200-201 Security Policies and Procedures Practice Test 4 — 15 Questions

Question 1

In the context of risk management, which term describes the risk that remains after implementing security controls?

Accepted Answer

Residual risk. Residual risk is the risk left after controls are applied. It must be accepted or further treated.

Answer

Acceptable risk

Answer

Inherent risk

Answer

Transfer risk

Question 2

An organization is developing an Acceptable Use Policy (AUP). Which of the following topics is typically covered in an AUP?

Accepted Answer

Prohibition of using company resources for illegal activities. An AUP defines acceptable use of IT resources, including prohibiting unauthorized access, personal use guidelines, and security responsibilities.

Answer

Password complexity requirements

Answer

Incident reporting procedures

Answer

Data classification levels

Question 3

A security analyst needs to share threat intelligence with other organizations in a standardized, machine-readable format. Which combination of standards should the analyst use?

Accepted Answer

STIX and TAXII. STIX is a language for threat intelligence, and TAXII is a protocol for sharing it. They are commonly used together.

Answer

TAXII and MISP

Answer

ISAC and STIX

Answer

OpenIOC and MISP

Question 4

During a security incident, the incident handler identifies that the breach involves personally identifiable information (PII) of customers. Which role is primarily responsible for determining if legal notification requirements apply?

Accepted Answer

Legal counsel. Legal counsel is primarily responsible for interpreting breach notification laws (e.g., GDPR, CCPA, HIPAA) and determining whether the incident triggers mandatory legal notifications. They assess factors such as the type of data involved, the number of affected individuals, and the jurisdiction to decide if notification is required. The incident handler focuses on technical containment and recovery, not legal analysis.

Answer

Incident handler

Answer

HR

Answer

CISO

Question 5

Which risk treatment option involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate is the risk treatment option that involves implementing security controls to reduce the likelihood or impact of a risk. This can include technical controls (e.g., firewalls, encryption), administrative controls (e.g., policies, training), or physical controls (e.g., locks, guards). Mitigation aims to bring the risk down to an acceptable level rather than eliminating it entirely.

Answer

Avoid

Answer

Transfer

Answer

Accept

Question 6

A SOC Tier 2 analyst is investigating an alert that was escalated from Tier 1. The analyst suspects the malware is using a new variant of ransomware. What is the most appropriate next step for the Tier 2 analyst?

Accepted Answer

Perform malware analysis and correlate with other alerts. A Tier 2 analyst's role is to perform deeper investigation than Tier 1, including malware analysis and correlating the alert with other telemetry to determine scope and impact. Performing malware analysis and correlating with other alerts is the appropriate next step to confirm whether the ransomware is a new variant and to understand its behavior. This informs containment and escalation decisions.

Answer

Notify legal counsel immediately

Answer

Escalate directly to Tier 3 for advanced analysis

Answer

Delete the affected files to contain the spread

Question 7

An organization is conducting a risk assessment and wants to assign numerical values to the likelihood and impact of risks. Which type of risk assessment is being performed?

Accepted Answer

Quantitative risk assessment. Quantitative risk assessment uses numerical values (e.g., monetary, percentages) to calculate risk.

Answer

Operational risk assessment

Answer

Qualitative risk assessment

Answer

Hybrid risk assessment

Question 8

In the NIST SP 800-61 Rev 2 incident response process, which phase involves activities such as performing lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. Post-Incident Activity includes lessons learned, updating plans, and metrics.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 9

A security analyst is collecting evidence from a compromised system for legal proceedings. Which TWO actions are critical to preserve the integrity of the evidence?

Accepted Answer

Compute a cryptographic hash of the original drive before imaging. Option B is correct because computing a cryptographic hash (e.g., SHA-256 or MD5) of the original drive before imaging establishes a verifiable baseline value that can later be compared against the hash of the forensic image to prove the copy is bit-for-bit identical and unaltered, which is essential for evidence admissibility. Option E is correct because a hardware or software write-blocker prevents any write operations from reaching the source drive during imaging, ensuring the original evidence is not modified and preserving its integrity for legal proceedings. Option A is wrong because storing evidence in a public folder exposes it to tampering, unauthorized access, and contamination, destroying the chain of custody. Option C is wrong because deleting files alters the original evidence and constitutes spoliation. Option D is wrong because running the system normally modifies the drive and volatile state, contaminating the evidence rather than preserving it.

Answer

Store the evidence in a public folder for easy access

Answer

Delete any sensitive files to protect privacy

Answer

Run the system normally to capture volatile data

Question 10

An organization is implementing a threat intelligence sharing program. Which THREE elements are commonly used standards or platforms for sharing threat intelligence?

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is correct because it is a widely used open-source threat intelligence platform that enables organizations to store, correlate, and share indicators of compromise and threat data with trusted partners. TAXII (Trusted Automated Exchange of Intelligence Information) is correct because it is the OASIS-defined application-layer protocol specifically designed to transport cyber threat intelligence over HTTPS between parties. STIX (Structured Threat Information Expression) is correct because it is the standardized language/schema used to represent cyber threat intelligence in a structured, machine-readable form, and it is commonly paired with TAXII for exchange. ISACs (Information Sharing and Analysis Centers) are sector-specific sharing organizations rather than a technical standard or platform, and OpenIOC is a proprietary Mandiant indicator format that never became a broadly adopted sharing standard, so neither belongs here.

Answer

ISAC

Answer

OpenIOC

Question 11

A security analyst is triaging an alert about a user downloading a suspicious file. According to the NIST SP 800-61 Rev 2 incident response process, in which phase does initial triage occur?

Accepted Answer

Detection and Analysis. Initial triage is part of the Detection and Analysis phase, where alerts are evaluated to determine if they are actual incidents.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 12

A SOC Tier 1 analyst receives an alert for a potential malware infection. What is the primary responsibility of the Tier 1 analyst?

Accepted Answer

Perform initial triage and basic investigation. Tier 1 analysts monitor alerts and perform initial triage to determine if further investigation is needed.

Answer

Communicate with the media

Answer

Develop detection signatures

Answer

Conduct advanced malware analysis

Question 13

An organization has implemented a new password policy requiring 12-character passwords with complexity. Which risk treatment option is this an example of?

Accepted Answer

Risk mitigation. Implementing controls to reduce risk is mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 14

After containing a security incident, the incident response team eradicates the malware and restores systems from clean backups. Which phase of the NIST SP 800-61 Rev 2 process does this represent?

Accepted Answer

Containment, Eradication, and Recovery. Eradication removes the threat, and recovery restores normal operations.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 15

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Accepted Answer

It provides a method to transport threat intelligence. TAXII is a protocol for exchanging STIX data.

Answer

It stores threat intelligence locally

Answer

It is a platform for malware analysis

Answer

It defines the format for threat indicators