200-201 Security Concepts Practice Test 3 — 15 Questions

Question 1

Which of the following is an example of a symmetric encryption algorithm?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning the same secret key is used for both encryption and decryption. It operates on fixed-size blocks (128 bits) with key sizes of 128, 192, or 256 bits and is the current NIST standard for symmetric encryption. Because both parties must share the same key, AES is fast and efficient for bulk data encryption.

Answer

SHA-256

Answer

RSA

Answer

ECC

Question 2

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 3

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing

Question 4

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the compliance framework specifically designed to protect cardholder data — including credit card numbers, expiration dates, and cardholder names — for any organization that stores, processes, or transmits payment card information. It is mandated by the major card brands and enforced through acquirers and payment processors.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA

Question 5

A security analyst needs to ensure that a message has not been tampered with during transit and that the sender cannot deny sending it. Which cryptographic method should be used?

Accepted Answer

Digital signature. A digital signature provides both integrity (ensuring the message has not been tampered with) and non-repudiation (preventing the sender from denying they sent it). It works by hashing the message and encrypting that hash with the sender's private key; the recipient verifies the signature using the sender's public key. This cryptographic method uniquely binds the sender to the message, unlike other options that only address one of these requirements.

Answer

Symmetric encryption

Answer

Hashing

Answer

Public key infrastructure (PKI)

Question 6

During a security audit, it is discovered that an organization’s network is vulnerable to ARP spoofing attacks. Which type of attack could result from exploiting this vulnerability?

Accepted Answer

Man-in-the-middle. ARP spoofing allows an attacker to send forged ARP replies that associate the attacker's MAC address with a legitimate IP (e.g., the default gateway), causing victims to send traffic to the attacker instead of the real destination. The attacker then relays traffic between the victim and the gateway, positioning themselves in the path — a classic man-in-the-middle (MITM) attack that enables eavesdropping, session hijacking, and credential theft.

Answer

DNS poisoning

Answer

Phishing

Answer

DoS

Question 7

An organization wants to implement a security framework that includes functions such as Identify, Protect, Detect, Respond, and Recover. Which framework aligns with this structure?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is explicitly organized around five core functions: Identify, Protect, Detect, Respond, and Recover. This structure provides a common language for managing cybersecurity risk and is widely adopted across industries. The framework's functions cover the full lifecycle of cybersecurity activities, from understanding assets and risks to recovering from incidents.

Answer

HIPAA Security Rule

Answer

PCI DSS

Answer

ISO 27001

Question 8

A security analyst is investigating a potential data breach. Which two actions are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Searching for employee information on LinkedIn. Option B is correct because searching LinkedIn for employee information is passive reconnaissance: the analyst gathers publicly available OSINT about personnel, roles, and organizational structure without sending any packets to or interacting with the target's systems, so it cannot be detected by the target. Option D is correct because a WHOIS lookup queries public registry databases (via port 43 to the registrar/RIR) for domain registration details such as registrant, admin contacts, name servers, and creation/expiry dates; this information is obtained from third-party records rather than from the target's own infrastructure, making it passive. The unmarked options do not belong: A (port scan) and C (ping sweep) are active reconnaissance techniques that directly probe the target's hosts and services and are detectable in logs or IDS/IPS, while E (phishing email) is an active social-engineering attack that interacts with employees and is not reconnaissance at all.

Answer

Performing a port scan on the company's web server

Answer

Using a ping sweep to identify live hosts

Answer

Sending a phishing email to employees

Question 9

A security team is analyzing a malware infection. Which two characteristics are typical of a worm? (Choose two.)

Accepted Answer

Exploits vulnerabilities to spread without user interaction. Option A is correct because a worm actively exploits vulnerabilities (for example, unpatched SMB or RDP flaws) to propagate autonomously across systems without requiring any user action such as clicking a link or opening an attachment. Option E is correct because self-replication is the defining trait of a worm: it copies itself from host to host over network connections, often scanning for new targets and consuming bandwidth. Option B is wrong because requiring a host file to propagate describes a virus, which needs to infect an executable or document, not a worm. Option C is wrong because disguising itself as a legitimate program is characteristic of a Trojan, which relies on deception rather than self-replication. Option D is wrong because attaching to an email to spread is typical of a mass-mailing virus or email-based malware, not the network-propagating worm behavior described here.

Answer

Requires a host file to propagate

Answer

Disguises itself as a legitimate program

Answer

Attaches to an email to spread

Question 10

Which element of the CIA triad is primarily compromised when an attacker successfully intercepts and reads encrypted network traffic without authorization?

Accepted Answer

Confidentiality. Confidentiality ensures data is not disclosed to unauthorized parties. When an attacker intercepts and reads encrypted traffic, the confidentiality of that data is breached because the adversary gains access to information they were not authorized to see. Integrity concerns unauthorized modification, and availability concerns disruption of access, neither of which is the primary impact of a read-only interception.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 11

A security analyst discovers that a server's configuration allows users to access files outside of their intended directory. In security terminology, what is this weakness called?

Accepted Answer

Vulnerability. A vulnerability is a weakness or flaw in a system's design, configuration, or code that could be exploited to violate security. The scenario describes a path traversal weakness in the server configuration, which is a classic vulnerability. This is the precise security term for the condition described.

Answer

Exploit

Answer

Threat

Answer

Risk

Question 12

During a penetration test, a security engineer uses publicly available information from LinkedIn and Google to gather details about employees and organizational structure. Which type of reconnaissance is being performed?

Accepted Answer

Passive reconnaissance. The security engineer is gathering information from publicly available sources (LinkedIn, Google) without directly interacting with the target's systems. This is the definition of passive reconnaissance, which involves collecting data from open-source intelligence (OSINT) without sending any packets to the target network.

Answer

Active reconnaissance

Answer

Social engineering

Answer

Internal reconnaissance

Question 13

An attacker sends an email posing as the company's IT department, asking employees to click a link and enter their credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick recipients into revealing credentials, which is the classic definition of phishing. Phishing is a broad category of social engineering that employs deceptive electronic communications (typically email) to steal sensitive information.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 14

Which type of malware is characterized by self-replication and spreading to other systems without user interaction, often causing network congestion?

Accepted Answer

Worm. A worm is self-replicating malware that spreads autonomously across networks without requiring a user to open a file or click a link, often consuming bandwidth and causing congestion. Classic examples include WannaCry's worm component and Conficker. Ransomware, Trojans, and viruses all require some form of user action or host file execution to propagate.

Answer

Ransomware

Answer

Trojan

Answer

Virus

Question 15

An attacker intercepts communication between a client and a server, allowing the attacker to read, insert, and modify messages in both directions. Which type of network attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and relays communication between two parties, allowing them to read, insert, and modify messages. This matches the scenario exactly. The attacker positions themselves between the client and server, often without either party's knowledge.

Answer

Denial of Service

Answer

ARP spoofing

Answer

DNS poisoning