200-201 Security Policies and Procedures — 40 Questions

Question 1

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 2

In the context of risk management, which THREE are valid risk treatment options?

Accepted Answer

Mitigate. In risk management, the standard risk treatment options are mitigate, transfer, and accept, so options C, D, and E are correct. Mitigate (C) means applying controls to reduce the likelihood or impact of a risk to an acceptable level. Transfer (D) means shifting the financial impact of a risk to a third party, typically through insurance or outsourcing. Accept (E) means acknowledging the risk and deciding to retain it without further action, often when the cost of treatment exceeds the potential loss. The unmarked options A and B are not standard risk treatment choices: monitoring is part of ongoing risk review rather than a treatment decision, and ignoring a risk is not a recognized, deliberate treatment option.

Answer

Monitor

Answer

Ignore

Question 3

Which TWO standards/protocols are directly associated with threat intelligence sharing as defined by the CyberOps Associate curriculum?

Accepted Answer

TAXII. STIX and TAXII are the primary standards for threat intelligence sharing. OpenIOC and MISP are related but not the core standards defined.

Answer

ISO 27001

Answer

OpenIOC

Answer

MISP

Question 4

During a security incident involving an insider threat, which TWO roles are most likely to be directly involved in the response?

Accepted Answer

Legal counsel. Legal counsel (A) is directly involved in insider-threat response because insider incidents often involve employee privacy, evidence handling, potential prosecution, and regulatory or contractual notification obligations, so legal must guide interviews, data collection, and law-enforcement referral. HR (B) is also directly involved because the suspect is an employee, and HR manages the employment relationship, disciplinary process, internal investigations, and coordination with legal on termination or sanctions. SOC Tier 1 (C) may detect and triage alerts, but Tier 1 is not typically a primary decision-making role in an insider-threat case once it is escalated. PR (D) handles external communications and reputational messaging, which is not a direct response function for an insider investigation. External auditor (E) provides independent assurance and is not part of the operational incident-response chain.

Answer

SOC Tier 1 analyst

Answer

PR

Answer

External auditor

Question 5

During an incident investigation, a forensic analyst needs to preserve the integrity of a hard drive. Which two actions should the analyst take before imaging the drive?

Accepted Answer

Generate a hash of the drive using SHA-256. Before imaging a drive, the analyst must ensure data integrity and prevent modification. Generating a hash (e.g., SHA-256) of the drive provides a baseline for verification that the image is an exact copy. Using a write blocker prevents any writes to the drive during the imaging process, preserving the original evidence. These two actions are standard forensic practices.

Answer

Connect the drive directly to the forensic workstation

Answer

Install antivirus software on the drive

Question 6

A SOC analyst is investigating a possible insider threat. Which team member should be consulted due to the nature of the incident?

Accepted Answer

Human Resources. Insider threat investigations involve employee misconduct, policy violations, and potential termination or disciplinary action, all of which fall under Human Resources' purview. HR manages the employee relationship, ensures proper handling of personnel matters, and coordinates with legal to protect both the organization and employee rights during the investigation. They are the correct first point of consultation because the incident is fundamentally a personnel matter, not purely a technical or public-facing one.

Answer

Public Relations

Answer

CISO

Answer

Legal counsel

Question 7

A financial institution is evaluating risk treatment options for a newly identified vulnerability in its online banking platform. The vulnerability has a high likelihood of exploitation but low business impact. Which risk treatment option is most appropriate?

Accepted Answer

Mitigate. Mitigation is the most appropriate treatment when a vulnerability has high likelihood of exploitation but low business impact, because it reduces the risk to an acceptable level without over-investing. Applying patches, compensating controls, or configuration changes addresses the high likelihood directly while keeping cost proportional to the low impact.

Answer

Transfer

Answer

Accept

Answer

Avoid

Question 8

Which TWO roles are typically responsible for making decisions regarding business impact and external communication during an incident? (Select two.)

Accepted Answer

PR. Option A (PR) is correct because public relations owns external communication during an incident, crafting and delivering messaging to customers, media, and the public to protect the organization's reputation and satisfy disclosure expectations. Option C (CISO) is correct because the Chief Information Security Officer typically owns the security incident response strategy and makes business-impact decisions, such as severity classification, escalation, and whether to invoke crisis management, balancing security risk against business operations. Option B (Legal counsel) is not marked correct because legal advises on regulatory notification, liability, and privilege but does not typically own business-impact decisions or external communications. Option D (Incident handler) is not marked correct because incident handlers perform the tactical detection, containment, eradication, and recovery work rather than owning business-impact and external-communication decisions. Option E (HR) is not marked correct because HR handles personnel matters such as employee discipline or insider investigations, not incident business impact or external messaging.

Answer

Legal counsel

Answer

Incident handler

Answer

HR

Question 9

A company is implementing threat intelligence sharing. Which THREE standards or platforms are used for this purpose? (Select three.)

Accepted Answer

STIX. STIX (B) is correct because it is the Structured Threat Information Expression language, a standardized format for representing cyber threat intelligence such as indicators, campaigns, and threat actors. TAXII (E) is correct because it is the Trusted Automated Exchange of Intelligence Information protocol that defines how STIX content is exchanged between parties over HTTPS. MISP (C) is correct because it is an open-source threat intelligence sharing platform that stores, correlates, and distributes indicators using formats like STIX and OpenIOC. SIEM (A) is not a sharing standard but a security monitoring platform that aggregates and correlates logs for detection. OpenIOC (D) is a threat indicator format, but it is not one of the three standards or platforms specifically identified for threat intelligence sharing in this context.

Answer

SIEM

Answer

OpenIOC

Question 10

During the Containment, Eradication, and Recovery phase, which TWO actions are typically performed? (Select two.)

Accepted Answer

Evidence collection. Option B (Evidence collection) is correct because during the Containment, Eradication, and Recovery phase, responders must preserve volatile and non-volatile data—such as memory images, disk images, and logs—to support forensic analysis and potential legal action before remediation destroys it. Option E (Short-term containment) is correct because this phase includes immediate, tactical measures like isolating affected hosts, blocking malicious IPs/domains at the firewall, or disabling compromised accounts to stop the spread while a longer-term strategy is developed. The other options belong to earlier or later phases: Lessons learned analysis (A) occurs in the post-incident activity phase, while Initial triage (C) and Identifying the incident (D) are part of the detection and analysis phase that precedes containment.

Answer

Lessons learned analysis

Answer

Initial triage

Answer

Identifying the incident

Question 11

A security analyst is reviewing the organization's security policies and procedures. The analyst must ensure that the policies align with the CIA triad. Which TWO of the following are primary goals of the CIA triad? (Choose two.)

Accepted Answer

Confidentiality. The CIA triad consists of Confidentiality, Integrity, and Availability. The question asks for two, and the correct answers are Confidentiality and Integrity. These goals are fundamental to security policies and procedures, ensuring that data is protected from unauthorized access and modification.

Answer

Authentication

Answer

Availability

Answer

Non-repudiation

Question 12

A security manager is developing a business continuity plan (BCP) and needs to determine the maximum acceptable time that a critical business function can be unavailable after a disruption. Which metric should the manager use to define this time limit?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is the maximum acceptable time that a business function can be unavailable after a disruption. It is a key metric in business continuity planning. RPO deals with data loss, MTD is the overall tolerable downtime, and ALE is a financial risk metric. Thus, RTO is the correct choice for defining the time limit of unavailability.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Annualized Loss Expectancy (ALE)

Question 13

During a tabletop exercise, the CSIRT reviews its incident response plan and finds that no one has been designated to handle media inquiries, coordinate with legal, and communicate with customers. Which role in the incident response process is responsible for these activities?

Accepted Answer

Public Relations / Communications Officer. The Public Relations / Communications Officer is the CSIRT role that manages media inquiries, coordinates with legal, and handles customer communications during an incident. When an incident response plan lacks this assignment, public messaging can become inconsistent or legally risky. This role ensures that only approved information is released and that stakeholders are informed appropriately.

Answer

SOC Manager

Answer

Legal Advisor

Answer

Incident Handler

Question 14

A security analyst is reviewing the organization's incident response plan and notices that the plan does not address the handling of volatile evidence. The analyst wants to recommend procedures for collecting volatile data from a compromised Windows system before it is powered down. Which TWO types of data should be collected first because they are lost when the system is shut down? (Choose two.)

Accepted Answer

Active network connections and ARP cache.. Volatile data is lost when a system loses power. The order of volatility dictates that the most volatile data be collected first. RAM contents, including running processes, network connections, and ARP cache, are stored in memory and disappear on shutdown. Event logs, Recycle Bin files, and registry data reside on disk and persist, so they can be collected later without loss.

Answer

Installed software list from the registry.

Answer

Files in the Recycle Bin on the desktop.

Answer

System event logs stored on the local hard drive.

Question 15

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. The Preparation phase of NIST SP 800-61 Rev 2 covers establishing the incident response capability, including developing the IR plan, acquiring tools, training staff, and exercising the plan through tabletop and functional exercises. Exercising the plan before an incident occurs is explicitly a Preparation activity, not something done during or after an event.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 16

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 17

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 18

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 19

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 20

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance