200-201 Security Policies and Procedures Practice Test 9 — 15 Questions

Question 1

An organization is developing a new cloud-based application. The security policy requires that all data be encrypted in transit and at rest. Which combination of controls meets this requirement?

Accepted Answer

Use HTTPS and encrypt the database with TDE. Option D is correct because HTTPS encrypts data in transit and TDE encrypts data at rest. Option A is wrong because HTTPS alone does not encrypt data at rest. Option B is wrong because database encryption alone does not encrypt in transit. Option C is wrong because VPN encrypts in transit but not at rest.

Answer

Use a VPN for all connections

Answer

Encrypt the database using Transparent Data Encryption (TDE)

Answer

Use HTTPS for all communication

Question 2

A security policy requires that employees use strong passwords. Which TWO of the following are characteristics of a strong password? (Select two.)

Accepted Answer

Uses a mix of uppercase, lowercase, numbers, and special characters. Options A and C are correct because password length and complexity increase strength. Option B is wrong because including the username weakens the password. Option D is wrong because dictionary words are easily guessed. Option E is about password age, not strength.

Answer

Is changed every 90 days

Answer

Is a common dictionary word

Answer

Contains the user's username

Question 3

An incident response plan includes steps to contain a ransomware outbreak. Which TWO actions are typically performed during the containment phase? (Select two.)

Accepted Answer

Disconnect infected systems from the network. Options A and D are correct containment actions: disconnecting infected systems and quarantining malware. Option B is recovery, not containment. Option C is analysis. Option E is a post-incident action.

Answer

Notify law enforcement

Answer

Identify the initial infection vector

Answer

Restore data from backups

Question 4

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Options A, B, and D are correct hardening practices. Option C is wrong as default credentials are weak. Option E is wrong because Telnet is insecure.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 5

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Accepted Answer

HTTP and HTTPS traffic only. Option A is correct because the ACL permits TCP traffic from 10.0.0.0/8 to any destination on ports 80 (HTTP) and 443 (HTTPS). Option B is wrong because only these two ports are permitted. Option C is wrong because it permits only HTTP and HTTPS. Option D is wrong because both HTTP and HTTPS are allowed.

Answer

All TCP traffic

Answer

All IP traffic from 10.0.0.0/8

Answer

Only HTTP traffic

Question 6

GreenTech Inc. is a mid-sized company with 500 employees. The company uses Microsoft Exchange Online for email and has implemented a security policy that requires all employees to report suspicious emails to the security team. The security team uses a phishing simulation tool to train employees. In the past month, several employees have reported receiving emails that appear to be from the CEO requesting urgent wire transfers. The security team has blocked the sender domains and updated the email filters. However, one employee fell for the latest scam and transferred $50,000 to an account before reporting it. The security incident response plan states that any monetary loss must be reported to the board within 24 hours. The security analyst receives the report on Monday morning. What should the analyst do first based on the policy and best practices?

Accepted Answer

Immediately contact the bank to attempt to reverse the wire transfer. Option A is correct because time is critical; attempting to reverse the transfer may recover the funds. Option B is delayed and may miss the reversal window. Option C is secondary. Option D is overly disruptive.

Answer

Disable email access for all employees to prevent further attacks

Answer

Launch a full forensic investigation to identify the source

Answer

Notify the board within the 24-hour window as per policy

Question 7

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

Accepted Answer

Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process. Option C is correct because creating a forensic copy with hashing preserves integrity and chain of custody. Option A lacks chain of custody. Option B is overkill for log files. Option D does not preserve integrity.

Answer

Export the logs to a CSV file and email them to the security team

Answer

Use a write-blocker to create a forensic image of the entire hard drive

Answer

Copy the audit logs to a USB drive and store it in a locked drawer

Question 8

A security analyst at a medium-sized enterprise notices that an employee's workstation has been sending outbound traffic to a known malicious IP address at irregular intervals. The analyst runs a scan and finds no malware signatures. What should the analyst do next?

Accepted Answer

Escalate to the incident response team for further investigation.. Option C is correct because the situation suggests a potential advanced threat that requires specialized team. Disconnecting prematurely might destroy evidence. Blocking IP alone does not address the root cause. Reviewing history is part of investigation but escalation is the best next step.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Review the employee's recent web browsing history and email attachments.

Answer

Immediately disconnect the workstation from the network and reimage it.

Question 9

A company is implementing a security policy that requires all employees to use multi-factor authentication (MFA) when accessing corporate resources remotely. However, during a recent security audit, it was found that several employees have been using app passwords for legacy applications that do not support MFA. What is the best practice under this policy?

Accepted Answer

Create a separate policy for legacy applications with compensating controls.. Option C is correct because a separate policy with compensating controls (like network segmentation, monitoring) is appropriate. App passwords are not true MFA and can bypass security. Discontinuing legacy apps is too disruptive, allowing app passwords violates the policy, and VPN does not address the MFA requirement.

Answer

Allow app passwords as they provide a second factor.

Answer

Implement a VPN requirement for legacy application access.

Answer

Discontinue use of legacy applications until they support MFA.

Question 10

A network administrator is tasked with creating a security policy for handling sensitive data. Which of the following is the most critical element to include?

Accepted Answer

Data classification and handling procedures.. Data classification and handling procedures are fundamental to any data security policy. Topology, antivirus, and contacts are supporting but not the most critical.

Answer

Detailed network topology diagrams.

Answer

List of antivirus software versions.

Answer

Vendor contact information.

Question 11

A security policy mandates that all network devices must have logging enabled and that logs must be reviewed regularly. Which TWO practices are essential for effective log review?

Accepted Answer

Aggregating logs from all devices into a central server.. Automated log analysis (A) and central aggregation (E) are essential for effective and efficient log review. Retention (B) and format (C) are supporting but not core to review process. Reactive review (D) is not effective.

Answer

Reviewing logs only when an incident occurs.

Answer

Storing logs for at least one year.

Answer

Ensuring logs are in a common format like Syslog.

Question 12

A security analyst is creating a procedure for responding to a phishing email reported by a user. Which TWO steps should be included?

Accepted Answer

Immediately block the sender's email address at the gateway.. Blocking the sender (B) and investigating if others received similar emails (D) are standard initial steps. Forwarding original email (A) may alter headers; deleting remotely (C) is not always possible or needed; password change (E) is premature without evidence of compromise.

Answer

Delete the email from the user's inbox remotely.

Answer

Ask the user to forward the original email to the security team.

Answer

Require the user to change their password.

Question 13

A company's security policy requires that all changes to firewall rules must be approved by the change advisory board (CAB). Which THREE of the following are valid reasons to bypass this process?

Accepted Answer

Troubleshooting a network connectivity issue causing downtime.. Emergency fixes for critical vulnerabilities (A), connectivity issues causing downtime (C), and pre-approved penetration tests (D) are common exceptions. Planned additions (B) and removals (E) should follow standard change management.

Answer

Removing a rule for a decommissioned application during maintenance.

Answer

Adding a new server to the DMZ for a planned project.

Question 14

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

Accepted Answer

Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.. Option B is correct because reporting the violation and monitoring the laptop until encryption can be applied is a balanced approach. Option A violates policy by making changes without approval; Option C overreacts without evidence of breach; Option D ignores policy entirely.

Answer

Accept the executive's explanation and document it as an informal exception.

Answer

Escalate to the incident response team to treat this as a data breach because data may have been exposed.

Answer

Immediately re-enable encryption on the laptop and submit an exception request after the fact.

Question 15

You are the cybersecurity analyst for a small business that has a security policy requiring all network traffic to pass through a proxy server for content filtering. Recently, employees have been complaining that some websites are not loading correctly. You check the proxy logs and see that the proxy is blocking traffic that appears to be from non-standard ports. However, upon investigation, you find that the blocked sites are legitimate business tools that use custom ports. Which action aligns with the security policy?

Accepted Answer

Create a security exception based on business need and document it.. Option C is correct because creating a documented exception addresses the legitimate need while maintaining policy control. Option A bypasses policy by allowing all traffic on custom ports; Option B disables content filtering entirely; Option D may not be feasible.

Answer

Instruct employees to access the tools via HTTP instead.

Answer

Configure the proxy to allow all traffic on custom ports for those specific tools.

Answer

Disable content filtering for the affected employees.