200-201 Security Policies and Procedures — Timed 15 Questions

Question 1

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. Preparation includes creating the IR plan, team, tools, and conducting exercises. The other phases occur after an incident is detected.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 2

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 3

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 4

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 5

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 6

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 7

A SOC analyst at Tier 1 receives an alert for a known malware signature. After initial investigation, the analyst finds that the alert is a false positive caused by an outdated signature. What should the analyst do next?

Accepted Answer

Close the alert and document the finding. Tier 1 analysts handle basic investigation and can close false positives. Updating signatures is outside their scope.

Answer

Escalate the alert to Tier 2 for further analysis

Answer

Update the signature database on the security tools

Answer

Initiate the containment process

Question 8

Which threat intelligence sharing standard defines a language and format for representing structured threat information, such as indicators and campaigns?

Accepted Answer

STIX. STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

Answer

MISP

Answer

TAXII

Answer

OpenIOC

Question 9

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Accepted Answer

Perform a live forensic image of the server's memory before powering off. Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer

Disconnect the server from the network but leave it running

Answer

Immediately power off the server without any imaging

Answer

Skip evidence collection and focus solely on containment

Question 10

A company's security policy requires that all data classified as 'Confidential' must be encrypted at rest and in transit. This requirement is part of which policy?

Accepted Answer

Data Classification Policy. The requirement to encrypt 'Confidential' data is a direct outcome of a data classification policy, which defines categories (e.g., Public, Internal, Confidential, Restricted) and mandates specific security controls for each category. Encryption at rest and in transit is a typical control for the 'Confidential' tier, ensuring data is protected using mechanisms like AES-256 for storage and TLS 1.2+ for transmission.

Answer

Remote Access Policy

Answer

Password Policy

Answer

Acceptable Use Policy

Question 11

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

Accepted Answer

Tier 3. Tier 3 analysts perform proactive threat hunting and complex forensics.

Answer

Tier 1

Answer

All tiers equally

Answer

Tier 2

Question 12

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. Option C is correct because a write blocker is a hardware or software tool that intercepts and blocks any write commands to the original drive, ensuring that no data is altered during the forensic imaging process. This is essential to maintain the integrity of the evidence, as any modification could render the data inadmissible in legal proceedings. Without a write blocker, even a simple read operation from the operating system could trigger unintended writes (e.g., metadata updates, file system journaling).

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 13

Which of the following are responsibilities of the legal counsel role during incident response? (Choose two.)

Accepted Answer

Determining data breach notification requirements. Legal counsel advises on breach notification requirements and can place legal holds to preserve evidence for litigation.

Answer

Communicating with the media

Answer

Conducting technical analysis of malware

Answer

Approving financial expenditures for containment

Question 14

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, while TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging that STIX content over HTTPS. Together, they enable ISAC members to share both machine-readable indicators and human-readable reports in a standardized, automated manner.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 15

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident