200-201 Security Policies and Procedures Practice Test 5 — 15 Questions

Question 1

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Accepted Answer

MAC because it is more secure. MAC provides stricter, system-enforced controls based on classification, which is often adopted in higher-security environments. DAC relies on user discretion and is less secure.

Answer

DAC because it is more flexible

Answer

Both can coexist

Answer

A new hybrid model combining both

Question 2

A security policy requires multifactor authentication for all administrative access. Which TWO of the following are examples of factors used in MFA? (Choose two.)

Accepted Answer

Fingerprint. MFA requires two distinct factors: something you have (smart card) and something you are (fingerprint). Password is a single factor, username and MAC address are not valid factors.

Answer

MAC address

Answer

Password

Answer

Username

Question 3

A company's security policy mandates data encryption at rest. Which TWO of the following are acceptable methods to meet this requirement? (Choose two.)

Accepted Answer

Database encryption. Full disk encryption and file-level encryption both protect data at rest. Database encryption also does, but only two are needed. Encryption of network traffic protects data in transit, not at rest.

Answer

File-level encryption

Answer

Hashing

Answer

Encryption of network traffic (TLS)

Question 4

According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)

Accepted Answer

Ability to change their own password. Least privilege means users get only necessary rights. Typical users need write access to home directory, read access to shared calendar, and ability to change own password. They do not need software installation rights or local administrative rights.

Answer

Administrative rights to the local machine

Answer

Ability to install software

Question 5

Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?

Accepted Answer

Yes, because it denies RDP and Telnet.. The ACL explicitly denies RDP (port 3389) and Telnet (port 23) and permits all other traffic, which fully meets the policy requirement. The policy does not require blocking other services.

Answer

Yes, because it denies TCP ports 3389 and 23.

Answer

No, because it permits all other traffic.

Answer

No, because it should deny HTTP traffic as well.

Question 6

Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?

Accepted Answer

The source IP 10.10.10.5 should be allowed to pass HTTP traffic.. The syslog message shows that a packet from 10.10.10.5 to 192.168.1.10 on port 80 (HTTP) was permitted. According to the security policy, HTTP traffic from specific IPs is allowed, so 10.10.10.5 should be one of those permitted sources. The correct answer is D because the log indicates the traffic was allowed, which aligns with the policy exception, and no compromise or misconfiguration is evident.

Answer

The packet was permitted but logged.

Answer

The packet was denied because it was HTTP traffic from 10.10.10.5.

Answer

The destination IP 192.168.1.10 is compromised.

Question 7

Refer to the exhibit. A security policy requires that network traffic be classified and prioritized to ensure critical applications get bandwidth. A network engineer implements this QoS policy. However, after deployment, a security scanner reports that SSH traffic is starved. Which of the following is the most likely cause?

Accepted Answer

SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.. Option D is correct because SSH traffic is not explicitly matched by any class map in the policy, so it falls into the class-default. The class-default in this policy uses fair-queue, which does not guarantee a minimum bandwidth; if higher-priority classes (like VOIP and critical data) consume most of the link, class-default can be starved. This results in SSH sessions timing out or experiencing severe packet loss.

Answer

The priority percent for VOIP is too high.

Answer

The fair-queue algorithm does not work with this policy.

Answer

The critical data class includes SSH traffic.

Question 8

A company's security policy requires that all employees change their passwords every 90 days. Which type of security control does this policy enforce?

Accepted Answer

Preventive. Password aging is a preventive control because it reduces the window of opportunity for credential theft. Option A is correct. Option B (detective) is incorrect because password changes do not detect attacks. Option C (corrective) is incorrect because it does not fix a breach. Option D (compensating) is incorrect because it is not an alternative control.

Answer

Compensating

Answer

Detective

Answer

Corrective

Question 9

An analyst discovers that an employee has been using company-issued laptops to run a personal cryptocurrency mining software. Which policy violation has occurred?

Accepted Answer

Acceptable Use Policy. Cryptocurrency mining typically violates the Acceptable Use Policy (AUP) because it consumes company resources for non-work purposes. Option B is correct. Option A (data classification policy) is about labeling data. Option C (incident response policy) is about handling security events. Option D (change management policy) is about modifying systems.

Answer

Incident Response Policy

Answer

Change Management Policy

Answer

Data classification policy

Question 10

During a security audit, an analyst finds that a third-party vendor has access to sensitive customer data beyond what is necessary for their services. Which principle of least privilege should the policy enforce?

Accepted Answer

Enforce a data classification and access control policy. The principle of least privilege means granting only the minimum rights needed. The policy should enforce a data classification and access control policy that restricts vendor access to only required data sets. Option C is correct. Option A (end-user license agreement) is between vendor and customer. Option B (SLA) defines service levels. Option D (incident response) is after-the-fact.

Answer

Implement an incident response plan for data leaks

Answer

Update the end-user license agreement

Answer

Invoke a service-level agreement

Question 11

A company's security policy states that all employees must use multi-factor authentication (MFA) when accessing the corporate network remotely. Which policy is being applied?

Accepted Answer

Access Control Policy. MFA is an authentication control, often part of an Access Control Policy. Option B is correct. Option A (remote access policy) is a subset but the stem directly says 'accessing the corporate network.' Option C (acceptable use) is about behavior. Option D (incident response) is about handling incidents.

Answer

Incident Response Policy

Answer

Remote Access Policy

Answer

Acceptable Use Policy

Question 12

During a change management process, a security administrator approves a firewall rule change. After implementation, a critical application becomes unreachable. Which step in the change process was likely missed?

Accepted Answer

Backout plan development. A thorough backout plan should be prepared before change implementation so that if issues occur, the change can be reversed. Option D is correct. Option A (peer review) helps but is not the direct cause. Option B (testing) might have been done but not the immediate issue. Option C (documentation) is important but not the direct cause of unreachability.

Answer

Post-implementation documentation

Answer

Testing in a staging environment

Answer

Peer review of the change

Question 13

An organization's security policy requires data classification labels to be applied to all documents. A manager sends a spreadsheet containing employee PII (personally identifiable information) to the entire company without labeling. Which policy has been violated?

Accepted Answer

Data Classification Policy. The data classification policy requires proper labeling. Sending unlabeled PII violates that policy. Option A is correct. Option B (acceptable use) might be relevant but labeling is the core. Option C (incident response) is for after detection. Option D (remote access) is not relevant.

Answer

Acceptable Use Policy

Answer

Remote Access Policy

Answer

Incident Response Policy

Question 14

Which security policy defines the process for reporting discovered security vulnerabilities to the organization?

Accepted Answer

Vulnerability Disclosure Policy. A vulnerability disclosure policy outlines how to report and handle security weaknesses. Option C is correct. Option A (incident response) is for active attacks. Option B (acceptable use) is for employee behavior. Option D (change management) is for changes.

Answer

Acceptable Use Policy

Answer

Incident Response Policy

Answer

Change Management Policy

Question 15

A security analyst is creating a policy for handling sensitive customer data. The policy must ensure data is encrypted at rest and in transit. Which type of policy most directly addresses this requirement?

Accepted Answer

Data Protection Policy. A data protection policy specifically covers encryption, storage, and transmission controls. Option B is correct. Option A (access control) is about permissions. Option C (incident response) is about breaches. Option D (physical security) is about facilities.

Answer

Incident Response Policy

Answer

Access Control Policy

Answer

Physical Security Policy