200-201 Security Policies and Procedures — Timed 10 Questions

Question 1

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. A write blocker prevents any writes to the original drive, preserving its integrity during imaging. Option D is correct because computing a cryptographic hash (e.g., SHA-256) of the original drive before imaging creates a digital fingerprint that can be used later to verify that the forensic image is an exact copy and that no alterations occurred during acquisition or analysis. Both actions are essential to maintain evidence integrity and admissibility.

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 2

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, enabling both machine-readable indicators and human-readable context. TAXII (Trusted Automated Exchange of Indicator Information) is the transport protocol that defines how STIX content is exchanged over HTTPS. Together, they allow ISAC members to share threat intelligence in a standardized, automated manner. Snort rules are signatures for intrusion detection, not a sharing standard. OpenIOC is a format for indicators but lacks the report capability and transport protocol. MISP is a platform that can use STIX/TAXII but is not itself a standard or protocol.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 3

During an incident investigation, a forensic analyst needs to preserve the integrity of a hard drive. Which two actions should the analyst take before imaging the drive?

Accepted Answer

Generate a hash of the drive using SHA-256. To preserve integrity, the analyst must use a write blocker to prevent any writes during imaging, and generate a hash (e.g., SHA-256) before and after to verify no changes occurred.

Answer

Connect the drive directly to the forensic workstation

Answer

Install antivirus software on the drive

Question 4

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. Preparation includes creating the IR plan, team, tools, and conducting exercises. The other phases occur after an incident is detected.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 5

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 6

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 7

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 8

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 9

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 10

A SOC analyst at Tier 1 receives an alert for a known malware signature. After initial investigation, the analyst finds that the alert is a false positive caused by an outdated signature. What should the analyst do next?

Accepted Answer

Close the alert and document the finding. Tier 1 analysts handle basic investigation and can close false positives. Updating signatures is outside their scope.

Answer

Escalate the alert to Tier 2 for further analysis

Answer

Update the signature database on the security tools

Answer

Initiate the containment process