hardMultiple Choice
200-201 Practice Question: A security policy states that all portable media…
A security policy states that all portable media must be encrypted. An employee loses a USB drive containing customer data. The drive was encrypted with AES-256. Which of the following is true regarding policy compliance?
⚠ Common exam trap
Cisco often tests the distinction between policy compliance and incident response obligations, trapping candidates who assume encryption alone eliminates the need to report a lost device.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy was followed, but the incident still needs to be reported per incident response procedures
The security policy mandates encryption for portable media, and AES-256 encryption was applied to the USB drive, so the policy was technically followed. However, the loss of a device containing customer data still triggers incident response procedures, as the encryption key or the possibility of decryption could be compromised, and reporting is required to assess risk and comply with breach notification laws.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy was followed, but the incident still needs to be reported per incident response procedures
Why this is correct
AES-256 encryption satisfies the portable media encryption requirement, so the policy itself was followed. Loss of the drive is still a security incident involving customer data, triggering mandatory reporting under incident response procedures regardless of encryption.
- ✗
The employee violated policy because the drive was lost
Why it's wrong here
The policy required encryption, and AES-256 was applied, so the employee complied; losing a drive is a separate incident, not a policy violation. It is tempting because loss feels like negligence, but the stated control concerns data-at-rest protection, not physical custody of the device.
- ✗
The policy was followed because the data was encrypted, so a breach is not reportable
Why it's wrong here
Encryption satisfies the media-handling policy, but losing customer data still triggers breach-notification obligations under GDPR and similar regimes; compliance with one control does not remove the incident-reporting requirement. It is tempting because AES-256 renders the data unreadable, so teams often assume no report is needed.
- ✗
Encryption is not sufficient, the employee should have used a different media
Why it's wrong here
The policy mandates encryption, which was implemented, so switching media type is not required by that control; the loss still needs reporting. It is tempting because removable media feels riskier than alternatives, but the stem's requirement is encryption, not media substitution.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.