View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 81

Which protocol distributes digital certificates across public key infrastructure?

1. Simple Network Management Protocol
2. Online Certificate Status Protocol
3. Dynamic Host Configuration Protocol
4. Domain Name System protocol

Correct Answer: 2

Explanation:

The Online Certificate Status Protocol (OCSP) is an internet protocol used for obtaining the revocation status of an X.509 digital certificate in real time. Traditional public key infrastructure implementations relied heavily on Certificate Revocation Lists, which required clients to download large, periodically updated files containing lists of all revoked certificates. This approach introduced significant network overhead and latency. OCSP addresses this inefficiency by allowing client applications to query a designated OCSP responder directly for the revocation status of a specific certificate during the TLS handshake. This ensures immediate validation and enhances security posture across enterprise web services.

Question 82

What security technology analyzes event logs for anomaly detection?

1. Security Information and Event Management
2. Layer 2 Ethernet hardware switch
3. Structured network cabling patch panel
4. Basic passive signal repeater hub

Correct Answer: 1

Explanation:

A Security Information and Event Management (SIEM) solution is a comprehensive enterprise security technology that aggregates, normalizes, and correlates log data collected from various hardware devices, operating systems, applications, and network infrastructure components. By centralizing log telemetry, SIEM platforms enable security operations centers to monitor real-time security events, detect advanced persistent threats, and identify behavioral anomalies that deviate from established baselines. They utilize pre-configured correlation rules, automated threat intelligence feeds, and machine learning algorithms to generate actionable alerts, facilitating rapid incident response and regulatory compliance auditing across modern corporate networks.

Question 83

Which mechanism secures Border Gateway Protocol routing table exchanges?

1. Simple Network Management Protocol v3
2. Dynamic Host Configuration Protocol snooping
3. Resource Public Key Infrastructure authentication
4. Address Resolution Protocol dynamic inspection

Correct Answer: 3

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking and accidental misconfigurations where rogue autonomous systems advertised fake IP address blocks. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers. Routers implementing RPKI validate these digital signatures before accepting routing updates, ensuring reliable path selection and global routing security.

Question 84

What security assessment technique evaluates wireless network signal vulnerabilities?

1. Active port scanning utility
2. Wireless network penetration testing
3. Static code security inspection
4. Packet sniffer log analysis

Correct Answer: 2

Explanation:

Wireless network penetration testing is a specialized security assessment methodology designed to evaluate the physical security, configuration integrity, and cryptographic resilience of enterprise wireless local area networks. Ethical hackers simulate real-world attacks against Wi-Fi infrastructure—including rogue access point deployment, Bluetooth sniffing, deauthentication flooding, and WPA2/WPA3 handshake capture—to identify exploitable weaknesses. The assessment uncovers misconfigured guest portals, weak pre-shared keys, and unauthorized rogue access points before malicious actors can leverage them to compromise internal enterprise network segments, ensuring robust wireless security governance.

Question 85

Which device drops unauthorized traffic based on signatures?

1. Intrusion Prevention System appliance
2. Layer 2 Ethernet bridging switch
3. Passive network signal tap hub
4. Unshielded twisted-pair patch cable

Correct Answer: 1

Explanation:

An Intrusion Prevention System (IPS) is an advanced inline security appliance designed to monitor network traffic for malicious activities, policy violations, and known attack signatures with the capability to actively block or drop identified threats in real time. Unlike passive Intrusion Detection Systems that merely generate alerts for administrative review, an IPS sits directly in the data path of network traffic flows. When packet inspection algorithms detect malicious signatures, exploit patterns, or anomalous behavior, the IPS instantly terminates the connection session, drops malicious packets, and shields internal enterprise assets against active network-based cyber attacks.

Question 86

What cryptographic protocol secures web server and browser sessions?

1. File Transfer Protocol daemon
2. Unencrypted Telnet remote console
3. Trivial File Transfer Protocol service
4. Transport Layer Security protocol

Correct Answer: 4

Explanation:

Transport Layer Security (TLS) is a foundational cryptographic protocol designed to provide secure, encrypted communications over computer networks, heavily utilized in securing web browser and server interactions via HTTPS. TLS establishes a secure connection through a cryptographic handshake process that negotiates encryption algorithms, authenticates digital certificates, and generates shared session keys. By encapsulating application-layer payloads inside robust cryptographic wrappers, TLS guarantees data confidentiality, message integrity, and peer authentication, effectively protecting sensitive user credentials and enterprise web application data against eavesdropping and tampering during transit across public networks.

Question 87

Which database security control prevents SQL injection vulnerabilities effectively?

1. Parameterized query input validation
2. Unencrypted Telnet administration access
3. Passive packet sniffer inspection
4. MAC address port security enforcement

Correct Answer: 1

Explanation:

Parameterized queries—also known as prepared statements—provide the most effective defense mechanism against SQL injection vulnerabilities by strictly separating user-supplied input data from executable database query structures. When applications utilize parameterized queries, the database management system treats user input strictly as literal values rather than executable SQL command syntax, even if the input contains malicious query fragments. Combined with rigorous input validation and robust error handling, parameterized queries prevent attackers from manipulating database logic, ensuring that sensitive enterprise data remains secure against unauthorized extraction and manipulation.

Question 88

What network security architecture segments data into zones?

1. Traditional perimeter defense model
2. Enterprise network micro-segmentation design
3. Unencrypted hub wiring topology
4. Passive broadcast sniffing architecture

Correct Answer: 2

Explanation:

Enterprise network micro-segmentation is an advanced security architecture that divides a data center or cloud environment into distinct, highly secure zones down to the workload or container level. By enforcing granular, perimeter-less firewall policies between individual servers and application tiers, micro-segmentation restricts lateral movement for attackers who manage to breach the initial network perimeter. Even if a single endpoint or server is compromised, the containment policies prevent malware from spreading laterally across adjacent internal systems, significantly reducing the overall blast radius of security incidents within enterprise networks.

Question 89

Which security metric evaluates software vulnerability exploitability and impact?

1. Common Vulnerability Scoring System
2. Open Web Application Security framework
3. National Institute of Standards standard
4. Information Technology Infrastructure Library guideline

Correct Answer: 1

Explanation:

The Common Vulnerability ScoringSystem (CVSS) is an open, standardized framework used to assess and measure the severity of computer system security vulnerabilities. CVSS produces numerical score ratings ranging from 0.0 to 10.0 based on various metric groups, including exploitability metrics (how easily a flaw can be accessed), impact metrics (consequences to confidentiality, integrity, and availability), and temporal characteristics that change over time. Security operations teams utilize CVSS scores to prioritize vulnerability remediation efforts, allocate resources effectively, and evaluate operational risk across enterprise software and hardware inventories.

Question 90

What protocol provides secure remote command-line administration sessions?

1. Unencrypted Telnet network protocol
2. File Transfer Protocol daemon
3. Secure Shell cryptographic protocol
4. Trivial File Transfer Protocol utility

Correct Answer: 3

Explanation:

Secure Shell (SSH) is a cryptographic network protocol designed specifically to provide secure, encrypted command-line administration and remote login capabilities across unsecured IP networks. It serves as a modern, secure replacement for legacy unencrypted protocols like Telnet. When an administrator connects to a network device via SSH, all transmitted keystrokes, passwords, and management commands are encapsulated in robust cryptographic wrappers. This prevents malicious actors from capturing sensitive credentials through packet sniffing or executing man-in-the-middle attacks on enterprise infrastructure. SSH operates by default over Transmission Control Protocol port 22 and requires cryptographic key exchanges prior to establishing an authenticated session.

Question 91

Which cloud deployment model retains dedicated private physical hardware?

1. Public cloud shared infrastructure model
2. Private cloud dedicated hardware environment
3. Hybrid cloud multi-tenant architecture
4. Community cloud collaborative hosting platform

Correct Answer: 2

Explanation:

A private cloud deployment model provides cloud computing resources dedicated exclusively to a single business organization, hosted either on-premises or managed externally by a third-party vendor. Unlike public cloud environments that pool virtualized infrastructure across multiple tenants, a private cloud maintains dedicated physical hardware, storage arrays, and network fabrics. This architecture delivers superior control, customization, and data privacy, making it an ideal choice for enterprises operating under strict regulatory compliance mandates, financial constraints, or specialized security requirements that prohibit sharing physical infrastructure with external tenants.

Question 92

What security control restricts lateral movement within networks?

1. Flat unsegmented network topology
2. Network micro-segmentation firewall policy
3. Passive signal repeating hub
4. Unencrypted remote administration Telnet

Correct Answer: 2

Explanation:

Network micro-segmentation firewall policies enforce strict communication boundaries between internal hosts, workloads, and subnet segments, effectively containing threats and restricting lateral movement across enterprise networks. Traditional flat network designs allowed uninhibited communication between internal devices once initial perimeter defenses were bypassed. Micro-segmentation eliminates this vulnerability by requiring explicit authorization and granular security inspection for every internal traffic flow. This ensures that if a single endpoint or application is compromised by malware or an insider threat, the infection cannot easily spread to critical adjacent systems.

Question 93

Which mechanism detects unauthorized changes to system files?

1. File integrity monitoring software
2. Passive network traffic sniffing
3. Unshielded twisted-pair cabling
4. Dynamic IP address assignment

Correct Answer: 1

Explanation:

File integrity monitoring (FIM) is an automated security control and software mechanism that examines operating system files, application binaries, and configuration files to detect unauthorized modifications, tampering, or corruption. FIM tools typically calculate cryptographic hash baselines of critical system files during known-good states and continuously compare current file hashes against these baseline references. If an attacker modifies a system binary, installs a rootkit, or alters configuration settings, the FIM engine instantly flags the discrepancy, generating real-time security alerts for incident response teams to investigate potential system compromises.

Question 94

What security framework guides organizational risk management programs?

1. National Institute of Standards framework
2. Layer 2 Ethernet switching standard
3. Dynamic Host Configuration Protocol daemon
4. Structured cabling patch panel block

Correct Answer: 1

Explanation:

The National Institute of Standards and Technology (NIST) Cybersecurity Framework provides a comprehensive, policy-based standard of guidelines, standards, and best practices designed to help organizations manage and reduce cybersecurity risk. Structured around five core functions—Identify, Protect, Detect, Respond, and Recover—the framework enables organizations of all sizes to assess their current security posture, establish target maturity levels, and communicate security requirements across business units. By adopting NIST guidelines, enterprises can build resilient security programs, align technical defenses with business objectives, and streamline regulatory compliance audits effectively.

Question 95

Which protocol synchronizes network device clocks securely worldwide?

1. Simple Network Management Protocol
2. Dynamic Host Configuration Protocol
3. Network Time Security protocol
4. Trivial File Transfer Protocol

Correct Answer: 3

Explanation:

Network Time Security (NTS) is a cryptographic extension of the Network Time Protocol designed to provide secure, authenticated time synchronization across computer networks. Traditional time synchronization protocols were highly vulnerable to spoofing, tampering, and man-in-the-middle attacks, allowing malicious actors to manipulate system clocks and disrupt time-sensitive security logs, Kerberos authentication tickets, and cryptographic certificates. NTS addresses this by utilizing Transport Layer Security and authenticated encryption to secure time packets between clients and time servers, ensuring absolute time integrity across enterprise infrastructure and distributed systems.

Question 96

What security service validates user credentials across domains?

1. Active Directory federation and SSO
2. Passive packet analyzer diagnostic tool
3. Unshielded twisted-pair patch cable
4. Layer 2 unmanaged Ethernet switch

Correct Answer: 1

Explanation:

Active Directory federation and Single Sign-On (SSO) services provide centralized identity management and authentication validation across multiple disparate security domains, cloud platforms, and enterprise applications. Instead of requiring users to maintain separate credentials for every service, federation utilizes standardized protocols like Security Assertion Markup Language and OpenID Connect to securely pass authenticated identity tokens between trusted identity providers and service providers. This centralized approach simplifies administrative overhead, enhances user experience, and strengthens enterprise security by reducing password fatigue and centralizing multi-factor authentication enforcement.

Question 97

Which attack bypasses perimeter security using legitimate credentials?

1. Credential stuffing and account takeover
2. Content Addressable Memory table flooding
3. Address Resolution Protocol cache poisoning
4. Distributed denial of service flood

Correct Answer: 1

Explanation:

Credential stuffing is an automated cyber attack where malicious actors take stolen username and password pairs obtained from data breaches on unrelated websites and attempt to log in across large numbers of target enterprise accounts. Because many users reuse identical passwords across multiple services, credential stuffing attacks frequently succeed, resulting in account takeover without requiring traditional vulnerability exploitation. This type of attack effectively bypasses perimeter firewalls and network segmentation controls because the authentication traffic appears entirely legitimate. Defending against credential stuffing requires multi-factor authentication, bot mitigation tools, and continuous credential monitoring.

Question 98

What protocol secures email delivery via cryptographic keys?

1. Unencrypted Telnet remote console
2. Pretty Good Privacy encryption standard
3. Trivial File Transfer Protocol utility
4. File Transfer Protocol daemon

Correct Answer: 2

Explanation:

Pretty Good Privacy (PGP) is a widely used cryptographic software system that provides cryptographic privacy and authentication for data communication. PGP is frequently utilized for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions to increase the security of email communications. It combines symmetric encryption algorithms and public-key cryptography to ensure robust confidentiality and integrity. By utilizing a web of trust model, PGP allows users to verify digital signatures and establish trust in public keys without relying exclusively on centralized certificate authorities, making it a powerful tool for secure peer-to-peer messaging.

Question 99

Which security test injects random inputs into applications?

1. Static code review analysis
2. Passive network log sniffing
3. Automated application fuzz testing
4. Active port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing—or fuzzing—is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook. By identifying and patching these hidden software bugs prior to production release, organizations significantly enhance application robustness and reduce vulnerability risks.

Question 100

What security discipline focuses on preserving digital evidence?

1. Network traffic packet analysis
2. Computer digital forensics investigation
3. Static code security review
4. Vulnerability assessment scanning

Correct Answer: 2

Explanation:

Computer digital forensics is a specialized branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often in relation to computer crime and security breaches. Digital forensics professionals follow strict chain-of-custody protocols to ensure that digital evidence—such as hard disk images, memory dumps, and log files—is collected, preserved, and analyzed without altering or contaminating the original data. This rigorous methodology ensures that findings remain legally admissible in court and provides actionable intelligence regarding root causes during enterprise incident response investigations.