200-201 Security Concepts Practice Test 7 — 15 Questions

Question 1

A security analyst is notified that an employee's laptop was stolen. The laptop contains sensitive customer data. Which type of threat does this incident represent?

Accepted Answer

Threat. A threat is any potential cause of an unwanted incident that could harm assets; a stolen laptop containing sensitive data is a threat event because it can lead to unauthorized disclosure. The laptop itself is the asset, the sensitive data is what's at risk, and the theft is the threat action. Exploit, risk, and vulnerability describe different concepts in the threat model.

Answer

Exploit

Answer

Risk

Answer

Vulnerability

Question 2

An attacker sends a fraudulent email that appears to come from the company's IT department, requesting that the recipient click a link and enter their login credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because the attacker uses a fraudulent email that impersonates a trusted entity (the IT department) to trick the recipient into clicking a malicious link and entering sensitive login credentials. Phishing is a broad category of social engineering that relies on deceptive electronic communications, typically email, to harvest credentials or deliver malware.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 3

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.

Answer

Rootkit

Answer

Worm

Answer

Trojan horse

Question 4

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices without their knowledge. Which type of attack is this?

Accepted Answer

Man-in-the-middle (MitM). This scenario describes an attacker intercepting and modifying communications between two devices without their knowledge, which is the defining characteristic of a Man-in-the-Middle (MitM) attack. In a MitM attack, the attacker positions themselves between the two communicating parties, allowing them to eavesdrop, capture, and alter data in transit while both endpoints believe they are communicating directly with each other.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Denial of Service (DoS)

Question 5

Which encryption method uses a single key for both encryption and decryption of data?

Accepted Answer

Symmetric encryption. Symmetric encryption uses a single shared key for both encryption and decryption of data. This is the defining characteristic of symmetric algorithms like AES, DES, and 3DES, where the same secret key must be known to both sender and receiver to protect confidentiality.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Hashing

Question 6

An organization wants to ensure that a received email genuinely came from the claimed sender and has not been altered. Which cryptographic mechanism provides both authentication and integrity?

Accepted Answer

Digital signature. A digital signature uses the sender's private key to sign the message, and the recipient verifies it with the sender's public key. This process provides authentication (proving the sender's identity) and integrity (detecting any alteration) because any change to the message invalidates the signature. Hash functions alone provide integrity but not authentication, while PKI is the infrastructure that supports digital signatures but is not the mechanism itself.

Answer

Hash function

Answer

Public key infrastructure (PKI)

Answer

Symmetric encryption

Question 7

Which compliance standard specifically applies to organizations that handle credit card information?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the compliance standard specifically designed for organizations that handle credit card information. It sets requirements for securing cardholder data, including encryption, access control, and network security, and applies to all entities that store, process, or transmit card data.

Answer

HIPAA

Answer

GDPR

Answer

ISO 27001

Question 8

A security analyst needs to verify that a downloaded software update has not been tampered with. The update's publisher provides a file containing a hash value. Which process should the analyst use to verify integrity?

Accepted Answer

Compute the file's hash and compare it with the provided hash. Verifying file integrity involves computing a cryptographic hash (e.g., SHA-256) of the downloaded file and comparing it to the hash provided by the publisher. If the hashes match, the file has not been altered; any tampering would produce a different hash value. This is a standard integrity check, not a confidentiality or authentication mechanism.

Answer

Decrypt the file using the publisher's public key

Answer

Use a digital signature to sign the file

Answer

Encrypt the file using the publisher's private key

Question 9

An attacker uses a tool to scan all IP addresses in a range to identify which hosts are online and what services are running. Which type of reconnaissance is this?

Accepted Answer

Active reconnaissance. Active reconnaissance involves directly interacting with the target system to gather information, such as scanning IP addresses to identify live hosts and open services. This type of scanning generates traffic that can be detected by the target, distinguishing it from passive reconnaissance.

Answer

Denial of Service

Answer

Passive reconnaissance

Answer

Social engineering

Question 10

An organization wants to ensure that a user cannot deny having sent an email. Which security goal does this address?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a party cannot deny having performed a specific action, such as sending an email. This is typically achieved through digital signatures using asymmetric cryptography (e.g., RSA or ECDSA) and public key infrastructure (PKI), where the sender's private key creates a signature that can be verified by anyone with the sender's public key. The goal is to provide irrefutable proof of origin and integrity, preventing the sender from later claiming they did not send the message.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 11

Which component of the NIST Cybersecurity Framework involves taking action to stop an ongoing attack?

Accepted Answer

Respond. The Respond function includes activities to contain and mitigate incidents.

Answer

Identify

Answer

Detect

Answer

Protect

Question 12

A security analyst is investigating a potential data breach. The analyst identifies that the attacker used a technique to impersonate a legitimate user by spoofing the MAC address and IP address. Which TWO types of network attacks could involve these techniques? (Choose two.)

Accepted Answer

ARP spoofing. ARP spoofing (A) is correct because it works by sending forged ARP replies that map the attacker's MAC address to a legitimate user's IP address, effectively spoofing both MAC and IP to impersonate that user on the local subnet. IP spoofing (D) is correct because it involves crafting packets with a forged source IP address (and often a spoofed MAC at layer 2) to make traffic appear to originate from a legitimate host. Denial of Service (B) focuses on exhausting resources or bandwidth rather than impersonating a user via MAC/IP spoofing. DNS poisoning (C) corrupts DNS resolver cache entries to redirect name resolution, not to impersonate a user's MAC/IP identity. Phishing (E) is a social-engineering attack using deceptive messages or sites, not MAC/IP address spoofing.

Answer

Denial of Service

Answer

DNS poisoning

Answer

Phishing

Question 13

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Accepted Answer

Transport Layer Security (TLS). TLS (B) is correct because it provides confidentiality for data in transit by encrypting the session between client and server using negotiated symmetric ciphers (e.g., AES) after an asymmetric handshake. Symmetric encryption (C) is correct because it uses a shared secret key with algorithms such as AES to encrypt data at rest or in transit, directly providing confidentiality. Asymmetric encryption (E) is correct because it uses public/private key pairs (e.g., RSA, ECC) to encrypt data so that only the holder of the corresponding private key can decrypt it, protecting confidentiality. Digital signature (A) is not correct because it provides integrity, authentication, and non-repudiation, not confidentiality. Hashing (D) is not correct because it is a one-way function used for integrity verification and cannot encrypt or conceal data.

Answer

Digital signature

Answer

Hashing

Question 14

A company is implementing a security policy to reduce risk. Which THREE activities are examples of risk mitigation? (Choose three.)

Accepted Answer

Implementing access controls. Implementing access controls (A) is a risk mitigation activity because it enforces authentication and authorization mechanisms (such as RBAC, least privilege, and MFA) that reduce the likelihood of unauthorized access to systems and data. Encrypting sensitive data (C) mitigates risk by protecting confidentiality, so even if data is intercepted or stolen, it remains unreadable without the proper cryptographic keys (e.g., AES-256). Patching vulnerabilities (E) mitigates risk by remediating known weaknesses (e.g., CVEs) that attackers could exploit, thereby reducing the attack surface. Accepting the risk without action (B) is risk acceptance, not mitigation, since no controls are applied. Purchasing cyber insurance (D) is risk transference, as the financial impact is shifted to an insurer rather than reduced through technical or administrative controls.

Answer

Accepting the risk without action

Answer

Purchasing cyber insurance

Question 15

A security analyst is investigating an incident where an employee received an email that appeared to be from the company's IT department, requesting the employee to verify their account by clicking a link and entering their credentials. The employee complied, and later the attacker used those credentials to access the corporate VPN. Which combination of attack types best describes this incident?

Accepted Answer

Spear phishing and credential theft. The incident involves a targeted email that appears to be from the IT department, requesting credential verification—this is spear phishing because it's tailored to the organization. The employee providing credentials leads to credential theft, which the attacker then uses to access the VPN. Thus, spear phishing and credential theft best describe the attack.

Answer

Pretexting and privilege escalation

Answer

Phishing and man-in-the-middle

Answer

Vishing and brute force