View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 361

Which security control provides a centralized method for collecting authentication logs and tracking user access activity?

1. RADIUS accounting
2. DNSSEC
3. Port security
4. DHCP snooping

Correct Answer: 1

Explanation

RADIUS accounting provides a centralized mechanism for recording information about user network-access sessions. It can record details such as when a user connects, when the session ends, and other attributes associated with network access. This information can support auditing, troubleshooting, security investigations, and usage monitoring. Authentication determines whether a user is allowed to access the network, while accounting records information about the resulting activity. DNSSEC protects DNS information, port security controls switch interfaces, and DHCP snooping protects DHCP operations. Therefore, RADIUS accounting is the appropriate technology for centralized tracking of network-access activity.

Question 362

Which security technology can enforce access policies based on a user’s identity and the security posture of the endpoint?

1. NAT
2. Cisco ISE
3. NTP
4. FTP

Correct Answer: 2

Explanation

Cisco Identity Services Engine (ISE) provides identity-based access control and can evaluate information about users and endpoints when making network-access decisions. It can work with technologies such as 802.1X, MAB, RADIUS, endpoint profiling, and posture assessment. Policies can consider factors such as user identity, device type, authentication status, and security posture. NAT translates addresses, NTP synchronizes clocks, and FTP transfers files. Cisco ISE therefore provides the centralized identity and policy capabilities described in the question.

Question 363

Which attack attempts to exhaust the resources of a server or network service by sending a large number of requests from many compromised systems?

1. Brute-force attack
2. SQL injection
3. Distributed denial-of-service attack
4. Credential stuffing

Correct Answer: 3

Explanation

A Distributed Denial-of-Service (DDoS) attack attempts to overwhelm a target using traffic or requests generated from multiple compromised or otherwise distributed systems. The objective is to consume resources such as bandwidth, CPU, memory, or connection capacity so legitimate users cannot access the service normally. A brute-force attack attempts to guess credentials, SQL injection targets vulnerable database queries, and credential stuffing uses previously stolen credentials. Organizations can use traffic filtering, rate limiting, specialized mitigation services, and other controls to reduce DDoS impact. Therefore, DDoS is correct.

Question 364

Which security mechanism can provide evidence that a message was signed by a particular private key and has not been modified?

1. NAT
2. Digital signature
3. VLAN
4. DHCP

Correct Answer: 2

Explanation

A digital signature provides cryptographic evidence that data was signed using a particular private key and can help verify that the signed information has not been modified. The sender uses a private key to create the signature, while the recipient uses the corresponding public key to verify it. Digital signatures support integrity and authentication and can contribute to nonrepudiation depending on the implementation and legal context. NAT translates addresses, VLANs provide network segmentation, and DHCP supplies network configuration. Therefore, a digital signature is the appropriate security mechanism.

Question 365

Which security control helps limit communication between different network security zones according to defined policies?

1. Firewall
2. File hashing
3. Password manager
4. NTP

Correct Answer: 1

Explanation

A firewall can control communication between different network security zones according to configured policies. Organizations can use firewalls to separate internal networks, guest networks, server networks, DMZs, management networks, and external networks. Rules can allow required traffic while blocking unauthorized connections. This segmentation can reduce the ability of an attacker to move laterally after compromising one system. File hashing is used to identify data changes, password managers securely store credentials, and NTP synchronizes clocks. Therefore, a firewall is the security control that can enforce communication policies between network zones.

Question 366

Which type of malware disguises itself as legitimate software to trick a user into installing or executing it?

1. Worm
2. Rootkit
3. Trojan horse
4. Ransomware

Correct Answer: 3

Explanation

A Trojan horse is malware that disguises itself as legitimate or useful software to persuade a victim to install or execute it. Once executed, the malicious program may steal information, provide unauthorized access, install additional malware, or perform other harmful activities. Unlike a worm, a Trojan does not primarily depend on self-propagation. Rootkits focus on hiding malicious activity and maintaining access, while ransomware generally attempts to encrypt or otherwise restrict access to data. Therefore, Trojan horse is the correct malware category described in the question.

Question 367

Which technology allows administrators to identify the operating system and device type of endpoints connecting to a network?

1. NetFlow
2. Cisco ISE profiling
3. DNSSEC
4. SNMPv1

Correct Answer: 2

Explanation

Cisco ISE profiling can identify characteristics of endpoints connected to a network and use those characteristics in access-control policies. Profiling can help distinguish devices such as computers, smartphones, printers, IP phones, cameras, and other endpoint types. Information gathered from network activity and other available attributes can support policy decisions. NetFlow provides information about traffic flows, DNSSEC protects DNS data, and SNMPv1 is an older network-management protocol. Therefore, Cisco ISE profiling is the technology most directly associated with identifying endpoint characteristics for access-control purposes.

Question 368

Which security practice helps ensure that security logs from different systems can be accurately correlated by using consistent timestamps?

1. Network segmentation
2. Data encryption
3. Time synchronization
4. Port security

Correct Answer: 3

Explanation

Time synchronization ensures that systems and network devices maintain consistent and accurate clocks. This is important for security monitoring because analysts often need to correlate events occurring across multiple systems. If devices have significantly different timestamps, it can become difficult to establish the correct sequence of events during an investigation. NTP is commonly used to synchronize system clocks with trusted time sources. Network segmentation separates networks, encryption protects information, and port security controls switch interfaces. Therefore, time synchronization is essential for accurate correlation of security logs.

Question 369

Which security architecture places public-facing servers in a dedicated network segment isolated from the internal network?

1. DMZ
2. Flat network
3. Peer-to-peer network
4. Open LAN

Correct Answer: 1

Explanation

A Demilitarized Zone (DMZ) is a dedicated network segment commonly used to host public-facing services such as web, DNS, mail, or other externally accessible servers. Firewalls can control communication between the Internet, DMZ, and internal network. This architecture provides an additional security boundary so that compromise of a public-facing server does not automatically provide unrestricted access to internal systems. A flat network provides little segmentation, while peer-to-peer and open LAN designs do not specifically provide the security architecture described. Therefore, a DMZ is correct.

Question 370

Which security technique attempts to determine whether a system contains exploitable vulnerabilities by actively testing the system?

1. Asset inventory
2. Penetration testing
3. Log collection
4. Backup verification

Correct Answer: 2

Explanation

Penetration testing is an authorized security assessment in which testers actively attempt to exploit vulnerabilities in systems, applications, networks, or other resources. The objective is to determine whether identified weaknesses can actually be exploited and to understand their potential impact. Vulnerability scanning can identify potential weaknesses but generally does not attempt exploitation in the same manner as penetration testing. Asset inventory identifies resources, log collection gathers events, and backup verification confirms that backups can be restored. Therefore, penetration testing is the correct answer.

Question 371

Which security feature can prevent an edge switch port from participating in Spanning Tree after receiving an unexpected BPDU?

1. BPDU Guard
2. Root Guard
3. DHCP snooping
4. IP Source Guard

Correct Answer: 1

Explanation

BPDU Guard protects edge ports by responding when unexpected Bridge Protocol Data Units are received. If a BPDU arrives on a port where BPDUs are not expected, BPDU Guard can place the interface into an error-disabled state. This helps prevent unauthorized switches from influencing the Spanning Tree topology through ports intended for end devices. Root Guard has a different purpose and prevents a port from accepting superior BPDUs that could change the root bridge. DHCP snooping protects DHCP operations, while IP Source Guard helps prevent IP address spoofing. Therefore, BPDU Guard is correct.

Question 372

Which security feature helps prevent an unauthorized switch from becoming the root bridge in a Spanning Tree topology?

1. PortFast
2. Root Guard
3. DHCP snooping
4. File Integrity Monitoring

Correct Answer: 2

Explanation

Root Guard helps protect the intended Spanning Tree topology by preventing a protected interface from accepting superior BPDUs that could cause another switch to become the root bridge. If superior BPDUs are received, the interface can enter a root-inconsistent state until the unexpected information is removed. PortFast accelerates the forwarding transition of edge ports but does not protect the root role. DHCP snooping protects DHCP traffic, while File Integrity Monitoring detects changes to files. Therefore, Root Guard is the appropriate security feature.

Question 373

Which security mechanism protects sensitive information by transforming readable data into ciphertext using an encryption algorithm?

1. Hashing
2. Digital signature
3. Encryption
4. Tokenization

Correct Answer: 3

Explanation

Encryption transforms readable plaintext into ciphertext using a cryptographic algorithm and key. Authorized parties with the appropriate key can decrypt the ciphertext and recover the original information. Encryption is commonly used to protect data at rest and data in transit. Hashing creates a one-way digest rather than reversible ciphertext, while digital signatures provide authentication and integrity capabilities. Tokenization replaces sensitive values with tokens that represent the original data without directly exposing it. Therefore, encryption is the mechanism that transforms readable information into ciphertext for confidentiality.

Question 374

Which attack attempts to take control of an already authenticated user’s active session?

1. Session hijacking
2. DNS poisoning
3. DHCP starvation
4. MAC flooding

Correct Answer: 1

Explanation

Session hijacking occurs when an attacker obtains or otherwise takes control of a valid authenticated session. Instead of needing to authenticate normally, the attacker may attempt to use a stolen session token, cookie, or other session identifier to impersonate the legitimate user. Strong session management, HTTPS, secure cookies, multifactor authentication, and appropriate session expiration policies can help reduce the risk. DNS poisoning manipulates DNS information, DHCP starvation exhausts address pools, and MAC flooding targets switch CAM tables. Therefore, session hijacking is the correct attack.

Question 375

Which security protocol provides encryption and authentication for IP traffic and is commonly used to create VPN tunnels?

1. SMTP
2. IPsec
3. SNMP
4. DHCP

Correct Answer: 2

Explanation

IPsec is a collection of protocols and standards used to secure IP communications. It can provide confidentiality, integrity, authentication, and anti-replay protection depending on the selected protocols and configuration. IPsec is widely used to establish secure VPN connections, including site-to-site and remote-access VPNs. SMTP is used for email transport, SNMP is used for network management, and DHCP provides automatic network configuration. Therefore, IPsec is the technology commonly used to secure IP traffic and create VPN tunnels.

Question 376

Which type of VPN connects two or more entire networks rather than providing access for only one individual remote user?

1. Remote-access VPN
2. Site-to-site VPN
3. Host-based firewall
4. Proxy server

Correct Answer: 2

Explanation

A site-to-site VPN securely connects entire networks through a VPN tunnel, allowing systems at one location to communicate with systems at another location over an untrusted network. This type of VPN is commonly used to connect branch offices, data centers, or organizational sites. A remote-access VPN is generally designed for individual users connecting to an organization’s network from external locations. A host-based firewall protects an individual system, while a proxy server acts as an intermediary for specific traffic. Therefore, site-to-site VPN is correct.

Question 377

Which security method replaces sensitive information such as payment-card data with a non-sensitive substitute value?

1. Encryption
2. Tokenization
3. Hashing
4. Compression

Correct Answer: 2

Explanation

Tokenization replaces sensitive information with a substitute value called a token. The token can be used by systems that do not need direct access to the original sensitive data, reducing the number of systems that must store or process the actual information. Tokenization is commonly used for payment-card data and other sensitive information. Encryption transforms data into ciphertext using a cryptographic key, hashing creates a fixed-length digest, and compression reduces data size. Therefore, tokenization is the security technique described in the question.

Question 378

Which security technology can detect and block access to websites categorized as malicious, phishing, or otherwise prohibited by organizational policy?

1. Web security filtering
2. NTP
3. RADIUS accounting
4. DHCP relay

Correct Answer: 1

Explanation

Web security filtering can inspect web requests and apply organizational policies to determine whether access should be allowed. Security filters may block websites associated with malware, phishing, inappropriate content, or other categories selected by an organization. Depending on the implementation, filtering can occur through DNS security, secure web gateways, proxies, or other security services. NTP synchronizes system clocks, RADIUS accounting records authentication activity, and DHCP relay forwards DHCP messages between network segments. Therefore, web security filtering is the appropriate technology for controlling access to malicious or prohibited websites.

Question 379

Which security technology can use a centralized server to authenticate administrators accessing network devices and provide detailed authorization controls?

1. DHCP
2. TACACS+
3. DNS
4. TFTP

Correct Answer: 2

Explanation

TACACS+ is a AAA protocol commonly used to centrally manage administrative access to network devices. It supports authentication, authorization, and accounting and can provide detailed authorization policies for administrative commands. This allows organizations to control what individual administrators can do after successfully authenticating. TACACS+ uses TCP and encrypts the body of the authentication packet between the client and server. DHCP provides IP configuration, DNS resolves domain names, and TFTP provides basic file transfer. Therefore, TACACS+ is the appropriate centralized protocol for network-device administrative access.

Question 380

Which security principle focuses on ensuring that authorized users can access systems and information when they are needed?

1. Confidentiality
2. Integrity
3. Availability
4. Authentication

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, applications, and information when they need them. Security controls that support availability include redundancy, backups, disaster recovery planning, DDoS protection, fault-tolerant infrastructure, and appropriate capacity management. Confidentiality focuses on preventing unauthorized disclosure, while integrity ensures information is not improperly modified. Authentication verifies the identity of users or devices. Availability is especially important for business-critical applications where service interruptions can affect operations. Therefore, availability is the security principle described in the question.