200-201 Security Concepts Practice Test 4 — 15 Questions

Question 1

An analyst is investigating a security incident where an attacker gained access to a server by exploiting a known vulnerability. The attacker then moved laterally and exfiltrated data. Which THREE phases of the Cyber Kill Chain are evident in this scenario? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploitation. Exploitation uses the vulnerability, lateral movement is installation or command and control, and exfiltration is actions on objectives.

Answer

Reconnaissance

Answer

Weaponization

Question 2

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. The integrity element of the CIA triad ensures that data cannot be modified by unauthorized parties. Integrity mechanisms, such as hashing algorithms (e.g., SHA-256) or digital signatures, detect any unauthorized changes to data in transit or at rest. If an attacker alters a packet or file, the hash value will not match, alerting the system to the breach.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 3

A security analyst discovers that an attacker is using a vulnerability scanning tool to identify open ports on the company's network. Which type of attack is being performed?

Accepted Answer

Active reconnaissance. Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.

Answer

Social engineering

Answer

Passive reconnaissance

Answer

Denial of Service

Question 4

A user receives an email that appears to be from the company's IT department asking for their password to perform a security check. The email contains a link to a fake login page. Which type of social engineering attack is this?

Accepted Answer

Phishing. Phishing typically uses deceptive emails and fake websites to trick users into revealing sensitive information.

Answer

Spear phishing

Answer

Vishing

Answer

Pretexting

Question 5

Which cryptographic technique uses a public and private key pair to provide non-repudiation?

Accepted Answer

Digital signature. Digital signatures use asymmetric cryptography to provide authentication and non-repudiation, as only the signer's private key can create the signature.

Answer

Symmetric encryption

Answer

Digital certificate

Answer

Hashing

Question 6

An organization is required to protect cardholder data. Which compliance framework applies to this requirement?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that handle credit card data.

Answer

ISO 27001

Answer

HIPAA

Answer

GDPR

Question 7

Which term describes a weakness in a system that could be exploited by a threat?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system, such as a missing security patch, misconfiguration, or design flaw, that a threat actor could exploit to compromise confidentiality, integrity, or availability. In the context of the 200-201 exam, this aligns with the core security concept that vulnerabilities are the specific gaps that make an asset susceptible to attack.

Answer

Risk

Answer

Exploit

Answer

Threat

Question 8

An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?

Accepted Answer

Man-in-the-Middle. Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 9

Which type of malware is designed to replicate itself and spread to other systems without user intervention?

Accepted Answer

Worm. A worm is a self-replicating malware that spreads automatically across networks, unlike viruses that require a host file.

Answer

Virus

Answer

Ransomware

Answer

Trojan

Question 10

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet

Question 11

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption, such as AES, provides confidentiality by encrypting data so that only those with the key can read it.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 12

A security analyst is evaluating risks and calculates that a threat has a likelihood of 0.5 and an impact of $200,000. What is the risk value?

Accepted Answer

$100,000. The risk value is calculated by multiplying the likelihood (0.5) by the impact ($200,000), resulting in $100,000. This is the standard quantitative risk analysis formula used in security assessments to prioritize threats.

Answer

$50,000

Answer

$400,000

Answer

$200,000

Question 13

Which NIST Cybersecurity Framework function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function supports the ability to limit or contain the impact of a potential cybersecurity event.

Answer

Respond

Answer

Detect

Answer

Identify

Question 14

A security analyst is investigating a network breach. Which TWO activities are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Reviewing LinkedIn profiles of employees. Passive reconnaissance involves gathering information without directly interacting with the target, such as searching public records and social media.

Answer

Sending ping sweeps to identify live hosts

Answer

Using a vulnerability scanner to find weaknesses

Answer

Performing a port scan on the target network

Question 15

Which THREE components are part of a Public Key Infrastructure (PKI)? (Choose three.)

Accepted Answer

Registration Authority (RA). The Registration Authority (RA) is a key component of a PKI because it acts as the intermediary between the user and the Certificate Authority (CA). The RA is responsible for verifying the identity of an entity requesting a digital certificate before the CA issues the certificate, thereby offloading identity proofing tasks from the CA.

Answer

Symmetric encryption key

Answer

Hash function