200-201 Security Policies and Procedures Practice Test 6 — 15 Questions

Question 1

Which TWO are components of the NIST SP 800-61 Rev 2 Preparation phase? (Select two.)

Accepted Answer

Developing an incident response plan. NIST SP 800-61 Rev 2 places the creation of a formal, written IR plan—covering mission, goals, roles, communication paths, and escalation procedures—squarely in the Preparation phase, before any incident occurs. Option D (Creating an incident response team) is also correct because staffing and organizing the CSIRT (with defined roles, authority, and on-call procedures) is a core Preparation activity that must exist before incidents can be handled. By contrast, option A (Conducting lessons learned) belongs to the Post-Incident Activity phase, where the team reviews what happened and improves the plan. Option C (Containing the incident) is part of the Detection and Analysis/Containment, Eradication, and Recovery handling phase, not Preparation. Option E (Identifying indicators of compromise) is a Detection and Analysis activity, since IoCs are used to discover and validate incidents rather than to prepare for them.

Answer

Conducting lessons learned

Answer

Containing the incident

Answer

Identifying indicators of compromise

Question 2

Which TWO are examples of risk treatment options? (Select two.)

Accepted Answer

Mitigate. Mitigate (B) is a recognized risk treatment option because it involves applying controls or countermeasures to reduce the likelihood and/or impact of a risk to an acceptable level. Accept (D) is also a recognized risk treatment option, meaning the organization acknowledges the risk and decides to retain it without additional controls, typically when the cost of treatment outweighs the benefit or the risk is within tolerance. The other options are not standard risk treatment categories: Neglect (A) and Ignore (C) imply simply disregarding a risk without a formal, documented decision, which is not a valid treatment strategy, and Amplify (E) is not a recognized risk treatment option since treatment aims to reduce or transfer risk, not increase exposure.

Answer

Neglect

Answer

Ignore

Answer

Amplify

Question 3

A SOC Tier 1 analyst is processing alerts. Which THREE tasks are typical for a Tier 1 analyst? (Select three.)

Accepted Answer

Execute basic investigation using standard tools. Option C is correct because Tier 1 analysts perform basic investigations with standard tools such as SIEM queries, log review, and endpoint/EDR lookups to validate alerts before escalation. Option D is correct because continuous monitoring of alerts and events from sources like SIEM, IDS/IPS, and EDR is a core Tier 1 responsibility. Option E is correct because initial triage and categorization—confirming true/false positive, assigning severity, and routing to the right queue—is exactly the Tier 1 role. Option A does not belong because deep malware analysis (reverse engineering, sandboxing, code disassembly) is typically Tier 2/Tier 3 or a dedicated malware analyst function. Option B does not belong because developing new detection signatures or rules is an engineering/detection-content task, not a Tier 1 monitoring and triage duty.

Answer

Conduct deep malware analysis

Answer

Develop new detection signatures

Question 4

A financial institution must comply with PCI DSS requirements for handling cardholder data. A security administrator is asked to implement the control that directly addresses the requirement to protect stored cardholder data. Which technology should the administrator deploy to meet this specific PCI DSS requirement?

Accepted Answer

Tokenization of the primary account number (PAN). PCI DSS requires that stored cardholder data be rendered unreadable, and tokenization replaces the PAN with a non-sensitive surrogate, directly fulfilling that requirement. Other controls such as endpoint encryption, segmentation, and MFA are valuable but do not address the specific protection of stored cardholder data. Tokenization also reduces the scope of the cardholder data environment, which is a key compliance benefit.

Answer

Full-disk encryption on all employee laptops

Answer

Network segmentation between the DMZ and internal network

Answer

Multifactor authentication for all administrative access

Question 5

A retail company is updating its security policy framework and needs to align its security controls with a widely recognized U.S. federal standard. The company wants a publication that provides a comprehensive catalog of security and privacy controls for federal information systems and organizations. Which NIST publication should the security team reference?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the definitive catalog of security and privacy controls for federal information systems and organizations. It is widely adopted by private sector organizations to build robust security programs. The other NIST publications focus on incident handling, risk assessment, and the risk management framework, respectively, and do not provide the comprehensive control catalog needed.

Answer

NIST SP 800-61

Answer

NIST SP 800-37

Answer

NIST SP 800-30

Question 6

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. A new marketing campaign document contains strategic pricing information that, if disclosed, could cause competitive harm. According to typical data classification practices, how should this document be classified?

Accepted Answer

Confidential. Data classification policies typically define Confidential as information whose unauthorized disclosure could cause harm, including competitive harm. Strategic pricing information fits that definition, so it should be classified as Confidential. Public and Internal are too low, and Restricted is generally reserved for more severe impact, making Confidential the appropriate level for this document.

Answer

Internal

Answer

Restricted

Answer

Public

Question 7

A security analyst is reviewing the organization's incident response plan. The plan defines several roles, including one responsible for coordinating all incident response activities and serving as the central point of communication. During a recent ransomware incident, this person was responsible for declaring the incident and ensuring that all stakeholders were informed. Which role does this describe?

Accepted Answer

Incident Response Manager. The Incident Response Manager is responsible for the overall coordination of the incident response process. This includes declaring incidents, managing communication with stakeholders, and ensuring that the response follows the organization's policies. The other roles have more specific or tactical responsibilities that do not include overarching coordination.

Answer

Legal Advisor

Answer

SOC Tier 1 Analyst

Answer

Incident Handler

Question 8

A healthcare organization is developing an incident response plan. The security manager wants to ensure that the plan includes a phase where the team practices and tests their response capabilities before an actual incident occurs. According to the NIST incident response lifecycle, which phase involves preparing and preventing incidents through activities like training and exercises?

Accepted Answer

Preparation. According to the NIST incident response lifecycle, Preparation is the phase dedicated to establishing and maintaining incident response capabilities, including training, exercises, and plan development. The other phases are reactive and occur during or after an incident. Therefore, the security manager should focus on Preparation to ensure the team is ready before an incident happens.

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 9

A security operations center (SOC) manager is developing a playbook for handling phishing incidents. The playbook must specify the first action an analyst should take upon receiving a reported phishing email. Which action should be performed first according to standard incident response procedures?

Accepted Answer

Preserve the email and analyze its headers and attachments. Standard incident response procedures for phishing begin with preserving and analyzing the reported email to confirm maliciousness and extract indicators. This step enables accurate containment and remediation, such as blocking malicious domains and quarantining similar messages. Isolating, deleting, or notifying law enforcement are subsequent actions that depend on the initial analysis.

Answer

Notify law enforcement about the phishing attempt

Answer

Isolate the recipient's workstation from the network

Answer

Delete the email from all mailboxes

Question 10

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The analyst is asked to classify a document that contains the company's proprietary source code. According to typical data classification standards, which classification level is most appropriate?

Accepted Answer

Restricted. Proprietary source code is a critical asset that requires the highest level of protection. The Restricted classification is designed for such data, ensuring that only authorized personnel with a specific need can access it. This minimizes the risk of intellectual property theft and aligns with common data classification policies.

Answer

Internal

Answer

Confidential

Answer

Public

Question 11

A financial institution is implementing a data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The security team must ensure that data labeled 'Restricted' receives the highest level of protection, including encryption, strict access controls, and monitoring. Which data classification level is typically subject to the most stringent regulatory requirements and requires the strongest security controls?

Accepted Answer

Restricted. In a typical data classification scheme, Restricted is the highest level and demands the most stringent security controls, including encryption, strict access, and monitoring. Public, Internal, and Confidential have progressively lower protection requirements. Since the policy defines Restricted as requiring the highest protection, that classification is the correct answer.

Answer

Internal

Answer

Confidential

Answer

Public

Question 12

A security manager is drafting a service level agreement (SLA) with a cloud service provider. The SLA must specify the maximum acceptable time for the provider to restore service after a disruption. Which metric should the manager include in the SLA to define this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a service after a disruption, making it the correct metric for the SLA. RPO addresses data loss, while MTBF and MTTR are reliability and repair averages, not restoration targets. The manager should specify RTO to ensure the provider meets business continuity requirements.

Answer

Mean Time To Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 13

A security analyst is reviewing the organization's security policies and notices that the Acceptable Use Policy (AUP) is outdated. The analyst is asked to identify key elements that should be included in an effective AUP. Which two elements are essential components of an AUP? (Choose two.)

Accepted Answer

Consequences for policy violations. An Acceptable Use Policy must clearly define acceptable and unacceptable use of organizational assets and specify consequences for violations. These elements set expectations and enable enforcement. Technical details like network diagrams, incident response procedures, and vulnerability lists belong in other documents and are not core components of an AUP.

Answer

List of all software vulnerabilities and patches

Answer

Detailed network diagram of the organization's infrastructure

Answer

Step-by-step incident response procedures

Question 14

A security analyst is reviewing the chain of custody form for a laptop seized from an employee suspected of intellectual property theft. The form shows the laptop was collected by the IT manager, transported to a storage room, and later examined by an outside forensics firm. The analyst notices that the form lacks signatures for the transfer between the IT manager and the storage room custodian. What is the most likely impact of this omission on the investigation?

Accepted Answer

The evidence may be challenged as tampered or unauthenticated in legal proceedings.. A chain of custody is a chronological documentation of evidence seizure, custody, transfer, and analysis. Each transfer must be signed and dated to prove the evidence was not tampered with. Missing signatures create an unaccounted period, which undermines the evidence's authenticity. Courts may exclude or discount such evidence, so the correct impact is that it may be challenged as tampered or unauthenticated.

Answer

The outside forensics firm must re-examine the laptop from scratch to restore integrity.

Answer

The forensic examination results will be automatically inadmissible in court.

Answer

The IT manager will be held personally liable for any data loss from the laptop.

Question 15

A new security analyst is reviewing the organization's data classification policy and notices that data labeled 'Restricted' must be encrypted at rest and in transit, while data labeled 'Internal' has no encryption requirement. The analyst asks why the policy distinguishes between these levels. What is the primary purpose of a data classification policy?

Accepted Answer

To define handling requirements based on the sensitivity and value of the data. A data classification policy categorizes information by sensitivity and value so that appropriate controls, such as encryption for 'Restricted' data, can be applied consistently. It supports risk-based decision-making, regulatory compliance, and clear handling procedures. The distinction between 'Restricted' and 'Internal' in the scenario exists precisely to ensure stronger protections are applied where the impact of disclosure is greatest.

Answer

To provide a legal shield that eliminates liability if data is breached

Answer

To specify which employees are allowed to access the internet from corporate devices

Answer

To ensure all data receives the same level of protection regardless of sensitivity