200-201 Security Concepts Practice Test 5 — 15 Questions

Question 1

A healthcare organization must comply with HIPAA. Which THREE security measures are typically required under HIPAA? (Choose three.)

Accepted Answer

Encryption of electronic protected health information (ePHI). HIPAA requires encryption of ePHI, access controls, and audit controls to ensure confidentiality, integrity, and availability of protected health information.

Answer

Regular vulnerability scanning of all internet-facing systems

Answer

Annual penetration testing by an external firm

Question 2

An organization implements encryption for all sensitive data at rest and in transit to prevent unauthorized access. Which element of the CIA triad is being primarily addressed?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals or systems.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 3

A security analyst discovers that an attacker used a publicly available tool to scan a company's network for open ports and services. What type of attack is this?

Accepted Answer

Active reconnaissance. Using a publicly available tool to scan a company's network for open ports and services involves directly interacting with the target systems by sending probes (e.g., TCP SYN packets, UDP datagrams) and analyzing responses. This constitutes active reconnaissance, as the attacker's actions generate traffic that can be detected by intrusion detection systems (IDS) or firewall logs, unlike passive methods that only observe existing traffic.

Answer

Passive reconnaissance

Answer

Denial of Service

Answer

Social engineering

Question 4

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.

Question 5

A security engineer is analyzing a recent breach. The attacker gained access by sending an email that appeared to be from the CEO, requesting the recipient to transfer funds. What type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing targets a specific individual with personalized content, often impersonating a trusted source.

Answer

Vishing

Answer

Phishing

Answer

Pretexting

Question 6

An organization wants to ensure that a message has not been altered during transmission. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing creates a fixed-size digest; any change in data changes the hash, verifying integrity.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Symmetric encryption

Question 7

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

Accepted Answer

DDoS. A DDoS uses multiple sources to flood a target, making it unavailable.

Answer

ARP spoofing

Answer

DoS

Answer

DNS poisoning

Question 8

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices on the same network. Which attack technique is being used?

Accepted Answer

Man-in-the-Middle. Man-in-the-Middle attacks intercept and alter communications between two parties.

Answer

Reconnaissance

Answer

ARP spoofing

Answer

DNS poisoning

Question 9

An attacker uses a tool to capture keystrokes on a compromised system. What type of malware is most likely in use?

Accepted Answer

Keylogger. A keylogger is a type of malware specifically designed to capture and record keystrokes on a compromised system. The question directly describes the behavior of capturing keystrokes, which is the primary function of a keylogger, making it the most likely malware in use.

Answer

Spyware

Answer

Rootkit

Answer

Ransomware

Question 10

A security analyst needs to verify the authenticity and integrity of a software update. The update is signed with a digital signature. Which key is used to verify the signature?

Accepted Answer

Sender's public key. Digital signatures use asymmetric cryptography: the sender's private key signs, the public key verifies.

Answer

Sender's private key

Answer

Recipient's public key

Answer

Recipient's private key

Question 11

A security analyst is investigating an incident where an attacker successfully altered DNS records to redirect users to a fake website. Which attack occurred?

Accepted Answer

DNS poisoning. DNS poisoning corrupts DNS resolver caches to redirect traffic to malicious sites.

Answer

ARP spoofing

Answer

Man-in-the-Middle

Answer

Pharming

Question 12

An organization must comply with a regulation that requires protecting the privacy of EU citizens' personal data. Which compliance framework applies?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the EU regulation specifically designed to protect the privacy and personal data of EU citizens. It applies to any organization that processes or controls the personal data of individuals in the EU, regardless of where the organization is based. This makes GDPR the correct compliance framework for the scenario described.

Answer

HIPAA

Answer

ISO 27001

Answer

PCI DSS

Question 13

A security analyst is selecting a symmetric encryption algorithm for encrypting data at rest. Which of the following is a suitable symmetric algorithm?

Accepted Answer

AES. AES is a widely used symmetric encryption algorithm.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 14

A security analyst is identifying potential vulnerabilities in the network. Which TWO of the following are examples of passive reconnaissance?

Accepted Answer

Google search for company information. Passive reconnaissance involves gathering information without directly interacting with the target systems. A Google search for company information (Option B) collects publicly available data from search engine caches and indexed pages, which does not send any packets to the target's network. A WHOIS lookup (Option C) queries public registration databases for domain ownership and contact details, again without touching the target's infrastructure. Both methods rely on third-party sources and leave no trace on the target's systems.

Answer

Vulnerability scan

Answer

Ping sweep

Answer

Port scanning

Question 15

Which THREE of the following are common types of malware?

Accepted Answer

Virus. A virus is a type of malware that replicates by attaching itself to legitimate executable files or scripts, requiring user action (e.g., opening an infected attachment) to spread. It is one of the classic and most common forms of malicious software, making option B correct.

Answer

Patch

Answer

Firewall