200-201 Security Policies and Procedures Practice Test 8 — 15 Questions

Question 1

A security administrator is configuring a firewall rule set to control traffic between the corporate network and the internet. The policy states that only web browsing (HTTP and HTTPS) should be allowed outbound, and all other outbound traffic should be denied. Which type of security control is this an example of?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preventive control. The firewall rule set is a preventive control because it enforces the policy by blocking all outbound traffic except HTTP and HTTPS before it can leave the network. Preventive controls are proactive measures that stop unwanted actions. Detective controls identify events, corrective controls remediate after incidents, and compensating controls are alternatives when primary controls are not feasible.

Answer

Detective control

Answer

Compensating control

Answer

Corrective control

Question 2

A security analyst is reviewing the organization's password policy. The policy currently requires passwords to be at least 8 characters and changed every 60 days. The analyst recommends aligning with NIST SP 800-63B guidelines. Which change should the analyst recommend?

Accepted Answer

Remove the periodic password expiration and instead enforce a longer minimum length with a blocklist of common passwords.. The analyst should recommend removing periodic password expiration and instead enforcing a longer minimum length with a blocklist of common passwords. NIST SP 800-63B emphasizes that password expiration can degrade security by encouraging weak, predictable passwords. A blocklist prevents users from choosing easily guessed or compromised passwords, and a longer minimum length increases resistance to brute-force attacks. This approach aligns with modern best practices and reduces the burden on users and help desk.

Answer

Increase the minimum password length to 12 characters and require complexity.

Answer

Require passwords to be changed every 30 days to reduce the window of compromise.

Answer

Implement a requirement for passwords to include at least one special character and one number.

Question 3

A financial services firm must retain security event logs for seven years to satisfy regulatory requirements. The SOC manager asks which property of log data must be preserved so that logs cannot be altered or deleted after collection, even by administrators. Which property should the manager emphasize?

Accepted Answer

Integrity. Log integrity means the data has not been altered or destroyed after collection, which is exactly what regulators expect when logs are retained as evidence. Techniques such as write-once media, hashing, and forwarding to hardened centralized collectors enforce integrity. Confidentiality limits who can read logs, availability keeps them reachable, and non-repudiation proves authorship, so none of those properties directly prevents tampering with stored records.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 4

A security analyst is reviewing an incident response policy that requires the team to preserve evidence for potential legal action. The analyst notices that the policy does not address how to handle evidence when a compromised system must be rebooted to restore services. What should the analyst recommend to balance evidence preservation with operational recovery?

Accepted Answer

Capture volatile memory and disk images before rebooting, and document the sequence of actions. When a compromised system must be rebooted, capturing volatile memory and disk images beforehand preserves evidence that would otherwise be lost. Documenting each action maintains chain of custody and supports legal admissibility. This balanced approach allows services to be restored without sacrificing the integrity of the investigation, addressing the gap in the current policy.

Answer

Shut down the system and store it in a secure room without further analysis

Answer

Continue running the compromised system indefinitely to observe attacker behavior

Answer

Reboot immediately to restore services and collect evidence afterward from backups

Question 5

A security manager is developing a business continuity plan (BCP) for a critical e-commerce application. The application has a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 15 minutes. The manager must choose a backup strategy that meets these objectives. Which strategy is most appropriate?

Accepted Answer

Continuous data replication to a hot site with automated failover.. The RTO of 4 hours requires recovery within that time, and the RPO of 15 minutes requires minimal data loss. Continuous replication to a hot site with automated failover can achieve both by keeping data synchronized and enabling rapid switchover. Other strategies like nightly, weekly, or daily backups introduce too much data loss and longer recovery times, failing to meet the objectives.

Answer

Weekly incremental backups to a warm site with manual failover.

Answer

Daily differential backups to a cold site with tape restoration.

Answer

Nightly full backups stored offsite with manual restore.

Question 6

A security manager is preparing an incident response plan for a retail company. The plan must define how the organization will handle incidents consistently and must satisfy auditors. Which TWO elements are essential components of an incident response policy? (Choose two.)

Accepted Answer

A requirement to classify incidents by severity with corresponding escalation and notification criteria. An incident response policy governs how incidents are handled consistently by defining team roles, decision authority, and severity-based escalation and notification criteria. Those elements give responders clear direction and give auditors measurable expectations. Detection signatures, exact command syntax, and the full business continuity plan belong to tooling, procedures, or a separate discipline, so they are not essential policy components.

Answer

A complete list of every vulnerability scanner signature and detection rule deployed in the environment

Answer

The exact command syntax used to isolate a compromised endpoint from the network

Answer

A copy of the organization's entire business continuity plan as an appendix

Question 7

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. Which TWO handling requirements are typically associated with data classified as 'Restricted'? (Choose two.)

Accepted Answer

Access is limited to a need-to-know basis with strict approval workflows.. Restricted data, as the highest classification, requires strong protections such as encryption at rest and in transit, and access limited to a need-to-know basis with strict approvals. These controls reduce the risk of unauthorized disclosure. Free sharing, mandatory removable media storage, and automatic declassification are not typical requirements and would weaken security.

Answer

Data can be declassified to Public after 30 days automatically.

Answer

Data must be stored only on removable media for physical security.

Answer

Data can be shared freely within the organization without additional controls.

Question 8

A security team wants to adopt a framework that provides a common language for describing cyberthreats, including tactics, techniques, and procedures observed in real intrusions. Which framework should the team use to map adversary behavior?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the framework that catalogs real-world adversary tactics and techniques, giving defenders a shared vocabulary for describing intrusions. Teams use it to map detections to techniques, identify coverage gaps, and communicate findings consistently. Governance standards and vulnerability scoring systems serve different purposes and do not describe adversary behavior.

Answer

ISO/IEC 27001

Answer

NIST Cybersecurity Framework

Answer

CVSS

Question 9

A security analyst is tasked with developing a data loss prevention (DLP) strategy for the organization. The strategy must align with the CyberOps Associate curriculum and address both endpoint and network-based data exfiltration. Which two actions should the analyst include in the strategy? (Choose two.)

Accepted Answer

Deploy network DLP solutions to inspect outbound traffic for sensitive data patterns and block unauthorized transfers.. The two actions to include are endpoint DLP and network DLP. Endpoint DLP controls data transfers at the device level, such as to USB drives or cloud services, while network DLP inspects outbound traffic for sensitive data. Together, they provide comprehensive coverage for data exfiltration across both endpoints and the network. These technical controls directly address the requirement to monitor and prevent unauthorized data transfers, aligning with the CyberOps Associate curriculum's focus on data protection.

Answer

Implement role-based access control (RBAC) to limit access to sensitive data.

Answer

Configure full-disk encryption on all endpoints to prevent data loss if a device is stolen.

Answer

Establish a security awareness program to educate employees about data handling policies.

Question 10

An organization classifies data into Public, Internal, Confidential, and Restricted tiers. A developer needs to place a dataset containing customer payment card numbers into the correct tier and apply the required handling controls. According to common data classification practices, which tier and control combination is most appropriate?

Accepted Answer

Restricted, with encryption, strict need-to-know access, and audit logging. Payment card numbers are regulated under PCI DSS and represent a high-impact asset if disclosed, so they belong in the most restrictive tier the organization defines. Restricted classification paired with encryption, need-to-know access, and audit logging satisfies both internal policy and regulatory expectations. Lower tiers such as Internal, Confidential, or Public would apply weaker controls than the data warrants and could create compliance exposure.

Answer

Confidential, with encryption at rest and in transit

Answer

Internal, because the data is used only by employees

Answer

Public, because the numbers are only partial card values

Question 11

A security analyst is reviewing the organization's data classification policy. The policy defines four levels: Public, Internal, Confidential, and Restricted. The analyst finds that a marketing team has stored a file containing customer credit card numbers on a shared drive accessible to all employees. The analyst must recommend the appropriate classification and handling for this file. What should the analyst recommend?

Accepted Answer

Classify as Restricted, encrypt the file, and limit access to authorized personnel only.. Customer credit card numbers are highly sensitive and regulated by PCI DSS. They should be classified as Restricted, the highest level in the policy, requiring encryption and strict access controls. Leaving them on a shared drive accessible to all employees is a serious violation. The analyst should recommend reclassification and secure handling to prevent data breaches and regulatory penalties.

Answer

Classify as Public, because the customers consented to sharing their data.

Answer

Classify as Internal, because it is used by the marketing team for business purposes.

Answer

Classify as Confidential, apply password protection, and leave on the shared drive.

Question 12

A security analyst is reviewing the organization's password policy, which currently requires a minimum of eight characters with complexity but no expiration. After a recent audit finding, management wants to align with modern best practices. Which change should the analyst recommend?

Accepted Answer

Increase the minimum length to 14 characters and remove forced periodic expiration. Modern password guidance recommends longer minimum lengths, such as 14 characters, and discourages forced periodic expiration unless compromise is suspected. Longer passwords increase the effort required for brute-force attacks, while removing arbitrary expiration reduces predictable user behavior. This combination addresses the audit finding by aligning the policy with current best practices.

Answer

Allow users to choose any password of any length as long as it contains a special character

Answer

Reduce the minimum length to six characters and require changes every 30 days

Answer

Require passwords to be changed every 60 days and prohibit reuse of the last 24 passwords

Question 13

A multinational manufacturer handles personal data of employees in several countries and wants to ensure its security program aligns with recognized international standards for establishing, implementing, maintaining, and continually improving an information security management system. Which framework should the security team adopt as the primary basis for this program?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the internationally recognized standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system. That scope matches the manufacturer's goal of a globally aligned, certifiable security program. The NIST Cybersecurity Framework, CIS Controls, and PCI DSS serve different purposes: voluntary taxonomy, technical safeguards, and payment card requirements, respectively.

Answer

CIS Critical Security Controls

Answer

PCI DSS

Answer

NIST Cybersecurity Framework

Question 14

A financial services firm must retain security audit logs for a period specified by its regulator and be able to produce them during an examination. Which action BEST ensures the logs remain trustworthy and available for that purpose?

Accepted Answer

Forward logs to a centralized, access-controlled repository with integrity protection. Centralizing logs in an access-controlled repository with integrity protections ensures they survive host compromise or failure and can be trusted during a regulatory examination. Retention enforcement and restricted access are as important as collection, because examiners expect complete, unaltered records that can be produced on demand.

Answer

Increase the local log file size limit so events are overwritten less frequently

Answer

Compress logs and email them weekly to the security team's distribution list

Answer

Store logs only on the originating server with local administrator access

Question 15

A security manager is developing a business continuity plan (BCP) and needs to determine the maximum tolerable downtime (MTD) for a critical order-processing system. The system generates $10,000 in revenue per hour. If the system is down for more than 4 hours, the company will lose a key customer. What is the MTD for this system?

Accepted Answer

4 hours. The maximum tolerable downtime (MTD) is the longest time a system can be offline before the business suffers unacceptable consequences. Here, the loss of a key customer after 4 hours defines that threshold, so the MTD is 4 hours. Revenue loss per hour is relevant for cost analysis but does not change the MTD.

Answer

The MTD cannot be determined from the information given.

Answer

24 hours

Answer

1 hour