200-201 Security Policies and Procedures Practice Test 3 — 15 Questions

Question 1

During which phase of the NIST SP 800-61 Rev 2 incident response process would the incident response team conduct initial triage and determine whether an event qualifies as an incident?

Accepted Answer

Detection and Analysis. Initial triage and identification of incidents occur in the Detection and Analysis phase.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 2

A security analyst at a SOC Tier 1 receives an alert about a potential malware infection on a user's workstation. What is the primary responsibility of the Tier 1 analyst in this scenario?

Accepted Answer

Conduct initial triage and basic investigation. Tier 1 analysts monitor alerts, perform initial triage, and escalate if needed. They conduct basic investigation.

Answer

Coordinate with legal counsel for data breach notification

Answer

Develop new detection signatures

Answer

Perform deep forensic analysis of the malware

Question 3

An organization is implementing a new remote access policy. Which of the following is a key component that should be included in this policy?

Accepted Answer

Requirements for multi-factor authentication. Remote access policies typically specify allowed methods (e.g., VPN), authentication requirements, and security controls.

Answer

Prohibition of personal device usage for any work

Answer

Mandatory use of social media for communication

Answer

Daily password changes for remote users

Question 4

During an incident, a forensic analyst needs to preserve evidence from a compromised hard drive. Which of the following steps is essential to maintain the chain of custody?

Accepted Answer

Documenting the date, time, and person handling the evidence. Chain of custody requires documenting each transfer, including who handled evidence and when. Write-blocking prevents alteration, and hashing verifies integrity. Documentation of transfers is key.

Answer

Deleting unnecessary files to reduce data volume

Answer

Storing the hard drive in a standard office drawer

Answer

Creating a bit-for-bit copy without write-blocking

Question 5

In the context of risk management, which term describes the risk that remains after implementing security controls?

Accepted Answer

Residual risk. Residual risk is the risk left after controls are applied. It must be accepted or further treated.

Answer

Acceptable risk

Answer

Inherent risk

Answer

Transfer risk

Question 6

An organization is developing an Acceptable Use Policy (AUP). Which of the following topics is typically covered in an AUP?

Accepted Answer

Prohibition of using company resources for illegal activities. An AUP defines acceptable use of IT resources, including prohibiting unauthorized access, personal use guidelines, and security responsibilities.

Answer

Password complexity requirements

Answer

Incident reporting procedures

Answer

Data classification levels

Question 7

A security analyst needs to share threat intelligence with other organizations in a standardized, machine-readable format. Which combination of standards should the analyst use?

Accepted Answer

STIX and TAXII. STIX is a language for threat intelligence, and TAXII is a protocol for sharing it. They are commonly used together.

Answer

TAXII and MISP

Answer

ISAC and STIX

Answer

OpenIOC and MISP

Question 8

During a security incident, the incident handler identifies that the breach involves personally identifiable information (PII) of customers. Which role is primarily responsible for determining if legal notification requirements apply?

Accepted Answer

Legal counsel. Legal counsel advises on data breach notification laws and regulatory requirements.

Answer

Incident handler

Answer

HR

Answer

CISO

Question 9

Which risk treatment option involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate means applying controls to reduce risk.

Answer

Avoid

Answer

Transfer

Answer

Accept

Question 10

A SOC Tier 2 analyst is investigating an alert that was escalated from Tier 1. The analyst suspects the malware is using a new variant of ransomware. What is the most appropriate next step for the Tier 2 analyst?

Accepted Answer

Perform malware analysis and correlate with other alerts. Tier 2 conducts deeper investigation, including malware analysis and correlation with other data.

Answer

Notify legal counsel immediately

Answer

Escalate directly to Tier 3 for advanced analysis

Answer

Delete the affected files to contain the spread

Question 11

An organization is conducting a risk assessment and wants to assign numerical values to the likelihood and impact of risks. Which type of risk assessment is being performed?

Accepted Answer

Quantitative risk assessment. Quantitative risk assessment uses numerical values (e.g., monetary, percentages) to calculate risk.

Answer

Operational risk assessment

Answer

Qualitative risk assessment

Answer

Hybrid risk assessment

Question 12

In the NIST SP 800-61 Rev 2 incident response process, which phase involves activities such as performing lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. Post-Incident Activity includes lessons learned, updating plans, and metrics.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 13

A security analyst is collecting evidence from a compromised system for legal proceedings. Which TWO actions are critical to preserve the integrity of the evidence?

Accepted Answer

Compute a cryptographic hash of the original drive before imaging. Write-blocking prevents modification during acquisition, and hashing verifies integrity before and after imaging.

Answer

Store the evidence in a public folder for easy access

Answer

Delete any sensitive files to protect privacy

Answer

Run the system normally to capture volatile data

Question 14

An organization is implementing a threat intelligence sharing program. Which THREE elements are commonly used standards or platforms for sharing threat intelligence?

Accepted Answer

MISP. STIX, TAXII, and MISP are widely used for threat intelligence sharing. ISAC is an organization, not a standard/platform. OpenIOC is a format but less common now.

Answer

ISAC

Answer

OpenIOC

Question 15

During a security incident involving an insider threat, which TWO roles are most likely to be directly involved in the response?

Accepted Answer

Legal counsel. HR handles personnel issues, and legal counsel handles legal aspects like termination and potential charges.

Answer

SOC Tier 1 analyst

Answer

PR

Answer

External auditor