200-201 Security Policies and Procedures — Timed 20 Questions

Question 1

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. Preparation includes creating the IR plan, team, tools, and conducting exercises. The other phases occur after an incident is detected.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 2

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 3

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 4

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 5

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 6

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 7

A SOC analyst at Tier 1 receives an alert for a known malware signature. After initial investigation, the analyst finds that the alert is a false positive caused by an outdated signature. What should the analyst do next?

Accepted Answer

Close the alert and document the finding. Tier 1 analysts handle basic investigation and can close false positives. Updating signatures is outside their scope.

Answer

Escalate the alert to Tier 2 for further analysis

Answer

Update the signature database on the security tools

Answer

Initiate the containment process

Question 8

Which threat intelligence sharing standard defines a language and format for representing structured threat information, such as indicators and campaigns?

Accepted Answer

STIX. STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

Answer

MISP

Answer

TAXII

Answer

OpenIOC

Question 9

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Accepted Answer

Perform a live forensic image of the server's memory before powering off. Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer

Disconnect the server from the network but leave it running

Answer

Immediately power off the server without any imaging

Answer

Skip evidence collection and focus solely on containment

Question 10

A company's security policy requires that all data classified as 'Confidential' must be encrypted at rest and in transit. This requirement is part of which policy?

Accepted Answer

Data Classification Policy. The requirement to encrypt 'Confidential' data is a direct outcome of a data classification policy, which defines categories (e.g., Public, Internal, Confidential, Restricted) and mandates specific security controls for each category. Encryption at rest and in transit is a typical control for the 'Confidential' tier, ensuring data is protected using mechanisms like AES-256 for storage and TLS 1.2+ for transmission.

Answer

Remote Access Policy

Answer

Password Policy

Answer

Acceptable Use Policy

Question 11

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

Accepted Answer

Tier 3. Tier 3 analysts perform proactive threat hunting and complex forensics.

Answer

Tier 1

Answer

All tiers equally

Answer

Tier 2

Question 12

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. Option C is correct because a write blocker is a hardware or software tool that intercepts and blocks any write commands to the original drive, ensuring that no data is altered during the forensic imaging process. This is essential to maintain the integrity of the evidence, as any modification could render the data inadmissible in legal proceedings. Without a write blocker, even a simple read operation from the operating system could trigger unintended writes (e.g., metadata updates, file system journaling).

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 13

Which of the following are responsibilities of the legal counsel role during incident response? (Choose two.)

Accepted Answer

Determining data breach notification requirements. Legal counsel advises on breach notification requirements and can place legal holds to preserve evidence for litigation.

Answer

Communicating with the media

Answer

Conducting technical analysis of malware

Answer

Approving financial expenditures for containment

Question 14

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, while TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging that STIX content over HTTPS. Together, they enable ISAC members to share both machine-readable indicators and human-readable reports in a standardized, automated manner.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 15

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident

Question 16

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 17

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 18

In the NIST SP 800-61 Rev 2 incident response process, which phase involves documenting lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. Option C is correct because the Post-Incident Activity phase of NIST SP 800-61 Rev 2 is specifically designed for conducting a lessons learned meeting, documenting findings, and updating the incident response plan based on those insights. This phase ensures continuous improvement of the incident response process by capturing what worked, what didn't, and what changes are needed for future incidents.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 19

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Accepted Answer

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.. Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer

Create a forensic image without write-blocking, then hash the image.

Answer

Copy all files to an external drive without hashing.

Answer

Disconnect the hard drive and boot from a live CD to collect data.

Question 20

During a security incident, the CISO decides to contain a compromised server by isolating it from the network. Which role is primarily responsible for making this containment decision based on business impact?

Accepted Answer

CISO. The CISO is the decision-maker for business impact and authorizes containment actions.

Answer

Incident handler

Answer

Legal counsel

Answer

PR representative