View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 181

What security technology acts as a gatekeeper between enterprise users and cloud service providers to enforce security policies and compliance?

1. Cloud Access Security Broker (CASB)
2. Layer 2 unmanaged Ethernet switch
3. Basic passive network signal repeater
4. Unshielded twisted-pair patch cable

Correct Answer: 1

Explanation:

A Cloud Access Security Broker (CASB) is a software tool or service deployed between enterprise network consumers and cloud service providers to enforce security, governance, and compliance policies. As organizations transition workloads and data to Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS) environments, CASBs provide critical visibility into shadow IT, monitor user behavior, detect data exfiltration attempts, enforce data loss prevention (DLP) rules, and ensure encryption of sensitive corporate data across cloud perimeters.

Question 182

Which protocol operates at Layer 2 to provide port-based network access control and device authentication?

1. Simple Network Management Protocol v3
2. IEEE 802.1X port-based access control
3. Dynamic Host Configuration Protocol daemon
4. Trivial File Transfer Protocol utility

Correct Answer: 2

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a LAN or WLAN. 802.1X uses the Extensible Authentication Protocol (EAP) to pass authentication messages between the supplicant client, the network access device (authenticator), and a centralized authentication server (such as RADIUS). Until the client successfully authenticates, the switch port blocks all traffic except EAPOL frames, preventing unauthorized or rogue endpoints from accessing enterprise network resources.

Question 183

What security appliance operates inline to monitor traffic and actively drop packets matching malicious signatures?

1. Intrusion Prevention System (IPS) appliance
2. Layer 2 unmanaged Ethernet bridge switch
3. Passive optical network signal tap hub
4. Unshielded twisted-pair patch cord link

Correct Answer: 1

Explanation:

An Intrusion Prevention System (IPS) is an advanced inline security appliance designed to monitor network traffic for malicious activities, policy violations, and known attack signatures with the capability to actively block or drop identified threats in real time. Unlike passive Intrusion Detection Systems (IDS) that merely generate alerts for administrative review, an IPS sits directly in the data path of network traffic flows. When packet inspection algorithms detect malicious signatures, exploit patterns, or anomalous behavior, the IPS instantly terminates the connection session and drops malicious packets.

Question 184

Which SIEM process standardizes raw log data collected from disparate formats into a unified schema for efficient correlation?

1. Log normalization and parsing
2. Unencrypted Telnet remote console access
3. Passive network traffic sniffing inspection
4. Dynamic MAC address port limiting

Correct Answer: 1

Explanation:

Log normalization is a critical foundational process within Security Information and Event Management (SIEM) architectures where raw log data collected from various hardware devices, operating systems, applications, and security sensors—each using distinct syntax and formatting—is parsed and converted into a standardized, structured schema. Normalization enables SIEM correlation engines to analyze events uniformly across multi-vendor environments, allowing security analysts to track threat indicators and detect advanced attacks efficiently.

Question 185

What component within a Public Key Infrastructure is responsible for issuing, signing, and revoking digital certificates?

1. Certificate Authority (CA) server
2. Layer 2 Ethernet hardware switch
3. Passive signal repeating hub device
4. Structured cabling patch panel block

Correct Answer: 1

Explanation:

A Certificate Authority (CA) is a trusted entity within a Public Key Infrastructure (PKI) responsible for issuing, signing, and managing digital certificates used for cryptographic authentication and encryption. The CA validates the identity of certificate applicants and signs certificates using its private key, establishing a chain of trust. Additionally, the CA manages certificate lifecycle operations, including issuing updates, publishing Certificate Revocation Lists (CRLs), and supporting Online Certificate Status Protocol (OCSP) validation services across enterprise systems.

Question 186

Which IPsec VPN mode encrypts only the data payload while leaving the original IP packet header intact?

1. IPsec Tunnel mode architecture
2. IPsec Transport mode implementation
3. Unencrypted Telnet remote console session
4. Dynamic Host Configuration Protocol lease

Correct Answer: 2

Explanation:

IPsec Transport mode encrypts only the payload (the data portion) of the IP packet, leaving the original IP header unencrypted so that routing devices can examine source and destination addresses directly along the transmission path. Transport mode is primarily utilized for host-to-host communications (such as secure remote management sessions). In contrast, IPsec Tunnel mode encrypts both the entire original IP packet and its header, encapsulating it inside a new IP packet wrapper with a fresh header, making it ideal for secure site-to-site VPN tunnels across public networks.

Question 187

What authorization framework enables third-party applications to obtain limited access to user accounts without exposing passwords?

1. OAuth 2.0 authorization framework
2. Simple Network Management Protocol v3
3. Address Resolution Protocol dynamic inspection
4. Port-based 802.1X network authentication

Correct Answer: 1

Explanation:

OAuth 2.0 is an industry-standard authorization framework that enables applications to obtain limited access to user accounts on an HTTP service, such as a cloud platform or social media provider. Instead of sharing raw user credentials or passwords with third-party applications, OAuth 2.0 utilizes secure token exchanges, granting scoped access permissions (tokens) that can be restricted by duration and resource type. This framework underpins modern API security, enterprise integrations, and Single Sign-On architectures.

Question 188

Which identity protocol acts as a simple identity layer built on top of OAuth 2.0 to provide authenticated user profile information?

1. OpenID Connect (OIDC) protocol
2. Unencrypted Lightweight Directory Access Protocol
3. Trivial File Transfer Protocol utility service
4. Legacy File Transfer Protocol daemon

Correct Answer: 1

Explanation:

OpenID Connect (OIDC) is an interoperable authentication protocol built on top of the OAuth 2.0 framework. While OAuth 2.0 is strictly designed for authorization (granting resource access permissions), OIDC adds a standardized identity layer that allows client applications to verify the identity of an end-user based on authentication performed by an authorization server. OIDC accomplishes this by returning a secure JSON Web Token (JWT) known as an ID token, enabling seamless Single Sign-On (SSO) across enterprise web and mobile applications.

Question 189

What modern security model operates on the core principle of “never trust, always verify” regardless of whether a user is inside or outside the corporate network perimeter?

1. Traditional perimeter defense model
2. Zero Trust Architecture (ZTA)
3. Flat unsegmented network topology
4. Unencrypted remote administration

Correct Answer: 2

Explanation:

Zero Trust Architecture (ZTA) is an enterprise cybersecurity paradigm that eliminates the concept of implicit trust based solely on network location (such as being inside the corporate firewall). Under a Zero Trust model, every user, device, and application request—whether originating from inside or outside the corporate network perimeter—must be continuously authenticated, authorized, and validated before gaining access to enterprise resources. ZTA relies on micro-segmentation, multi-factor authentication, least privilege access, and real-time behavioral monitoring.

Question 190

What SIEM capability automatically evaluates multiple disparate log events against pre-configured logic rules to identify complex attack patterns?

1. SIEM event correlation engine
2. Passive network packet sniffer tool
3. Static application source code scanner
4. Unshielded twisted-pair cabling link

Correct Answer: 1

Explanation:

A SIEM event correlation engine is an advanced analytics mechanism that aggregates, parses, and analyzes log streams from multiple disparate sources in real time. By applying logical rules, statistical thresholds, and threat intelligence feeds, the correlation engine connects seemingly unrelated events—such as a failed login attempt on a VPN followed immediately by a successful database access query from an unusual IP address—transforming raw logs into high-fidelity security alerts that indicate sophisticated multi-stage attacks.

Question 191

What proactive security practice involves human analysts actively searching through enterprise networks to detect and isolate advanced threats that evade automated defenses?

1. Automated vulnerability port scanning
2. Cyber threat hunting engagement
3. Passive network traffic log sniffing
4. Static code review analysis

Correct Answer: 2

Explanation:

Cyber threat hunting is an active, human-led cybersecurity defense practice designed to detect and isolate advanced persistent threats (APTs) and sophisticated malware campaigns that successfully evade automated security solutions like SIEM alerts, antivirus tools, and firewalls. Threat hunters form hypotheses based on adversary tactics, techniques, and procedures (TTPs), proactively querying endpoint telemetry, network flows, and log repositories to uncover hidden anomalies and compromised assets within enterprise environments.

Question 192

What malware analysis technique involves running executable code inside an isolated virtual sandbox to observe runtime behavior?

1. Static application source code review
2. Dynamic malware sandbox analysis
3. Passive network log file inspection
4. Active network port mapping scan

Correct Answer: 2

Explanation:

Dynamic malware analysis involves executing suspicious software inside an isolated, virtualized sandbox environment to observe its runtime behavior safely without risking production infrastructure. By monitoring API calls, file system modifications, registry changes, and network command-and-control connection attempts, security analysts can identify malicious intent, capture indicators of compromise (IoCs), and understand the functional mechanics of zero-day exploits and unknown malware payloads.

Question 193

Which DNS security extension utilizes cryptographic digital signatures to ensure the authenticity and integrity of domain name resolution responses?

1. Domain Name System Security Extensions (DNSSEC)
2. Dynamic Host Configuration Protocol option
3. Simple Network Management Protocol v3
4. Network Time Protocol synchronization

Correct Answer: 1

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the IETF to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in authentication, leaving them vulnerable to cache poisoning and spoofing attacks. DNSSEC addresses this by cryptographically signing DNS records using public key cryptography. This allows client resolvers to verify the authenticity and integrity of responses, ensuring users connect to legitimate destination servers.

Question 194

What specialized web security appliance protects web applications by inspecting HTTP traffic and blocking SQL injection and cross-site scripting attacks?

1. Web Application Firewall (WAF)
2. Layer 2 unmanaged Ethernet switch
3. Basic passive network signal repeater
4. Unshielded twisted-pair patch cable

Correct Answer: 1

Explanation:

A Web Application Firewall (WAF) is a specialized security device or service designed to protect web applications by filtering, monitoring, and blocking HTTP/HTTPS traffic traveling between web applications and client browsers. Unlike traditional network firewalls that operate at lower OSI layers, a WAF inspects Layer 7 application traffic specifically to detect and prevent common web exploits—such as SQL injection, cross-site scripting (XSS), local file inclusion, and cookie tampering—before malicious requests reach application backend databases.

Question 195

What combination of email authentication technologies utilizes SPF, DKIM, and DMARC to prevent domain spoofing and phishing?

1. Simple Mail Transfer Protocol security suite
2. SPF, DKIM, and DMARC framework
3. Unencrypted Telnet remote console tools
4. Trivial File Transfer Protocol daemons

Correct Answer: 2

Explanation:

Email spoofing defenses rely on three complementary standards: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). SPF allows domain owners to publish authorized sending mail servers in DNS records. DKIM adds cryptographic digital signatures to email headers to verify message integrity. DMARC builds upon SPF and DKIM, providing policy instructions to receiving mail servers on how to handle emails that fail authentication (e.g., quarantine or reject), effectively stopping phishing and domain impersonation attacks.

Question 196

Which NIST incident response phase focuses on containing an active security breach to limit damage before eradication and recovery?

1. Preparation incident management phase
2. Containment, eradication, and recovery phase
3. Post-incident activity review phase
4. Initial detection and analysis phase

Correct Answer: 2

Explanation:

The National Institute of Standards and Technology (NIST) incident response framework outlines four core operational phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, and (4) Post-Incident Activity. The containment phase is critical during an active security breach, as it involves isolating affected network segments, disabling compromised user accounts, or taking infected hosts offline to prevent malware from spreading laterally across enterprise infrastructure prior to executing thorough eradication and system recovery steps.

Question 197

What network security architecture utilizes firewalls and VLANs to divide a network into functional security zones and restrict lateral movement?

1. Flat unsegmented network topology design
2. Network zoning and segmentation architecture
3. Passive network signal repeating hub setup
4. Unencrypted remote administration Telnet

Correct Answer: 2

Explanation:

Network zoning and segmentation is an essential security architecture that divides an enterprise network into distinct functional segments or zones (e.g., DMZ, internal user VLANs, database tiers, and management networks) separated by internal firewalls. This design ensures that traffic between zones is strictly filtered and inspected. By enforcing granular access control policies between zones, organizations restrict lateral movement for attackers who breach the perimeter, containing threats within isolated segments and protecting critical enterprise assets.

Question 198

What cryptographic discipline ensures the secure generation, storage, rotation, and destruction of encryption keys across their lifecycle?

1. Cryptographic key management lifecycle
2. Static public key distribution scripting
3. Unencrypted session identifier generation
4. Electronic Codebook cipher configuration

Correct Answer: 1

Explanation:

Cryptographic key management encompasses all rigorous administrative and technical protocols required to handle cryptographic keys safely throughout their entire lifecycle, including secure generation, distribution, storage, backup, rotation, archiving, and destruction. Because the security of any cryptographic encryption algorithm relies entirely on the confidentiality and integrity of its keys, poor key management practices (such as hardcoding keys or storing them in unencrypted repositories) completely undermine enterprise data protection, regardless of cipher strength.

Question 199

Which wireless security standard utilizes SAE for key establishment and provides robust enterprise authentication and encryption?

1. Wired Equivalent Privacy (WEP) standard
2. Wi-Fi Protected Access 3 (WPA3) Enterprise
3. Unencrypted open wireless local network
4. Legacy Wi-Fi Protected Access (WPA)

Correct Answer: 2

Explanation:

Wi-Fi Protected Access 3 (WPA3) represents the modern standard for wireless security, offering advanced cryptographic enhancements over WPA2. WPA3-Enterprise incorporates robust cryptographic options, including support for 192-bit cryptographic suites, enhanced protection for sensitive enterprise environments, and secured management frames. For consumer and smaller setups, WPA3-Personal introduces Simultaneous Authentication of Equals (SAE) to eliminate vulnerabilities associated with offline dictionary attacks against pre-shared passphrases, ensuring strong forward secrecy.

Question 200

What Cisco management platform provides centralized orchestration, policy enforcement, and threat defense management across Secure Firewall Threat Defense appliances?

1. Cisco Firewall Management Center (FMC)
2. Basic unmanaged Layer 2 switch utility
3. Unshielded twisted-pair patch cable link
4. Passive network signal sniffer analyzer

Correct Answer: 1

Explanation:

Cisco Firewall Management Center (FMC) is the centralized administrative and orchestration platform designed to manage Cisco Secure Firewall Threat Defense (FTD) appliances, intrusion prevention systems, and advanced malware protection features. FMC provides comprehensive visibility into network traffic, security event monitoring, centralized policy creation, and automated threat correlation. By unifying firewall management across physical, virtual, and cloud environments, FMC enables security teams to streamline operational workflows and enforce consistent security policies across enterprise infrastructure.