View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 201

Which protocol is commonly used to securely retrieve email messages from a mail server while keeping the connection encrypted?

1. POP3
2. IMAP over TLS
3. FTP
4. TFTP

Correct Answer: 2

Explanation

IMAP over TLS provides encrypted communication between an email client and an IMAP mail server. TLS helps protect authentication credentials and email content from interception while the connection is being established and used. IMAP is commonly used when users need to access and synchronize messages stored on a mail server across multiple devices. POP3 can also be secured with TLS, but plain POP3 does not inherently provide encryption. FTP and TFTP are file-transfer protocols rather than email retrieval protocols. Therefore, IMAP over TLS is the correct answer for securely retrieving email messages.

Question 202

Which email security technology allows a receiving mail server to verify that a message was sent from an authorized server for the sending domain?

1. DKIM
2. DMARC
3. SPF
4. SNMP

Correct Answer: 3

Explanation

Sender Policy Framework, or SPF, allows a domain owner to publish DNS records identifying the mail servers authorized to send email for that domain. Receiving mail systems can compare the sending server’s information against the domain’s SPF policy. This helps reduce certain types of email spoofing and improves the ability to identify unauthorized senders. DKIM uses cryptographic signatures to validate message integrity and domain association, while DMARC builds on mechanisms such as SPF and DKIM. SNMP is used for network management. Therefore, SPF is the correct answer.

Question 203

Which email security mechanism uses a cryptographic signature to help verify message integrity and the sending domain?

1. DKIM
2. SPF
3. DHCP
4. NAT

Correct Answer: 1

Explanation

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to outgoing email messages. The receiving mail server can retrieve the sender domain’s public key from DNS and use it to verify the signature. This helps determine whether the message was associated with the claimed domain and whether signed portions of the message were modified during transit. SPF instead evaluates whether the sending server is authorized, while DHCP provides IP configuration and NAT translates addresses. Therefore, DKIM is the email security mechanism that uses cryptographic signatures to help validate messages.

Question 204

Which email security standard allows a domain owner to specify how receiving servers should handle messages that fail SPF or DKIM checks?

1. SMTP
2. IMAP
3. POP3
4. DMARC

Correct Answer: 4

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows domain owners to publish policies describing how receiving mail systems should handle messages that fail authentication checks such as SPF or DKIM. A DMARC policy can instruct receiving systems to monitor, quarantine, or reject messages depending on the domain’s configuration. DMARC also supports reporting that can help domain owners understand email authentication activity. SMTP transports email, while IMAP and POP3 are used for retrieving messages. Therefore, DMARC is the correct standard for specifying handling policies for authentication failures.

Question 205

Which security control can restrict outbound network traffic so that compromised systems cannot freely communicate with external destinations?

1. Firewall egress filtering
2. Password hashing
3. Disk encryption
4. File compression

Correct Answer: 1

Explanation

Firewall egress filtering controls traffic leaving an organization’s network. By restricting outbound connections according to security policies, administrators can prevent systems from communicating with unauthorized destinations or services. Egress filtering can help limit command-and-control communication, unauthorized data transfers, and other malicious activity originating from compromised systems. Password hashing protects stored credentials, disk encryption protects data at rest, and file compression reduces file size. Properly configured outbound filtering should permit required business traffic while blocking unnecessary or suspicious communication. Therefore, firewall egress filtering is the appropriate security control.

Question 206

Which security method protects stored data on a laptop if the physical device is lost or stolen?

1. Network segmentation
2. Full-disk encryption
3. DNS filtering
4. Port security

Correct Answer: 2

Explanation

Full-disk encryption protects data stored on a device by encrypting the contents of the storage drive. If a laptop is lost or stolen, an unauthorized person who removes the drive or attempts to access its contents may not be able to read the protected data without the required authentication or encryption keys. Full-disk encryption is particularly important for mobile devices that may contain sensitive business or personal information. Network segmentation controls communication, DNS filtering controls domain access, and port security restricts switch ports. Therefore, full-disk encryption is the correct protection for stored laptop data.

Question 207

Which security technology can analyze network behavior to identify unusual communication patterns without inspecting the full content of every packet?

1. Secure Shell
2. DNSSEC
3. Network intrusion prevention
4. Network traffic analysis

Correct Answer: 4

Explanation

Network traffic analysis examines communication patterns and metadata to identify unusual or suspicious behavior. Information such as source and destination addresses, ports, protocols, traffic volume, timing, and connection frequency can reveal scanning, unexpected data transfers, command-and-control communication, or other anomalies. Network traffic analysis does not necessarily require inspection of the full payload of every packet. SSH provides secure remote administration, DNSSEC protects DNS integrity, and intrusion prevention focuses on detecting and blocking threats according to configured security mechanisms. Therefore, network traffic analysis is the appropriate technology.

Question 208

Which security control provides a record of who performed an administrative action on a network device?

1. Authentication
2. Authorization
3. Accounting
4. Encryption

Correct Answer: 3

Explanation

AAA accounting records information about user activity and administrative actions. In network environments, accounting can record events such as login times, commands executed, session duration, or other administrative activities depending on the system and configuration. This information can support auditing, incident investigations, and compliance requirements. Authentication verifies who the user is, while authorization determines what the user is allowed to do. Encryption protects information from unauthorized disclosure. Therefore, accounting is the AAA function responsible for recording user and administrative activity.

Question 209

Which attack attempts to exploit a previously unknown software vulnerability for which no official patch may yet be available?

1. Zero-day attack
2. Brute-force attack
3. Phishing attack
4. Password spraying

Correct Answer: 1

Explanation

A zero-day attack exploits a previously unknown or insufficiently addressed vulnerability. The term refers to the fact that defenders may have had little or no time to develop and deploy an effective patch before exploitation occurs. Zero-day vulnerabilities can therefore present significant challenges to security teams. Organizations can reduce exposure through defense in depth, application allowlisting, endpoint detection, network segmentation, monitoring, and rapid threat intelligence response. Brute-force attacks attempt repeated password guesses, phishing relies on deception, and password spraying uses common passwords across multiple accounts. Therefore, zero-day attack is correct.

Question 210

Which security practice involves comparing installed software versions against known vulnerabilities to determine whether systems require updates?

1. Data classification
2. Vulnerability assessment
3. Network Address Translation
4. Log rotation

Correct Answer: 2

Explanation

A vulnerability assessment identifies weaknesses in systems, applications, configurations, or software versions that could be exploited by attackers. Security teams can compare installed software against vulnerability databases and vendor advisories to determine whether updates or other mitigations are required. Vulnerability assessment helps organizations prioritize remediation based on factors such as severity, exposure, and business importance. Data classification organizes information according to sensitivity, NAT translates addresses, and log rotation manages stored log files. Therefore, vulnerability assessment is the practice used to identify systems affected by known vulnerabilities.

Question 211

Which security testing activity attempts to exploit vulnerabilities in an authorized environment to determine their real-world impact?

1. Penetration testing
2. Log collection
3. Asset inventory
4. Configuration backup

Correct Answer: 1

Explanation

Penetration testing is an authorized security assessment in which testers attempt to exploit vulnerabilities in systems, applications, or networks. The objective is to determine whether identified weaknesses can actually be exploited and to understand their potential impact. Penetration tests should be carefully scoped and authorized to avoid disrupting production systems or violating legal requirements. Log collection gathers event information, asset inventory identifies systems, and configuration backups preserve system settings. Therefore, penetration testing is the activity that attempts controlled exploitation of vulnerabilities.

Question 212

Which document defines an organization’s acceptable rules and requirements for using company information systems and resources?

1. Incident response plan
2. Disaster recovery plan
3. Acceptable Use Policy
4. Network topology diagram

Correct Answer: 3

Explanation

An Acceptable Use Policy, or AUP, defines how employees and other authorized users are permitted to use organizational systems, networks, devices, and information resources. It may address activities such as internet usage, software installation, password protection, data handling, and prohibited behavior. An incident response plan focuses on responding to security incidents, while a disaster recovery plan addresses restoration of systems after disruptive events. A network topology diagram describes network structure rather than user behavior. Therefore, an Acceptable Use Policy is the document that establishes acceptable rules for using organizational resources.

Question 213

Which security process identifies important systems, applications, and data so that an organization knows what assets it must protect?

1. Asset inventory
2. Packet filtering
3. Password rotation
4. Traffic encryption

Correct Answer: 1

Explanation

An asset inventory identifies and records systems, devices, applications, services, and information resources that belong to or are managed by an organization. Maintaining an accurate inventory is an important foundation for security because organizations cannot effectively protect assets they do not know exist. Asset information can also support vulnerability management, patching, incident response, and risk assessment. Packet filtering controls network traffic, password rotation changes credentials, and traffic encryption protects data in transit. Therefore, asset inventory is the process that establishes visibility into the resources an organization needs to protect.

Question 214

Which security principle requires an organization to identify potential threats and determine their possible impact before selecting security controls?

1. Risk assessment
2. Network Address Translation
3. File transfer
4. Port forwarding

Correct Answer: 4

Explanation

Risk assessment identifies potential threats and vulnerabilities and evaluates the possible impact and likelihood associated with them. Organizations can use the results to prioritize security controls and resources according to their specific risks. Risk assessment may consider assets, threats, vulnerabilities, business impact, existing controls, and potential consequences. NAT translates addresses, file transfer moves information between systems, and port forwarding directs traffic toward specified internal services. Therefore, risk assessment is the process used to understand potential risks before selecting appropriate security controls.

Question 215

Which security control can prevent users from executing unauthorized applications on managed endpoints?

1. Application allowlisting
2. DNS caching
3. Port mirroring
4. NTP synchronization

Correct Answer: 2

Explanation

Application allowlisting restricts software execution to applications that have been explicitly approved or identified as trusted. This can prevent unauthorized or unknown applications from running on managed endpoints and can reduce the risk associated with malware or unapproved software. Depending on the implementation, allowlisting may use application hashes, certificates, paths, publishers, or other identification methods. DNS caching stores domain-resolution information, port mirroring copies network traffic for analysis, and NTP synchronizes system clocks. Therefore, application allowlisting is the security control designed to restrict application execution.

Question 216

Which security architecture places publicly accessible servers in a separate network segment from internal corporate systems?

1. Flat network
2. Workgroup network
3. DMZ
4. Peer-to-peer network

Correct Answer: 3

Explanation

A Demilitarized Zone, or DMZ, is a separate network segment commonly used to host services that must be accessible from less-trusted networks, such as the public Internet. Examples include public web servers, mail gateways, and DNS servers. Placing these systems in a DMZ creates a security boundary between publicly accessible services and sensitive internal resources. A flat network provides little segmentation, while workgroup and peer-to-peer networks describe other network arrangements rather than this specific security architecture. Therefore, a DMZ is the appropriate architecture for separating public-facing servers from internal systems.

Question 217

Which security measure can help prevent attackers from using a compromised administrator account to access every system in an organization?

1. Least privilege and administrative segmentation
2. Open network access
3. Shared administrator passwords
4. Unrestricted remote access

Correct Answer: 4

Explanation

Least privilege and administrative segmentation can limit the damage caused by a compromised administrator account. Administrators should receive only the permissions required for their responsibilities, and privileged access can be separated by systems, roles, or security zones. This reduces the possibility that one compromised account can provide unrestricted access throughout an environment. Shared administrator passwords, unrestricted remote access, and broad network access increase the potential impact of credential compromise. Therefore, applying least privilege together with administrative segmentation helps reduce the scope of unauthorized access after an administrator account is compromised.

Question 218

Which IPv6 security feature helps prevent unauthorized devices from sending false Router Advertisement messages?

1. DHCP snooping
2. RA Guard
3. Port security
4. DNSSEC

Correct Answer: 2

Explanation

Router Advertisement Guard, commonly called RA Guard, helps protect IPv6 networks against unauthorized or malicious Router Advertisement messages. Attackers may attempt to send fraudulent advertisements to influence how IPv6 hosts configure their network settings. RA Guard can be implemented on switches to identify and block unauthorized Router Advertisement traffic on access ports. DHCP snooping addresses certain DHCP-related attacks, port security restricts MAC addresses, and DNSSEC protects DNS information. Therefore, RA Guard is the appropriate IPv6 security feature for preventing unauthorized Router Advertisement messages.

Question 219

Which attack attempts to exhaust the available addresses in a DHCP scope by sending a large number of fake DHCP requests?

1. DNS poisoning
2. ARP spoofing
3. DHCP starvation
4. VLAN hopping

Correct Answer: 3

Explanation

DHCP starvation occurs when an attacker sends numerous DHCP requests, often using spoofed MAC addresses, to consume the available addresses in a DHCP server’s address pool. Legitimate clients may then be unable to obtain an IP address. DHCP snooping can help defend against certain DHCP attacks by monitoring DHCP messages and enforcing trusted ports. DNS poisoning manipulates DNS information, ARP spoofing targets local address-resolution mappings, and VLAN hopping attempts to gain unauthorized access to VLAN traffic. Therefore, DHCP starvation is the attack described in the question.

Question 220

Which security mechanism can prevent an attacker from sending forged ARP messages that associate their MAC address with another host’s IP address?

1. DHCP relay
2. DNS filtering
3. IPsec
4. Dynamic ARP Inspection

Correct Answer: 4

Explanation

Dynamic ARP Inspection, or DAI, helps protect IPv4 networks against ARP spoofing and poisoning attacks. It validates ARP messages against trusted IP-to-MAC address information, often learned through DHCP snooping. If an ARP packet contains an invalid binding, the switch can drop it. This helps prevent attackers from falsely associating their MAC address with another device’s IP address and potentially intercepting traffic. DHCP relay forwards DHCP messages, DNS filtering controls domain access, and IPsec protects IP communications. Therefore, Dynamic ARP Inspection is the correct security mechanism.