200-201 Practice Exam 52 — 20 Questions

Question 1

A new security analyst is reviewing the organization's data classification policy and notices that data labeled 'Restricted' must be encrypted at rest and in transit, while data labeled 'Internal' has no encryption requirement. The analyst asks why the policy distinguishes between these levels. What is the primary purpose of a data classification policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

To define handling requirements based on the sensitivity and value of the data. A data classification policy categorizes information by sensitivity and value so that appropriate controls, such as encryption for 'Restricted' data, can be applied consistently. It supports risk-based decision-making, regulatory compliance, and clear handling procedures. The distinction between 'Restricted' and 'Internal' in the scenario exists precisely to ensure stronger protections are applied where the impact of disclosure is greatest.

Answer

To provide a legal shield that eliminates liability if data is breached

Answer

To specify which employees are allowed to access the internet from corporate devices

Answer

To ensure all data receives the same level of protection regardless of sensitivity

Question 2

A security analyst is reviewing the organization's incident response plan and notices that it does not specify how to handle a situation where a zero-day vulnerability is exploited before a patch is available. The analyst wants to recommend a proactive measure that aligns with the NIST SP 800-61 revision 2 and the CyberOps Associate curriculum. Which of the following should the analyst recommend?

Accepted Answer

Develop and maintain a playbook for zero-day incident response that includes isolation, monitoring, and temporary workarounds.. The correct recommendation is to develop a zero-day incident response playbook. NIST SP 800-61 emphasizes the importance of having specific procedures for incidents that do not have immediate fixes. A playbook outlines steps for containment, monitoring, and applying temporary mitigations, which are critical when a patch is unavailable. This proactive measure ensures the organization can respond effectively and minimize impact during a zero-day attack.

Answer

Deploy a next-generation firewall with signature-based detection to block all known exploits.

Answer

Conduct regular vulnerability scans to identify and remediate all unpatched systems.

Answer

Implement a bug bounty program to incentivize external researchers to report vulnerabilities.

Question 3

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. A new marketing campaign document contains strategic pricing information that, if disclosed, could cause competitive harm. According to typical data classification practices, how should this document be classified?

Accepted Answer

Confidential. Data classification policies typically define Confidential as information whose unauthorized disclosure could cause harm, including competitive harm. Strategic pricing information fits that definition, so it should be classified as Confidential. Public and Internal are too low, and Restricted is generally reserved for more severe impact, making Confidential the appropriate level for this document.

Answer

Internal

Answer

Restricted

Answer

Public

Question 4

A security analyst is reviewing the organization's incident response plan. The plan defines several roles, including one responsible for coordinating all incident response activities and serving as the central point of communication. During a recent ransomware incident, this person was responsible for declaring the incident and ensuring that all stakeholders were informed. Which role does this describe?

Accepted Answer

Incident Response Manager. The Incident Response Manager is responsible for the overall coordination of the incident response process. This includes declaring incidents, managing communication with stakeholders, and ensuring that the response follows the organization's policies. The other roles have more specific or tactical responsibilities that do not include overarching coordination.

Answer

Legal Advisor

Answer

SOC Tier 1 Analyst

Answer

Incident Handler

Question 5

A healthcare organization is developing an incident response plan. The security manager wants to ensure that the plan includes a phase where the team practices and tests their response capabilities before an actual incident occurs. According to the NIST incident response lifecycle, which phase involves preparing and preventing incidents through activities like training and exercises?

Accepted Answer

Preparation. According to the NIST incident response lifecycle, Preparation is the phase dedicated to establishing and maintaining incident response capabilities, including training, exercises, and plan development. The other phases are reactive and occur during or after an incident. Therefore, the security manager should focus on Preparation to ensure the team is ready before an incident happens.

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 6

A security operations center (SOC) manager is developing a playbook for handling phishing incidents. The playbook must specify the first action an analyst should take upon receiving a reported phishing email. Which action should be performed first according to standard incident response procedures?

Accepted Answer

Preserve the email and analyze its headers and attachments. Standard incident response procedures for phishing begin with preserving and analyzing the reported email to confirm maliciousness and extract indicators. This step enables accurate containment and remediation, such as blocking malicious domains and quarantining similar messages. Isolating, deleting, or notifying law enforcement are subsequent actions that depend on the initial analysis.

Answer

Notify law enforcement about the phishing attempt

Answer

Isolate the recipient's workstation from the network

Answer

Delete the email from all mailboxes

Question 7

A security analyst is reviewing the organization's security policies and notices that the Acceptable Use Policy (AUP) is outdated. The analyst is asked to identify key elements that should be included in an effective AUP. Which two elements are essential components of an AUP? (Choose two.)

Accepted Answer

Consequences for policy violations. An Acceptable Use Policy must clearly define acceptable and unacceptable use of organizational assets and specify consequences for violations. These elements set expectations and enable enforcement. Technical details like network diagrams, incident response procedures, and vulnerability lists belong in other documents and are not core components of an AUP.

Answer

List of all software vulnerabilities and patches

Answer

Detailed network diagram of the organization's infrastructure

Answer

Step-by-step incident response procedures

Question 8

A security analyst is reviewing the organization's security policy framework. The analyst notes that the policy defines the acceptable use of company assets, including computers, networks, and data. Which document typically outlines the rules for employee behavior when using these assets?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) is designed to outline the rules and guidelines for using company assets. It typically covers what is allowed and prohibited, and the consequences of violations. This aligns with the scenario's requirement to define acceptable use of computers, networks, and data.

Answer

Service Level Agreement (SLA)

Answer

Non-Disclosure Agreement (NDA)

Answer

Incident Response Plan (IRP)

Question 9

A financial institution is implementing a data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The security team must ensure that data labeled 'Restricted' receives the highest level of protection, including encryption, strict access controls, and monitoring. Which data classification level is typically subject to the most stringent regulatory requirements and requires the strongest security controls?

Accepted Answer

Restricted. In a typical data classification scheme, Restricted is the highest level and demands the most stringent security controls, including encryption, strict access, and monitoring. Public, Internal, and Confidential have progressively lower protection requirements. Since the policy defines Restricted as requiring the highest protection, that classification is the correct answer.

Answer

Internal

Answer

Confidential

Answer

Public

Question 10

A security manager is drafting an incident response policy and wants to ensure that the organization can legally monitor employee communications during an investigation. The manager asks the legal team what element must be included in the employee handbook and policy documents to support this capability. Which element is most critical?

Accepted Answer

A statement that employees have no expectation of privacy when using corporate systems. The legal basis for monitoring employee communications is established by clearly informing employees that corporate systems are monitored and that privacy should not be expected. This notice, typically embedded in an Acceptable Use Policy or handbook, demonstrates consent and supports investigations. Reporting deadlines and device surrender clauses address different concerns and do not provide the same legal foundation for monitoring.

Answer

A provision that all incident response activities are exempt from regulatory oversight

Answer

A requirement that employees report all security incidents within one hour of discovery

Answer

A clause requiring employees to surrender personal devices for forensic imaging at any time

Question 11

A multinational manufacturer handles personal data of employees in several countries and wants to ensure its security program aligns with recognized international standards for establishing, implementing, maintaining, and continually improving an information security management system. Which framework should the security team adopt as the primary basis for this program?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the internationally recognized standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system. That scope matches the manufacturer's goal of a globally aligned, certifiable security program. The NIST Cybersecurity Framework, CIS Controls, and PCI DSS serve different purposes: voluntary taxonomy, technical safeguards, and payment card requirements, respectively.

Answer

CIS Critical Security Controls

Answer

PCI DSS

Answer

NIST Cybersecurity Framework

Question 12

A mid-size healthcare company has completed its annual review of security documentation. The CISO asks the governance team to align the documents into a clear hierarchy, where a single high-level document states the organization's overall security intentions and direction, and all subordinate documents must conform to it. Which document should the governance team treat as the highest-level authority?

Accepted Answer

Security policy. The security policy is the foundational, management-approved statement of security intent, scope, and objectives, and it drives every standard, procedure, and guideline beneath it. Standards define mandatory requirements, procedures describe exact steps, and guidelines provide optional advice. Only the security policy functions as the single highest-level authority to which all subordinate documentation must conform.

Answer

Security standard

Answer

Security guideline

Answer

Security procedure

Question 13

A company is updating its security policy to align with the principle of least privilege. The IT director asks the security analyst to recommend a control that enforces this principle for user access to a financial application. Which control should the analyst recommend?

Accepted Answer

Role-based access control (RBAC) that grants permissions based on job functions.. The principle of least privilege requires that users have only the minimum access necessary to perform their job functions. Role-based access control (RBAC) achieves this by defining roles with specific permissions and assigning users to roles. This limits access based on job needs and simplifies administration. Other controls like MAC, DAC, or SSO/MFA do not directly enforce least privilege for application access.

Answer

Single sign-on (SSO) with multifactor authentication (MFA).

Answer

Mandatory access control (MAC) using sensitivity labels on all data.

Answer

Discretionary access control (DAC) where data owners set permissions.

Question 14

A security analyst is reviewing the chain of custody form for a laptop seized from an employee suspected of intellectual property theft. The form shows the laptop was collected by the IT manager, transported to a storage room, and later examined by an outside forensics firm. The analyst notices that the form lacks signatures for the transfer between the IT manager and the storage room custodian. What is the most likely impact of this omission on the investigation?

Accepted Answer

The evidence may be challenged as tampered or unauthenticated in legal proceedings.. A chain of custody is a chronological documentation of evidence seizure, custody, transfer, and analysis. Each transfer must be signed and dated to prove the evidence was not tampered with. Missing signatures create an unaccounted period, which undermines the evidence's authenticity. Courts may exclude or discount such evidence, so the correct impact is that it may be challenged as tampered or unauthenticated.

Answer

The outside forensics firm must re-examine the laptop from scratch to restore integrity.

Answer

The forensic examination results will be automatically inadmissible in court.

Answer

The IT manager will be held personally liable for any data loss from the laptop.

Question 15

A security analyst is reviewing the organization's password policy. The policy currently requires passwords to be at least 8 characters and changed every 60 days. The analyst recommends aligning with NIST SP 800-63B guidelines. Which change should the analyst recommend?

Accepted Answer

Remove the periodic password expiration and instead enforce a longer minimum length with a blocklist of common passwords.. The analyst should recommend removing periodic password expiration and instead enforcing a longer minimum length with a blocklist of common passwords. NIST SP 800-63B emphasizes that password expiration can degrade security by encouraging weak, predictable passwords. A blocklist prevents users from choosing easily guessed or compromised passwords, and a longer minimum length increases resistance to brute-force attacks. This approach aligns with modern best practices and reduces the burden on users and help desk.

Answer

Increase the minimum password length to 12 characters and require complexity.

Answer

Require passwords to be changed every 30 days to reduce the window of compromise.

Answer

Implement a requirement for passwords to include at least one special character and one number.

Question 16

A hospital's security team is updating its data handling policy. The compliance officer asks which two classification labels are most appropriate for a patient's electronic protected health information (ePHI) under a typical data classification scheme aligned with HIPAA expectations. (Choose two.)

Accepted Answer

Confidential. In a typical data classification scheme, ePHI belongs in the highest sensitivity tiers because unauthorized disclosure causes regulatory penalties and patient harm. Restricted and Confidential are the two labels that mandate encryption, strict access control, and handling procedures consistent with HIPAA. Public, Internal Use Only, and Unclassified all imply weaker or no protections, so they cannot be applied to patient health information in this policy.

Answer

Internal Use Only

Answer

Unclassified

Answer

Public

Question 17

A hospital's IT department issues a document that tells administrators the exact sequence of steps to disable a terminated clinician's account, including which systems to check and in what order. The document is mandatory and is referenced during audits. Which type of security documentation does this describe?

Accepted Answer

Security procedure. A security procedure is the mandatory, detailed, step-by-step documentation that describes how to carry out a specific operational task, such as disabling a terminated user's account across multiple systems in a defined order. Policies state intent, standards define mandatory requirements, and guidelines offer optional advice. The scenario's emphasis on an exact sequence of steps makes the procedure the correct classification.

Answer

Security standard

Answer

Security policy

Answer

Security guideline

Question 18

A security manager is updating the organization's data classification policy. The policy must align with the CyberOps Associate curriculum and ensure that data handling procedures are consistent. The manager proposes that data classified as 'Public' should still be encrypted when stored on internal servers. Which principle should guide the manager's decision?

Accepted Answer

Data should be protected according to its classification level, and 'Public' data does not require encryption at rest.. The guiding principle is that data protection controls should be commensurate with the data's classification. Public data, by definition, is not sensitive and does not require encryption at rest. Encrypting it would add unnecessary overhead without meaningful security benefit. The policy should ensure that higher classifications, such as Confidential, receive stronger protections like encryption, while Public data can be handled with basic integrity controls. This risk-based approach is consistent with the CyberOps Associate curriculum.

Answer

All data must be encrypted at rest regardless of classification to ensure defense in depth.

Answer

Encryption is only required for data in transit, not for data at rest, for any classification.

Answer

The classification of data should be based on the cost of encryption, not on its sensitivity.

Question 19

A security analyst discovers that a former employee's user account remains active 45 days after termination, and audit logs show that the account was used to access a file server twice in the past week. Which element of the access control lifecycle was MOST directly violated?

Accepted Answer

Account deprovisioning. The account of a terminated employee should have been disabled as part of the offboarding process. Its continued activity 45 days later shows the deprovisioning step of the identity lifecycle failed. Effective programs integrate HR termination events with identity management so accounts are disabled automatically, and they run periodic access reviews to catch accounts that slip through manual processes.

Answer

Credential rotation

Answer

Privilege escalation review

Answer

Account provisioning

Question 20

A security analyst is reviewing the organization's business continuity plan (BCP) after a recent power outage disrupted operations. The analyst notes that the plan includes an alternate processing site and a backup generator but lacks other key components. Which TWO additional elements should the analyst recommend including to improve the BCP? (Choose two.)

Accepted Answer

Documented roles and responsibilities for the continuity team. A business continuity plan should define recovery time objectives to set acceptable downtime limits and assign clear roles and responsibilities to the continuity team. These elements ensure that recovery efforts are prioritized and coordinated. The alternate site and generator address infrastructure, but without RTOs and defined roles, the organization cannot measure or manage its recovery effectively.

Answer

A list of employee personal social media accounts

Answer

A marketing plan for attracting new customers after the outage

Answer

A schedule for regular penetration testing of the alternate site