200-201 Security Policies and Procedures Practice Test 5 — 15 Questions

Question 1

A company's legal counsel is involved in an incident response due to a data breach. What is the primary role of legal counsel during the incident?

Accepted Answer

Advise on data breach notification requirements. Legal counsel ensures compliance with data breach notification laws.

Answer

Make decisions about business impact

Answer

Communicate with the public

Answer

Conduct forensic analysis of affected systems

Question 2

An organization is reviewing its risk management process and identifies a risk with a high probability and high impact. Management decides to stop the activity causing the risk. Which risk treatment option is being applied?

Accepted Answer

Risk avoidance. Risk avoidance is the treatment option where the organization eliminates the risk entirely by discontinuing the activity that creates it. Since management decided to stop the activity causing the high-probability, high-impact risk, this is avoidance. It is the only option that removes the risk rather than reducing, accepting, or transferring it.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 3

During an incident investigation, the IR team collects evidence from a compromised server. The evidence must be admissible in court. Which documentation is essential to maintain the chain of custody?

Accepted Answer

A log of who accessed the evidence and when. Chain of custody documentation must include a log of who accessed the evidence, when, and for what purpose, to ensure integrity and admissibility in court. This log creates an auditable trail that proves the evidence has not been tampered with. Without it, the evidence may be deemed inadmissible.

Answer

The CVSS score of the vulnerability

Answer

A copy of the incident response plan

Answer

The organization's acceptable use policy

Question 4

A SOC Tier 3 analyst is performing threat hunting. Which activity best describes the primary focus of a Tier 3 analyst?

Accepted Answer

Proactively searching for advanced threats. A Tier 3 analyst is the most senior level in a SOC, responsible for proactive threat hunting—actively searching for advanced threats that evade existing detection tools. Unlike Tier 1 and Tier 2, which focus on alert triage and correlation, Tier 3 uses hypothesis-driven investigations, threat intelligence, and advanced analytics to uncover stealthy adversaries. This aligns with the primary focus of a Tier 3 analyst as defined in the 200-201 exam objectives.

Answer

Monitoring incoming alerts for potential incidents

Answer

Correlating alerts from multiple sources

Answer

Creating user accounts and permissions

Question 5

An organization uses a qualitative risk assessment to evaluate a new vendor. Which characteristic is typical of qualitative risk assessments?

Accepted Answer

Ranks risks using scales such as high, medium, low. Qualitative assessments use subjective ratings like high, medium, low.

Answer

Calculates annual loss expectancy (ALE)

Answer

Assigns numeric probabilities and impact

Answer

Uses monetary values to estimate loss

Question 6

A security analyst is establishing a data classification policy. Which TWO categories are commonly included in a data classification policy?

Accepted Answer

Confidential. Options D and E are correct because data classification policies typically define sensitivity levels that describe who may access the data and how it must be handled. 'Confidential' (D) is a standard classification label for data whose unauthorized disclosure could cause harm, so it is restricted to authorized personnel. 'Public' (E) is the opposite end of the spectrum, labeling data approved for unrestricted release to anyone. These sensitivity tiers are the core of a classification scheme, often alongside labels like Internal or Restricted. The unmarked options do not belong because 'Archived' (A) and 'Backup' (C) describe data lifecycle or storage states, not sensitivity levels, and 'Encrypted' (B) is a protective control applied to data rather than a classification category.

Answer

Archived

Answer

Encrypted

Answer

Backup

Question 7

After a security incident, the IR team holds a lessons learned meeting. Which THREE activities are part of the Post-Incident Activity phase?

Accepted Answer

Developing metrics to measure IR effectiveness. Option A is correct because the Post-Incident Activity phase includes developing metrics (e.g., MTTD, MTTR, containment time) to measure the effectiveness of the incident response process and inform future improvements. Option B is correct because a core output of the lessons learned meeting is identifying improvements to the IR process, such as better detection rules, communication paths, or tooling gaps. Option C is correct because findings from the lessons learned review are used to update the incident response plan, ensuring procedures, playbooks, and roles reflect what was learned. Option D is not part of this phase; initial triage of new alerts belongs to the Detection and Analysis phase. Option E is also not part of this phase; restoring systems from backup occurs during the Containment, Eradication, and Recovery phase.

Answer

Conducting initial triage of new alerts

Answer

Restoring systems from backup

Question 8

A security team is implementing a remote access policy. Which TWO controls should be included to ensure secure remote access?

Accepted Answer

Multifactor authentication (MFA). Option A (Multifactor authentication (MFA)) is correct because requiring a second factor beyond a password (e.g., TOTP, push notification, or FIDO2 security key) defends against credential theft, phishing, and password reuse, which are the primary risks for remote access. Option D (Virtual private network (VPN)) is correct because a VPN establishes an encrypted tunnel (e.g., IPsec/IKEv2 or TLS) between the remote endpoint and the corporate network, protecting data in transit from interception and enabling authenticated, policy-controlled access to internal resources. Option B (Single sign-on (SSO)) is not a security control that secures the remote connection itself; it improves user convenience and centralizes authentication but does not encrypt traffic or add a verification factor. Option C (Password expiration every 90 days) is a legacy practice that is no longer recommended by NIST and does not compensate for weak or stolen credentials. Option E (Guest network access) is an isolated, untrusted network segment and does not provide secure access to corporate resources.

Answer

Single sign-on (SSO)

Answer

Password expiration every 90 days

Answer

Guest network access

Question 9

During which phase of the NIST SP 800-61 Rev 2 incident response process does an organization develop an incident response plan and assemble a team?

Accepted Answer

Preparation. The Preparation phase includes developing the IR plan, team, tools, and conducting exercises.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 10

A security analyst is investigating a potential data breach. They need to preserve evidence for legal proceedings. Which action should the analyst take to ensure the integrity of the data?

Accepted Answer

Use a write blocker when creating a forensic image. A write blocker is a hardware or software tool that prevents any write operations to the storage device while a forensic image is being created, preserving the original evidence and ensuring the image is a bit-for-bit copy. This maintains the integrity and admissibility of evidence in legal proceedings.

Answer

Run antivirus scans on the affected system

Answer

Delete suspicious files to contain the threat

Answer

Copy files to a network share without write protection

Question 11

A SOC Tier 2 analyst receives an escalated alert about a potential command-and-control (C2) communication. The analyst needs to correlate network logs with threat intelligence. Which data format and transport protocol pair is specifically designed for standardized threat intelligence sharing?

Accepted Answer

STIX and TAXII. STIX is the format, TAXII is the transport protocol for sharing threat intelligence.

Answer

OpenIOC and MISP

Answer

MISP and STIX

Answer

TAXII and OpenIOC

Question 12

Which security policy defines acceptable use of an organization's IT resources, including internet browsing and email?

Accepted Answer

Acceptable Use Policy (AUP). AUP specifies what is acceptable and unacceptable use of IT resources.

Answer

Password Policy

Answer

Information Security Policy

Answer

Remote Access Policy

Question 13

During an incident, a SOC Tier 1 analyst identifies a series of failed login attempts from an internal IP address. The analyst escalates the alert. What is the primary role of a Tier 2 analyst in this scenario?

Accepted Answer

Perform deeper investigation and correlate events. Tier 2 analysts take escalated alerts from Tier 1 and perform deeper investigation, correlating events across multiple log sources, endpoints, and network telemetry to determine scope and root cause. In this scenario, the failed login attempts from an internal IP require correlation with authentication logs, endpoint activity, and threat intelligence — exactly the Tier 2 function.

Answer

Monitor alerts and perform initial triage

Answer

Make decisions on business impact and notification

Answer

Conduct threat hunting and advanced forensics

Question 14

An incident handler collects a hard drive from a compromised server. To maintain chain of custody, which information must be documented?

Accepted Answer

The date, time, and signature of each person who handled the evidence. Chain of custody requires detailed documentation of who handled evidence and when.

Answer

The IP address of the server

Answer

The name of the antivirus software installed

Answer

The operating system version

Question 15

A SOC analyst is investigating a potential malware outbreak. Which THREE actions should the analyst take to preserve evidence? (Select three.)

Accepted Answer

Calculate a hash of the original drive before imaging. Option A is correct because calculating a cryptographic hash (e.g., MD5 or SHA-256) of the original drive before imaging establishes a verifiable baseline that proves the forensic image is an exact, unaltered copy, which is essential for evidence integrity and admissibility. Option C is correct because documenting the chain of custody records who handled, accessed, and transferred the evidence, and when, ensuring the evidence's integrity can be attested in legal or disciplinary proceedings. Option D is correct because using a hardware or software write blocker prevents any writes to the source drive while creating a forensic image, preserving the original evidence in an unmodified state. Option B is not correct because rebooting the system destroys volatile memory (RAM) contents such as running processes, network connections, and encryption keys, which are valuable evidence. Option E is not correct because running a full antivirus scan can modify or delete files and alter system state, contaminating the evidence rather than preserving it.

Answer

Reboot the system to clear memory

Answer

Run a full antivirus scan to remove malware