200-201 Security Policies and Procedures Practice Test 6 — 15 Questions

Question 1

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

Accepted Answer

Incident Response Procedure for evidence preservation. Incident response procedures typically require preserving volatile data before disconnecting. Option A is correct. Option B (chain of custody) is about evidence handling. Option C (forensic analysis) is a later step. Option D (escalation) is not the core issue.

Answer

Chain of Custody Procedure

Answer

Forensic Analysis Procedure

Answer

Escalation Procedure

Question 2

Which TWO of the following are key components of a security policy framework according to Cisco? (Choose two.)

Accepted Answer

Guidelines. In Cisco's security policy framework, guidelines and standards are foundational components. Guidelines offer recommended practices and flexible advice for implementing security controls, while standards define mandatory, specific technical requirements (e.g., encryption algorithms, password complexity) that must be followed. Together, they provide the structure for consistent security enforcement across an organization.

Answer

Incident Response Plan

Answer

Audit Logs

Answer

Firewalls

Question 3

Which THREE are required steps in a proper incident response procedure? (Choose three.)

Accepted Answer

Containment, Eradication, and Recovery. The IR process includes preparation, detection, containment, eradication, recovery, and lessons learned. Options A, C, and D are direct steps. Option B (system hardening) is a preventive measure. Option E (change management) is a separate process.

Answer

Change Management Processing

Answer

System Hardening

Question 4

Which TWO activities are typically part of a security policy review cycle? (Choose two.)

Accepted Answer

Reviewing regulatory updates. Policy review includes identifying changes in regulatory requirements and periodic audits. Options A and B are correct. Option C (patching) is operational. Option D (user training) is part of awareness, not review. Option E (incident handling) is not review.

Answer

Delivering security awareness training

Answer

Handling a security incident

Answer

Applying system patches

Question 5

Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?

Accepted Answer

The user enters user EXEC mode but is denied enable access due to missing enable secret. The configuration uses 'enable' authentication for enable mode, which means it uses the enable password (not set) or if not set, the local user database? Actually 'enable' method uses the enable secret/password. Since no enable secret is configured, authentication fails. However, the user must first log in to user EXEC mode. For user EXEC, it uses local-case authentication, so 'admin' with password 'cisco123' works there. But for enable, it uses 'enable' method, which requires the enable password. Since no enable password is set, the user is denied enable access. Option D is correct. Option A is wrong because user EXEC works. Option B is wrong because enable access fails. Option C is wrong because the user cannot even enter enable mode.

Answer

The user is granted access to user EXEC mode only

Answer

The user is denied all access because no enable secret is set

Answer

The user is granted full privileged EXEC access

Question 6

Refer to the exhibit. A network administrator applied this ACL inbound on the external interface of a firewall. An attacker sends a TCP SYN packet with source IP 192.0.2.1 to destination 10.1.1.100 port 80. Which statement accurately describes the packet's treatment?

Accepted Answer

The packet is permitted by the first ACE. The ACL permits TCP to 10.1.1.100 on port 80, so the SYN packet is permitted. However, since it's inbound, the firewall will still check the state. But the ACL itself allows it. Option A is correct. Option B is incorrect because there is an explicit deny. Option C is incorrect because it is permitted by the first line. Option D is incorrect because it doesn't match deny before.

Answer

The packet is permitted because the ACL only denies non-TCP traffic

Answer

The packet is denied by the implicit deny at the end

Answer

The packet is denied because there is no permit for source 192.0.2.1

Question 7

Refer to the exhibit. A security analyst views these log entries from a Cisco router. What conclusion can be drawn about ACL 101?

Accepted Answer

ACL 101 denies Telnet and permits HTTP. The log shows a denied packet to port 23 (Telnet) and a permitted packet to port 80 (HTTP). This indicates the ACL denies Telnet and permits HTTP. Option B is correct. Option A is incorrect because some traffic is denied. Option C is incorrect because the ACL likely allows other ports. Option D is incorrect because HTTP is permitted.

Answer

ACL 101 blocks HTTP traffic

Answer

ACL 101 applies only to inbound traffic

Answer

ACL 101 permits all traffic

Question 8

A company's security policy states that employees must not use corporate laptops for personal web browsing. An employee is found to have streamed video during work hours, consuming significant bandwidth. What is the best course of action?

Accepted Answer

Report the violation to HR for disciplinary action per the existing policy. Option C is correct because the policy is clear, and a violation should be addressed consistently, typically through HR for disciplinary action. Option A is too harsh for a first offense. Option B bypasses policy enforcement. Option D ignores the policy violation entirely.

Answer

Give a verbal warning and take no further action

Answer

Update the policy to allow streaming under certain conditions

Answer

Immediately terminate the employee

Question 9

During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?

Accepted Answer

Analyze the memory dump to identify indicators of compromise. Option A is correct because after containment (isolation) and data collection (memory dump), the next step is analysis to understand the scope and impact. Option B is premature before analysis. Option C is not a standard incident response step. Option D happens after analysis and eradication.

Answer

Reboot the host to clear any malware from memory

Answer

Notify the public relations team immediately

Answer

Restore the host from a known good backup

Question 10

A security auditor reviews a company's security policies and finds that the password policy requires a minimum length of 8 characters and complexity including uppercase, lowercase, digit, and special character. However, the policy does not mandate password expiration. Which of the following is the most significant risk due to this omission?

Accepted Answer

Stolen credentials could be used for extended periods without detection. Option B is correct because without expiration, compromised credentials remain valid indefinitely, increasing risk. Option A is less likely if complexity is enforced. Option C is not directly related. Option D is a minor inconvenience compared to credential theft.

Answer

Users may choose weak passwords that are easy to guess

Answer

Help desk will receive an increased number of password reset requests

Answer

Users might reuse passwords across different systems

Question 11

An organization's data classification policy defines four levels: Public, Internal, Confidential, and Restricted. An employee accidentally sends an email containing customer payment card information (PCI) to the entire company mailing list. The data should have been classified as which level?

Accepted Answer

Restricted. Option D is correct because PCI data is highly sensitive and legally protected, warranting Restricted classification. Option A is for non-sensitive data. Option B is for internal use but not as sensitive. Option C is sensitive but not as high as Restricted.

Answer

Public

Answer

Internal

Answer

Confidential

Question 12

A company has implemented a role-based access control (RBAC) policy for its network devices. A network engineer needs temporary access to configure a router in a different region. According to the RBAC policy, what is the appropriate procedure?

Accepted Answer

Submit a request to the security team for temporary role elevation with a specified time limit. Option D is correct because RBAC policies require that any deviation from assigned roles, such as temporary access to a router in a different region, must be handled through a formal privilege elevation process. This typically involves submitting a request to the security team, who can grant temporary role elevation with a specified time limit, ensuring that access is auditable, time-bound, and revoked automatically. This aligns with the principle of least privilege and maintains the integrity of the RBAC model by avoiding permanent or shared credentials.

Answer

Have the root password shared via encrypted email to the engineer

Answer

Use the shared admin account for the duration of the task

Answer

Ask another engineer with access to perform the configuration changes

Question 13

A business impact analysis (BIA) for a critical enterprise application reveals a maximum tolerable downtime (MTD) of 4 hours and a recovery time objective (RTO) of 2 hours. The current backup solution can restore the application in 3 hours under optimal conditions. Which of the following is the most appropriate action from a policy perspective?

Accepted Answer

Upgrade the backup solution to achieve a restore time of 2 hours or less. Option C is correct because the backup restore time (3 hours) exceeds the RTO (2 hours), so the plan fails. The MTD is 4 hours, but RTO must be met to avoid significant impact. Option A is incorrect because the RTO is not satisfied. Option B might not address the core issue. Option D ignores the policy requirement.

Answer

Accept the current restore time because it is within the MTD of 4 hours

Answer

Reduce the RTO to 1 hour to make the backup solution acceptable

Answer

Increase the MTD to 5 hours to match the backup restore time

Question 14

A security policy mandates that all employees complete annual security awareness training. Which of the following metrics best demonstrates the effectiveness of this training?

Accepted Answer

Decrease in security incidents attributed to user error. Option D is correct because a reduction in incidents caused by user error directly indicates improved awareness. Option A may reflect adherence but not effectiveness. Option B measures volume, not effectiveness. Option C could be due to other factors.

Answer

Results of a post-training quiz

Answer

Percentage of employees who completed the training

Answer

Number of help desk tickets related to phishing

Question 15

A change management policy requires that all network configuration changes be approved by a change advisory board (CAB) before implementation. An urgent security vulnerability requires an immediate firewall rule change to block an active exploit. What should the network administrator do?

Accepted Answer

Apply the change immediately and then submit an emergency change request for post-approval. Option A is correct because emergency change procedures should allow immediate action with retroactive approval. Option B violates policy. Option C is unnecessary if emergency procedure exists. Option D is unrealistic for an urgent fix.

Answer

Convene an emergency CAB meeting before making the change

Answer

Ignore the vulnerability until the next scheduled CAB meeting

Answer

Wait for CAB approval to ensure compliance with policy