200-201 Security Concepts Practice Test 4 — 15 Questions

Question 1

Which cryptographic method uses the same key for both encryption and decryption, and is typically faster than asymmetric encryption?

Accepted Answer

AES. Symmetric encryption uses a single shared key for both operations.

Answer

Digital signature

Answer

RSA

Answer

SHA-256

Question 2

A security administrator needs to verify that a downloaded file has not been altered during transit. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing produces a fixed-size hash that changes if the file is modified, allowing integrity verification.

Answer

Public key encryption

Answer

Symmetric encryption

Answer

Digital signature

Question 3

What is the primary purpose of a digital certificate in a Public Key Infrastructure (PKI)?

Accepted Answer

To bind a public key to an identity. The primary purpose of a digital certificate in a Public Key Infrastructure (PKI) is to bind a specific public key to a verified identity (such as a person, device, or organization). This binding is achieved through the certificate authority (CA) signing the certificate, which cryptographically asserts that the public key belongs to the named subject. Without this binding, there would be no trusted way to associate a public key with its owner, making secure communications and authentication impossible.

Answer

To encrypt all network traffic

Answer

To provide a backup of private keys

Answer

To prevent malware infections

Question 4

A company processes credit card payments and must comply with a framework that mandates specific security controls for protecting cardholder data. Which compliance framework applies?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the framework specifically mandated for organizations that store, process, or transmit cardholder data. It defines 12 requirement categories covering network security, access control, encryption, monitoring, and policy. Any company processing credit card payments must comply with PCI DSS.

Answer

ISO 27001

Answer

GDPR

Answer

HIPAA

Question 5

Which phase of the NIST Cybersecurity Framework involves actions to limit the impact of a cybersecurity incident?

Accepted Answer

Respond. The Respond function of the NIST Cybersecurity Framework (CSF) covers the actions taken once an incident is detected—containment, mitigation, analysis, and communication—to limit the impact and prevent further damage. It is the phase where incident response plans, communications, and mitigation activities are executed. This directly matches the question's wording about limiting the impact of an incident.

Answer

Protect

Answer

Identify

Answer

Detect

Question 6

A security analyst observes repeated failed login attempts from a single external IP address, causing the authentication server to become unresponsive. Which type of attack is occurring?

Accepted Answer

Denial of Service. The scenario describes repeated failed login attempts from a single external IP that render the authentication server unresponsive — this is a Denial of Service (DoS) condition, where the volume of authentication requests exhausts server resources (CPU, connection table, lock contention) and denies service to legitimate users. The defining symptom is availability loss, not credential compromise or information gathering. A brute force attack would aim to guess credentials, but here the observed outcome is service unavailability.

Answer

Reconnaissance

Answer

Brute force attack

Answer

Man-in-the-middle

Question 7

A security engineer is analyzing a recent data breach. Which TWO are examples of active reconnaissance techniques? (Select two.)

Accepted Answer

Port scanning. Port scanning (A) is an active reconnaissance technique because it sends TCP/UDP probes (e.g., SYN, ACK, or UDP packets via tools like Nmap) directly to target hosts to discover open ports and services, which interacts with the target and can be logged. Ping sweep (B) is also active reconnaissance because it transmits ICMP Echo Request packets (or ARP/TCP probes) across an IP range to identify live hosts, again directly engaging the target network. By contrast, LinkedIn profiling (C), WHOIS lookup (D), and Google dorking (E) are passive reconnaissance techniques, as they gather information from third-party sources or public records without sending traffic to the target's systems.

Answer

LinkedIn profiling

Answer

WHOIS lookup

Answer

Google dorking

Question 8

Which TWO of the following are examples of malware that rely on user interaction to spread? (Select two.)

Accepted Answer

Trojan. Option C (Trojan) is correct because a Trojan horse is malware disguised as legitimate software, and it requires the user to download and execute the file before it can infect the system — the user's action is the trigger for the infection. Option D (Virus) is correct because a virus must attach itself to a host file or program and typically needs the user to run that infected file or share it (e.g., via email attachment or USB drive) for it to propagate. By contrast, Option B (Worm) is incorrect because worms self-replicate and spread across networks automatically without any user interaction. Option A (Rootkit) is incorrect because it is a stealth tool for maintaining privileged access, not a self-spreading mechanism, and Option E (Ransomware) is incorrect because it is defined by its payload (encrypting data for extortion) rather than by a user-interaction-dependent spreading method.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 9

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. Integrity is the CIA triad element that ensures data has not been altered or tampered with by unauthorized parties. It guarantees that information remains accurate, complete, and trustworthy throughout its lifecycle, typically enforced through hashing, checksums, digital signatures, and access controls.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Question 10

A security analyst discovers that an employee's computer is infected with malware that encrypts files and demands payment. What type of malware is this?

Accepted Answer

Ransomware. Ransomware is a type of malware that encrypts files on a victim's system and demands payment (often in cryptocurrency) for the decryption key. The scenario explicitly describes file encryption and a payment demand, which are the defining characteristics of ransomware. Unlike other malware types, ransomware's primary goal is extortion through data denial, not stealth or data theft.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 11

A network analyst notices a high volume of traffic from a single external IP address to multiple internal hosts on port 443. The traffic includes incomplete TCP handshakes. Which type of reconnaissance is being performed?

Accepted Answer

Active reconnaissance via port scanning. A high volume of connections to port 443 with incomplete TCP handshakes (SYN sent, no ACK) from one external IP to many internal hosts is the signature of a TCP SYN scan — an active reconnaissance technique used to discover which hosts and ports are open. The incomplete handshakes occur because the scanner does not complete the three-way handshake, either to avoid logging or to speed up the scan.

Answer

Social engineering attack

Answer

Denial of Service attack

Answer

Passive reconnaissance using WHOIS

Question 12

What is the primary difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric uses a single shared key; asymmetric uses a key pair. Symmetric encryption uses a single shared key for both encryption and decryption, while asymmetric encryption uses a key pair: a public key for encryption and a private key for decryption. This fundamental difference in key usage is the primary distinction.

Answer

Asymmetric encryption is used only for hashing

Answer

Symmetric uses two keys, asymmetric uses one

Answer

Symmetric is slower than asymmetric

Question 13

A company's security policy requires that sensitive data be encrypted at rest using AES-256. Which type of encryption does AES-256 represent?

Accepted Answer

Symmetric encryption. AES-256 is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. It is widely used for data at rest due to its strength and efficiency. The '256' refers to the key size in bits, making it highly resistant to brute-force attacks.

Answer

Hashing algorithm

Answer

Digital signature

Answer

Asymmetric encryption

Question 14

During a security assessment, an analyst uses the Shodan search engine to find exposed industrial control systems. Which phase of the attack lifecycle does this activity represent?

Accepted Answer

Reconnaissance. Using Shodan to search for exposed industrial control systems is a form of passive/active information gathering about the target's internet-facing assets — this is the Reconnaissance phase of the attack lifecycle (also called footprinting or information gathering). The attacker is mapping the attack surface before any exploitation, delivery, or command-and-control activity occurs. Shodan indexes banners from internet-connected devices, making it a classic reconnaissance tool.

Answer

Command and control

Answer

Delivery

Answer

Exploitation

Question 15

An organization needs to ensure that a document has not been altered and to verify the sender's identity. Which combination of cryptographic techniques should be used?

Accepted Answer

Digital signature and hashing. A digital signature provides authentication (verifying the sender's identity via their private key) and integrity (proving the document was not altered), while hashing produces the fixed-length digest that the signature signs. Together they satisfy both requirements: the hash detects any modification, and the asymmetric signature binds the document to the sender's private key.

Answer

Digital signature and symmetric encryption

Answer

Symmetric encryption and hashing

Answer

Asymmetric encryption and hashing