200-201 Security Policies and Procedures Practice Test 2 — 15 Questions

Question 1

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident

Question 2

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 3

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 4

In the NIST SP 800-61 Rev 2 incident response process, which phase involves documenting lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 Rev 2 is specifically designed for conducting a lessons learned meeting, documenting findings, and updating the incident response plan based on those insights. This phase ensures continuous improvement of the incident response process by capturing what worked, what didn't, and what changes are needed for future incidents.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 5

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Accepted Answer

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.. Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer

Create a forensic image without write-blocking, then hash the image.

Answer

Copy all files to an external drive without hashing.

Answer

Disconnect the hard drive and boot from a live CD to collect data.

Question 6

During a security incident, the CISO decides to contain a compromised server by isolating it from the network. Which role is primarily responsible for making this containment decision based on business impact?

Accepted Answer

CISO. The CISO is the decision-maker for business impact and authorizes containment actions.

Answer

Incident handler

Answer

Legal counsel

Answer

PR representative

Question 7

Which of the following is the CORRECT order of the NIST SP 800-61 Rev 2 incident response lifecycle phases?

Accepted Answer

Preparation, Detection and Analysis, Containment Eradication and Recovery, Post-Incident Activity. The correct order is Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity.

Answer

Containment Eradication and Recovery, Detection and Analysis, Preparation, Post-Incident Activity

Answer

Post-Incident Activity, Preparation, Detection and Analysis, Containment Eradication and Recovery

Answer

Detection and Analysis, Preparation, Containment Eradication and Recovery, Post-Incident Activity

Question 8

An organization is conducting a risk assessment and assigns a monetary value to potential losses. Which risk assessment method is being used?

Accepted Answer

Quantitative risk assessment. Assigning a monetary value to potential losses is a hallmark of quantitative risk assessment. This method uses numerical data (e.g., dollar amounts, percentages) to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE), enabling objective comparison of risks. In contrast, qualitative methods rely on subjective ratings like high/medium/low.

Answer

Risk treatment

Answer

Qualitative risk assessment

Answer

Risk identification

Question 9

A SOC Tier 2 analyst is investigating an alert that was escalated by Tier 1. The analyst needs to perform deeper correlation and malware analysis. Which of the following actions is most appropriate for Tier 2?

Accepted Answer

Analyze the malware sample in a sandbox and correlate with other indicators.. Tier 2 analysts perform deeper investigation, correlation, and malware analysis.

Answer

Conduct threat hunting to proactively search for threats.

Answer

Develop new detection rules for the SIEM.

Answer

Perform initial triage and basic investigation.

Question 10

Which organization facilitates threat intelligence sharing among members in a specific sector, such as finance or healthcare?

Accepted Answer

ISAC. ISACs (Information Sharing and Analysis Centers) are sector-specific threat intelligence sharing groups.

Answer

MISP

Answer

STIX

Answer

TAXII

Question 11

During the Containment, Eradication, and Recovery phase, the incident response team collects evidence from a compromised system. Which document is used to record the chain of custody?

Accepted Answer

Chain of custody form. Chain of custody documentation tracks who handled evidence from collection to court presentation.

Answer

Data classification policy

Answer

Acceptable Use Policy

Answer

Incident response plan

Question 12

Which risk treatment option involves taking actions to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate means implementing controls to reduce risk.

Answer

Accept

Answer

Transfer

Answer

Avoid

Question 13

An organization is required to preserve data that may be relevant to a lawsuit. Which legal process is invoked to prevent destruction of this data?

Accepted Answer

Legal hold. A legal hold is issued to preserve data relevant to litigation.

Answer

E-discovery

Answer

Chain of custody

Answer

Data retention policy

Question 14

A SOC Tier 3 analyst is performing advanced threat analysis. Which TWO activities are typical for this tier?

Accepted Answer

Forensic analysis of compromised systems. Tier 3 involves threat hunting and advanced forensics, while Tier 1 handles triage and Tier 2 handles correlation.

Answer

Correlating multiple alerts

Answer

Monitoring SIEM dashboards

Answer

Initial triage of alerts

Question 15

In the context of risk management, which THREE are valid risk treatment options?

Accepted Answer

Mitigate. The four risk treatment options are accept, avoid, transfer, and mitigate. Monitor is not a treatment option; it is part of ongoing management.

Answer

Monitor

Answer

Ignore