View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 341

Which protocol is specifically designed to securely copy files between systems using SSH?

1. FTP
2. TFTP
3. HTTP
4. SCP

Correct Answer: 4

Explanation

Secure Copy Protocol (SCP) provides a secure method for transferring files between systems by using SSH. Because the transfer occurs through an encrypted SSH session, usernames, passwords, commands, and file contents can be protected from network interception. SCP is commonly used by network administrators to transfer configuration files, software images, logs, and other files between trusted systems. FTP does not encrypt traffic by default, TFTP provides basic file transfer without authentication or encryption, and HTTP is primarily designed for web communication. Therefore, SCP is the protocol specifically designed for secure file copying through SSH.

Question 342

Which security principle requires an organization to give users only the permissions needed to perform their assigned responsibilities?

1. Least privilege
2. Open access
3. Maximum privilege
4. Shared administration

Correct Answer: 1

Explanation

The principle of least privilege requires users, applications, and services to receive only the permissions necessary to perform their intended functions. Limiting privileges reduces the potential impact of compromised accounts, malicious insiders, and accidental actions. For example, a user who only needs to read a database should not automatically receive permission to modify or delete records. Administrative privileges should also be granted only when required. Open or excessive access increases security exposure. Therefore, least privilege is an important security principle for reducing unauthorized access and limiting the potential damage caused by compromised accounts.

Question 343

Which security feature can inspect ARP packets and compare their information against trusted DHCP snooping bindings?

1. Root Guard
2. BPDU Guard
3. Dynamic ARP Inspection
4. PortFast

Correct Answer: 3

Explanation

Dynamic ARP Inspection (DAI) protects networks against ARP spoofing by validating ARP packets before forwarding them. DAI can use the binding database created by DHCP snooping to verify whether an IP address and MAC address are legitimately associated with a particular switch port. Invalid or inconsistent ARP messages can then be dropped. Root Guard protects the Spanning Tree root role, BPDU Guard protects edge ports from unexpected BPDUs, and PortFast accelerates the transition of edge interfaces into the forwarding state. Therefore, Dynamic ARP Inspection is the security feature described.

Question 344

Which protocol is commonly used to securely synchronize time between network devices when authentication and encryption are required?

1. HTTP
2. NTP with authentication
3. FTP
4. Telnet

Correct Answer: 2

Explanation

Network Time Protocol (NTP) is used to synchronize clocks across network devices and systems. Accurate time is important for security because logs, authentication events, certificates, and incident investigations often depend on consistent timestamps. NTP can be configured with authentication mechanisms to help ensure that devices synchronize with trusted time sources. HTTP and FTP provide web and file-transfer functions, while Telnet provides unencrypted remote terminal access. Secure and consistent time synchronization helps security teams accurately correlate events across multiple systems. Therefore, authenticated NTP is the appropriate technology.

Question 345

Which security control can prevent unauthorized devices from communicating through a switch port based on their MAC addresses?

1. DNSSEC
2. RADIUS
3. NetFlow
4. Port security

Correct Answer: 4

Explanation

Port security allows a switch interface to restrict access based on MAC addresses. An administrator can configure specific secure MAC addresses or configure the switch to learn addresses according to a defined policy. The switch can then take an action if an unauthorized MAC address appears, such as dropping frames, generating a notification, or disabling the interface. DNSSEC protects DNS information, RADIUS provides centralized authentication, and NetFlow provides traffic-flow visibility. Therefore, port security is the appropriate control for restricting devices based on their MAC addresses.

Question 346

Which protocol is used to securely manage a network device through an encrypted command-line session?

1. SSH
2. Telnet
3. FTP
4. TFTP

Correct Answer: 1

Explanation

Secure Shell (SSH) provides encrypted remote command-line access to network devices, servers, and other systems. SSH protects authentication credentials and interactive session information against network interception when properly configured. Network administrators commonly use SSH instead of Telnet because Telnet sends information without encryption. FTP and TFTP are primarily file-transfer protocols rather than secure remote-administration protocols. SSH can also support secure file-transfer technologies such as SCP and SFTP. Therefore, SSH is the appropriate protocol for securely managing network devices through an encrypted command-line session.

Question 347

Which type of attack uses previously stolen usernames and passwords to attempt access to multiple online services?

1. Password spraying
2. Brute-force attack
3. Credential stuffing
4. Replay attack

Correct Answer: 3

Explanation

Credential stuffing uses previously stolen username-and-password combinations to attempt authentication against other services. Attackers rely on the fact that some users reuse passwords across multiple websites or applications. The attack does not necessarily require guessing passwords because the credentials were obtained from another source, such as a previous data breach. Password spraying tries a small number of common passwords across many accounts, while brute-force attacks systematically attempt many possible passwords. A replay attack attempts to reuse captured authentication information. Therefore, credential stuffing is the correct answer.

Question 348

Which security mechanism can help prevent a rogue DHCP server from providing malicious default gateways to network clients?

1. Port security
2. DHCP snooping
3. DNSSEC
4. IPsec

Correct Answer: 2

Explanation

DHCP snooping helps protect clients from rogue DHCP servers by allowing administrators to designate trusted and untrusted switch interfaces. DHCP server responses received on untrusted interfaces can be blocked. This prevents unauthorized devices from acting as DHCP servers and supplying clients with malicious IP configuration, including incorrect gateways or DNS servers. DHCP snooping can also build a binding table that supports additional controls such as Dynamic ARP Inspection and IP Source Guard. Port security focuses on MAC addresses, DNSSEC protects DNS data, and IPsec secures IP communications. Therefore, DHCP snooping is correct.

Question 349

Which security technology is designed to identify malicious traffic and automatically prevent the traffic from reaching protected systems?

1. IDS
2. IPS
3. Syslog
4. NetFlow

Correct Answer: 2

Explanation

An Intrusion Prevention System (IPS) monitors network traffic and can actively block traffic identified as malicious. It can use signatures, behavioral analysis, protocol inspection, and other detection methods to identify potential threats. An Intrusion Detection System primarily generates alerts when suspicious traffic is detected, whereas an IPS can take preventive action. Syslog is used for collecting and transporting log messages, while NetFlow provides information about network traffic flows. Therefore, IPS is the technology designed to detect malicious traffic and actively prevent it from reaching protected systems.

Question 350

Which technology provides centralized collection and correlation of security events from firewalls, servers, endpoints, and other systems?

1. NTP
2. DHCP
3. RADIUS
4. SIEM

Correct Answer: 4

Explanation

Security Information and Event Management (SIEM) systems collect logs and security events from many different sources and correlate them to identify suspicious patterns. Sources may include firewalls, authentication systems, servers, endpoint security products, applications, and network devices. Correlation can help security analysts identify relationships between events that might appear insignificant when viewed separately. SIEM platforms can also provide alerting, dashboards, investigation capabilities, and reporting. NTP synchronizes time, DHCP provides network configuration, and RADIUS provides centralized authentication. Therefore, SIEM is the technology described.

Question 351

Which attack involves intercepting communication between two parties while secretly relaying or modifying the exchanged information?

1. Man-in-the-middle attack
2. Password spraying
3. DHCP starvation
4. MAC flooding

Correct Answer: 1

Explanation

A man-in-the-middle attack occurs when an attacker positions themselves between two communicating parties and intercepts their traffic. Depending on the circumstances, the attacker may monitor, modify, or redirect information without either party realizing that communication has been intercepted. Strong encryption, certificate validation, secure protocols, and proper network security controls can help reduce this risk. Password spraying targets authentication systems, DHCP starvation attempts to exhaust address pools, and MAC flooding targets switch CAM tables. Therefore, the attack involving interception and possible modification of communication is a man-in-the-middle attack.

Question 352

Which security technology can help identify a compromised endpoint by analyzing processes, files, and network activity?

1. DHCP snooping
2. DNSSEC
3. EDR
4. Port security

Correct Answer: 3

Explanation

Endpoint Detection and Response (EDR) continuously monitors endpoint activity and collects telemetry related to processes, files, network connections, and other system events. Security teams can use this information to identify suspicious behavior and investigate potential compromises. EDR platforms may also provide response capabilities, including terminating malicious processes or isolating an affected endpoint. DHCP snooping protects against rogue DHCP servers, DNSSEC protects DNS integrity, and port security restricts switch-port access based on MAC addresses. Therefore, EDR is the security technology designed for detailed endpoint monitoring and response.

Question 353

Which security control is designed to identify unauthorized changes to critical operating-system files?

1. Network segmentation
2. Data encryption
3. File integrity monitoring
4. DNS filtering

Correct Answer: 3

Explanation

File Integrity Monitoring (FIM) detects changes to important files by comparing their current state with a trusted baseline. Cryptographic hashes can be used to determine whether a file has changed, because even a small modification can produce a different hash value. FIM can monitor operating-system files, application files, configuration files, and other sensitive resources. Network segmentation separates systems, encryption protects information from unauthorized disclosure, and DNS filtering controls access to selected domains. Therefore, file integrity monitoring is the security control specifically designed to detect unauthorized file changes.

Question 354

Which security practice helps organizations prioritize vulnerabilities based on their potential severity and risk?

1. Vulnerability management
2. Network address translation
3. Port forwarding
4. Load balancing

Correct Answer: 1

Explanation

Vulnerability management is an ongoing process used to identify, assess, prioritize, remediate, and monitor security weaknesses. Organizations can use information such as vulnerability severity, affected assets, exploit availability, business importance, and exposure to determine which vulnerabilities should receive attention first. Tools such as vulnerability scanners and scoring systems such as CVSS can support this process. NAT translates IP addresses, port forwarding directs traffic to particular services, and load balancing distributes traffic among servers. Therefore, vulnerability management is the security practice used to systematically prioritize and address security weaknesses.

Question 355

Which technology can enforce security policies by blocking traffic according to source and destination IP addresses, ports, and protocols?

1. SIEM
2. Firewall
3. NTP
4. NetFlow

Correct Answer: 2

Explanation

A network firewall controls traffic according to configured security policies. Depending on its capabilities, it can evaluate source and destination IP addresses, ports, protocols, connection states, applications, and other attributes. Administrators can use firewall rules to allow required communication and block unauthorized or suspicious traffic. SIEM systems collect and correlate security events, NTP synchronizes clocks, and NetFlow provides traffic-flow information. A firewall can therefore serve as a preventive control at network boundaries or between internal security zones. The correct answer is firewall.

Question 356

Which security approach requires users and devices to be continuously verified before access to protected resources is granted?

1. Open authentication
2. Flat networking
3. Zero Trust
4. Implicit trust

Correct Answer: 3

Explanation

Zero Trust is a security approach that avoids automatically trusting users or devices based solely on their network location. Access decisions can consider identity, device posture, resource sensitivity, authentication strength, and other contextual information. Verification may be performed repeatedly rather than assuming that successful initial authentication grants unrestricted access. This approach can reduce the impact of compromised credentials and infected endpoints by enforcing granular access policies. Open authentication and implicit trust provide fewer restrictions, while flat networking reduces segmentation. Therefore, Zero Trust is the approach described in the question.

Question 357

Which email-security mechanism allows a receiving mail server to verify that a message was authorized by the sending domain using a published public-key record?

1. SPF
2. DKIM
3. DMARC
4. SMTP

Correct Answer: 2

Explanation

DomainKeys Identified Mail (DKIM) uses cryptographic signatures to help verify that an email message is associated with the sending domain and that the signed content has not been improperly modified. The sender’s domain publishes a public key in DNS, while the sending mail system uses a corresponding private key to create the signature. The receiving server retrieves the public key and verifies the signature. SPF validates authorized sending servers based on IP information, DMARC defines policy and reporting around authentication results, and SMTP transports email. Therefore, DKIM is correct.

Question 358

Which email-security mechanism publishes a list of servers authorized to send email on behalf of a domain?

1. DKIM
2. DMARC
3. SPF
4. SFTP

Correct Answer: 3

Explanation

Sender Policy Framework (SPF) allows a domain owner to publish DNS records identifying the mail servers authorized to send messages on behalf of that domain. Receiving mail systems can check the sender’s source against the published SPF policy. SPF can help detect certain forms of sender-address spoofing, although it does not by itself provide message encryption or guarantee that the visible sender address has not been manipulated. DKIM uses digital signatures, DMARC defines handling and reporting policies, and SFTP provides secure file transfer. Therefore, SPF is the correct answer.

Question 359

Which security attack attempts to inject malicious commands or queries into a vulnerable web application’s database interaction?

1. Cross-site scripting
2. SQL injection
3. DNS poisoning
4. ARP spoofing

Correct Answer: 2

Explanation

SQL injection occurs when an attacker manipulates input sent to a vulnerable application so that unintended SQL commands or expressions are processed by the backend database. Successful SQL injection can potentially expose, modify, or delete database information and may have other consequences depending on application privileges. Secure coding practices, parameterized queries, input validation, and appropriate database permissions can reduce the risk. Cross-site scripting targets the execution of malicious scripts in a user’s browser, while DNS poisoning and ARP spoofing target network name-resolution and address-resolution mechanisms. Therefore, SQL injection is correct.

Question 360

Which incident-response phase focuses on restoring affected systems and services to normal operation after a security incident?

1. Recovery
2. Identification
3. Containment
4. Preparation

Correct Answer: 1

Explanation

Recovery is the incident-response phase focused on restoring affected systems, applications, and services to normal and secure operation after an incident. Recovery activities can include restoring data from trusted backups, rebuilding compromised systems, validating security controls, monitoring restored services, and returning systems to production. Identification involves detecting and analyzing the incident, while containment limits its spread and impact. Preparation occurs before an incident and establishes procedures, tools, and resources. Therefore, recovery is the phase that focuses on restoring normal operations after a security incident.