200-201 Security Policies and Procedures — 15 Questions

Question 1

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

Accepted Answer

Acceptable Use Policy violation. Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Answer

Remote Access Policy violation

Answer

Incident Response Policy violation

Answer

Data Classification Policy violation

Question 2

A company wants to ensure that employees report security incidents immediately. Which policy element is most important to include?

Accepted Answer

Define mandatory reporting procedures and contact information. Option C is correct because the core purpose of an incident response policy is to ensure timely reporting. Without mandatory reporting procedures and clear contact information, employees may delay or fail to report security incidents, increasing dwell time and potential damage. This directly supports the incident response lifecycle (NIST SP 800-61) by establishing a clear chain of communication for initial detection and reporting.

Answer

Specify encryption standards for data at rest

Answer

List acceptable uses of company resources

Answer

Require complex passwords for all accounts

Question 3

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Option C is correct because implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope

Question 4

A security policy states that user activity logs must be retained for at least one year. What is the primary purpose of this requirement?

Accepted Answer

To support forensic investigations of security incidents. The primary purpose of retaining user activity logs for at least one year is to support forensic investigations of security incidents. When a breach or policy violation occurs, security analysts need historical log data to reconstruct the timeline of events, identify the initial compromise vector, and determine the scope of damage. Without long-term retention, critical evidence may be overwritten or purged before an incident is discovered, making root cause analysis impossible.

Answer

To improve system performance through log analysis

Answer

To comply with regulatory requirements only

Answer

To enable real-time monitoring of user behavior

Question 5

A security analyst notices that an employee is accessing the corporate network from an unauthorized device. According to the security policy, which action should the analyst take first?

Accepted Answer

Disable the device's network access immediately. Option C is correct because the immediate priority when an unauthorized device is detected on the corporate network is to contain the threat by disabling network access. This aligns with the principle of least privilege and incident response procedures, where the first step is to stop the unauthorized access to prevent potential data breaches or malware propagation. The security policy typically mandates such immediate action to enforce access control, often implemented via 802.1X or MAC address filtering at the switch or NAC (Network Access Control) level.

Answer

Report the employee to human resources for disciplinary action

Answer

Ignore the incident because it is a minor violation

Answer

Update the security policy to allow personal devices

Question 6

A security policy requires that all changes to firewall rules be approved by two administrators. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement that two administrators must approve firewall rule changes enforces separation of duties, a security principle that prevents any single individual from having exclusive control over a critical operation. This reduces the risk of unauthorized or malicious rule modifications by ensuring collusion or independent review is required. In firewall management, this is often implemented via change management workflows with distinct approval and implementation roles.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 7

An organization's security policy states that all external connections must be authenticated using multi-factor authentication. Which type of policy is this?

Accepted Answer

Remote Access Policy. Option C is correct because a Remote Access Policy specifically governs how external users or devices connect to an internal network, and requiring multi-factor authentication (MFA) for all external connections is a standard control within this policy. This policy defines authentication methods, encryption standards (e.g., IPsec, TLS), and access controls for remote access, directly addressing the security policy's mandate for MFA on external connections.

Answer

Password Policy

Answer

Data Classification Policy

Answer

Acceptable Use Policy

Question 8

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy

Question 9

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines the boundaries of the policy's applicability. Option C is correct because explicitly listing the systems and networks covered ensures that all stakeholders understand which assets fall under the policy's requirements, preventing gaps or overlaps in security controls.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 10

Which THREE of the following are common elements of an incident response policy?

Accepted Answer

Procedures for containment and eradication. Option B is correct because containment and eradication are core phases of the NIST SP 800-61 incident response lifecycle. Containment limits the scope of the incident (e.g., isolating a compromised host via VLAN access control lists), while eradication removes the root cause (e.g., deleting malware, patching vulnerabilities). These procedures are explicitly documented in an incident response policy to ensure consistent, repeatable actions during a security event.

Answer

Data classification levels

Answer

Acceptable use of company resources

Question 11

Which TWO of the following are best practices for implementing a security policy?

Accepted Answer

Review and update the policy annually. Option D is correct because security policies must be living documents that adapt to evolving threats, regulatory changes (e.g., GDPR, PCI DSS), and organizational shifts. Annual reviews ensure the policy remains aligned with current risk posture and compliance requirements, as recommended by frameworks like NIST SP 800-53.

Answer

Use technical jargon to ensure precision

Answer

Avoid enforcement to promote user compliance

Answer

Write the policy once and never change it

Question 12

A security analyst reviews the firewall log. What is the most likely reason for the denied connection?

Accepted Answer

The access control list does not permit the traffic. The firewall log shows a denied connection, and the most likely reason is that the access control list (ACL) does not permit the traffic. Firewalls enforce security policies by evaluating traffic against ACL rules; if no rule explicitly allows the packet (based on source/destination IP, port, and protocol), the implicit deny at the end of the ACL drops the connection. This is the default behavior for stateful firewalls and is the most common cause of denied connections in logs.

Answer

The destination port is blocked by default

Answer

The source IP address is an external threat

Answer

The destination IP is a known malicious host

Question 13

A security auditor reviews the SNMP configuration. Which security concern should be reported?

Accepted Answer

The community strings are set to default values. Option C is correct because default SNMP community strings (e.g., 'public' for read-only, 'private' for read-write) are well-known and widely documented. An attacker who discovers these defaults can query or modify the device's MIB, leading to information disclosure or unauthorized configuration changes. This is a critical security concern that must be reported.

Answer

The location and contact information is exposed

Answer

SNMP is disabled on the router

Answer

The private community string is read-only

Question 14

You are a security analyst at a financial services company. The company's security policy mandates that all sensitive data must be encrypted at rest and in transit. A recent internal audit reveals that a database containing customer personally identifiable information (PII) is stored on a server that uses unencrypted storage volumes. The database is accessed by internal applications via unencrypted connections. The policy also requires quarterly vulnerability scans, and the latest scan shows that the server has a critical vulnerability in the database software. Additionally, the server's firewall rules permit inbound traffic from the entire corporate network to the database port. The company's incident response policy requires that any violation of data protection policies be escalated within 24 hours. The IT manager asks you to prioritize actions. What should you do first?

Accepted Answer

Apply the critical security patch to the database software. The most immediate threat is the critical vulnerability in the database software, which could allow remote code execution or data exfiltration without any authentication. Patching this vulnerability directly reduces the risk of exploitation, which is the highest priority in a security incident. Encryption and firewall restrictions are important but do not address an actively exploitable software flaw.

Answer

Enable encryption on the storage volumes and database connections

Answer

Escalate the violation to management within 24 hours

Answer

Restrict firewall access to only authorized application servers

Question 15

You are a security operations analyst for a medium-sized enterprise. The company's security policy requires that all endpoint devices have antivirus software installed and updated. During a routine check, you find that a group of 50 laptops used by the sales team have not received antivirus updates for over three months. The policy also states that any non-compliant devices must be quarantined from the network until they are remediated. The sales team manager argues that quarantining the laptops will disrupt critical sales activities. The company's incident response policy has a clause that allows for temporary exceptions in business-critical situations, but requires approval from the CISO. What is the best course of action?

Accepted Answer

Request a temporary exception from the CISO while expediting the updates. Option C is correct because it balances security policy compliance with business continuity. The incident response policy explicitly allows temporary exceptions for business-critical situations with CISO approval, and expediting the updates ensures the 50 laptops are remediated quickly. Quarantining without considering the business impact could violate the company's own exception clause, while ignoring the issue or updating without quarantining bypasses the security controls required by policy.

Answer

Ignore the issue to avoid disrupting sales activities

Answer

Quarantine the laptops immediately as per policy

Answer

Update the antivirus without quarantining, then report to management