200-201 Security Concepts Practice Questions

Explanation: HIPAA (C) is a compliance framework because it is a U.S. federal law that mandates administrative, physical, and technical safeguards for protected health information (PHI), directly guiding how sensitive data must be protected. PCI DSS (D) is a compliance framework because it is a mandated standard from the payment card industry that prescribes specific controls—such as encryption, access control, and network segmentation—for organizations handling cardholder data. GDPR (E) is a compliance framework because it is an EU regulation that imposes legally enforceable data protection requirements, including lawful processing, data subject rights, and breach notification, on organizations processing personal data of EU residents. NIST Cybersecurity Framework (A) is a voluntary risk-management framework rather than a compliance framework, and ISO 27001 (B) is a voluntary international standard for information security management systems, so neither is a legally mandated compliance framework in this context.

Explanation: Digital signatures (B) are correct because they use the signer's private key to produce a value verifiable with the signer's public key, providing both integrity and non-repudiation since only the private-key holder could have signed. Hashing (C) is correct because a cryptographic hash (e.g., SHA-256) produces a fixed-length digest that detects any modification to the document, thereby ensuring data integrity. Asymmetric encryption (D) is correct because public/private key pairs enable secure key exchange and support the signature and verification processes that underpin non-repudiation and integrity. Steganography (A) merely hides data within other media and provides no integrity or non-repudiation guarantees, and symmetric encryption (E) uses a shared secret key that provides confidentiality but cannot prove origin or prevent either party from denying authorship, so neither belongs here.

Explanation: Option A (Exploit) is correct because the sequence of failed logins followed by a successful login from an unusual location is the signature of an attacker actively leveraging a weakness—such as weak credentials or brute-forced passwords—to gain unauthorized access, which is the definition of an exploit in action. Option C (Threat) is correct because the malicious actor or event attempting unauthorized access via credential guessing or compromised credentials represents a threat, i.e., any potential cause of an unwanted security incident. Option B (Non-repudiation) does not belong because it refers to assurance that a party cannot deny performing an action, typically achieved through digital signatures and audit trails, not to detecting or characterizing an intrusion attempt. Option D (Risk) does not belong because risk is the potential for loss or damage when a threat exploits a vulnerability, a broader calculated likelihood/impact measure rather than the specific adversarial activity observed. Option E (Vulnerability) does not belong because a vulnerability is the underlying weakness itself (e.g., a misconfiguration or unpatched service), whereas the scenario describes the active exploitation and the threat actor, not the mere existence of the flaw.

Explanation: Option C (GDPR) is correct because it is the EU regulation governing the protection of personal data, including customer payment information, imposing requirements on how organizations collect, store, and process such data. Option D (PCI DSS) is correct because it is the Payment Card Industry Data Security Standard, a framework specifically designed to protect cardholder data and payment information during storage, processing, and transmission. Option A (HIPAA) is incorrect because it applies to protected health information in the healthcare sector, not payment card data. Option B (ISO 27001) is incorrect because it is a general information security management standard, not a payment-specific compliance framework. Option E (NIST Cybersecurity Framework) is incorrect because it provides voluntary cybersecurity guidance rather than a compliance mandate specifically for payment information.

Explanation: Option B (Exploitation) is correct because the scenario explicitly states the attacker gained access by exploiting a known vulnerability, which is the kill chain phase where the malicious payload is executed against the target. Option D (Installation) is correct because after gaining access the attacker established a foothold on the server, allowing persistent presence and enabling the subsequent lateral movement. Option E (Actions on Objectives) is correct because the attacker moved laterally and exfiltrated data, which are the goal-oriented activities that define this final phase. Option A (Reconnaissance) is not evident since no information gathering or target research is described, and Option C (Weaponization) is not evident because no coupling of exploit with a deliverable payload (e.g., creating a malicious document or implant) is mentioned.