200-201 Security Policies and Procedures Practice Question
A security analyst is reviewing the organization's incident response plan and notices that it does not specify how to handle a situation where a zero-day vulnerability is exploited before a patch is available. The analyst wants to recommend a proactive measure that aligns with the NIST SP 800-61 revision 2 and the CyberOps Associate curriculum. Which of the following should the analyst recommend?
⚠ Common exam trap
The trap here is assuming that vulnerability scanning or signature-based firewalls can protect against zero-day exploits, when they are ineffective without known signatures or patches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop and maintain a playbook for zero-day incident response that includes isolation, monitoring, and temporary workarounds.
The correct recommendation is to develop a zero-day incident response playbook. NIST SP 800-61 emphasizes the importance of having specific procedures for incidents that do not have immediate fixes. A playbook outlines steps for containment, monitoring, and applying temporary mitigations, which are critical when a patch is unavailable. This proactive measure ensures the organization can respond effectively and minimize impact during a zero-day attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a next-generation firewall with signature-based detection to block all known exploits.
Why it's wrong here
Signature-based detection relies on known patterns, so it cannot block a zero-day exploit that has no existing signature. While a next-generation firewall may offer other protections like application control, it is not a proactive measure for unknown threats. The scenario specifically requires a measure for a zero-day before a patch is available, which signature-based tools cannot provide.
- ✗
Conduct regular vulnerability scans to identify and remediate all unpatched systems.
Why it's wrong here
Vulnerability scans can identify missing patches, but they cannot detect a zero-day vulnerability because there is no known signature or CVE. Moreover, the scenario states that a patch is not yet available, so remediation is not possible. Scanning is a good practice but does not address the immediate need for a response procedure when a zero-day is exploited.
- ✓
Develop and maintain a playbook for zero-day incident response that includes isolation, monitoring, and temporary workarounds.
Why this is correct
A zero-day playbook provides predefined steps for containment, such as network segmentation, increased monitoring, and applying vendor-provided mitigations or workarounds. This aligns with NIST SP 800-61's recommendation to have specific procedures for handling incidents when patches are unavailable. It ensures a coordinated and efficient response, reducing the time an attacker has to operate and limiting damage.
- ✗
Implement a bug bounty program to incentivize external researchers to report vulnerabilities.
Why it's wrong here
Bug bounty programs can help discover vulnerabilities, but they do not provide immediate protection when a zero-day is actively exploited. They are a long-term detection and disclosure strategy, not a real-time mitigation. The scenario requires a measure that can be applied during an active zero-day incident, so this option does not address the immediate need for containment and protection.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.