View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 201

What is the primary function of a Hardware Security Module (HSM) in enterprise security architectures?

1. Unencrypted local log file storage
2. Passive network packet capture analysis
3. Secure cryptographic key generation, management, and storage
4. Dynamic IP address leasing and assignment

Correct Answer: 3

Explanation:

A Hardware Security Module (HSM) is a dedicated physical computing device designed specifically to safeguard and manage digital keys, accelerate cryptographic operations, and provide secure crypto-processing. HSMs are heavily utilized in enterprise environments to protect sensitive keys used by Certificate Authorities, database encryption, and SSL/TLS termination. Because they are tamper-evident and tamper-resistant, HSMs prevent unauthorized extraction or exposure of master private keys, even if the host operating system is compromised.

Question 202

Which protocol is used for automated digital certificate enrollment and management over HTTP, commonly used by Let’s Encrypt?

1. Simple Network Management Protocol v3
2. Enrollment over Secure Transport (EST)
3. Simple Certificate Enrollment Protocol (SCEP)
4. Automated Certificate Management Environment (ACME) protocol

Correct Answer: 4

Explanation:

The Automated Certificate Management Environment (ACME) protocol is a communications protocol designed for automating interactions between certificate authorities and web servers, enabling the automated deployment of Public Key Infrastructure (PKI) certificates without human intervention. Standardized in RFC 8555 and popularized by Let’s Encrypt, ACME allows web servers to verify domain ownership and request, renew, or revoke digital certificates securely over HTTPS, drastically reducing administrative overhead and eliminating outages caused by expired certificates.

Question 203

What type of distributed cyber attack overwhelms a target server or network with massive volumes of traffic from multiple coordinated sources?

1. Address Resolution Protocol cache poisoning attack
2. Distributed Denial of Service (DDoS) flood attack
3. Content Addressable Memory table flooding exploit
4. Dynamic Host Configuration server exhaustion loop

Correct Answer: 2

Explanation:

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a massive flood of internet traffic. DDoS attacks utilize multiple compromised computer systems—often organized into botnets—as sources of attack traffic. Because the incoming traffic originates from numerous distributed IP locations, mitigating DDoS attacks requires specialized cloud scrubbing centers, rate-limiting rules, and traffic anomaly detection tools.

Question 204

Which asymmetric cryptographic algorithm is widely used for secure key exchange, digital signatures, and public-key encryption?

1. Message Digest 5 hashing algorithm
2. Advanced Encryption Standard symmetric cipher
3. Rivest-Shamir-Adleman (RSA) cryptosystem
4. Galois/Counter Mode authentication cipher

Correct Answer: 3

Explanation:

The Rivest-Shamir-Adleman (RSA) cryptosystem is one of the earliest and most widely utilized public-key cryptographic algorithms. It relies on the mathematical difficulty of factoring the product of two large prime numbers. RSA is foundational to modern cybersecurity, providing robust mechanisms for secure data encryption, digital signatures, and key exchange protocols (such as establishing TLS sessions). While newer elliptic-curve cryptography offers equivalent security with smaller key sizes, RSA remains a cornerstone of enterprise PKI deployments.

Question 205

What Cisco switch security feature protects against rogue DHCP servers by validating client messages on trusted ports?

1. Dynamic Host Configuration Protocol (DHCP) snooping
2. Unicast Reverse Path Forwarding (uRPF) inspection
3. Port-based 802.1X network access control
4. Dynamic ARP Inspection (DAI) filtering

Correct Answer: 1

Explanation:

DHCP snooping is a Layer 2 security technology built into Cisco Catalyst and Nexus switches that acts as a firewall between untrusted host devices and trusted DHCP servers. When enabled, DHCP snooping intercepts DHCP traffic, drops malicious DHCP server replies originating from untrusted ports (mitigating rogue DHCP server attacks), and builds a dynamic binding database tracking client IP addresses, MAC addresses, switch ports, and VLANs. This database is subsequently utilized by features like Dynamic ARP Inspection and IP Source Guard.

Question 206

Which email security standard adds cryptographic digital signatures to message headers to verify sender authenticity and integrity?

1. Sender Policy Framework (SPF)
2. Domain-based Message Authentication, Reporting, and Conformance
3. Unencrypted Simple Mail Transfer Protocol
4. DomainKeys Identified Mail (DKIM)

Correct Answer: 4

Explanation:

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a cryptographic mechanism to validate a domain name identity associated with a message through cryptographic signing. The sending mail server signs the email header and body hashes with a private key, and the receiving server validates the signature using the sender’s public key published in the domain’s DNS records. DKIM ensures that the email was genuinely sent by the domain owner and that the message payload was not altered in transit.

Question 207

What Cisco technology provides network traffic visibility and telemetry collection using NetFlow/IPFIX data exported from network routers and switches?

1. Cisco Identity Services Engine (ISE)
2. Cisco Secure Network Analytics (Stealthwatch)
3. Cisco Firewall Management Center (FMC)
4. Cisco Cloud Access Security Broker (CASB)

Correct Answer: 2

Explanation:

Cisco Secure Network Analytics—formerly known as Stealthwatch—is an enterprise security platform that uses network telemetry (such as NetFlow, IPFIX, and proxy logs) combined with machine learning and behavioral modeling to detect threats, lateral movement, and anomalous traffic patterns across campus, data center, and cloud environments. By analyzing network flows without requiring inline packet decryption, Stealthwatch provides deep visibility into enterprise communications, helping security operations teams identify compromised endpoints and insider threats rapidly.

Question 208

What cloud security architecture ensures that sensitive workloads remain encrypted while being actively processed in memory using hardware isolation?

1. Traditional public cloud shared tenancy
2. Infrastructure as a Service virtualization
3. Confidential Computing hardware-based enclaves
4. Perimeter firewall micro-segmentation

Correct Answer: 3

Explanation:

Confidential Computing is a cloud security technology that protects data in use by performing computations in a hardware-based, isolated CPU enclave. While traditional cloud architectures encrypted data at rest (storage) and in transit (network), data in memory was historically vulnerable to hypervisor-level attacks or malicious host administrators. Confidential Computing utilizes secure enclaves—such as Intel SGX or AMD SEV—to isolate sensitive workloads and encryption keys at the hardware level, ensuring that even the cloud provider cannot access data while it is being processed.

Question 209

What memory vulnerability occurs when an application writes more data to a buffer than it can hold, allowing execution flow manipulation?

1. Buffer overflow vulnerability exploit
2. Structured Query Language injection flaw
3. Cross-site scripting web application bug
4. Address Resolution Protocol poisoning attack

Correct Answer: 1

Explanation:

A buffer overflow is a software vulnerability that occurs when a program or application attempts to store more data in a fixed-length memory buffer than the buffer was allocated to hold. Excess data overflows into adjacent memory locations, overwriting stored execution pointers or critical application data. Skilled attackers can craft malicious payloads that exploit buffer overflows to inject and execute arbitrary machine code, granting them system access or causing application crashes. Defending against buffer overflows requires rigorous bounds checking, safe programming practices, and compiler protections.

Question 210

Which operational incident response metric measures the average time required to repair, patch, or restore a system following a security breach?

1. Mean Time to Detect (MTTD) metric
2. Mean Time to Acknowledge (MTTA) alert
3. Common Vulnerability Scoring System (CVSS) score
4. Mean Time to Repair or Remediate (MTTR)

Correct Answer: 4

Explanation:

Mean Time to Repair or Remediate (MTTR) is a key operational performance metric in security and IT operations that calculates the average time required to troubleshoot, fix, patch, or fully recover a compromised system or service following a security incident. Along with Mean Time to Detect, MTTR helps security leaders evaluate the efficiency of their Incident Response team, automated containment workflows, and patching pipelines, driving continuous improvement in enterprise security resilience.

Question 211

Which secure protocol is used to query directory services over encrypted Transport Layer Security connections on TCP port 636?

1. Unencrypted Lightweight Directory Access Protocol (LDAP)
2. Lightweight Directory Access Protocol Secure (LDAPS)
3. Trivial File Transfer Protocol directory utility
4. Simple Network Management Protocol daemon

Correct Answer: 2

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of LDAP that encrypts all communications between client applications and directory service servers using Transport Layer Security (TLS) or Secure Sockets Layer (SSL). Standard LDAP transmits directory queries, user attributes, and passwords in clear text over TCP port 389, leaving them vulnerable to packet sniffing and credential harvesting. LDAPS operates by default over TCP port 636, wrapping directory transactions in cryptographic privacy to protect enterprise authentication data.

Question 212

What component within the Cisco XDR architecture serves as the automated orchestration engine for executing incident response workflows?

1. Cisco Secure Firewall Threat Defense
2. Basic unmanaged Layer 2 switch hardware
3. Cisco Secure Orchestration (formerly Threat Response)
4. Unshielded twisted-pair patch cable link

Correct Answer: 3

Explanation:

Cisco Secure Orchestration—integrated within the Cisco XDR platform—serves as the automated engine that executes security playbooks, orchestrates incident response workflows, and coordinates actions across disparate security products (such as firewalls, email gateways, and endpoint agents). By automating repetitive containment tasks—like isolating compromised hosts, blocking malicious IP addresses, or revoking compromised user sessions—Secure Orchestration significantly reduces incident response times and operational overhead for Security Operations Centers.

Question 213

What type of malicious software encrypts files on a host system and demands financial ransom in exchange for the decryption key?

1. Ransomware file encryption payload
2. Adware marketing software package
3. Spyware tracking telemetry agent
4. Rootkit kernel concealment module

Correct Answer: 1

Explanation:

Ransomware is a destructive form of malware that encrypts files, directories, or entire hard disk drives on a victim’s computer system using robust symmetric and asymmetric encryption algorithms. Once the files are locked, the malicious actors demand a financial ransom payment—typically in cryptocurrency—in exchange for the private decryption key. Modern ransomware operations frequently employ double-extortion tactics, exfiltrating sensitive corporate data prior to encryption and threatening public leaks if demands are unmet. Defense requires rigorous backup strategies, endpoint detection, and email filtering.

Question 214

Which IEEE standard defines Rapid Spanning Tree Protocol to eliminate network switching loops and speed convergence?

1. IEEE 802.1X port-based access control standard
2. IEEE 802.1Q VLAN trunking encapsulation specification
3. IEEE 802.11ac wireless local networking protocol
4. IEEE 802.1w Rapid Spanning Tree Protocol (RSTP)

Correct Answer: 4

Explanation:

The IEEE 802.1w standard defines Rapid Spanning Tree Protocol (RSTP), an evolution of the original IEEE 802.1D Spanning Tree Protocol designed to prevent switching loops in enterprise LAN topologies. While legacy STP took up to 50 seconds to converge after a topology change, RSTP introduces rapid state transitions and backup port roles, achieving convergence in milliseconds. This ensures high availability and rapid fault recovery across enterprise switched infrastructure without disrupting mission-critical network connectivity.

Question 215

What routing security feature checks incoming packets against routing table entries to drop spoofed IP source addresses?

1. Dynamic Host Configuration Protocol snooping
2. Unicast Reverse Path Forwarding (uRPF)
3. Port security MAC address limiting
4. Address Resolution Protocol dynamic inspection

Correct Answer: 2

Explanation:

Unicast Reverse Path Forwarding (uRPF) is a security and routing feature implemented on Cisco network devices to mitigate problems caused by malicious or accidental IP address spoofing. When uRPF is enabled on an interface, the router examines incoming packets and checks its routing table to determine if the packet arrived on the optimal interface back to the source IP address. If the packet arrives on an unexpected interface or if no valid routing entry exists for that source IP, the router drops the packet. This prevents attackers from launching spoofed DoS attacks or bypassing perimeter access controls.

Question 216

Which cryptographic hash function produces a fixed 256-bit hash digest and belongs to the Secure Hash Algorithm 2 family?

1. Message Digest 5 (MD5) algorithm
2. Secure Hash Algorithm 1 (SHA-1)
3. Secure Hash Algorithm 256 (SHA-256)
4. Secure Hash Algorithm 384 (SHA-384)

Correct Answer: 3

Explanation:

Secure Hash Algorithm 256 (SHA-256) is a widely utilized cryptographic hash function that produces a fixed 256-bit (32-byte) hash digest, typically represented as a 64-character hexadecimal string. Part of the SHA-2 family standardized by NIST, SHA-256 provides strong collision resistance and data integrity verification. It is foundational to modern digital signatures, TLS certificates, blockchain technology, and secure file checksum validation, replacing older broken algorithms like MD5 and SHA-1.

Question 217

What cybersecurity framework developed by MITRE provides a comprehensive taxonomy of adversary tactics, techniques, and procedures (TTPs)?

1. MITRE ATT&CK knowledge base framework
2. Open Web Application Security Project standard
3. National Institute of Standards risk framework
4. Information Technology Infrastructure Library guide

Correct Answer: 1

Explanation:

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible, curated knowledge base of adversary tactics and techniques based on real-world observation. Security operations teams, threat hunters, and defenders utilize the ATT&CK framework to understand attacker behavior, map enterprise security monitoring coverage, evaluate detection tool effectiveness, and simulate adversary TTPs during threat emulation and penetration testing exercises.

Question 218

Which mechanism secures BGP peer authentication by embedding cryptographic hash checks into TCP session headers?

1. Resource Public Key Infrastructure (RPKI)
2. Dynamic ARP Inspection (DAI) filtering
3. Unicast Reverse Path Forwarding (uRPF)
4. TCP MD5 Signature Option (RFC 2385)

Correct Answer: 4

Explanation:

The TCP MD5 Signature Option—defined in RFC 2385—allows routers to authenticate BGP routing sessions by embedding a cryptographic hash (MAC) inside the TCP header of every BGP segment. Both peering routers are configured with a shared secret key, and any routing packet lacking the correct MD5 signature hash is automatically dropped. This prevents malicious actors from injecting forged BGP routing updates, hijacking prefixes, or conducting TCP reset attacks against critical core routing infrastructure.

Question 219

What software tool captures and analyzes raw network frames to assist with troubleshooting and security forensic investigations?

1. Layer 2 unmanaged Ethernet switch device
2. Packet analyzer utility (e.g., Wireshark)
3. Unshielded twisted-pair patch cable link
4. Passive network signal repeater hub

Correct Answer: 2

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications and detect anomalies.

Question 220

What internal security policy mandates dividing critical operational responsibilities among multiple individuals to prevent fraud and errors?

1. Principle of least privilege access
2. Defense in depth architectural strategy
3. Separation of duties governance policy
4. Zero Trust network verification model

Correct Answer: 3

Explanation:

Separation of duties is a foundational internal control and governance principle designed to prevent fraud, errors, and malicious activities by ensuring that no single individual maintains end-to-end control over a critical operational or financial transaction. By dividing sensitive workflows—such as financial authorizations, code deployments, or cryptographic key management—across multiple distinct roles, organizations enforce accountability and require collusion for malicious actions to succeed, significantly enhancing enterprise security posture and compliance alignment.