200-201 Security Policies and Procedures Practice Test 7 — 15 Questions

Question 1

A security analyst is reviewing the organization's security policy framework. The analyst notes that the policy defines the acceptable use of company assets, including computers, networks, and data. Which document typically outlines the rules for employee behavior when using these assets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) is designed to outline the rules and guidelines for using company assets. It typically covers what is allowed and prohibited, and the consequences of violations. This aligns with the scenario's requirement to define acceptable use of computers, networks, and data.

Answer

Service Level Agreement (SLA)

Answer

Non-Disclosure Agreement (NDA)

Answer

Incident Response Plan (IRP)

Question 2

A mid-size healthcare company has completed its annual review of security documentation. The CISO asks the governance team to align the documents into a clear hierarchy, where a single high-level document states the organization's overall security intentions and direction, and all subordinate documents must conform to it. Which document should the governance team treat as the highest-level authority?

Accepted Answer

Security policy. The security policy is the foundational, management-approved statement of security intent, scope, and objectives, and it drives every standard, procedure, and guideline beneath it. Standards define mandatory requirements, procedures describe exact steps, and guidelines provide optional advice. Only the security policy functions as the single highest-level authority to which all subordinate documentation must conform.

Answer

Security standard

Answer

Security guideline

Answer

Security procedure

Question 3

A company is updating its security policy to align with the principle of least privilege. The IT director asks the security analyst to recommend a control that enforces this principle for user access to a financial application. Which control should the analyst recommend?

Accepted Answer

Role-based access control (RBAC) that grants permissions based on job functions.. The principle of least privilege requires that users have only the minimum access necessary to perform their job functions. Role-based access control (RBAC) achieves this by defining roles with specific permissions and assigning users to roles. This limits access based on job needs and simplifies administration. Other controls like MAC, DAC, or SSO/MFA do not directly enforce least privilege for application access.

Answer

Single sign-on (SSO) with multifactor authentication (MFA).

Answer

Mandatory access control (MAC) using sensitivity labels on all data.

Answer

Discretionary access control (DAC) where data owners set permissions.

Question 4

A security manager is drafting an incident response policy and wants to ensure that the organization can legally monitor employee communications during an investigation. The manager asks the legal team what element must be included in the employee handbook and policy documents to support this capability. Which element is most critical?

Accepted Answer

A statement that employees have no expectation of privacy when using corporate systems. The legal basis for monitoring employee communications is established by clearly informing employees that corporate systems are monitored and that privacy should not be expected. This notice, typically embedded in an Acceptable Use Policy or handbook, demonstrates consent and supports investigations. Reporting deadlines and device surrender clauses address different concerns and do not provide the same legal foundation for monitoring.

Answer

A provision that all incident response activities are exempt from regulatory oversight

Answer

A requirement that employees report all security incidents within one hour of discovery

Answer

A clause requiring employees to surrender personal devices for forensic imaging at any time

Question 5

A security analyst is reviewing the organization's security policy framework. The analyst notes that the policy defines the acceptable use of company assets, including computers, networks, and data. Which document typically outlines the rules for employee behavior when using these assets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Develop and maintain a playbook for zero-day incident response that includes isolation, monitoring, and temporary workarounds.. The correct recommendation is to develop a zero-day incident response playbook. NIST SP 800-61 emphasizes the importance of having specific procedures for incidents that do not have immediate fixes. A playbook outlines steps for containment, monitoring, and applying temporary mitigations, which are critical when a patch is unavailable. This proactive measure ensures the organization can respond effectively and minimize impact during a zero-day attack.

Answer

Deploy a next-generation firewall with signature-based detection to block all known exploits.

Answer

Conduct regular vulnerability scans to identify and remediate all unpatched systems.

Answer

Implement a bug bounty program to incentivize external researchers to report vulnerabilities.

Question 6

A financial services firm must comply with regulations covering cardholder data. The security team is mapping its controls to the PCI DSS framework and wants to confirm that the framework's requirements are being met before an upcoming assessment. Which statement best describes what PCI DSS provides to the organization?

Accepted Answer

A set of mandatory requirements and control objectives for organizations that store, process, or transmit cardholder data. PCI DSS is an industry-mandated framework of requirements and control objectives that applies to any organization handling cardholder data. It specifies outcomes, such as protecting stored data and encrypting transmission over open networks, but leaves specific technical implementation to the organization. It is enforced contractually through acquiring banks, not as advisory guidance or as government legislation.

Answer

A voluntary advisory publication that suggests best practices but carries no compliance obligations for the merchant

Answer

A prescriptive technical configuration baseline that dictates exact settings for every operating system and application in the environment

Answer

A legal statute enacted by a national government that replaces all contractual security obligations with statutory penalties

Question 7

A SOC manager is drafting the organization's incident response plan and wants to align it with the NIST SP 800-61 Rev. 2 lifecycle so that phases are clearly defined for auditors. Which sequence correctly represents the four phases of the incident response lifecycle as described in NIST SP 800-61 Rev. 2?

Accepted Answer

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. NIST SP 800-61 Rev. 2 organizes incident response into four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. A plan built on this structure gives clear entry and exit criteria for each phase, supports role assignment, and provides auditors with a recognizable mapping. The other sequences either describe only response sub-steps or borrow generic project management terms that do not match the standard.

Answer

Identification, Containment, Eradication, Recovery

Answer

Preparation, Prevention, Detection, Response

Answer

Planning, Execution, Monitoring, Closure

Question 8

A security analyst discovers that a former employee's user account remains active 45 days after termination, and audit logs show that the account was used to access a file server twice in the past week. Which element of the access control lifecycle was MOST directly violated?

Accepted Answer

Account deprovisioning. The account of a terminated employee should have been disabled as part of the offboarding process. Its continued activity 45 days later shows the deprovisioning step of the identity lifecycle failed. Effective programs integrate HR termination events with identity management so accounts are disabled automatically, and they run periodic access reviews to catch accounts that slip through manual processes.

Answer

Credential rotation

Answer

Privilege escalation review

Answer

Account provisioning

Question 9

A security analyst is reviewing the organization's security policy framework. The analyst notes that the policy defines the acceptable use of company assets, including computers, networks, and data. Which document typically outlines the rules for employee behavior when using these assets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Documented roles and responsibilities for the continuity team. A business continuity plan should define recovery time objectives to set acceptable downtime limits and assign clear roles and responsibilities to the continuity team. These elements ensure that recovery efforts are prioritized and coordinated. The alternate site and generator address infrastructure, but without RTOs and defined roles, the organization cannot measure or manage its recovery effectively.

Answer

A list of employee personal social media accounts

Answer

A marketing plan for attracting new customers after the outage

Answer

A schedule for regular penetration testing of the alternate site

Question 10

A security manager is updating the organization's data classification policy. The policy must align with the CyberOps Associate curriculum and ensure that data handling procedures are consistent. The manager proposes that data classified as 'Public' should still be encrypted when stored on internal servers. Which principle should guide the manager's decision?

Accepted Answer

Data should be protected according to its classification level, and 'Public' data does not require encryption at rest.. The guiding principle is that data protection controls should be commensurate with the data's classification. Public data, by definition, is not sensitive and does not require encryption at rest. Encrypting it would add unnecessary overhead without meaningful security benefit. The policy should ensure that higher classifications, such as Confidential, receive stronger protections like encryption, while Public data can be handled with basic integrity controls. This risk-based approach is consistent with the CyberOps Associate curriculum.

Answer

All data must be encrypted at rest regardless of classification to ensure defense in depth.

Answer

Encryption is only required for data in transit, not for data at rest, for any classification.

Answer

The classification of data should be based on the cost of encryption, not on its sensitivity.

Question 11

A hospital's security team is updating its data handling policy. The compliance officer asks which two classification labels are most appropriate for a patient's electronic protected health information (ePHI) under a typical data classification scheme aligned with HIPAA expectations. (Choose two.)

Accepted Answer

Confidential. In a typical data classification scheme, ePHI belongs in the highest sensitivity tiers because unauthorized disclosure causes regulatory penalties and patient harm. Restricted and Confidential are the two labels that mandate encryption, strict access control, and handling procedures consistent with HIPAA. Public, Internal Use Only, and Unclassified all imply weaker or no protections, so they cannot be applied to patient health information in this policy.

Answer

Internal Use Only

Answer

Unclassified

Answer

Public

Question 12

A hospital's IT department issues a document that tells administrators the exact sequence of steps to disable a terminated clinician's account, including which systems to check and in what order. The document is mandatory and is referenced during audits. Which type of security documentation does this describe?

Accepted Answer

Security procedure. A security procedure is the mandatory, detailed, step-by-step documentation that describes how to carry out a specific operational task, such as disabling a terminated user's account across multiple systems in a defined order. Policies state intent, standards define mandatory requirements, and guidelines offer optional advice. The scenario's emphasis on an exact sequence of steps makes the procedure the correct classification.

Answer

Security standard

Answer

Security policy

Answer

Security guideline

Question 13

A healthcare organization stores patient records and must comply with the HIPAA Security Rule. The CISO wants to document the types of safeguards that protect data through encryption, access controls, and audit logging. Which category of safeguards under the HIPAA Security Rule covers these controls?

Accepted Answer

Technical safeguards. The HIPAA Security Rule groups safeguards into administrative, physical, and technical categories. Encryption, access controls, and audit logging are technology-based protections applied to electronic protected health information, which places them squarely in the technical safeguards category. Administrative safeguards involve policies and workforce management, while physical safeguards involve facility and device protections, so neither fits the described controls.

Answer

Organizational requirements

Answer

Physical safeguards

Answer

Administrative safeguards

Question 14

A financial services company must retain security event logs for a period defined by its policy and applicable regulations. The security architect is documenting how long different log sources must be kept and where. Which statement best reflects a sound log retention practice for security operations?

Accepted Answer

Define retention periods per log source based on regulatory and business requirements, and store logs centrally with integrity protection.. Effective log retention ties each source to a defined period justified by regulation and business need, then centralizes storage with integrity protection so logs remain available and trustworthy. Indefinite retention on source systems, extremely short deletion windows, or keeping only correlated alerts all undermine investigations and compliance. The chosen approach supports both retrospective hunting and evidentiary requirements.

Answer

Retain only logs that the SIEM has already correlated into alerts, discarding raw events to save space.

Answer

Delete logs after 24 hours to reduce the risk of exposing sensitive information in the event of a breach.

Answer

Retain all logs indefinitely on the source system to guarantee availability for any future investigation.

Question 15

A hospital must protect patient records under a regulation that specifies administrative, physical, and technical safeguards for electronic protected health information. Which U.S. regulation establishes these requirements?

Accepted Answer

HIPAA Security Rule. The HIPAA Security Rule is the U.S. regulation that requires covered entities to implement administrative, physical, and technical safeguards for electronic protected health information. Its three safeguard categories map directly to the scenario, and compliance is enforced through risk analysis and documented policies rather than a prescriptive control checklist.

Answer

SOX

Answer

GDPR

Answer

PCI DSS