View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 121

What protocol secures web traffic over TLS connections?

1. Unencrypted Telnet protocol
2. Hypertext Transfer Protocol Secure
3. Trivial File Transfer Protocol
4. File Transfer Protocol daemon

Correct Answer: 2

Explanation:

Hypertext Transfer Protocol Secure (HTTPS) is the secure extension of standard HTTP, designed to protect web communications between client browsers and enterprise web servers against eavesdropping, tampering, and man-in-the-middle attacks. HTTPS wraps standard HTTP data payloads inside Transport Layer Security (TLS) or Secure Sockets Layer (SSL) cryptographic encryption wrappers backed by digital certificates issued by trusted certificate authorities. Network administrators configure HTTPS to operate over TCP port 443, ensuring robust data confidentiality, integrity, and authentication for modern web applications and cloud services. This cryptographic wrapping protects sensitive user data during transit across untrusted public networks.

Question 122

Which security appliance inspects network traffic packets inline?

1. Layer 2 unmanaged Ethernet switch
2. Basic passive network signal repeater
3. Unshielded twisted-pair patch cable
4. Next-Generation Firewall security appliance

Correct Answer: 4

Explanation:

A Next-Generation Firewall (NGFW) is an advanced security appliance that goes far beyond traditional packet-filtering firewalls by performing deep packet inspection up to Layer 7 of the OSI model. While legacy firewalls evaluated only IP addresses and port numbers, NGFWs inspect application-layer traffic payloads to identify specific applications, detect sophisticated malware signatures, prevent intrusion attempts, and enforce granular security policies. They integrate traditional firewall capabilities with intrusion prevention systems, URL filtering, and advanced threat intelligence feeds, providing comprehensive security visibility and enforcement across modern corporate networks and data centers.

Question 123

What security device drops packets matching attack signatures?

1. Intrusion Prevention System appliance
2. Layer 2 unmanaged Ethernet bridge
3. Passive optical network signal tap
4. Unshielded twisted-pair patch cord

Correct Answer: 1

Explanation:

An Intrusion Prevention System (IPS) is an advanced inline security appliance designed to monitor network traffic for malicious activities, policy violations, and known attack signatures with the capability to actively block or drop identified threats in real time. Unlike passive Intrusion Detection Systems that merely generate alerts for administrative review, an IPS sits directly in the data path of network traffic flows. When packet inspection algorithms detect malicious signatures, exploit patterns, or anomalous behavior, the IPS instantly terminates the connection session, drops malicious packets, and shields internal enterprise assets against active network-based cyber attacks.

Question 124

Which cryptographic attack attempts dictionary guessing against hashes?

1. Man-in-the-middle interception attack
2. Distributed denial of service flood
3. Brute-force and dictionary attack
4. Address Resolution Protocol poisoning

Correct Answer: 3

Explanation:

A dictionary attack is a cryptographic and authentication exploit where an attacker attempts to determine a decryption key or user password by systematically searching through a large pre-computed list of likely candidates, such as dictionary words, common phrases, and previously breached passwords. In the context of password hashes or wireless handshakes, attackers hash each dictionary word and compare the resulting digest against the target hash. If a match occurs, the plaintext password is compromised. Defending against dictionary attacks requires enforcing strong, complex password policies, multi-factor authentication, and account lockout mechanisms.

Question 125

What networking protocol maps IP addresses to MAC addresses?

1. Dynamic Host Configuration Protocol
2. Address Resolution Protocol stack
3. Internet Control Message Protocol
4. Domain Name System resolution protocol

Correct Answer: 2

Explanation:

Address Resolution Protocol (ARP) is a fundamental networking protocol used to map a network layer IP address to a physical hardware MAC address recognized by the local area network data link layer. When a host needs to communicate with another device on the same local subnet, it broadcasts an ARP request packet asking, “Who has this IP address?” The target device responds with its unique hardware MAC address, allowing the sender to encapsulate data frames correctly for physical transmission. While essential for local delivery, standard ARP lacks authentication, making it vulnerable to spoofing and poisoning attacks.

Question 126

Which wireless security protocol introduced Simultaneous Authentication Equals?

1. Wired Equivalent Privacy standard
2. Wi-Fi Protected Access protocol
3. Wi-Fi Protected Access 2
4. Wi-Fi Protected Access 3

Correct Answer: 4

Explanation:

Wi-Fi Protected Access 3 (WPA3) introduced advanced cryptographic enhancements to secure wireless networks against offline dictionary attacks. Traditional WPA2-Personal networks relied on static pre-shared keys, allowing attackers to capture handshake packets over the air and execute brute-force decryption offline if the passphrase was weak. WPA3-Personal replaces this exchange with Simultaneous Authentication of Equals (SAE), a secure key establishment protocol based on elliptic-curve cryptography. SAE ensures that even if users choose weak passwords, attackers cannot recover the password through offline dictionary attacks, providing robust forward secrecy.

Question 127

What enterprise technology aggregates security event logs centrally?

1. Security Information and Event Management
2. Layer 2 managed Ethernet switch
3. Basic passive network signal hub
4. Structured cabling patch panel block

Correct Answer: 1

Explanation:

A Security Information and Event Management (SIEM) solution is a comprehensive enterprise security technology that aggregates, normalizes, and correlates log data collected from various hardware devices, operating systems, applications, and network infrastructure components. By centralizing log telemetry, SIEM platforms enable security operations centers to monitor real-time security events, detect advanced persistent threats, and identify behavioral anomalies that deviate from established baselines. They utilize pre-configured correlation rules, automated threat intelligence feeds, and machine learning algorithms to generate actionable alerts, facilitating rapid incident response and regulatory compliance auditing.

Question 128

Which cryptographic protocol establishes secure web session keys?

1. File Transfer Protocol daemon
2. Unencrypted Telnet remote administration
3. Transport Layer Security protocol
4. Trivial File Transfer Protocol service

Correct Answer: 3

Explanation:

Transport Layer Security (TLS) is a foundational cryptographic protocol designed to provide secure, encrypted communications over computer networks, heavily utilized in securing web browser and server interactions via HTTPS. TLS establishes a secure connection through a cryptographic handshake process that negotiates encryption algorithms, authenticates digital certificates, and generates shared session keys. By encapsulating application-layer payloads inside robust cryptographic wrappers, TLS guarantees data confidentiality, message integrity, and peer authentication, effectively protecting sensitive user credentials and enterprise web application data against eavesdropping and tampering during transit across public networks.

Question 129

What core security principle restricts user account permissions?

1. Defense in depth security strategy
2. Principle of least privilege
3. Zero Trust network architecture
4. Separation of duties governance policy

Correct Answer: 2

Explanation:

The principle of least privilege is a fundamental information security concept that dictates that a user, process, or system component must be given only the minimum levels of access permissions—or privileges—necessary to perform its specific, authorized job functions. By restricting privileges strictly to operational requirements, organizations significantly limit the potential blast radius of credential compromise, insider threats, and malware propagation. For example, standard network users should never possess administrative privileges, and software applications should execute under restricted service accounts rather than root-level permissions.

Question 130

Which network attack floods switch CAM tables rapidly?

1. Address Resolution Protocol poisoning attack
2. Dynamic Host Configuration server exhaustion
3. Spanning Tree Root bridge hijacking
4. Content Addressable Memory table flooding

Correct Answer: 4

Explanation:

A Content Addressable Memory (CAM) table flooding attack—commonly referred to as a MAC flooding attack—is a Layer 2 exploit where a malicious actor overwhelms an enterprise switch by transmitting a high volume of Ethernet frames with randomized source MAC addresses. Because switches maintain limited physical memory capacity within their CAM tables to track valid interface associations, exhausting this table forces the switch into an insecure hub-like broadcast mode. In this degraded state, subsequent traffic destined for any port is broadcast across all ports, allowing the attacker to capture sensitive data using packet sniffers.

Question 131

What protocol secures network device configurations via SSH?

1. Network Configuration Protocol daemon
2. Telnet remote administration protocol
3. Hypertext Transfer Protocol service
4. Trivial File Transfer Protocol utility

Correct Answer: 1

Explanation:

Network Configuration Protocol (NETCONF) is a network management protocol developed by the Internet Engineering Task Force to address the limitations of legacy management interfaces like SNMP and CLI scripting. NETCONF provides mechanisms to install, manipulate, and delete the configurations of network devices programmatically. It operates over secure transport protocols like Secure Shell (SSH), ensuring that management sessions and configuration data payloads are fully encrypted and authenticated. By utilizing XML-based data encodings and supporting structured data models like YANG, NETCONF enables automated network orchestration and software-defined networking workflows across enterprise infrastructures.

Question 132

Which diagnostic tool captures raw binary network frames?

1. Layer 2 unmanaged Ethernet hardware switch
2. Basic passive network signal repeater hub
3. Packet sniffer network analyzer tool
4. Structured cabling patch cord cable

Correct Answer: 3

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software or hardware tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications, detect anomalies, identify malicious payloads, and audit security policies.

Question 133

What framework assesses software vulnerability severity score metrics?

1. Open Web Application Security Project
2. Common Vulnerability Scoring System
3. National Institute of Standards framework
4. Information Technology Infrastructure Library

Correct Answer: 2

Explanation:

The Common Vulnerability Scoring System (CVSS) is an open, standardized framework used to assess and measure the severity of computer system security vulnerabilities. CVSS produces numerical score ratings ranging from 0.0 to 10.0 based on various metric groups, including exploitability metrics (how easily a flaw can be accessed), impact metrics (consequences to confidentiality, integrity, and availability), and temporal characteristics that change over time. Security operations teams utilize CVSS scores to prioritize vulnerability remediation efforts, allocate resources effectively, and evaluate operational risk across enterprise software and hardware inventories.

Question 134

Which cloud deployment model provides dedicated physical hardware?

1. Public cloud shared multi-tenant architecture
2. Hybrid cloud federated environment
3. Community cloud collaborative hosting platform
4. Private cloud dedicated hardware environment

Correct Answer: 4

Explanation:

A private cloud deployment model provides cloud computing resources dedicated exclusively to a single business organization, hosted either on-premises or managed externally by a third-party vendor. Unlike public cloud environments that pool virtualized infrastructure across multiple tenants, a private cloud maintains dedicated physical hardware, storage arrays, and network fabrics. This architecture delivers superior control, customization, and data privacy, making it an ideal choice for enterprises operating under strict regulatory compliance mandates, financial constraints, or specialized security requirements that prohibit sharing physical infrastructure with external tenants.

Question 135

What malicious software conceals processes within operating systems?

1. Rootkit system concealment software
2. Adware marketing program package
3. Spyware tracking telemetry agent
4. Ransomware file encryption utility

Correct Answer: 1

Explanation:

A rootkit is a stealthy type of malicious software designed to conceal the existence of certain processes or programs from normal methods of detection while maintaining privileged administrative access to a computer system. Rootkits frequently compromise core operating system kernels or system binaries, intercepting operating system application programming interface calls to hide files, network connections, and active malicious processes from antivirus scanners and system administrators. Because they operate at deep privilege levels, detecting and removing rootkits often requires specialized offline scanning tools or complete operating system reinstallation.

Question 136

Which cryptographic framework secures BGP routing table exchanges?

1. Simple Network Management Protocol v3
2. Dynamic Host Configuration Protocol snooping
3. Resource Public Key Infrastructure authentication
4. Address Resolution Protocol dynamic inspection

Correct Answer: 3

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking and accidental misconfigurations where rogue autonomous systems advertised fake IP address blocks. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers. Routers implementing RPKI validate these digital signatures before accepting routing updates, ensuring reliable path selection and global routing security.

Question 137

What security mechanism detects unauthorized system file modifications?

1. Passive network traffic sniffing
2. File integrity monitoring software
3. Unshielded twisted-pair cabling
4. Dynamic IP address assignment

Correct Answer: 2

Explanation:

File integrity monitoring (FIM) is an automated security control and software mechanism that examines operating system files, application binaries, and configuration files to detect unauthorized modifications, tampering, or corruption. FIM tools typically calculate cryptographic hash baselines of critical system files during known-good states and continuously compare current file hashes against these baseline references. If an attacker modifies a system binary, installs a rootkit, or alters configuration settings, the FIM engine instantly flags the discrepancy, generating real-time security alerts for incident response teams to investigate potential system compromises.

Question 138

Which automated attack uses stolen credentials across sites?

1. Content Addressable Memory table flooding
2. Address Resolution Protocol cache poisoning
3. Distributed denial of service flood
4. Credential stuffing and account takeover

Correct Answer: 4

Explanation:

Credential stuffing is an automated cyber attack where malicious actors take stolen username and password pairs obtained from data breaches on unrelated websites and attempt to log in across large numbers of target enterprise accounts. Because many users reuse identical passwords across multiple services, credential stuffing attacks frequently succeed, resulting in account takeover without requiring traditional vulnerability exploitation. This type of attack effectively bypasses perimeter firewalls and network segmentation controls because the authentication traffic appears entirely legitimate. Defending against credential stuffing requires multi-factor authentication, bot mitigation tools, and continuous credential monitoring.

Question 139

What IEEE standard defines port-based network access control?

1. IEEE 802.1X port-based access control
2. IEEE 802.1Q trunking standard specification
3. IEEE 802.11ac wireless networking protocol
4. IEEE 802.3af Power over Ethernet standard

Correct Answer: 1

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a LAN or WLAN. 802.1X uses the Extensible Authentication Protocol to pass authentication messages between the supplicant client, the network access device (authenticator), and a centralized authentication server (such as RADIUS). Until the client successfully authenticates, the switch port blocks all traffic except EAPOL frames. This ensures that unauthorized endpoints, rogue devices, or unverified computers cannot access enterprise network resources.

Question 140

Which cryptographic protocol secures domain name resolution records?

1. Dynamic Host Configuration Protocol engine
2. Simple Network Management Protocol daemon
3. Domain Name System Security Extensions
4. Network Time Protocol synchronization

Correct Answer: 3

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the Internet Engineering Task Force to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in security, making them highly vulnerable to cache poisoning and spoofing attacks where malicious actors redirected traffic to fraudulent servers. DNSSEC addresses this by signing DNS records cryptographically using digital signatures based on public key cryptography. This allows client resolvers to verify the authenticity and integrity of DNS responses, ensuring users connect to legitimate destinations.