200-201 Security Concepts — 50 Questions

Question 1

An organization is implementing a security policy to protect sensitive data. Which three are considered compliance frameworks that could guide this effort? (Choose three.)

Accepted Answer

HIPAA. HIPAA (C) is a compliance framework because it is a U.S. federal law that mandates administrative, physical, and technical safeguards for protected health information (PHI), directly guiding how sensitive data must be protected. PCI DSS (D) is a compliance framework because it is a mandated standard from the payment card industry that prescribes specific controls—such as encryption, access control, and network segmentation—for organizations handling cardholder data. GDPR (E) is a compliance framework because it is an EU regulation that imposes legally enforceable data protection requirements, including lawful processing, data subject rights, and breach notification, on organizations processing personal data of EU residents. NIST Cybersecurity Framework (A) is a voluntary risk-management framework rather than a compliance framework, and ISO 27001 (B) is a voluntary international standard for information security management systems, so neither is a legally mandated compliance framework in this context.

Answer

NIST Cybersecurity Framework

Answer

ISO 27001

Question 2

An organization wants to ensure data integrity and non-repudiation for sensitive documents. Which THREE cryptographic mechanisms should be implemented? (Select three.)

Accepted Answer

Digital signatures. Digital signatures (B) are correct because they use the signer's private key to produce a value verifiable with the signer's public key, providing both integrity and non-repudiation since only the private-key holder could have signed. Hashing (C) is correct because a cryptographic hash (e.g., SHA-256) produces a fixed-length digest that detects any modification to the document, thereby ensuring data integrity. Asymmetric encryption (D) is correct because public/private key pairs enable secure key exchange and support the signature and verification processes that underpin non-repudiation and integrity. Steganography (A) merely hides data within other media and provides no integrity or non-repudiation guarantees, and symmetric encryption (E) uses a shared secret key that provides confidentiality but cannot prove origin or prevent either party from denying authorship, so neither belongs here.

Answer

Steganography

Answer

Symmetric encryption

Question 3

A security analyst is reviewing network logs and identifies several failed login attempts followed by a successful login from an unusual geographic location. Which TWO security concepts are most directly related to this scenario? (Choose two.)

Accepted Answer

Exploit. Option A (Exploit) is correct because the sequence of failed logins followed by a successful login from an unusual location is the signature of an attacker actively leveraging a weakness—such as weak credentials or brute-forced passwords—to gain unauthorized access, which is the definition of an exploit in action. Option C (Threat) is correct because the malicious actor or event attempting unauthorized access via credential guessing or compromised credentials represents a threat, i.e., any potential cause of an unwanted security incident. Option B (Non-repudiation) does not belong because it refers to assurance that a party cannot deny performing an action, typically achieved through digital signatures and audit trails, not to detecting or characterizing an intrusion attempt. Option D (Risk) does not belong because risk is the potential for loss or damage when a threat exploits a vulnerability, a broader calculated likelihood/impact measure rather than the specific adversarial activity observed. Option E (Vulnerability) does not belong because a vulnerability is the underlying weakness itself (e.g., a misconfiguration or unpatched service), whereas the scenario describes the active exploitation and the threat actor, not the mere existence of the flaw.

Answer

Non-repudiation

Answer

Risk

Answer

Vulnerability

Question 4

A company is implementing a new security policy to protect customer payment information. Which TWO compliance frameworks are most relevant to this requirement? (Choose two.)

Accepted Answer

GDPR. Option C (GDPR) is correct because it is the EU regulation governing the protection of personal data, including customer payment information, imposing requirements on how organizations collect, store, and process such data. Option D (PCI DSS) is correct because it is the Payment Card Industry Data Security Standard, a framework specifically designed to protect cardholder data and payment information during storage, processing, and transmission. Option A (HIPAA) is incorrect because it applies to protected health information in the healthcare sector, not payment card data. Option B (ISO 27001) is incorrect because it is a general information security management standard, not a payment-specific compliance framework. Option E (NIST Cybersecurity Framework) is incorrect because it provides voluntary cybersecurity guidance rather than a compliance mandate specifically for payment information.

Answer

HIPAA

Answer

ISO 27001

Answer

NIST Cybersecurity Framework

Question 5

An analyst is investigating a security incident where an attacker gained access to a server by exploiting a known vulnerability. The attacker then moved laterally and exfiltrated data. Which THREE phases of the Cyber Kill Chain are evident in this scenario? (Choose three.)

Accepted Answer

Exploitation. Option B (Exploitation) is correct because the scenario explicitly states the attacker gained access by exploiting a known vulnerability, which is the kill chain phase where the malicious payload is executed against the target. Option D (Installation) is correct because after gaining access the attacker established a foothold on the server, allowing persistent presence and enabling the subsequent lateral movement. Option E (Actions on Objectives) is correct because the attacker moved laterally and exfiltrated data, which are the goal-oriented activities that define this final phase. Option A (Reconnaissance) is not evident since no information gathering or target research is described, and Option C (Weaponization) is not evident because no coupling of exploit with a deliverable payload (e.g., creating a malicious document or implant) is mentioned.

Answer

Reconnaissance

Answer

Weaponization

Question 6

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. The integrity element of the CIA triad ensures that data cannot be modified by unauthorized parties. Integrity mechanisms, such as hashing algorithms (e.g., SHA-256) or digital signatures, detect any unauthorized changes to data in transit or at rest. If an attacker alters a packet or file, the hash value will not match, alerting the system to the breach.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 7

A user receives an email that appears to be from the company's IT department asking for their password to perform a security check. The email contains a link to a fake login page. Which type of social engineering attack is this?

Accepted Answer

Phishing. Phishing typically uses deceptive emails and fake websites to trick users into revealing sensitive information.

Answer

Spear phishing

Answer

Vishing

Answer

Pretexting

Question 8

A security engineer is analyzing a recent breach. The attacker gained access by sending an email that appeared to be from the CEO, requesting the recipient to transfer funds. What type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a spear phishing attack because it is a targeted email that appears to come from a trusted authority (the CEO) and requests a specific action (funds transfer). Spear phishing is characterized by its targeted nature and use of social engineering to trick a specific individual or group.

Answer

Vishing

Answer

Phishing

Answer

Pretexting

Question 9

An organization wants to ensure that a message has not been altered during transmission. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing produces a fixed-length digest of a message; any alteration to the message changes the hash value, so comparing the computed hash against the transmitted hash detects tampering. This provides integrity, which is exactly what the question asks for.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Symmetric encryption

Question 10

A security analyst is investigating an incident where an attacker successfully altered DNS records to redirect users to a fake website. Which attack occurred?

Accepted Answer

DNS poisoning. DNS poisoning (also called DNS cache poisoning or DNS spoofing) is the attack in which an attacker injects forged DNS records into a resolver's cache, causing users to be redirected to attacker-controlled IP addresses. The scenario — altered DNS records redirecting users to a fake website — is the textbook definition of DNS poisoning.

Answer

ARP spoofing

Answer

Man-in-the-Middle

Answer

Pharming

Question 11

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. Integrity ensures that data is not modified or altered by unauthorized parties. It guarantees that data remains accurate and consistent over its lifecycle. In the CIA triad, integrity is specifically concerned with preventing unauthorized modification, which directly answers the question.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Availability

Question 12

A security analyst discovers that an attacker has captured network traffic and used it to impersonate a legitimate user in a subsequent session. Which element of the CIA triad is most directly compromised in this scenario?

Accepted Answer

Confidentiality. Confidentiality is compromised when data is accessed by unauthorized parties. The attacker captured traffic (unauthorized access to data), which leads to impersonation, but the core violation here is confidentiality because the data was disclosed.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability

Question 13

A security team is implementing a Public Key Infrastructure (PKI) to support digital signatures for email. Which THREE components are essential to the PKI framework? (Choose three.)

Accepted Answer

Registration Authority (RA). The Registration Authority (RA) is essential because it acts as the intermediary that verifies subscriber identity and processes certificate requests before forwarding approved requests to the CA, offloading identity-proofing duties from the CA. The Certificate Authority (CA) is the core trust anchor that signs and issues digital certificates, binding public keys to verified identities, which is indispensable for validating email digital signatures. Digital certificates are essential because they are the actual X.509 credentials that carry the subscriber's public key and CA's signature, enabling recipients to verify signed email. The Private key is not a PKI framework component but a key owned by the subscriber, and the Certificate Revocation List (CRL) is a supporting revocation mechanism rather than a foundational framework component, so neither belongs among the three essential components.

Answer

Private key

Answer

Certificate Revocation List (CRL)

Question 14

A security analyst notices that a user's workstation is repeatedly resolving a domain that closely resembles the company's legitimate internal payroll portal, but the domain is registered to an unfamiliar overseas registrar. The user reports being redirected to a page requesting credentials after clicking a link in a recent email. Which type of attack is most likely occurring?

Accepted Answer

Phishing. The user received an email with a link to a domain that mimics a legitimate internal payroll portal and was redirected to a page requesting credentials. This matches phishing, where attackers impersonate trusted entities to steal sensitive information. The look-alike domain and credential capture page are key indicators that distinguish phishing from other attacks such as typosquatting or watering hole.

Answer

Watering hole attack

Answer

Typosquatting

Answer

DNS tunneling

Question 15

A security team deploys a new web application and wants to classify the risk that an unauthenticated attacker could read the contents of the back-end database through a crafted input field. Which concept best describes the exposure being assessed?

Accepted Answer

Impact. Risk is commonly expressed as the combination of the likelihood of a threat exploiting a vulnerability and the resulting impact. The scenario describes assessing how much harm would come from an unauthenticated attacker reading the back-end database, which is the impact component. Threat and vulnerability identify the source and the weakness, while likelihood measures probability. Only impact captures the magnitude of potential data loss being evaluated.

Answer

Vulnerability

Answer

Likelihood

Answer

Threat

Question 16

A security analyst is investigating a recent security incident. The analyst discovers that an attacker gained initial access by exploiting a vulnerability in a public-facing web server. The attacker then moved laterally to a database server and exfiltrated sensitive data. Which phase of the Cyber Kill Chain does the lateral movement represent?

Accepted Answer

Actions on Objectives. In the Cyber Kill Chain, lateral movement and data exfiltration are part of the Actions on Objectives phase. This phase encompasses the attacker's ultimate goals after establishing a foothold. The earlier phases like Exploitation and Installation focus on gaining access and persistence. Therefore, the lateral movement to the database server falls under Actions on Objectives.

Answer

Exploitation

Answer

Installation

Answer

Weaponization

Question 17

An analyst is examining a suspicious email attachment that appears to be a PDF invoice. Static analysis reveals embedded JavaScript that, when executed, uses the PDF reader's API to launch a command shell and download a payload from a remote server. The file's hash is not found in any signature database. Which malware evasion technique is most clearly demonstrated?

Accepted Answer

Living off the land. The PDF uses a legitimate feature (embedded JavaScript) and a built-in command shell to fetch a payload, which is the essence of living off the land. This avoids known signatures because the initial file is not malicious by hash and relies on trusted applications, making detection harder.

Answer

Packing

Answer

Polymorphic code

Answer

Rootkit

Question 18

A security operations center (SOC) analyst is investigating a potential security incident. The analyst needs to determine whether the organization is compliant with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO of the following are core requirements of PCI DSS? (Choose two.)

Accepted Answer

Encrypt transmission of cardholder data across open, public networks. PCI DSS has 12 core requirements, including installing and maintaining a firewall configuration to protect cardholder data and encrypting transmission of cardholder data across open, public networks. These are foundational technical controls to secure cardholder data. The other options are either not requirements or are not core technical requirements.

Answer

Maintain a policy that addresses information security for all personnel

Answer

Implement mandatory annual penetration testing for all employees

Answer

Use only open-source software for all payment processing systems

Question 19

A security analyst is reviewing a packet capture from a compromised host and observes that the attacker's traffic to a command-and-control server is encoded to look like normal HTTPS but uses a self-signed certificate with an unusual Common Name. The analyst wants to classify this technique within the CIA triad impact. Which security concept does this scenario primarily illustrate?

Accepted Answer

Integrity. The attacker is altering the appearance of command-and-control traffic to blend in with legitimate HTTPS, which undermines the trustworthiness of the communication. Integrity is about preventing unauthorized modification or deception, and the use of a self-signed certificate with an odd Common Name signals that the traffic is not genuine. Confidentiality and availability are not directly impacted in this described technique.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 20

An analyst is reviewing a packet capture and sees a host repeatedly sending TCP SYN packets to many different destination ports on a single target, but the host never completes the three-way handshake. Which type of attack is most consistent with this behavior?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending numerous SYN requests without completing the final ACK. The target keeps each connection in a half-open state, consuming memory and connection table entries until legitimate clients cannot connect. The scenario's repeated SYNs to many ports on one target, with no completed handshake, matches this denial-of-service pattern. Port scanning may look similar but aims to discover services rather than exhaust resources, and UDP or ARP attacks use entirely different mechanisms.

Answer

ARP spoofing

Answer

Port scan

Answer

UDP flood