200-201 Security Concepts — 10 Questions

Question 1

A company needs to comply with regulations that protect personal data of EU citizens. Which TWO compliance frameworks are directly relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. GDPR is the EU regulation directly protecting personal data of EU citizens. ISO 27001 is an international security management standard that provides a framework for establishing, implementing, and maintaining an information security management system (ISMS), which is often used to demonstrate compliance with GDPR's requirements for data protection and security. The other options are not directly relevant: PCI DSS focuses on payment card data, HIPAA on US health data, and NIST CSF is a general cybersecurity framework primarily used in the US.

Answer

PCI DSS

Answer

NIST Cybersecurity Framework

Answer

HIPAA

Question 2

Which element of the CIA triad is primarily concerned with preventing unauthorized access to data?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad element that ensures data is accessible only to authorized users. It is primarily enforced through encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit) and access control mechanisms (e.g., RBAC, ACLs). Preventing unauthorized access directly aligns with confidentiality's goal of protecting data from disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 3

A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?

Accepted Answer

Passive reconnaissance. Reconnaissance attacks involve gathering information to identify vulnerabilities. Passive reconnaissance uses publicly available sources like social media.

Answer

Active reconnaissance

Answer

Denial of Service

Answer

Social engineering

Question 4

Which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that could be exploited. A vulnerability is a weakness in a system that can be exploited by a threat.

Answer

The act of taking advantage of a weakness

Answer

The likelihood that a threat will exploit a weakness

Answer

A potential event that could cause harm

Question 5

An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?

Accepted Answer

Availability. A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 6

A security analyst is examining a log file and notices that the hash value of a configuration file does not match the expected value. Which security goal has been violated?

Accepted Answer

Integrity. Integrity ensures that data has not been altered. A mismatched hash indicates the file has been modified.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 7

Which of the following is an example of a symmetric encryption algorithm?

Accepted Answer

AES. Symmetric encryption uses the same key for encryption and decryption. AES and 3DES are symmetric algorithms.

Answer

SHA-256

Answer

RSA

Answer

ECC

Question 8

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 9

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing

Question 10

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is designed to secure credit card transactions and protect cardholder data.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA