should the analyst do first?

Accepted Answer

Contact the customer to verify the file is intended.. The first step when a legitimate-seeming email attachment is flagged as malicious is to verify its authenticity with the sender. This aligns with the security policy's requirement to scan attachments while avoiding unnecessary disruption to business operations. Contacting the customer confirms whether the file was intentionally sent and is safe, allowing the analyst to make an informed decision before taking further action.

Answer

Allow the email through since it's from a known sender.

Answer

Quarantine the email and delete the attachment.

Answer

Escalate to the incident response team.

Answer

Update the antivirus signatures and rescan.

Question 6

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 7

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 8

A security analyst is reviewing network traffic and notices a high volume of small packets from an internal IP to a single external IP on port 53. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using small packets to evade detection. A high volume of small packets from an internal IP to a single external IP on port 53, without corresponding internal DNS server traffic, is a classic indicator of data exfiltration via DNS tunneling.

Answer

DNS amplification attack

Answer

Port scan

Answer

Normal DNS resolution

Question 9

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

Accepted Answer

Authentication. Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Answer

Accounting

Answer

Auditing

Answer

Authorization

Question 10

A SOC analyst is reviewing a security alert generated by the SIEM. The alert indicates a successful login from an unusual geographic location for a user who typically logs in from the corporate office. The analyst verifies that the user is currently on vacation and should not be accessing the network. What should the analyst do next?

Accepted Answer

Disable the user account and begin an investigation. The alert indicates a clear security incident: a successful login from an unusual geographic location for a user who is on vacation and should not be accessing the network. Disabling the user account immediately contains the threat by preventing further unauthorized access, and beginning an investigation allows the analyst to determine if the account was compromised or if credentials were stolen. This aligns with the NIST SP 800-61 incident response process, where containment is a priority before proceeding to eradication and recovery.

Answer

Ignore the alert because the user might be using a VPN

Answer

Block the IP address in the firewall

Answer

Start a full incident investigation before taking any action