200-201 Security Policies and Procedures Practice Test 8 — 15 Questions

Question 1

A security policy requires that all endpoints have host-based firewalls enabled. A user reports that an application stopped working after a recent update. What should the analyst do?

Accepted Answer

Create an exception rule for the application.. Option B is correct because creating an exception maintains firewall policy while allowing the app. Option A violates policy. Option C may revert security patches. Options D and E are less direct.

Answer

Escalate to the application vendor.

Answer

Roll back the update.

Answer

Disable the host firewall for that user.

Answer

Reinstall the application.

Question 2

An analyst is reviewing this configuration. What is the most significant security concern?

Accepted Answer

The access-list does not specify source IPs, allowing any source.. Option D is correct because allowing any source IP is a security risk; source restriction is missing. Option A is the purpose. Option B is present (deny any). Option C is a design choice. Option E is not recommended.

Answer

The access-list permits all traffic to 192.168.1.100 on ports 80 and 443.

Answer

The access-list is missing a rule to deny all other traffic.

Answer

The access-list only permits traffic to a single host.

Answer

The access-list should permit traffic to the entire subnet.

Question 3

An analyst sees these logs. What should be the immediate course of action?

Accepted Answer

Investigate whether these are legitimate SSH attempts from authorized remote administrators.. Option B is correct because the attempts could be from authorized admins; investigation is needed. Option A is premature. Option C is too aggressive. Option D is not a solution. Option E is extreme.

Answer

Change the SSH port to a non-standard port.

Answer

Block all traffic from the 10.0.0.0/24 subnet.

Answer

Add an ACL permit rule for SSH from these sources.

Answer

Disable SSH access to the router.

Question 4

An analyst is verifying a VPN configuration. Which of the following is true about this configuration?

Accepted Answer

The VPN uses AES-256 encryption and SHA-1 authentication.. Option A is correct because 'esp-aes 256' uses AES-256, and 'esp-sha-hmac' uses SHA-1. Option B uses DES/MD5. Option C uses 3DES/SHA-256. Option D uses AES-128/SHA-1. Option E uses AES-256/SHA-2, but SHA-2 is not specified.

Answer

The VPN uses AES-128 encryption and SHA-1 authentication.

Answer

The VPN uses AES-256 encryption and SHA-2 authentication.

Answer

The VPN uses 3DES encryption and SHA-256 authentication.

Answer

The VPN uses DES encryption and MD5 authentication.

Question 5

A security policy requires that all data at rest be encrypted. Which TWO of the following are considered best practices for implementing encryption?

Accepted Answer

Store encryption keys separately from the encrypted data.. Options A and C are correct. Option A: hardware-based encryption is more secure. Option C: separate key storage. Option B: same key weakens security. Option D: weak encryption is poor practice. Option E: encryption should be at multiple layers.

Answer

Implement encryption at the application layer only.

Answer

Use weak encryption algorithms to reduce performance impact.

Answer

Use the same key for all data to simplify management.

Question 6

An organization's security policy requires that all security incidents be reported within 1 hour. A system administrator discovers a potential data breach but delays reporting by 3 hours because they were trying to contain it. Which TWO are the most likely consequences of this delay?

Accepted Answer

The incident response team loses valuable time for analysis.. Options A and D are correct. Option A: lost time for analysis. Option D: potential regulatory fines. Option B: termination is possible but not most likely. Option C: escalation due to lack of containment (delay may worsen, but not a direct consequence of delay itself). Option E: incident will not be automatically closed.

Answer

The incident will be automatically closed.

Answer

The administrator will be terminated.

Answer

The breach may escalate due to lack of containment.

Question 7

An organization's security policy defines acceptable use of corporate email. Which THREE of the following actions are typically prohibited?

Accepted Answer

Sending personal emails using the corporate account.. Options A, B, and C are typically prohibited. Option A: personal emails are often restricted. Option B: forwarding to personal accounts raises data loss risk. Option C: sending sensitive data unencrypted violates policy. Option D: emailing IT support is allowed. Option E: subscribing to newsletters is often discouraged but not always prohibited; however, here it is not selected.

Answer

Using email to subscribe to personal newsletters.

Answer

Emailing the IT support for assistance.

Question 8

An organization's security policy requires that all data at rest on laptops be encrypted. An employee reports that their laptop was stolen. Which control would most likely prevent data exposure?

Accepted Answer

Full disk encryption. Option B is correct because full disk encryption ensures data cannot be read from the drive. Option A is wrong because remote wipe requires network connectivity. Option C is wrong because screen lock only protects while unattended. Option D is wrong because biometric authentication does not encrypt data.

Answer

Remote wipe

Answer

Biometric authentication

Answer

Screen lock with password

Question 9

An security auditor finds that the company's backup policy does not include offsite storage. The security policy requires that backups be stored in a geographically separate location. What should the company do?

Accepted Answer

Use encrypted cloud backup in a different region. Option D is correct because encrypted offsite cloud storage satisfies the geographical separation requirement. Option A is wrong because onsite storage is not geographically separate. Option B is wrong because increasing retention does not change location. Option C is wrong because RAID provides redundancy but not offsite storage.

Answer

Store backups in a fireproof safe on-site

Answer

Implement RAID on the backup server

Answer

Increase backup retention period

Question 10

A company is implementing a new data classification policy. The policy defines three levels: Public, Internal, and Confidential. An employee accidentally emails a spreadsheet marked 'Confidential' to an external partner. The email system automatically encrypts all outbound emails containing 'Confidential' classification. Which security control is being demonstrated?

Accepted Answer

Data Loss Prevention (DLP). Option D is correct because the email system is automatically encrypting outbound emails based on classification, which is a type of data loss prevention (DLP). Option A is wrong because access control restricts who can access data, not how it is transmitted. Option B is wrong because encryption at rest occurs when data is stored. Option C is wrong because auditing records events but does not prevent data loss.

Answer

Auditing

Answer

Encryption at rest

Answer

Access control

Question 11

A company's security policy requires that all system logs be retained for at least one year. A security analyst discovers that log files are being overwritten after 30 days. What is the most likely cause?

Accepted Answer

The log rotation policy is set to 30 days. Option C is correct because the log rotation setting is likely set to 30 days, causing overwrites. Option A is wrong while disk space may contribute, the direct cause is the rotation policy. Option B is wrong because malware is less likely. Option D is wrong because an administrator deleting logs would be a deliberate act.

Answer

Logs are being manually deleted by an administrator

Answer

Malware infection

Answer

Insufficient disk space

Question 12

A security policy requires that all remote access be authenticated using a one-time password (OTP) token. Which technology should be implemented?

Accepted Answer

RADIUS with token server. Option A is correct because RADIUS can integrate with an OTP token server. Option B is wrong because LDAP with password does not provide OTP. Option C is wrong because SSH keys are not OTP. Option D is wrong because pre-shared keys are not OTP.

Answer

SSH key pairs

Answer

LDAP with username and password

Answer

VPN with pre-shared key

Question 13

During a security incident, the incident response team isolates a compromised workstation from the network. The security policy requires that all actions taken during the incident be documented and approved. However, the team lead isolates the workstation without waiting for formal approval. Which principle of incident response is being prioritized?

Accepted Answer

Speed of containment. Option B is correct because speed of containment is prioritized to limit damage, even if it means bypassing formal approval. Option A is wrong because isolation does preserve evidence, but the question emphasizes the lack of approval. Option C is wrong because preservation of evidence is a separate priority. Option D is wrong because rapid containment is not a distinct principle from speed.

Answer

Rapid containment

Answer

Chain of custody

Answer

Preservation of evidence

Question 14

A user reports that they cannot access a file server. The security policy requires that all access be logged and monitored. What is the most likely reason for the access failure?

Accepted Answer

The user's IP address is not in the allowed list. Option C is correct because the user's IP address might not be in the allowed list per policy. Options A, B, and D are plausible but less directly related to the policy requirement.

Answer

The user's account is locked

Answer

The file server is down

Answer

The user's password has expired

Question 15

A company's security policy requires that all firewall rule changes be approved through a change management process. An engineer notices an unauthorized rule that allows RDP from any external IP. What is the first step the engineer should take?

Accepted Answer

Remove the rule immediately and document the change after. Option A is correct because the rule represents an active threat, so immediate removal is justified as an emergency change, followed by documentation. Option B is wrong because waiting for approval delays protection. Option C is wrong because investigation can follow removal. Option D is wrong because blocking all RDP is too broad.

Answer

Wait for approval from the change management board

Answer

Investigate who added the rule

Answer

Block all RDP access to the network