200-201 Security Concepts — 20 Questions

Question 1

A company needs to comply with regulations that protect personal data of EU citizens. Which TWO compliance frameworks are directly relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. GDPR is the EU regulation directly protecting personal data of EU citizens. ISO 27001 is an international security management standard that provides a framework for establishing, implementing, and maintaining an information security management system (ISMS), which is often used to demonstrate compliance with GDPR's requirements for data protection and security. The other options are not directly relevant: PCI DSS focuses on payment card data, HIPAA on US health data, and NIST CSF is a general cybersecurity framework primarily used in the US.

Answer

PCI DSS

Answer

NIST Cybersecurity Framework

Answer

HIPAA

Question 2

Which element of the CIA triad is primarily concerned with preventing unauthorized access to data?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad element that ensures data is accessible only to authorized users. It is primarily enforced through encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit) and access control mechanisms (e.g., RBAC, ACLs). Preventing unauthorized access directly aligns with confidentiality's goal of protecting data from disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 3

A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?

Accepted Answer

Passive reconnaissance. Reconnaissance attacks involve gathering information to identify vulnerabilities. Passive reconnaissance uses publicly available sources like social media.

Answer

Active reconnaissance

Answer

Denial of Service

Answer

Social engineering

Question 4

Which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that could be exploited. A vulnerability is a weakness in a system that can be exploited by a threat.

Answer

The act of taking advantage of a weakness

Answer

The likelihood that a threat will exploit a weakness

Answer

A potential event that could cause harm

Question 5

An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?

Accepted Answer

Availability. A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 6

A security analyst is examining a log file and notices that the hash value of a configuration file does not match the expected value. Which security goal has been violated?

Accepted Answer

Integrity. Integrity ensures that data has not been altered. A mismatched hash indicates the file has been modified.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 7

Which of the following is an example of a symmetric encryption algorithm?

Accepted Answer

AES. Symmetric encryption uses the same key for encryption and decryption. AES and 3DES are symmetric algorithms.

Answer

SHA-256

Answer

RSA

Answer

ECC

Question 8

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 9

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing

Question 10

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is designed to secure credit card transactions and protect cardholder data.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA

Question 11

A security analyst needs to ensure that a message has not been tampered with during transit and that the sender cannot deny sending it. Which cryptographic method should be used?

Accepted Answer

Digital signature. A digital signature provides both integrity (ensuring the message has not been tampered with) and non-repudiation (preventing the sender from denying they sent it). It works by hashing the message and encrypting that hash with the sender's private key; the recipient verifies the signature using the sender's public key. This cryptographic method uniquely binds the sender to the message, unlike other options that only address one of these requirements.

Answer

Symmetric encryption

Answer

Hashing

Answer

Public key infrastructure (PKI)

Question 12

During a security audit, it is discovered that an organization’s network is vulnerable to ARP spoofing attacks. Which type of attack could result from exploiting this vulnerability?

Accepted Answer

Man-in-the-middle. ARP spoofing can be used to perform man-in-the-middle attacks by associating the attacker's MAC address with the IP address of a legitimate host.

Answer

DNS poisoning

Answer

Phishing

Answer

DoS

Question 13

An organization wants to implement a security framework that includes functions such as Identify, Protect, Detect, Respond, and Recover. Which framework aligns with this structure?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework is built around these five core functions.

Answer

HIPAA Security Rule

Answer

PCI DSS

Answer

ISO 27001

Question 14

A security analyst is investigating a potential data breach. Which two actions are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Searching for employee information on LinkedIn. Passive reconnaissance involves gathering information without directly interacting with the target. WHOIS lookups and searching job postings are passive. Port scanning and social engineering are active.

Answer

Performing a port scan on the company's web server

Answer

Using a ping sweep to identify live hosts

Answer

Sending a phishing email to employees

Question 15

An organization is implementing a security policy to protect sensitive data. Which three are considered compliance frameworks that could guide this effort? (Choose three.)

Accepted Answer

HIPAA. PCI DSS, HIPAA, and GDPR are well-known compliance frameworks. NIST CSF is a framework but not a compliance standard; ISO 27001 is a standard but the question asks for compliance frameworks.

Answer

NIST Cybersecurity Framework

Answer

ISO 27001

Question 16

A security team is analyzing a malware infection. Which two characteristics are typical of a worm? (Choose two.)

Accepted Answer

Exploits vulnerabilities to spread without user interaction. Worms are self-replicating and spread across networks without human intervention. They do not require a host file and often exploit vulnerabilities.

Answer

Requires a host file to propagate

Answer

Disguises itself as a legitimate program

Answer

Attaches to an email to spread

Question 17

Which element of the CIA triad is primarily compromised when an attacker successfully intercepts and reads encrypted network traffic without authorization?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized entities. Intercepting and reading traffic violates this principle.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 18

A security analyst discovers that a server's configuration allows users to access files outside of their intended directory. In security terminology, what is this weakness called?

Accepted Answer

Vulnerability. A vulnerability is a weakness that can be exploited.

Answer

Exploit

Answer

Threat

Answer

Risk

Question 19

During a penetration test, a security engineer uses publicly available information from LinkedIn and Google to gather details about employees and organizational structure. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. The security engineer is gathering information from publicly available sources (LinkedIn, Google) without directly interacting with the target's systems. This is the definition of passive reconnaissance, which involves collecting data from open-source intelligence (OSINT) without sending any packets to the target network.

Answer

Active reconnaissance

Answer

Social engineering

Answer

Internal reconnaissance

Question 20

An attacker sends an email posing as the company's IT department, asking employees to click a link and enter their credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick recipients into revealing credentials, which is the classic definition of phishing. Phishing is a broad category of social engineering that employs deceptive electronic communications (typically email) to steal sensitive information.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing