View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 1

Which security principle ensures that users receive only the permissions required to perform their assigned tasks?

1. Defense in depth
2. Least privilege
3. Network segmentation
4. High availability

Correct Answer: 2

Explanation

The principle of least privilege ensures that users, applications, and systems receive only the permissions necessary to perform their intended functions. This reduces the potential impact of compromised accounts or unauthorized activity because an attacker cannot automatically access every resource available to a highly privileged account. Organizations commonly apply least privilege through role-based access control, access policies, and carefully assigned permissions. Defense in depth uses multiple security controls, network segmentation separates network environments, and high availability focuses on maintaining service availability. Therefore, least privilege is the principle that most directly limits unnecessary access rights.

Question 2

Which protocol is commonly used to securely transfer files between a client and server over an encrypted SSH connection?

1. TFTP
2. FTP
3. SCP
4. Telnet

Correct Answer: 3

Explanation

Secure Copy Protocol, or SCP, transfers files securely between systems using the SSH protocol. Because SSH provides encryption and secure authentication, SCP protects file contents and credentials while they are being transmitted across the network. TFTP does not provide encryption and is generally used for simple file transfers in controlled environments. Traditional FTP transfers data without providing the same level of encryption, while Telnet is designed for remote terminal access rather than secure file transfer. Therefore, SCP is the appropriate protocol when files need to be transferred securely through an SSH-based connection.

Question 3

Which type of malware encrypts a victim’s files and demands payment to restore access?

1. Ransomware
2. Spyware
3. Rootkit
4. Adware

Correct Answer: 1

Explanation

Ransomware is malware designed to deny access to data or systems, commonly by encrypting files and demanding payment from the victim. A successful ransomware attack can disrupt business operations and may affect availability of critical information. Spyware is primarily designed to monitor or collect information from users, rootkits are designed to conceal malicious activity and maintain privileged access, and adware primarily displays unwanted advertisements. Although ransomware can use several techniques during an attack, file encryption and an extortion demand are characteristic behaviors. Therefore, ransomware is the correct answer.

Question 4

Which security technology can inspect network traffic and automatically block malicious activity based on configured detection rules?

1. Hub
2. Proxy ARP
3. DHCP server
4. Intrusion Prevention System

Correct Answer: 4

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic for malicious or suspicious activity and can take preventive action when a threat is detected. Depending on its configuration, an IPS can drop malicious packets, block connections, or otherwise prevent identified attacks from reaching their destination. A hub simply forwards traffic, Proxy ARP allows a device to answer ARP requests on behalf of another device, and a DHCP server dynamically assigns network configuration parameters. Therefore, an IPS is the security technology specifically designed to inspect traffic and actively prevent detected malicious activity.

Question 5

Which hashing algorithm is generally considered unsuitable for modern password storage because of known security weaknesses?

1. SHA-256
2. MD5
3. bcrypt
4. scrypt

Correct Answer: 2

Explanation

MD5 is considered unsuitable for modern security-sensitive applications because practical collision attacks have demonstrated significant weaknesses in the algorithm. It is also a fast hashing algorithm, which makes it inappropriate by itself for protecting passwords against modern brute-force and password-cracking techniques. Modern password storage should use dedicated password-hashing algorithms such as bcrypt, scrypt, or Argon2, together with appropriate salts and configuration. SHA-256 is stronger than MD5 for general hashing purposes, although it is also not a password-specific hashing function. Therefore, MD5 is the correct answer.

Question 6

Which authentication method requires a user to provide two or more independent types of evidence to verify identity?

1. Multifactor authentication
2. Single sign-on
3. Password synchronization
4. Anonymous authentication

Correct Answer: 1

Explanation

Multifactor authentication, or MFA, requires users to provide authentication factors from multiple categories. Common categories include something the user knows, such as a password; something the user has, such as a security token or phone; and something the user is, such as a biometric characteristic. MFA improves account security because compromising one factor does not necessarily provide access to the account. Single sign-on allows access to multiple applications after one authentication event, while password synchronization manages password consistency. Anonymous authentication does not require normal identity verification. Therefore, MFA is the correct answer.

Question 7

Which network security device primarily controls traffic by allowing or denying connections according to configured rules?

1. DNS server
2. Firewall
3. NTP server
4. Syslog server

Correct Answer: 2

Explanation

A firewall controls network traffic according to configured security policies or rules. It can permit or deny traffic based on characteristics such as source and destination addresses, ports, protocols, interfaces, and connection state. Firewalls can be implemented as dedicated appliances, software applications, or integrated security features. A DNS server resolves domain names, an NTP server provides time synchronization, and a Syslog server collects log messages. Although these services contribute to network operations and security, they do not primarily enforce traffic-filtering policies. Therefore, a firewall is the correct device for controlling network connections.

Question 8

Which attack attempts to make a service unavailable by overwhelming it with a large volume of traffic or requests?

1. Phishing
2. Credential stuffing
3. Denial-of-Service attack
4. Privilege escalation

Correct Answer: 3

Explanation

A Denial-of-Service, or DoS, attack attempts to make a system, application, or network service unavailable to legitimate users. Attackers may accomplish this by consuming bandwidth, exhausting system resources, overwhelming application processes, or generating excessive requests. A distributed denial-of-service attack uses multiple systems to generate the attack traffic. Phishing attempts to deceive users into revealing information, credential stuffing uses previously compromised credentials against other services, and privilege escalation attempts to gain higher access rights. Therefore, a Denial-of-Service attack is the correct answer when availability is targeted through overwhelming traffic or requests.

Question 9

Which protocol is commonly used to securely manage a network device through a remote command-line interface?

1. SSH
2. HTTP
3. FTP
4. TFTP

Correct Answer: 1

Explanation

Secure Shell, or SSH, provides encrypted remote access to network devices and servers through a command-line interface. SSH protects authentication credentials and management traffic from being transmitted in plaintext. It is widely used by network administrators to securely configure and troubleshoot devices remotely. HTTP is primarily used for web communication, FTP is designed for file transfers, and TFTP provides a lightweight file transfer mechanism without strong security features. Therefore, SSH is the appropriate protocol for secure remote command-line management of network devices.

Question 10

Which security concept describes separating a network into smaller security zones to limit the movement of an attacker?

1. Data compression
2. Network segmentation
3. Load balancing
4. Port aggregation

Correct Answer: 2

Explanation

Network segmentation divides a larger network into separate logical or physical sections. Security policies can then be applied between these segments to restrict unnecessary communication. This approach can limit lateral movement if an attacker compromises one system because access to other network segments can be controlled. Segmentation may be implemented using VLANs, firewalls, access control policies, or other technologies. Data compression reduces the size of transmitted information, load balancing distributes workloads, and port aggregation combines network links. Therefore, network segmentation is the concept that helps restrict attacker movement between network areas.

Question 11

Which technology provides encrypted communication between a web browser and a web server?

1. HTTP
2. Telnet
3. HTTPS
4. TFTP

Correct Answer: 3

Explanation

HTTPS is the secure version of HTTP and uses Transport Layer Security, or TLS, to protect communication between a client and a web server. TLS provides encryption and helps protect the confidentiality and integrity of information transmitted during the session. HTTPS is commonly used for websites that handle authentication credentials, financial information, personal data, and other sensitive content. HTTP by itself does not provide encryption, while Telnet is an insecure remote-access protocol and TFTP is a lightweight file-transfer protocol. Therefore, HTTPS is the correct choice for encrypted web communication.

Question 12

Which type of social engineering attack attempts to deceive users by sending fraudulent messages that appear to come from a trusted organization?

1. Phishing
2. Port scanning
3. Packet fragmentation
4. ARP inspection

Correct Answer: 1

Explanation

Phishing is a social engineering technique in which attackers use deceptive emails, messages, websites, or other communications to persuade victims to reveal sensitive information or perform an unsafe action. Attackers commonly impersonate trusted organizations, coworkers, banks, or service providers. The objective may be to obtain passwords, financial information, authentication codes, or access to systems. Port scanning is used to identify network services, packet fragmentation concerns IP packet handling, and ARP inspection is a network security mechanism. Therefore, phishing is the attack type that relies on fraudulent communications impersonating trusted entities.

Question 13

Which security principle focuses on maintaining access to systems and data when hardware, software, or network components fail?

1. Confidentiality
2. Integrity
3. Availability
4. Nonrepudiation

Correct Answer: 3

Explanation

Availability means ensuring that authorized users can access systems, applications, and data when they are needed. Organizations improve availability through technologies and practices such as redundancy, backups, clustering, failover systems, load balancing, and disaster recovery. Confidentiality protects information from unauthorized disclosure, integrity protects information from unauthorized modification, and nonrepudiation provides evidence that an action or transaction occurred and can be attributed to a specific party. Therefore, availability is the security principle most directly concerned with maintaining access to resources despite failures or disruptions.

Question 14

Which Cisco security technology is designed to prevent unauthorized devices from connecting to a network by enforcing access policies at the network access layer?

1. Cisco Secure Network Analytics
2. Cisco Identity Services Engine
3. Cisco Secure Firewall
4. Cisco Secure Endpoint

Correct Answer: 2

Explanation

Cisco Identity Services Engine, or ISE, provides centralized identity-based access control for network environments. It can authenticate users and devices and apply access policies based on identity, device characteristics, location, posture, and other contextual information. Organizations can use ISE to control which devices are permitted to access network resources and what level of access they receive. Cisco Secure Firewall focuses on network traffic filtering, Secure Endpoint provides endpoint security capabilities, and Secure Network Analytics focuses on network visibility and threat detection. Therefore, Cisco ISE is the appropriate technology for identity-based network access control.

Question 15

Which type of attack attempts to discover valid usernames and passwords by trying many combinations automatically?

1. Brute-force attack
2. VLAN hopping
3. DNS poisoning
4. Man-in-the-middle attack

Correct Answer: 1

Explanation

A brute-force attack attempts to discover credentials by systematically trying many possible password combinations. Attackers may use automated tools to test large numbers of combinations against authentication systems. Strong passwords, account lockout policies, multifactor authentication, rate limiting, and monitoring can reduce the effectiveness of brute-force attempts. VLAN hopping targets network segmentation, DNS poisoning attempts to manipulate name-resolution information, and man-in-the-middle attacks involve intercepting or manipulating communications between parties. Therefore, a brute-force attack is the technique specifically associated with systematically trying numerous password combinations.

Question 16

Which security control is specifically designed to detect and remove malicious software from an endpoint?

1. Load balancer
2. Antivirus or antimalware software
3. DHCP relay
4. DNS forwarder

Correct Answer: 2

Explanation

Antivirus and antimalware software is designed to detect, quarantine, and remove malicious software from endpoint systems. Modern endpoint protection solutions can use signatures, behavioral analysis, machine learning, reputation information, and other detection techniques to identify threats. A load balancer distributes network or application traffic, DHCP relay forwards DHCP messages between network segments, and a DNS forwarder passes DNS queries to another DNS server. These technologies do not primarily provide malware detection and removal. Therefore, antivirus or antimalware software is the appropriate security control for protecting endpoints from malicious software.

Question 17

Which protocol is commonly used to synchronize clocks across networked devices?

1. LDAP
2. SNMP
3. NTP
4. SMTP

Correct Answer: 3

Explanation

Network Time Protocol, or NTP, is used to synchronize the clocks of computers and network devices across IP networks. Accurate time synchronization is important for security logging, event correlation, authentication systems, certificates, and troubleshooting. If devices have significantly different timestamps, security teams may have difficulty correlating events during an investigation. LDAP is commonly used for directory services, SNMP is used for network monitoring and management, and SMTP is used for email transmission. Therefore, NTP is the protocol specifically designed to synchronize time across networked devices.

Question 18

Which type of attack intercepts communication between two parties and may allow an attacker to read or modify the exchanged information?

1. Man-in-the-Middle attack
2. Ransomware
3. Password spraying
4. DoS attack

Correct Answer: 1

Explanation

A Man-in-the-Middle, or MitM, attack occurs when an attacker positions themselves between two communicating parties and intercepts their traffic. Depending on the circumstances, the attacker may read, modify, redirect, or inject information into the communication. Encryption, certificate validation, secure protocols, and appropriate network security controls can help reduce the risk. Ransomware targets data or system availability, password spraying attempts a small number of common passwords across many accounts, and DoS attacks primarily target service availability. Therefore, Man-in-the-Middle attack is the correct description of communication interception and manipulation.

Question 19

Which security assessment technique actively attempts to exploit vulnerabilities in a controlled environment to determine whether they can be compromised?

1. Log collection
2. Vulnerability scanning
3. Penetration testing
4. Configuration backup

Correct Answer: 3

Explanation

Penetration testing is an authorized security assessment in which testers actively attempt to exploit vulnerabilities to determine the real-world impact of identified weaknesses. It can help organizations validate security controls and understand how vulnerabilities could potentially be chained together during an attack. Vulnerability scanning primarily identifies potential weaknesses without necessarily exploiting them. Log collection gathers security and operational events, while configuration backups preserve device settings. Therefore, penetration testing is the assessment technique that actively attempts controlled exploitation of vulnerabilities.

Question 20

Which principle ensures that data has not been altered or corrupted without authorization?

1. Availability
2. Confidentiality
3. Authentication
4. Integrity

Correct Answer: 4

Explanation

Integrity ensures that data remains accurate, complete, and protected from unauthorized modification or corruption. Security mechanisms such as hashes, digital signatures, checksums, access controls, and file integrity monitoring can help detect or prevent unauthorized changes. Confidentiality protects information from unauthorized disclosure, availability ensures that authorized users can access resources, and authentication verifies the identity of a user or system. Therefore, integrity is the security principle that addresses whether data has remained unchanged and trustworthy from an unauthorized modification perspective.