200-201 Security Concepts Practice Test 5 — 15 Questions

Question 1

Which security concept describes the potential for a threat to exploit a vulnerability, and is often expressed as a combination of likelihood and impact?

Accepted Answer

Risk. Risk is defined as the potential for a threat to exploit a vulnerability, typically calculated as likelihood × impact. It is the overarching concept that combines the probability of a threat event with the resulting business or asset damage. In security frameworks like NIST and ISO 27005, risk = f(threat, vulnerability, impact, likelihood), which matches the question's wording exactly.

Answer

Exploit

Answer

Threat

Answer

Vulnerability

Question 2

An attacker sends an email that appears to come from the company's IT department, asking the recipient to click a link and reset their password due to a security breach. Which type of social engineering is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick the recipient into clicking a malicious link and divulging credentials. This matches the definition of phishing, which is a broad social engineering technique that employs deceptive electronic communications (typically email) to steal sensitive information. The email impersonates the IT department to create a false sense of urgency, a hallmark of phishing campaigns.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 3

Which compliance framework is specifically designed to protect the privacy and security of electronic health information in the United States?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the US federal law that specifically governs the privacy and security of protected health information (PHI) held by covered entities and business associates. It defines the Privacy Rule, Security Rule, and Breach Notification Rule, making it the direct answer for electronic health information in the United States. GDPR, ISO 27001, and PCI DSS address different scopes and jurisdictions.

Answer

GDPR

Answer

ISO 27001

Answer

PCI DSS

Question 4

A security engineer discovers that an attacker has inserted fake entries into a DNS resolver's cache, redirecting users to a malicious website. Which attack has occurred?

Accepted Answer

DNS poisoning. DNS poisoning, also known as DNS cache poisoning, occurs when an attacker inserts forged DNS resource records into a resolver's cache. This causes the resolver to return a malicious IP address for a legitimate domain, redirecting users to an attacker-controlled site without their knowledge.

Answer

DDoS

Answer

Man-in-the-middle

Answer

ARP spoofing

Question 5

In a PKI, what is the role of a Certificate Authority (CA)?

Accepted Answer

Issues and validates digital certificates. A Certificate Authority (CA) is a trusted entity that issues and validates digital certificates. It verifies the identity of certificate applicants and signs the certificates with its private key, thereby binding a public key to an identity. This is the core function of a CA in a PKI.

Answer

Generates private keys for users

Answer

Provides symmetric keys for session encryption

Answer

Encrypts data for secure transmission

Question 6

A security analyst discovers that an attacker is using a vulnerability scanning tool to identify open ports on the company's network. Which type of attack is being performed?

Accepted Answer

Active reconnaissance. Active reconnaissance involves directly interacting with the target system to gather information, such as port scanning, vulnerability scanning, or banner grabbing. Using a vulnerability scanning tool to identify open ports sends packets to the target and elicits responses, which is the definition of active reconnaissance. This contrasts with passive reconnaissance, which collects information without direct interaction.

Answer

Social engineering

Answer

Passive reconnaissance

Answer

Denial of Service

Question 7

Which cryptographic technique uses a public and private key pair to provide non-repudiation?

Accepted Answer

Digital signature. A digital signature is created by hashing the message and encrypting that hash with the sender's private key. Anyone can verify it using the sender's public key, and because only the sender possesses the private key, the sender cannot later deny having signed it — this is non-repudiation. Symmetric encryption, certificates, and hashing alone do not provide that property.

Answer

Symmetric encryption

Answer

Digital certificate

Answer

Hashing

Question 8

An organization is required to protect cardholder data. Which compliance framework applies to this requirement?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that handle credit card data.

Answer

ISO 27001

Answer

HIPAA

Answer

GDPR

Question 9

Which term describes a weakness in a system that could be exploited by a threat?

Accepted Answer

Vulnerability. A vulnerability is a weakness in a system, such as a missing security patch, misconfiguration, or design flaw, that a threat actor could exploit to compromise confidentiality, integrity, or availability. In the context of the 200-201 exam, this aligns with the core security concept that vulnerabilities are the specific gaps that make an asset susceptible to attack.

Answer

Risk

Answer

Exploit

Answer

Threat

Question 10

An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?

Accepted Answer

Man-in-the-Middle. A Man-in-the-Middle (MITM) attack occurs when an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. In this scenario, the attacker intercepts and modifies the data in transit, and neither the client nor the server detects the modification, which is the hallmark of a MITM attack. MITM is a broad category that encompasses various techniques, including ARP spoofing and DNS poisoning, but the core definition is the active interception and modification of traffic.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 11

Which type of malware is designed to replicate itself and spread to other systems without user intervention?

Accepted Answer

Worm. A worm is malware that self-replicates and spreads to other systems automatically, without requiring user interaction or a host program. It typically exploits network vulnerabilities or weak credentials to propagate across networks. This autonomous spreading behavior is the defining characteristic that distinguishes worms from other malware types.

Answer

Virus

Answer

Ransomware

Answer

Trojan

Question 12

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet

Question 13

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption with AES transforms plaintext into ciphertext using a shared secret key, so an attacker who intercepts the data over the internet cannot read it without the key. AES is the standard, NIST-approved symmetric cipher (FIPS 197) used in TLS, VPNs, and disk encryption. This directly satisfies the requirement that intercepted data cannot be read.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 14

A security analyst is evaluating risks and calculates that a threat has a likelihood of 0.5 and an impact of $200,000. What is the risk value?

Accepted Answer

$100,000. The risk value is calculated by multiplying the likelihood (0.5) by the impact ($200,000), resulting in $100,000. This is the standard quantitative risk analysis formula used in security assessments to prioritize threats.

Answer

$50,000

Answer

$400,000

Answer

$200,000

Question 15

Which NIST Cybersecurity Framework function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function of the NIST Cybersecurity Framework involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers access control, awareness training, data security, protective technology, and maintenance. This function limits or contains the impact of a potential cybersecurity event.

Answer

Respond

Answer

Detect

Answer

Identify