200-201 Practice Test

200-201 Practice Test practice questions, page 6 of 19, with answer review and explanations.

Question 26

A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

  1. the intellectual property that was stolen
  2. the defense contractor who stored the intellectual property
  3. the method used to conduct the attack
  4. the foreign government that conducted the attack

Question 27

What is the practice of giving an employee access to only the resources needed to accomplish their job?

  1. principle of least privilege
  2. organizational separation
  3. separation of duties
  4. need to know principle

Question 28

Which metric is used to capture the level of access needed to launch a successful attack?

  1. privileges required
  2. user interaction
  3. attack complexity
  4. attack vector

Question 29

What is the difference between an attack vector and an attack surface?

  1. An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.
  2. An attack vector identifies components that can be exploited; and an attack surface identifies the potential path an attack can take to penetrate the network.
  3. An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.
  4. An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

Question 30

Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

  1. integrity
  2. confidentiality
  3. availability
  4. scope