200-201 Security Policies and Procedures — Timed 20 Questions

Question 1

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

Accepted Answer

Acceptable Use Policy violation. Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Answer

Remote Access Policy violation

Answer

Incident Response Policy violation

Answer

Data Classification Policy violation

Question 2

A company wants to ensure that employees report security incidents immediately. Which policy element is most important to include?

Accepted Answer

Define mandatory reporting procedures and contact information. Option C is correct because the core purpose of an incident response policy is to ensure timely reporting. Without mandatory reporting procedures and clear contact information, employees may delay or fail to report security incidents, increasing dwell time and potential damage. This directly supports the incident response lifecycle (NIST SP 800-61) by establishing a clear chain of communication for initial detection and reporting.

Answer

Specify encryption standards for data at rest

Answer

List acceptable uses of company resources

Answer

Require complex passwords for all accounts

Question 3

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Option C is correct because implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope

Question 4

A security policy states that user activity logs must be retained for at least one year. What is the primary purpose of this requirement?

Accepted Answer

To support forensic investigations of security incidents. The primary purpose of retaining user activity logs for at least one year is to support forensic investigations of security incidents. When a breach or policy violation occurs, security analysts need historical log data to reconstruct the timeline of events, identify the initial compromise vector, and determine the scope of damage. Without long-term retention, critical evidence may be overwritten or purged before an incident is discovered, making root cause analysis impossible.

Answer

To improve system performance through log analysis

Answer

To comply with regulatory requirements only

Answer

To enable real-time monitoring of user behavior

Question 5

A security analyst notices that an employee is accessing the corporate network from an unauthorized device. According to the security policy, which action should the analyst take first?

Accepted Answer

Disable the device's network access immediately. Option C is correct because the immediate priority when an unauthorized device is detected on the corporate network is to contain the threat by disabling network access. This aligns with the principle of least privilege and incident response procedures, where the first step is to stop the unauthorized access to prevent potential data breaches or malware propagation. The security policy typically mandates such immediate action to enforce access control, often implemented via 802.1X or MAC address filtering at the switch or NAC (Network Access Control) level.

Answer

Report the employee to human resources for disciplinary action

Answer

Ignore the incident because it is a minor violation

Answer

Update the security policy to allow personal devices

Question 6

A security policy requires that all changes to firewall rules be approved by two administrators. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement that two administrators must approve firewall rule changes enforces separation of duties, a security principle that prevents any single individual from having exclusive control over a critical operation. This reduces the risk of unauthorized or malicious rule modifications by ensuring collusion or independent review is required. In firewall management, this is often implemented via change management workflows with distinct approval and implementation roles.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 7

An organization's security policy states that all external connections must be authenticated using multi-factor authentication. Which type of policy is this?

Accepted Answer

Remote Access Policy. Option C is correct because a Remote Access Policy specifically governs how external users or devices connect to an internal network, and requiring multi-factor authentication (MFA) for all external connections is a standard control within this policy. This policy defines authentication methods, encryption standards (e.g., IPsec, TLS), and access controls for remote access, directly addressing the security policy's mandate for MFA on external connections.

Answer

Password Policy

Answer

Data Classification Policy

Answer

Acceptable Use Policy

Question 8

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy

Question 9

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines the boundaries of the policy's applicability. Option C is correct because explicitly listing the systems and networks covered ensures that all stakeholders understand which assets fall under the policy's requirements, preventing gaps or overlaps in security controls.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 10

Which THREE of the following are common elements of an incident response policy?

Accepted Answer

Procedures for containment and eradication. Option B is correct because containment and eradication are core phases of the NIST SP 800-61 incident response lifecycle. Containment limits the scope of the incident (e.g., isolating a compromised host via VLAN access control lists), while eradication removes the root cause (e.g., deleting malware, patching vulnerabilities). These procedures are explicitly documented in an incident response policy to ensure consistent, repeatable actions during a security event.

Answer

Data classification levels

Answer

Acceptable use of company resources

Question 11

Which TWO of the following are best practices for implementing a security policy?

Accepted Answer

Review and update the policy annually. Option D is correct because security policies must be living documents that adapt to evolving threats, regulatory changes (e.g., GDPR, PCI DSS), and organizational shifts. Annual reviews ensure the policy remains aligned with current risk posture and compliance requirements, as recommended by frameworks like NIST SP 800-53.

Answer

Use technical jargon to ensure precision

Answer

Avoid enforcement to promote user compliance

Answer

Write the policy once and never change it

Question 12

A security analyst reviews the firewall log. What is the most likely reason for the denied connection?

Accepted Answer

The access control list does not permit the traffic. The firewall log shows a denied connection, and the most likely reason is that the access control list (ACL) does not permit the traffic. Firewalls enforce security policies by evaluating traffic against ACL rules; if no rule explicitly allows the packet (based on source/destination IP, port, and protocol), the implicit deny at the end of the ACL drops the connection. This is the default behavior for stateful firewalls and is the most common cause of denied connections in logs.

Answer

The destination port is blocked by default

Answer

The source IP address is an external threat

Answer

The destination IP is a known malicious host

Question 13

A security auditor reviews the SNMP configuration. Which security concern should be reported?

Accepted Answer

The community strings are set to default values. Option C is correct because default SNMP community strings (e.g., 'public' for read-only, 'private' for read-write) are well-known and widely documented. An attacker who discovers these defaults can query or modify the device's MIB, leading to information disclosure or unauthorized configuration changes. This is a critical security concern that must be reported.

Answer

The location and contact information is exposed

Answer

SNMP is disabled on the router

Answer

The private community string is read-only

Question 14

You are a security analyst at a financial services company. The company's security policy mandates that all sensitive data must be encrypted at rest and in transit. A recent internal audit reveals that a database containing customer personally identifiable information (PII) is stored on a server that uses unencrypted storage volumes. The database is accessed by internal applications via unencrypted connections. The policy also requires quarterly vulnerability scans, and the latest scan shows that the server has a critical vulnerability in the database software. Additionally, the server's firewall rules permit inbound traffic from the entire corporate network to the database port. The company's incident response policy requires that any violation of data protection policies be escalated within 24 hours. The IT manager asks you to prioritize actions. What should you do first?

Accepted Answer

Apply the critical security patch to the database software. The most immediate threat is the critical vulnerability in the database software, which could allow remote code execution or data exfiltration without any authentication. Patching this vulnerability directly reduces the risk of exploitation, which is the highest priority in a security incident. Encryption and firewall restrictions are important but do not address an actively exploitable software flaw.

Answer

Enable encryption on the storage volumes and database connections

Answer

Escalate the violation to management within 24 hours

Answer

Restrict firewall access to only authorized application servers

Question 15

You are a security operations analyst for a medium-sized enterprise. The company's security policy requires that all endpoint devices have antivirus software installed and updated. During a routine check, you find that a group of 50 laptops used by the sales team have not received antivirus updates for over three months. The policy also states that any non-compliant devices must be quarantined from the network until they are remediated. The sales team manager argues that quarantining the laptops will disrupt critical sales activities. The company's incident response policy has a clause that allows for temporary exceptions in business-critical situations, but requires approval from the CISO. What is the best course of action?

Accepted Answer

Request a temporary exception from the CISO while expediting the updates. Option C is correct because it balances security policy compliance with business continuity. The incident response policy explicitly allows temporary exceptions for business-critical situations with CISO approval, and expediting the updates ensures the 50 laptops are remediated quickly. Quarantining without considering the business impact could violate the company's own exception clause, while ignoring the issue or updating without quarantining bypasses the security controls required by policy.

Answer

Ignore the issue to avoid disrupting sales activities

Answer

Quarantine the laptops immediately as per policy

Answer

Update the antivirus without quarantining, then report to management

Question 16

A company's security policy requires that all laptops accessing the corporate network must have full-disk encryption enabled. During a routine audit, an analyst discovers that a manager's laptop does not have encryption enabled. What is the most appropriate first step according to standard security incident response procedures?

Accepted Answer

Document the finding and escalate to the incident response team.. Option B is correct because the first step in standard incident response procedures (as defined by NIST SP 800-61 and Cisco's IR framework) is to document the finding and escalate to the incident response team. This ensures that the potential policy violation is formally recorded and that trained responders can assess the risk, determine if sensitive data was exposed, and coordinate remediation without prematurely destroying evidence or causing operational disruption.

Answer

Disconnect the laptop from the network immediately.

Answer

Install encryption software on the laptop without notifying the user.

Answer

Wipe the laptop and reinstall the operating system.

Question 17

A network administrator is implementing a new security policy that requires all employees to use multi-factor authentication (MFA) when accessing email from external networks. However, several employees report that they cannot receive SMS codes while traveling internationally. Which design change best balances security and usability?

Accepted Answer

Allow the use of authenticator apps that generate time-based one-time passwords (TOTP).. Option A is correct because TOTP authenticator apps (e.g., Google Authenticator, Microsoft Authenticator) generate one-time passwords locally on the user's device without requiring cellular network connectivity. This solves the international SMS delivery problem while maintaining strong MFA security, as the TOTP algorithm (RFC 6238) uses a shared secret and the current time to produce codes that are valid for a short window (typically 30 seconds).

Answer

Allow email access without MFA from trusted countries.

Answer

Provide hardware tokens to all traveling employees.

Answer

Disable MFA for users who travel frequently.

Question 18

A security analyst is reviewing a series of failed login attempts on a critical server. The logs show that the source IP addresses are from multiple geographic regions and the usernames tried are all valid employees. The attempts occur every 5 minutes for the past hour. According to the company's security policy, which type of attack is most likely occurring, and what is the best immediate response?

Accepted Answer

Password spraying; enforce multi-factor authentication immediately.. The attack pattern—valid usernames with low-frequency attempts from diverse IPs—is characteristic of password spraying, where an attacker tries a single common password against many accounts to avoid lockout thresholds. The best immediate response is to enforce multi-factor authentication (MFA), which renders the stolen or guessed password insufficient for access, mitigating the attack without relying on IP-based blocking that is ineffective against distributed sources.

Answer

Credential stuffing; implement rate limiting.

Answer

Brute-force attack; add the IPs to a blocklist.

Answer

Dictionary attack; reset all employee passwords.

Question 19

During a security audit, an analyst discovers that several employees have shared their login credentials with colleagues to expedite work. Which policy enforcement mechanism would be most effective in preventing this behavior?

Accepted Answer

Implement multi-factor authentication.. Multi-factor authentication (MFA) is the most effective enforcement mechanism because it requires a second factor (e.g., a one-time passcode from an authenticator app, a hardware token, or a biometric) in addition to the password. Even if employees share their passwords, MFA prevents unauthorized access because the second factor is tied to the individual's device or identity and cannot be easily shared. This directly addresses the root cause of credential sharing by making shared credentials useless without the additional factor.

Answer

Implement a password complexity policy.

Answer

Enforce a password change policy every 30 days.

Answer

Conduct annual security awareness training.

Question 20

A company's security policy states that all remote access must be through a VPN. An employee complains that the VPN is too slow and asks for an exception to access a specific internal server directly over the internet. What should the security analyst recommend?

Accepted Answer

Investigate the VPN performance issue and optimize if possible.. Option D is correct because the security policy mandates VPN for all remote access, and bypassing it would violate the principle of least privilege and expose the internal server directly to the internet. The analyst should first investigate the VPN performance issue—common causes include MTU mismatch, high latency, or encryption overhead—and optimize it (e.g., adjusting MTU, using split tunneling, or upgrading hardware) rather than granting an exception that undermines security.

Answer

Configure a separate VPN profile with lower encryption.

Answer

Allow direct access but only from the employee's home IP.

Answer

Grant the exception temporarily and monitor the connection.