200-201 Security Policies and Procedures Practice Test 3 — 15 Questions

Question 1

A security analyst receives an alert that an employee's workstation is generating outbound traffic to a known malware command-and-control IP address at 3:00 AM. According to the company's incident response policy, what is the FIRST action the analyst should take?

Accepted Answer

Isolate the workstation from the network by disabling the switch port.. The first action is to isolate the workstation from the network by disabling the switch port. This immediately stops the outbound command-and-control (C2) traffic, preventing data exfiltration and further compromise, while preserving the system state for forensic analysis. According to the incident response policy, containment takes precedence over eradication or recovery to limit damage.

Answer

Reimage the workstation immediately to remove the malware.

Answer

Apply the latest security patches to the workstation.

Answer

Call the employee to ask if they are working late.

Question 2

Which TWO of the following are essential components of an effective security policy framework according to Cisco best practices?

Accepted Answer

A high-level security policy that defines management's intent.. A high-level security policy is essential because it defines management's intent, establishes the organization's security philosophy, and provides the authoritative foundation for all subordinate policies, standards, and procedures. According to Cisco best practices, this top-tier document must be approved by senior leadership and sets the strategic direction for the entire security program, ensuring alignment with business objectives and regulatory requirements.

Answer

A network diagram showing all security devices.

Answer

A password policy that specifies minimum length and complexity.

Answer

A log analysis procedure for detecting anomalies.

Question 3

Refer to the exhibit. A network administrator notices that remote SSH logins to the router succeed, but the router is not sending accounting records. Based on the configuration, what is the most likely cause?

Accepted Answer

The accounting command references a TACACS+ group that is not defined.. The correct answer is D because the `accounting exec default` command references a TACACS+ server group named 'tacacs_server_group' that is not defined in the configuration. Without a defined server group, the router cannot send accounting records to any TACACS+ server, even though SSH authentication succeeds via the local database.

Answer

The AAA authorization method is set to local, not TACACS+.

Answer

The TACACS+ server key is not configured correctly.

Answer

The AAA authentication method uses local database instead of TACACS+.

Question 4

Drag and drop the steps for initial configuration of a Cisco IOS device after booting into the correct order.

Question 5

Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.

Question 6

Match each network protocol to its well-known port number.

Question 7

Match each network attack type to its description.

Question 8

A security analyst detects a host infected with ransomware on the corporate network. According to incident response procedures, what should be the first action?

Accepted Answer

Isolate the host from the network. Option A is correct because isolating the host prevents the ransomware from spreading to other systems. Option B is wrong because reimaging without isolation could fail if network propagation continues. Option C is wrong because notifying management is important but not the immediate technical first step. Option D is wrong because updating signatures is a preventive measure, not a containment step.

Answer

Reimage the host immediately

Answer

Update antivirus signatures

Answer

Notify the IT management team

Question 9

A company's acceptable use policy (AUP) prohibits personal devices on the corporate network. An employee is found connecting a personal tablet to access internal resources. What should the security team do?

Accepted Answer

Remind the employee of the AUP and request removal. Option D is correct because the AUP clearly prohibits personal devices, so the employee should be reminded of the policy. Option A is wrong because allowing it without exception violates policy. Option B is wrong because blocking the device without communication is not in line with user education. Option C is wrong because disabling the port is excessive without first enforcing the policy.

Answer

Allow the device and update the policy

Answer

Block the device and investigate

Answer

Disable the network port

Question 10

A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?

Accepted Answer

Submit an emergency change request for immediate approval. Option C is correct because when a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.

Answer

Deploy the patch only at the end of the business day

Answer

Wait for the next scheduled change window

Answer

Install the patch without approval

Question 11

An analyst is handling a data breach involving sensitive customer information (PII) stored in a database. According to data classification policy, what is the most critical step to take first?

Accepted Answer

Contain the breach and preserve evidence. Option C is correct because containing the breach and preserving evidence is the immediate priority. Option A is wrong because notifying customers before understanding the scope may cause panic. Option B is wrong while important, the policy on customer notification has specific triggers that require investigation first. Option D is wrong because updating the data classification policy is a separate long-term action.

Answer

Classify the data as high impact

Answer

Review the data classification policy

Answer

Notify affected customers immediately

Question 12

A security administrator is implementing a privileged access management (PAM) solution. Which practice best enforces the principle of least privilege for administrators?

Accepted Answer

Use Just-in-Time administration to grant temporary privileges. Option A is correct because Just-in-Time administration provides access only when needed, reducing standing privileges. Option B is wrong because sharing accounts violates accountability. Option C is wrong because permanent admin rights increase risk. Option D is wrong because monitoring without limiting access still allows abuse.

Answer

Create shared admin accounts for the team

Answer

Grant permanent admin rights to all senior administrators

Answer

Monitor admin activity without restricting access

Question 13

A company operating in the EU experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. Option B is correct because GDPR requires notification within 72 hours of becoming aware of the breach. Option A is wrong because 24 hours is too short. Option C is wrong because 48 hours is not the specified timeframe. Option D is wrong because 96 hours exceeds the allowed period.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 14

During a security awareness training session, an employee reports they clicked a link in a phishing email but did not enter credentials. Which policy violation is most likely involved?

Accepted Answer

Incident reporting policy. Option C is correct because clicking a suspected phishing link without reporting it violates the incident reporting policy. Option A is wrong because the employee did not enter credentials, so password policy is intact. Option B is wrong because the link itself is not necessarily prohibited by AUP unless it involves inappropriate content. Option D is wrong because data classification policy is about handling data, not email links.

Answer

Data classification policy

Answer

Acceptable use policy

Answer

Password policy

Question 15

An investigator seizes a laptop as evidence from a crime scene. At the scene, the laptop is turned on and a log file is open. What should the investigator do to preserve evidence according to chain of custody procedures?

Accepted Answer

Photograph the screen and create a forensic image. Option A is correct because photographing the screen captures the state, and creating a forensic image preserves the data. Option B is wrong because closing the file may alter metadata or memory. Option C is wrong because shutting down may lose volatile data. Option D is wrong because executing the file could modify evidence.

Answer

Close the log file and copy it to a USB drive

Answer

Shut down the laptop and remove the hard drive

Answer

Execute the log file to ensure it is legitimate