View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 301

Which protocol provides centralized authentication and authorization for network access while commonly using UDP ports 1812 and 1813?

1. RADIUS
2. TACACS+
3. LDAP
4. Kerberos

Correct Answer: 1

Explanation

RADIUS is a widely used AAA protocol that provides centralized authentication, authorization, and accounting services. It is commonly used for network access technologies such as wireless authentication, VPN access, and 802.1X. Modern RADIUS implementations commonly use UDP port 1812 for authentication and authorization and UDP port 1813 for accounting. RADIUS is different from TACACS+, which is commonly associated with administrative access to network devices and uses TCP. LDAP is primarily a directory-access protocol, while Kerberos provides ticket-based authentication. Therefore, RADIUS is the protocol described in this question.

Question 302

Which feature allows a network administrator to configure a switch port so that only a limited number of MAC addresses can use the port?

1. Dynamic ARP Inspection
2. Port security
3. DHCP snooping
4. Root Guard

Correct Answer: 2

Explanation

Port security allows administrators to control which MAC addresses can use a switch interface. A maximum number of secure MAC addresses can be configured, and addresses can be learned dynamically or assigned statically depending on the implementation. If a violation occurs, the switch can take actions such as dropping unauthorized traffic, generating notifications, or disabling the interface. Dynamic ARP Inspection focuses on validating ARP messages, DHCP snooping protects against unauthorized DHCP activity, and Root Guard protects the Spanning Tree topology. Therefore, port security is the appropriate feature for limiting the number of MAC addresses on a switch port.

Question 303

Which security control is specifically designed to detect and block malicious network traffic by actively inspecting packets?

1. IDS
2. Firewall logging
3. IPS
4. Syslog

Correct Answer: 3

Explanation

An Intrusion Prevention System (IPS) actively inspects network traffic and can automatically block or prevent traffic identified as malicious according to configured signatures, behavioral rules, or security policies. This distinguishes an IPS from a traditional intrusion detection system, which primarily detects and alerts without directly blocking the traffic. Firewall logging records events, while Syslog provides a mechanism for transmitting and collecting log messages. An IPS can therefore serve as an active security control positioned within or integrated into the network traffic path. The correct answer is IPS.

Question 304

Which type of access control uses characteristics such as department, location, device type, and time of day when making an authorization decision?

1. DAC
2. RBAC
3. MAC
4. ABAC

Correct Answer: 4

Explanation

Attribute-Based Access Control (ABAC) evaluates attributes associated with users, devices, resources, and environmental conditions when determining whether access should be permitted. Examples include a user’s department, device security status, geographic location, requested resource, and time of access. This allows organizations to create detailed policies that can adapt to different circumstances. Role-Based Access Control primarily uses predefined roles, while Discretionary Access Control relies on resource owners and Mandatory Access Control uses centrally defined classifications. Therefore, ABAC is the model that can combine multiple attributes in an authorization decision.

Question 305

Which security mechanism is designed to prevent unauthorized devices from connecting through a switch port by validating endpoint identity?

1. 802.1X
2. DNSSEC
3. IPsec
4. SPF

Correct Answer: 1

Explanation

IEEE 802.1X provides port-based network access control by requiring an endpoint to authenticate before receiving normal network access. The endpoint acts as the supplicant, the switch or wireless access point acts as the authenticator, and an authentication server such as RADIUS can validate the credentials. This prevents unauthorized endpoints from freely accessing protected network resources through a switch port. DNSSEC protects DNS integrity, IPsec secures IP communications, and SPF is an email-security mechanism. Therefore, 802.1X is the appropriate technology for controlling network access based on endpoint authentication.

Question 306

Which attack attempts to manipulate the DNS cache so that users are redirected to an attacker-controlled destination?

1. ARP spoofing
2. DNS cache poisoning
3. DHCP starvation
4. MAC flooding

Correct Answer: 2

Explanation

DNS cache poisoning occurs when an attacker causes false DNS information to be stored in a resolver’s cache. When users subsequently request the affected domain, the resolver may provide the malicious IP address instead of the legitimate one. This can redirect users to attacker-controlled websites that may attempt to steal credentials, deliver malware, or collect sensitive information. ARP spoofing targets IP-to-MAC mappings, DHCP starvation exhausts DHCP address pools, and MAC flooding targets switch CAM tables. DNSSEC can help reduce certain DNS manipulation risks by providing cryptographic validation of DNS data.

Question 307

Which security protocol is commonly used to protect management traffic between a network-management system and network devices?

1. SNMPv1
2. SNMPv2c
3. SNMPv3
4. Telnet

Correct Answer: 3

Explanation

SNMPv3 provides security features that are not available in the same way in earlier SNMP versions. It can provide authentication, integrity, and privacy for management communications. This makes SNMPv3 more appropriate for securely monitoring and managing network infrastructure across potentially untrusted networks. SNMPv1 and SNMPv2c commonly rely on community strings and do not provide the same level of built-in security. Telnet provides remote terminal access but transmits information without encryption. Therefore, SNMPv3 is the preferred choice among these options for securing network-management traffic.

Question 308

Which security feature helps prevent an unauthorized switch from becoming the Spanning Tree root by blocking superior BPDUs on a protected port?

1. Root Guard
2. BPDU Guard
3. DHCP snooping
4. Port security

Correct Answer: 1

Explanation

Root Guard helps protect the intended Spanning Tree topology by preventing a designated interface from accepting superior Bridge Protocol Data Units that could cause an unauthorized switch to become the root bridge. If superior BPDUs are received on a Root Guard-protected interface, the port can enter a root-inconsistent state until the superior information is removed. BPDU Guard has a different purpose: it protects edge ports from unexpected BPDUs and can place them into an error-disabled state. DHCP snooping protects DHCP operations, while port security controls MAC addresses. Therefore, Root Guard is correct.

Question 309

Which security technology can use endpoint information such as operating system, device type, and user identity to apply network-access policies?

1. NAT
2. Cisco ISE
3. NTP
4. FTP

Correct Answer: 2

Explanation

Cisco Identity Services Engine (ISE) can provide centralized identity and access-control capabilities for enterprise networks. It can use information about users and endpoints, including identity, device characteristics, authentication status, and posture information, to apply network-access policies. ISE can work with technologies such as 802.1X, MAB, RADIUS, and network-access control policies. NAT translates IP addresses, NTP synchronizes system clocks, and FTP transfers files. Therefore, Cisco ISE is the technology that can use endpoint and identity information to enforce network-access policies.

Question 310

Which security control provides multiple independent layers of protection so that failure of one control does not necessarily expose the entire environment?

1. Single sign-on
2. Defense in depth
3. Port forwarding
4. Data compression

Correct Answer: 2

Explanation

Defense in depth is a security strategy that uses multiple complementary security controls rather than relying on a single protection mechanism. For example, an organization might combine firewalls, network segmentation, endpoint security, multifactor authentication, intrusion prevention, monitoring, and backups. If one control fails or is bypassed, additional controls can still provide protection or limit the attacker’s progress. Single sign-on simplifies authentication, port forwarding modifies how connections are directed, and data compression reduces data size. Therefore, defense in depth describes the layered security approach in this question.

Question 311

Which technology can inspect encrypted TLS traffic after decrypting it for security analysis and then re-encrypt it before forwarding it?

1. TLS inspection
2. DHCP snooping
3. Port security
4. ARP inspection

Correct Answer: 1

Explanation

TLS inspection allows a security device to decrypt encrypted traffic so that it can inspect the contents for threats, policy violations, malware, or other suspicious activity. After inspection, the traffic can be re-encrypted and forwarded toward its destination. Without appropriate inspection, encrypted traffic can potentially conceal malicious content from traditional security controls. TLS inspection requires careful certificate management because the security device typically acts as an intermediary for the protected connection. DHCP snooping protects DHCP operations, port security restricts MAC addresses, and ARP inspection validates ARP traffic. Therefore, TLS inspection is correct.

Question 312

Which type of malware can independently replicate and spread from one system to another without requiring a user to execute an infected file?

1. Trojan
2. Spyware
3. Worm
4. Ransomware

Correct Answer: 3

Explanation

A worm is malware capable of self-propagation, allowing it to spread from one system to another without necessarily requiring a user to manually execute an infected file. Worms may exploit network vulnerabilities, weak credentials, or other weaknesses to reach additional systems. A Trojan typically disguises itself as legitimate software and relies on a user or administrator to execute it. Spyware focuses on secretly collecting information, while ransomware generally encrypts or locks data to demand payment. Therefore, the malware characterized by independent replication and network propagation is a worm.

Question 313

Which type of attack attempts to capture a valid authentication exchange and reuse the captured information later?

1. Replay attack
2. SQL injection
3. DDoS
4. Watering-hole attack

Correct Answer: 1

Explanation

A replay attack occurs when an attacker captures valid authentication information or communication and later retransmits it to attempt unauthorized access. If a protocol does not adequately protect against replay, an attacker may be able to reuse captured messages even without knowing the underlying secret. Security mechanisms such as timestamps, sequence numbers, nonces, and challenge-response authentication can help prevent replay attacks. SQL injection targets vulnerable database queries, DDoS attempts to overwhelm services with traffic, and watering-hole attacks compromise websites commonly visited by a target group. Therefore, replay attack is correct.

Question 314

Which vulnerability-management metric provides a standardized numerical assessment of the severity of a vulnerability?

1. CVE
2. CVSS
3. IOC
4. SIEM

Correct Answer: 2

Explanation

The Common Vulnerability Scoring System (CVSS) provides a standardized framework for assessing the severity of security vulnerabilities. CVSS scores consider factors such as exploitability and potential impact, helping organizations prioritize remediation activities. A CVE identifier is primarily used to identify a specific publicly known vulnerability, while an IOC is an indicator of compromise that can assist detection and investigation. SIEM is a security monitoring and event-correlation technology. Therefore, CVSS is the metric used to provide a standardized severity assessment of vulnerabilities.

Question 315

Which document defines acceptable employee behavior when using an organization’s information systems and network resources?

1. Disaster Recovery Plan
2. Incident Response Plan
3. Acceptable Use Policy
4. Business Continuity Plan

Correct Answer: 3

Explanation

An Acceptable Use Policy (AUP) defines how employees and other authorized users may use an organization’s information systems, networks, devices, and services. It can address activities such as prohibited software, inappropriate web usage, handling of company information, personal device use, and other security responsibilities. An Incident Response Plan describes how security incidents should be handled. A Disaster Recovery Plan focuses on restoring systems after disruptive events, while a Business Continuity Plan addresses maintaining critical operations. Therefore, the Acceptable Use Policy is the document that defines expected and prohibited user behavior.

Question 316

Which security practice ensures that an organization knows what hardware, software, and other technology resources exist in its environment?

1. Asset inventory
2. Data encryption
3. Network segmentation
4. Password rotation

Correct Answer: 1

Explanation

An asset inventory provides an organized record of hardware, software, network devices, applications, cloud resources, and other technology assets belonging to an organization. Maintaining an accurate inventory is important because security teams cannot effectively protect systems they do not know exist. Asset inventories can support vulnerability management, patching, risk assessment, incident response, and compliance activities. Data encryption protects information, network segmentation separates network environments, and password rotation changes authentication credentials. Therefore, maintaining an asset inventory is the security practice that ensures an organization has visibility into its technology resources.

Question 317

Which security mechanism can detect unauthorized changes to important files by comparing their current cryptographic hashes with previously recorded values?

1. NAT
2. File integrity monitoring
3. DHCP relay
4. Load balancing

Correct Answer: 2

Explanation

File Integrity Monitoring (FIM) detects unauthorized or unexpected changes to files by establishing a known baseline and comparing later file states against it. Cryptographic hashes can be used to identify changes because even a small modification to a file can produce a different hash value. FIM is commonly used to monitor sensitive system files, configuration files, application components, and other important resources. NAT translates addresses, DHCP relay forwards DHCP messages between network segments, and load balancing distributes traffic among systems. Therefore, file integrity monitoring is the appropriate security mechanism.

Question 318

Which network security architecture separates public-facing servers from the internal corporate network using firewall-controlled boundaries?

1. Open network
2. Flat network
3. DMZ architecture
4. Peer-to-peer network

Correct Answer: 3

Explanation

A DMZ architecture places public-facing services such as web, email, or DNS servers in a separate network segment from the internal corporate network. Firewalls can enforce security policies between the Internet, DMZ, and internal network. This separation limits the potential impact if a publicly accessible server becomes compromised because the attacker does not automatically gain direct access to internal systems. A flat network provides less segmentation, while open and peer-to-peer network models do not specifically provide the layered security boundaries described. Therefore, DMZ architecture is the correct answer.

Question 319

Which security principle requires access decisions to be continuously evaluated instead of assuming that previously authenticated users should always remain trusted?

1. Zero Trust
2. Network Address Translation
3. Port security
4. Static routing

Correct Answer: 1

Explanation

Zero Trust emphasizes continuous verification rather than granting permanent trust after an initial authentication event. Access decisions can consider identity, device security posture, resource sensitivity, context, and current policy requirements. A user or device that successfully authenticated earlier is not automatically considered trustworthy for every subsequent request. This approach can reduce the impact of stolen credentials and compromised endpoints by limiting access to only what is required. NAT translates addresses, port security controls switch interfaces, and static routing determines network paths. Therefore, Zero Trust is the security principle described.

Question 320

Which incident-response activity focuses on limiting the spread of an attack while allowing security teams time to investigate and remediate it?

1. Recovery
2. Eradication
3. Preparation
4. Containment

Correct Answer: 4

Explanation

Containment is the incident-response activity focused on limiting the scope and impact of an active security incident. Security teams may isolate compromised endpoints, block malicious network connections, disable compromised accounts, or segment affected systems to prevent further spread. The goal is to control the incident while preserving enough information for investigation and remediation. Eradication focuses on removing the threat and its causes, while recovery focuses on restoring normal operations. Preparation occurs before incidents and establishes procedures, tools, and resources. Therefore, containment is the correct phase for limiting the spread of an attack.