200-201 Security Concepts Practice Test 2 — 15 Questions

Question 1

You are a security analyst for a mid-sized company with a flat network topology. The company uses a single firewall for internet access and has no internal segmentation. Recently, the IT team deployed a new file server running Windows Server 2019. The server was configured with default settings and placed in the same subnet as all user workstations. Two weeks later, the helpdesk receives multiple complaints about slow network performance. Upon investigation, you notice the file server's network interface is sending a high volume of broadcast traffic. Additionally, you find that the server's firewall is disabled and it is running an outdated SMBv1 protocol. The CEO is concerned about potential data loss and asks for immediate remediation. Which of the following is the most effective and immediate course of action to address the most critical security vulnerability?

Accepted Answer

Disable SMBv1 on the file server using PowerShell or Registry.. D is correct because the most critical security vulnerability is the outdated SMBv1 protocol, which is known to be exploited by ransomware like WannaCry and EternalBlue. Disabling SMBv1 immediately removes this attack vector, addressing the CEO's concern about potential data loss. While the broadcast traffic and disabled firewall are issues, SMBv1 poses a direct and severe risk to data integrity and confidentiality.

Answer

Enable the Windows Firewall on the file server and create rules to allow only essential traffic.

Answer

Configure the switch to block broadcast traffic on the file server's port.

Answer

Create VLANs to segment the file server from user workstations.

Question 2

Drag and drop the steps to configure SSH access on a Cisco IOS switch into the correct order.

Question 3

Drag and drop the steps to perform a password recovery on a Cisco IOS router into the correct order.

Question 4

Match each security tool to its primary purpose.

Question 5

Match each cybersecurity framework/standard to its focus.

Question 6

A security analyst needs to ensure data integrity. Which control best achieves this?

Accepted Answer

Hashing. Hashing is the correct control for ensuring data integrity because it produces a fixed-length digest (e.g., SHA-256) from the original data. Any change to the data, even a single bit, results in a completely different hash value, allowing the analyst to detect tampering or corruption. Unlike encryption, hashing is a one-way function that does not conceal the data but verifies its unchanged state.

Answer

Logging

Answer

Encryption

Answer

Access control

Question 7

During an incident, the analyst finds that an attacker modified system files. Which security principle was primarily violated?

Accepted Answer

Integrity. Integrity ensures that data and system files are not altered by unauthorized entities. When an attacker modifies system files, the trustworthiness and accuracy of those files are compromised, directly violating the integrity principle. This is distinct from confidentiality (unauthorized disclosure) or availability (denial of service).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 8

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

Accepted Answer

Authentication. Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Answer

Accounting

Answer

Auditing

Answer

Authorization

Question 9

An organization deploys a firewall to block unauthorized traffic. This is an example of which type of security control?

Accepted Answer

Technical. A firewall is a technical control because it uses software or hardware mechanisms—such as packet filtering, stateful inspection, or application-layer filtering—to enforce security policies and block unauthorized traffic. Technical controls are implemented through technology systems (e.g., routers, firewalls, IDS/IPS) rather than through physical barriers or administrative procedures.

Answer

Detective

Answer

Physical

Answer

Administrative

Question 10

A security analyst reviews logs and finds multiple failed login attempts from a single IP. This is indicative of what type of attack?

Accepted Answer

Brute-force. Multiple failed login attempts from a single IP address are characteristic of a brute-force attack, where an attacker systematically tries many passwords (or usernames) against a single account or service until successful. This pattern is distinct from other attack types because it involves repeated authentication attempts from one source, aiming to guess credentials rather than intercept traffic, deceive users, or overwhelm resources.

Answer

Man-in-the-middle

Answer

Phishing

Answer

DDoS

Question 11

To protect sensitive data at rest, a company uses AES-256 encryption. This primarily ensures which security goal?

Accepted Answer

Confidentiality. AES-256 encryption transforms plaintext data into ciphertext using a 256-bit symmetric key, rendering it unreadable without the correct decryption key. This directly ensures confidentiality by preventing unauthorized access to the stored data, even if the storage medium is compromised.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 12

Which principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using digital signatures or cryptographic mechanisms. In network security, this is often achieved through protocols like HMAC or digital certificates that bind an action to a specific identity, providing irrefutable proof. Without non-repudiation, a user could claim they never sent a message or executed a command, undermining audit trails and legal accountability.

Answer

Authentication

Answer

Accountability

Answer

Authorization

Question 13

A help desk receives a phone call from someone claiming to be from IT and requesting a password reset. What type of attack is this?

Accepted Answer

Vishing. Vishing (voice phishing) is a social engineering attack conducted over voice communication, such as a phone call, where the attacker impersonates a legitimate entity (e.g., IT support) to trick the victim into revealing sensitive information or performing an action like a password reset. This matches the scenario exactly: a phone call from someone claiming to be from IT requesting a password reset.

Answer

Social engineering

Answer

Phishing

Answer

Malware

Question 14

In a risk management process, after identifying risks, the next step is to determine the potential impact and likelihood. This is known as:

Accepted Answer

Risk assessment. After risks have been identified, the next logical step in the risk management process is to evaluate their potential impact and likelihood. This evaluation is formally known as risk assessment (or risk analysis), which quantifies or qualifies the risk level to prioritize subsequent treatment decisions. In the context of the 200-201 exam, risk assessment is a core component of the NIST SP 800-30 risk management framework.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 15

Which TWO are examples of technical security controls? (Select two.)

Accepted Answer

Firewall. A firewall is a technical security control because it is a hardware or software device that enforces access policies by inspecting network traffic based on rules (e.g., permit/deny IP addresses, ports, protocols). Encryption is a technical control that transforms plaintext data into ciphertext using algorithms like AES-256 or RSA, ensuring confidentiality during storage or transmission. Both are implemented through technology rather than administrative or physical means.

Answer

Security policy

Answer

Security awareness training

Answer

Background checks