200-201 Security Policies and Procedures Practice Test 2 — 15 Questions

Question 1

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 2

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 3

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 4

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 5

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 6

A SOC analyst at Tier 1 receives an alert for a known malware signature. After initial investigation, the analyst finds that the alert is a false positive caused by an outdated signature. What should the analyst do next?

Accepted Answer

Close the alert and document the finding. When a Tier 1 analyst determines an alert is a false positive caused by an outdated signature, the correct action is to close the alert and document the finding so the signature can be reviewed and tuned. Escalating or containing would waste resources on a non-incident. Documentation ensures the false positive is tracked and the detection rule can be improved.

Answer

Escalate the alert to Tier 2 for further analysis

Answer

Update the signature database on the security tools

Answer

Initiate the containment process

Question 7

Which threat intelligence sharing standard defines a language and format for representing structured threat information, such as indicators and campaigns?

Accepted Answer

STIX. STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

Answer

MISP

Answer

TAXII

Answer

OpenIOC

Question 8

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Accepted Answer

Perform a live forensic image of the server's memory before powering off. Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer

Disconnect the server from the network but leave it running

Answer

Immediately power off the server without any imaging

Answer

Skip evidence collection and focus solely on containment

Question 9

A company's security policy requires that all data classified as 'Confidential' must be encrypted at rest and in transit. This requirement is part of which policy?

Accepted Answer

Data Classification Policy. The requirement to encrypt 'Confidential' data is a direct outcome of a data classification policy, which defines categories (e.g., Public, Internal, Confidential, Restricted) and mandates specific security controls for each category. Encryption at rest and in transit is a typical control for the 'Confidential' tier, ensuring data is protected using mechanisms like AES-256 for storage and TLS 1.2+ for transmission.

Answer

Remote Access Policy

Answer

Password Policy

Answer

Acceptable Use Policy

Question 10

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

Accepted Answer

Tier 3. Tier 3 SOC analysts are the most senior and are responsible for advanced threat hunting, malware reverse engineering, and deep forensic analysis. Tier 1 handles initial triage and alert monitoring, while Tier 2 performs deeper investigation and incident response. Threat hunting and forensics are explicitly Tier 3 responsibilities in the standard SOC tier model.

Answer

Tier 1

Answer

All tiers equally

Answer

Tier 2

Question 11

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. A write blocker prevents any writes to the original drive, preserving its integrity during imaging. Option D is correct because computing a cryptographic hash (e.g., SHA-256) of the original drive before imaging creates a digital fingerprint that can be used later to verify that the forensic image is an exact copy and that no alterations occurred during acquisition or analysis. Both actions are essential to maintain evidence integrity and admissibility.

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 12

Which of the following are responsibilities of the legal counsel role during incident response? (Choose two.)

Accepted Answer

Determining data breach notification requirements. Legal counsel advises on breach notification requirements and can place legal holds to preserve evidence for litigation.

Answer

Communicating with the media

Answer

Conducting technical analysis of malware

Answer

Approving financial expenditures for containment

Question 13

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, enabling both machine-readable indicators and human-readable context. TAXII (Trusted Automated Exchange of Indicator Information) is the transport protocol that defines how STIX content is exchanged over HTTPS. Together, they allow ISAC members to share threat intelligence in a standardized, automated manner. Snort rules are signatures for intrusion detection, not a sharing standard. OpenIOC is a format for indicators but lacks the report capability and transport protocol. MISP is a platform that can use STIX/TAXII but is not itself a standard or protocol.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 14

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident

Question 15

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy