200-201 Security Policies and Procedures Practice Test 7 — 15 Questions

Question 1

A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?

Accepted Answer

Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy. Option C is correct because it acknowledges the vendor's need while insisting on compliance through technical controls (e.g., restricting to specific IPs within the subnet). Option A forces the vendor to comply without flexibility. Option B risks security. Option D allows non-compliance.

Answer

Amend the policy to allow entire subnets for vendors with multi-factor authentication

Answer

Accept the subnet as long as multi-factor authentication is used

Answer

Require the vendor to comply with the existing policy exactly as written

Question 2

Which TWO of the following are key elements that should be included in an incident response plan?

Accepted Answer

Roles and responsibilities of the incident response team. Options A and D are correct. An incident response plan should include roles and responsibilities (A) and communication protocols (D). Options B and E are operational procedures, not plan elements. Option C is a general security control.

Answer

Requirements for antivirus software on endpoints

Answer

List of approved forensic tools

Answer

Step-by-step technical remediation instructions for specific attack types

Question 3

Which THREE of the following are common types of security policies that organizations typically implement?

Accepted Answer

Data Classification Policy. Options A, C, and D are correct. Acceptable use policy (A), data classification policy (C), and password policy (D) are standard. Option B is a procedure, not a policy. Option E is a specific framework, not a policy type.

Answer

ISO 27001 Standard

Answer

Patch Management Procedure

Question 4

Which TWO of the following are essential requirements for a security policy to be effective?

Accepted Answer

It must be communicated to all relevant parties. Options B and E are correct. A policy must be enforceable (B) and communicated (E). Option A may be helpful but not essential. Option C is often legally required but not a policy effectiveness requirement. Option D reduces motivation.

Answer

It should be as long and detailed as possible

Answer

It must comply with all applicable laws

Answer

It should be updated only when an incident occurs

Question 5

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Accepted Answer

Incoming BitTorrent traffic using ports 6881-6889 is blocked. Option D is correct. The ACL denies TCP and UDP on ports 6881-6889 and permits everything else. BitTorrent uses these ports, so it is blocked in the inbound direction. Option A is wrong because it only denies those ports. Option B is wrong because it blocks only those specific ports. Option C is wrong because the permit any any allows all other traffic.

Answer

All TCP traffic is blocked

Answer

Only outgoing BitTorrent traffic is blocked

Answer

All BitTorrent traffic is permitted

Question 6

Refer to the exhibit. A security analyst observes these syslog messages from an ASA firewall. Based on the messages, which type of activity is most likely occurring?

Accepted Answer

An external host scanning internal hosts for open port 80. Option B is correct. The messages show multiple connection attempts from the same source IP to the same destination IP and port, with increasing source ports. This pattern indicates a port scan, specifically a TCP port scan against port 80. Option A is about hosts inside initiating connections. Option C would show success. Option D is for DoS, which would involve many destinations or bandwidth.

Answer

An inside host attempting to access a web server on the outside

Answer

A denial of service attack flooding the firewall

Answer

Successful web traffic from an external client

Question 7

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Accepted Answer

The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls. Option D is correct. The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.

Answer

The destination 'any' allows SSH to any external server, which is too permissive

Answer

The ACL permits SSH from unauthorized IP addresses

Answer

The ACL sequence is illogical; line 30 should be before lines 10 and 20

Question 8

A security policy requires that all email attachments be scanned for malware. An employee receives a legitimate PDF from a customer that is flagged as malicious. What should the analyst do first?

Accepted Answer

Contact the customer to verify the file is intended.. Option C is correct because verifying with the sender prevents unnecessary actions. Option A is too aggressive without confirmation. Option B escalates prematurely. Option D might be done later. Option E violates policy.

Answer

Allow the email through since it's from a known sender.

Answer

Quarantine the email and delete the attachment.

Answer

Escalate to the incident response team.

Answer

Update the antivirus signatures and rescan.

Question 9

A security analyst notices repeated failed login attempts from an external IP. The company has a policy for account lockout after 5 failed attempts. However, the lockout is not triggering. What is the most likely cause?

Accepted Answer

The failed attempts are occurring on a legacy application that does not integrate with Active Directory.. Option B is correct because legacy applications may not integrate with Active Directory domain lockout policies. Option A is plausible but not specific to external IP. Option C is unlikely. Option D is possible but not given. Option E is irrelevant.

Answer

The lockout threshold is set to 10 attempts.

Answer

The lockout policy is applied to user accounts but not to administrative accounts.

Answer

The intrusion prevention system is blocking the lockout mechanism.

Answer

The firewall is allowing the traffic but not logging.

Question 10

An organization's security policy specifies that all configuration changes must be approved through a change management process. An analyst discovers that a firewall rule was added without approval. What is the appropriate action?

Accepted Answer

Report the unauthorized change to management.. Option C is correct because reporting the unauthorized change is required by policy. Option A is too hasty without impact analysis. Option B might follow reporting. Option D violates policy. Option E is inappropriate.

Answer

Remove the rule immediately.

Answer

Change the policy to allow emergency changes without approval.

Answer

Document the change and ignore it.

Answer

Analyze the rule to see if it's needed, then either approve or remove.

Question 11

A company's security policy requires that all network devices be managed using SSHv2. An auditor finds that some older switches are still using Telnet. The network team claims they cannot upgrade due to budget constraints. What is the best immediate action to mitigate risk?

Accepted Answer

Implement an ACL to restrict Telnet access to only the management subnet.. Option A is correct because an ACL restricting Telnet to the management subnet reduces exposure. Option B is impractical for remote management. Option C still uses Telnet. Option D uses insecure SSHv1. Option E is unrelated.

Answer

Use SSHv1 as a compromise.

Answer

Create a VLAN for management and enforce Telnet only on that VLAN.

Answer

Implement port security on the switches.

Answer

Disable Telnet and rely on console access only.

Question 12

A security policy requires that all privileged access be logged and monitored. A junior admin uses a shared service account to perform maintenance. The logs show the account logged in from multiple IPs at the same time. What does this indicate?

Accepted Answer

The account is being used by multiple administrators simultaneously.. Option B is correct because a shared account used by multiple admins explains simultaneous logins. Option A is possible but less likely than policy violation. Options C, D, E are less plausible.

Answer

There is a network issue causing duplicate logs.

Answer

The account is compromised.

Answer

The account is being used by an automated script.

Answer

The logging system is malfunctioning.

Question 13

A security policy requires that all remote access be through a VPN using strong authentication. A user calls the help desk saying they cannot connect to the VPN. The analyst checks and sees that the user's token is not synchronized. What should the analyst do?

Accepted Answer

Reset the user's token and have them re-sync.. Option A is correct because resetting the token is standard procedure. Option B is too severe. Option C compromises strong auth. Option D violates policy. Option E is unnecessary.

Answer

Disable VPN access for the user.

Answer

Provide a temporary static password.

Answer

Escalate to the security team.

Answer

Have the user connect without a token.

Question 14

A company's security policy states that all network traffic must be inspected by an IPS. However, encrypted traffic (SSL/TLS) is bypassing inspection. The network team wants to implement SSL decryption. What is the primary policy consideration before implementing?

Accepted Answer

Obtain legal approval for decryption of user traffic.. Option B is correct because legal and policy approval for traffic decryption is paramount. Options A, C, E are technical steps after approval. Option D is important but secondary to legal approval.

Answer

Configure the firewall to block SSL traffic that cannot be decrypted.

Answer

Notify all users that their traffic will be inspected.

Answer

Create a certificate authority to issue certificates to all internal servers.

Answer

Ensure that the SSL decryption device has enough CPU capacity.

Question 15

A company's incident response policy defines four phases: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity. During an active ransomware outbreak, the IR team is unable to contain the spread because the containment plan did not account for the malware's use of PowerShell for lateral movement. Which phase had a deficiency?

Accepted Answer

Preparation. Option A is correct because Preparation should include threat modeling and playbooks for common TTPs. Options B, C, D are later phases that rely on preparation.

Answer

Containment Eradication & Recovery

Answer

None of the above

Answer

Post-Incident Activity

Answer

Detection & Analysis