200-201 Security Policies and Procedures Practice Test 2 — 15 Questions

Question 1

A company's security policy requires that all laptops accessing the corporate network must have full-disk encryption enabled. During a routine audit, an analyst discovers that a manager's laptop does not have encryption enabled. What is the most appropriate first step according to standard security incident response procedures?

Accepted Answer

Document the finding and escalate to the incident response team.. Option B is correct because the first step in standard incident response procedures (as defined by NIST SP 800-61 and Cisco's IR framework) is to document the finding and escalate to the incident response team. This ensures that the potential policy violation is formally recorded and that trained responders can assess the risk, determine if sensitive data was exposed, and coordinate remediation without prematurely destroying evidence or causing operational disruption.

Answer

Disconnect the laptop from the network immediately.

Answer

Install encryption software on the laptop without notifying the user.

Answer

Wipe the laptop and reinstall the operating system.

Question 2

A network administrator is implementing a new security policy that requires all employees to use multi-factor authentication (MFA) when accessing email from external networks. However, several employees report that they cannot receive SMS codes while traveling internationally. Which design change best balances security and usability?

Accepted Answer

Allow the use of authenticator apps that generate time-based one-time passwords (TOTP).. Option A is correct because TOTP authenticator apps (e.g., Google Authenticator, Microsoft Authenticator) generate one-time passwords locally on the user's device without requiring cellular network connectivity. This solves the international SMS delivery problem while maintaining strong MFA security, as the TOTP algorithm (RFC 6238) uses a shared secret and the current time to produce codes that are valid for a short window (typically 30 seconds).

Answer

Allow email access without MFA from trusted countries.

Answer

Provide hardware tokens to all traveling employees.

Answer

Disable MFA for users who travel frequently.

Question 3

A security analyst is reviewing a series of failed login attempts on a critical server. The logs show that the source IP addresses are from multiple geographic regions and the usernames tried are all valid employees. The attempts occur every 5 minutes for the past hour. According to the company's security policy, which type of attack is most likely occurring, and what is the best immediate response?

Accepted Answer

Password spraying; enforce multi-factor authentication immediately.. The attack pattern—valid usernames with low-frequency attempts from diverse IPs—is characteristic of password spraying, where an attacker tries a single common password against many accounts to avoid lockout thresholds. The best immediate response is to enforce multi-factor authentication (MFA), which renders the stolen or guessed password insufficient for access, mitigating the attack without relying on IP-based blocking that is ineffective against distributed sources.

Answer

Credential stuffing; implement rate limiting.

Answer

Brute-force attack; add the IPs to a blocklist.

Answer

Dictionary attack; reset all employee passwords.

Question 4

During a security audit, an analyst discovers that several employees have shared their login credentials with colleagues to expedite work. Which policy enforcement mechanism would be most effective in preventing this behavior?

Accepted Answer

Implement multi-factor authentication.. Multi-factor authentication (MFA) is the most effective enforcement mechanism because it requires a second factor (e.g., a one-time passcode from an authenticator app, a hardware token, or a biometric) in addition to the password. Even if employees share their passwords, MFA prevents unauthorized access because the second factor is tied to the individual's device or identity and cannot be easily shared. This directly addresses the root cause of credential sharing by making shared credentials useless without the additional factor.

Answer

Implement a password complexity policy.

Answer

Enforce a password change policy every 30 days.

Answer

Conduct annual security awareness training.

Question 5

A company's security policy states that all remote access must be through a VPN. An employee complains that the VPN is too slow and asks for an exception to access a specific internal server directly over the internet. What should the security analyst recommend?

Accepted Answer

Investigate the VPN performance issue and optimize if possible.. Option D is correct because the security policy mandates VPN for all remote access, and bypassing it would violate the principle of least privilege and expose the internal server directly to the internet. The analyst should first investigate the VPN performance issue—common causes include MTU mismatch, high latency, or encryption overhead—and optimize it (e.g., adjusting MTU, using split tunneling, or upgrading hardware) rather than granting an exception that undermines security.

Answer

Configure a separate VPN profile with lower encryption.

Answer

Allow direct access but only from the employee's home IP.

Answer

Grant the exception temporarily and monitor the connection.

Question 6

A security analyst is reviewing the company's incident response plan. The plan states that 'all incidents must be contained within 30 minutes.' During a recent ransomware incident, the analyst identified the affected systems but could not contain them because the containment procedures required manual steps that took over an hour. What is the most likely gap in the plan?

Accepted Answer

The plan does not provide automated containment options.. The plan's requirement to contain incidents within 30 minutes is unachievable because the containment procedures rely solely on manual steps that take over an hour. The most likely gap is the absence of automated containment options, such as pre-configured firewall ACLs, host-based IPS policies, or SOAR playbooks that can isolate affected systems in seconds. Without automation, the response time objective (RTO) for containment is fundamentally mismatched with the procedural capability.

Answer

The ransomware was too sophisticated.

Answer

The analyst lacked proper training.

Answer

The analyst did not have proper authorization.

Question 7

A company is developing a new security policy for cloud storage. Which principle should be the foundation of the policy to ensure data confidentiality and integrity?

Accepted Answer

All data must be encrypted at rest and in transit.. Option C is correct because encryption at rest and in transit directly protects data confidentiality and integrity by rendering data unreadable without the proper decryption keys and by ensuring data is not tampered with during transmission. In cloud storage, encryption at rest (e.g., AES-256) safeguards data stored on disk, while encryption in transit (e.g., TLS 1.2/1.3) prevents interception or modification during upload/download. This dual-layer approach is the foundational security control for meeting confidentiality and integrity objectives, as defined in the CIA triad.

Answer

Access logs must be retained for at least one year.

Answer

Only authorized users can access the cloud storage.

Answer

Data must be backed up daily.

Question 8

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 9

Which THREE of the following are best practices for creating and maintaining security policies? (Choose three.)

Accepted Answer

Obtain approval from senior management.. Option B is correct because security policies require executive endorsement to ensure organization-wide compliance and resource allocation. Senior management approval establishes authority and accountability, making the policy enforceable across all departments, not just IT. Without this buy-in, policies lack the legal and organizational weight needed for disciplinary actions or budget justification.

Answer

Develop policies in isolation by the security team.

Answer

Store policies in a secure location accessible only to security staff.

Question 10

Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)

Accepted Answer

A business-critical application cannot function with the policy control.. Option D is correct because a business-critical application that cannot function with a security policy control represents a legitimate operational need that may require a temporary exception. Security policies should support business objectives, and if a control (e.g., a firewall rule, an antivirus exclusion, or an application whitelisting policy) prevents a critical application from running, an exception can be granted after a risk assessment and compensating controls are implemented. This aligns with the principle of balancing security with business continuity.

Answer

The employee finds the policy inconvenient.

Answer

The policy is too new and employees are not yet trained.

Answer

The employee is a senior executive.

Question 11

Refer to the exhibit. A network administrator is configuring TACACS+ on a switch. Based on the configuration snippet, what is the expected behavior if the TACACS+ server becomes unreachable?

Accepted Answer

Users can still log in using local credentials.. The configuration snippet shows the 'tacacs-server host' command but does not include the 'tacacs-server directed-request' or 'aaa authentication login default group tacacs+ local' statement. By default, when 'aaa authentication login default group tacacs+' is configured without the 'local' fallback method, the switch will use local authentication if the TACACS+ server is unreachable. Option B is correct because the switch is configured to fall back to local credentials when the TACACS+ server becomes unreachable, as indicated by the presence of 'local' in the authentication list.

Answer

Users cannot log in because TACACS+ is required.

Answer

Users can log in but accounting logs are not generated.

Answer

The switch falls back to no authentication.

Question 12

Refer to the exhibit. A security analyst observes a SIEM alert and a firewall log. The firewall allowed the traffic. According to the company's security policy, which action should the analyst take first?

Accepted Answer

Create a firewall rule to block the source IP.. The correct answer is D because the firewall log shows the traffic was allowed, and the SIEM alert indicates a security event. According to the security policy, the immediate action is to block the source IP to prevent further potential malicious activity. Creating a firewall rule to block the source IP is a direct and effective response to mitigate the threat.

Answer

Check if the firewall blocked the traffic.

Answer

Investigate the user's recent activity.

Answer

Ignore the alert as it is a false positive.

Question 13

You are a security analyst at a mid-sized company that uses a mix of on-premises servers and cloud services. The company's security policy requires all sensitive data to be encrypted at rest and in transit, and all access to be logged and monitored. Recently, the company experienced a data breach where an attacker exfiltrated a database containing customer PII. The investigation revealed that the attacker gained access using a compromised VPN account that had been inactive for 6 months. The account belonged to a former employee who left the company but the account was never disabled. The VPN logs show that the account was used from an unusual IP address, but no alert was triggered because the account was not on any watchlist. The breach occurred over a weekend when the security team was not monitoring. Which of the following would have most effectively prevented this breach?

Accepted Answer

Automate the de-provisioning of user accounts upon employee termination.. The root cause of the breach was that the former employee's VPN account remained active after termination, allowing the attacker to use it. Automating the de-provisioning of user accounts upon employee termination (Option D) directly addresses this by ensuring that accounts are disabled or removed as part of the offboarding process, eliminating the attack vector entirely. This aligns with the principle of least privilege and identity lifecycle management, which are foundational to access control policies.

Answer

Deploy a SIEM with anomaly detection for unusual VPN login locations.

Answer

Implement multi-factor authentication on all VPN accounts.

Answer

Increase the frequency of log reviews to daily.

Question 14

A security analyst is reviewing the incident response plan for a small business. The plan states that after an incident is contained, the next step is to preserve evidence. The CISO wants to ensure that the plan follows NIST guidelines. Which step should be added between containment and evidence preservation according to NIST?

Accepted Answer

Eradication. According to NIST SP 800-61 Rev. 2, the incident response lifecycle includes Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (Lessons Learned). Eradication (option D) must follow containment to remove artifacts such as malware, backdoors, or compromised accounts before evidence is preserved for legal or forensic purposes. Without eradication, residual threats could tamper with or destroy evidence during collection.

Answer

Lessons learned

Answer

Recovery

Answer

Evidence collection and analysis

Question 15

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Accepted Answer

Smart card. Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Answer

IP address whitelist

Answer

Password

Answer

Security question