200-201 Security Policies and Procedures Practice Test 4 — 15 Questions

Question 1

A company's remote access policy requires VPN connections to use two-factor authentication (2FA). An employee reports they cannot connect because their token is not syncing. What is the best course of action?

Accepted Answer

Provide a new token and synchronize it correctly. Option D is correct because the core issue is a synchronization problem between the employee's token and the authentication server. Two-factor authentication (2FA) relies on time-based one-time passwords (TOTP) or event-based (HOTP) algorithms; if the token's clock drifts or the counter becomes out of sync, authentication fails. Providing a new token and correctly synchronizing it (e.g., via NTP time alignment or reseeding the HMAC-based OTP counter) restores secure access without bypassing the security policy.

Answer

Disable 2FA for the employee

Answer

Replace the token and allow access anyway

Answer

Temporarily allow connections without 2FA

Question 2

Which TWO components are essential in a well-written security policy?

Accepted Answer

Scope. A security policy must define its scope to specify which systems, users, and data are covered. Without a clear scope, the policy cannot be consistently applied, leading to gaps in enforcement. The scope ensures that all relevant assets are protected and that the policy's boundaries are understood by all stakeholders.

Answer

Cost estimates

Answer

Technology stack

Answer

Vendor names

Question 3

Which TWO incident types must be reported within 1 hour under the company's incident response policy?

Accepted Answer

Unauthorized access. Option A (malware outbreak) and Option C (unauthorized access) are critical incidents requiring immediate reporting. Options B, D, and E are less severe and may have longer reporting windows.

Answer

Phishing simulation failure

Answer

Spam campaign

Answer

Policy violation

Question 4

Which THREE actions are mandatory in the evidence handling process according to standard forensic procedures?

Accepted Answer

Document the chain of custody. Options A, B, and D are mandatory: documenting chain of custody, creating a forensic image, and using write blockers. Option C (rebooting) is avoided to preserve evidence. Option E (deleting malware) destroys evidence.

Answer

Delete any malware found immediately

Answer

Reboot the device to clear temporary files

Question 5

Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?

Accepted Answer

Traffic will be denied. The ASA security policy shown uses an access control list (ACL) that implicitly denies all traffic unless explicitly permitted. Since the exhibit does not show any ACL entry permitting HTTP traffic from the internet to 192.168.1.5, the traffic is denied by default. The correct answer is B because the ASA's default behavior for inbound traffic on an interface is to deny it unless a matching permit ACE exists.

Answer

Traffic will be allowed, but logged

Answer

Traffic will be allowed only if it matches the subnet

Answer

Traffic will be permitted

Question 6

Refer to the exhibit. A security analyst sees this syslog message from the ASA. Which statement best describes what is occurring?

Accepted Answer

An external host is connecting to an internal host. Option C is correct because the log shows a connection built from an outside host (203.0.113.1) to an inside host (192.168.1.100). This indicates a normal outbound connection from the internal host to the external web server. Option A is wrong because the source is outside. Option B is wrong because the destination is inside. Option D is wrong because the connection is allowed (built), not denied.

Answer

An inside host is initiating a connection to a web server

Answer

Traffic is being denied by the access list

Answer

The connection is being torn down

Question 7

Refer to the exhibit. A Cisco router is configured with the shown access list applied inbound on the external interface. An external attacker sends a packet with source IP 10.0.0.1, destination IP 192.168.1.100, destination port 22. What will the router do?

Accepted Answer

Drop the packet. Option A is correct because the ACL has a specific deny for SSH (port 22) to host 192.168.1.100, which matches this packet. The packet will be dropped. Option B is wrong because the permit any any only applies if no previous deny matches. Option C is wrong because there is no such rule about port 80. Option D is wrong because the packet is not forwarded.

Answer

Forward the packet to the next hop

Answer

Permit the packet only if it is HTTP

Answer

Permit the packet

Question 8

A security policy mandates that all administrative access to network devices must be encrypted. Which of the following protocols should be used to comply with this policy?

Accepted Answer

SSH. SSH provides encrypted remote access, meeting the policy requirement. Telnet sends passwords in clear text. TFTP and SNMPv2c are not used for administrative access.

Answer

Telnet

Answer

TFTP

Answer

SNMPv2c

Question 9

An organization's security policy requires that all security incidents be reported within one hour of discovery. A junior analyst notices an unauthorized login attempt but is unsure if it qualifies as an incident. What should the analyst do first?

Accepted Answer

Report the suspicious activity immediately. Reporting suspicious activity immediately aligns with the policy, even if not confirmed. Waiting or deleting logs could violate reporting requirements.

Answer

Delete the logs to avoid false alarms

Answer

Wait until the incident is confirmed

Answer

Investigate on their own without reporting

Question 10

A company's data classification policy defines "Confidential" data. Which of the following is an example of Confidential data?

Accepted Answer

Customer payment card information. Customer payment card information is typically classified as Confidential due to regulatory requirements like PCI DSS. The other options are lower sensitivity.

Answer

Public marketing brochures

Answer

Company cafeteria menu

Answer

Employee phone numbers

Question 11

During a security audit, it is discovered that several users have passwords set to never expire. According to the security policy, passwords must be changed every 90 days. What is the best course of action?

Accepted Answer

Update the password policy in Active Directory to enforce 90-day expiration. Option D is correct because the most efficient and enforceable way to ensure all users comply with the 90-day password expiration policy is to configure a Group Policy Object (GPO) in Active Directory that sets the 'Maximum password age' to 90 days. This automatically forces password changes at login after the expiration period, ensuring uniform enforcement without manual intervention or disruption.

Answer

Disable accounts that violate the policy

Answer

Notify users to change their passwords voluntarily

Answer

Immediately reset all user passwords

Question 12

An incident response plan specifies that containment must be completed before eradication. A security analyst identifies a malware infection on a critical server. What should be done first?

Accepted Answer

Disconnect the server from the network. According to the incident response plan, containment must be completed before eradication. Disconnecting the server from the network (Option A) is the immediate containment action that prevents the malware from spreading laterally to other hosts, preserving the integrity of the network and allowing for forensic analysis. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized to limit damage before any eradication or recovery steps are taken.

Answer

Run antivirus scans

Answer

Notify law enforcement

Answer

Reinstall the operating system

Question 13

A company's security policy prohibits the use of shared accounts. However, a legacy application requires a shared administrative account to run. What is the best approach?

Accepted Answer

Use a privileged access management solution to control and monitor the shared account. A privileged access management (PAM) solution can monitor and control the shared account, providing accountability while allowing the legacy application to function.

Answer

Create a policy exception

Answer

Disable the application

Answer

Ignore the policy because it's a legacy system

Question 14

An organization's security policy requires that all traffic between the corporate network and the internet be inspected by an IPS. However, encrypted traffic (HTTPS) cannot be inspected without breaking encryption. Which solution best meets the policy requirement?

Accepted Answer

Implement SSL/TLS interception using a proxy with a trusted certificate. SSL/TLS interception using a trusted proxy allows inspection of encrypted traffic while maintaining security, though it requires careful implementation and user acceptance.

Answer

Allow all HTTPS traffic without inspection

Answer

Rely on endpoint security only

Answer

Disable HTTPS for internal users

Question 15

A security policy states that all portable media must be encrypted. An employee loses a USB drive containing customer data. The drive was encrypted with AES-256. Which of the following is true regarding policy compliance?

Accepted Answer

The policy was followed, but the incident still needs to be reported per incident response procedures. Option A is correct because the security policy mandates encryption for portable media, and AES-256 encryption was applied to the USB drive, so the policy was technically followed. However, the loss of a device containing customer data still triggers incident response procedures, as the encryption key or the possibility of decryption could be compromised, and reporting is required to assess risk and comply with breach notification laws.

Answer

The employee violated policy because the drive was lost

Answer

The policy was followed because the data was encrypted, so a breach is not reportable

Answer

Encryption is not sufficient, the employee should have used a different media