200-201 Security Policies and Procedures Practice Test 4 — 15 Questions

Question 1

A security analyst is triaging an alert about a user downloading a suspicious file. According to the NIST SP 800-61 Rev 2 incident response process, in which phase does initial triage occur?

Accepted Answer

Detection and Analysis. Initial triage is part of the Detection and Analysis phase, where alerts are evaluated to determine if they are actual incidents.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 2

During an incident investigation, a forensic analyst needs to preserve the integrity of a hard drive. Which two actions should the analyst take before imaging the drive?

Accepted Answer

Generate a hash of the drive using SHA-256. Write-blocking prevents modification, and hashing ensures integrity verification before and after imaging.

Answer

Connect the drive directly to the forensic workstation

Answer

Install antivirus software on the drive

Question 3

A SOC Tier 1 analyst receives an alert for a potential malware infection. What is the primary responsibility of the Tier 1 analyst?

Accepted Answer

Perform initial triage and basic investigation. Tier 1 analysts monitor alerts and perform initial triage to determine if further investigation is needed.

Answer

Communicate with the media

Answer

Develop detection signatures

Answer

Conduct advanced malware analysis

Question 4

An organization has implemented a new password policy requiring 12-character passwords with complexity. Which risk treatment option is this an example of?

Accepted Answer

Risk mitigation. Implementing controls to reduce risk is mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 5

After containing a security incident, the incident response team eradicates the malware and restores systems from clean backups. Which phase of the NIST SP 800-61 Rev 2 process does this represent?

Accepted Answer

Containment, Eradication, and Recovery. Eradication removes the threat, and recovery restores normal operations.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 6

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Accepted Answer

It provides a method to transport threat intelligence. TAXII is a protocol for exchanging STIX data.

Answer

It stores threat intelligence locally

Answer

It is a platform for malware analysis

Answer

It defines the format for threat indicators

Question 7

A company's legal counsel is involved in an incident response due to a data breach. What is the primary role of legal counsel during the incident?

Accepted Answer

Advise on data breach notification requirements. Legal counsel ensures compliance with data breach notification laws.

Answer

Make decisions about business impact

Answer

Communicate with the public

Answer

Conduct forensic analysis of affected systems

Question 8

A SOC analyst is investigating a possible insider threat. Which team member should be consulted due to the nature of the incident?

Accepted Answer

Human Resources. HR is involved in insider threat cases due to employee relations.

Answer

Public Relations

Answer

CISO

Answer

Legal counsel

Question 9

An organization is reviewing its risk management process and identifies a risk with a high probability and high impact. Management decides to stop the activity causing the risk. Which risk treatment option is being applied?

Accepted Answer

Risk avoidance. Avoidance means eliminating the risk by discontinuing the activity.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 10

During an incident investigation, the IR team collects evidence from a compromised server. The evidence must be admissible in court. Which documentation is essential to maintain the chain of custody?

Accepted Answer

A log of who accessed the evidence and when. Chain of custody documentation includes detailed logs of evidence handling, including who collected it and when.

Answer

The CVSS score of the vulnerability

Answer

A copy of the incident response plan

Answer

The organization's acceptable use policy

Question 11

A SOC Tier 3 analyst is performing threat hunting. Which activity best describes the primary focus of a Tier 3 analyst?

Accepted Answer

Proactively searching for advanced threats. Tier 3 focuses on proactive threat hunting and advanced analysis.

Answer

Monitoring incoming alerts for potential incidents

Answer

Correlating alerts from multiple sources

Answer

Creating user accounts and permissions

Question 12

An organization uses a qualitative risk assessment to evaluate a new vendor. Which characteristic is typical of qualitative risk assessments?

Accepted Answer

Ranks risks using scales such as high, medium, low. Qualitative assessments use subjective ratings like high, medium, low.

Answer

Calculates annual loss expectancy (ALE)

Answer

Assigns numeric probabilities and impact

Answer

Uses monetary values to estimate loss

Question 13

A security analyst is establishing a data classification policy. Which TWO categories are commonly included in a data classification policy?

Accepted Answer

Confidential. Common categories include public, internal, confidential, and restricted.

Answer

Archived

Answer

Encrypted

Answer

Backup

Question 14

After a security incident, the IR team holds a lessons learned meeting. Which THREE activities are part of the Post-Incident Activity phase?

Accepted Answer

Developing metrics to measure IR effectiveness. Post-incident activities include identifying improvements, updating the IR plan, and creating metrics.

Answer

Conducting initial triage of new alerts

Answer

Restoring systems from backup

Question 15

A security team is implementing a remote access policy. Which TWO controls should be included to ensure secure remote access?

Accepted Answer

Multifactor authentication (MFA). MFA and VPN are standard controls for secure remote access.

Answer

Single sign-on (SSO)

Answer

Password expiration every 90 days

Answer

Guest network access