View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 241

What security technology uses machine learning to analyze behavioral anomalies in enterprise event logs and detect advanced threats?

1. Layer 2 unmanaged Ethernet switch
2. Security Information and Event Management (SIEM)
3. Basic passive network signal repeater
4. Unshielded twisted-pair patch cable

Correct Answer: 2

Explanation:

A Security Information and Event Management (SIEM) solution is a comprehensive enterprise security technology that aggregates, normalizes, and correlates log data collected from various hardware devices, operating systems, applications, and network infrastructure components. By centralizing log telemetry, SIEM platforms enable security operations centers to monitor real-time security events, detect advanced persistent threats, and identify behavioral anomalies that deviate from established baselines. They utilize pre-configured correlation rules, automated threat intelligence feeds, and machine learning algorithms to generate actionable alerts.

Question 242

Which cryptographic mode provides both data confidentiality and authentication simultaneously within symmetric block ciphers?

1. Electronic Codebook mode encryption
2. Cipher Block Chaining mode standard
3. Galois/Counter Mode authenticated encryption
4. Counter Mode cipher implementation

Correct Answer: 3

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly.

Question 243

What networking mechanism prevents IP spoofing by checking if packets arrive on the optimal interface back to the source IP?

1. Dynamic Host Configuration Protocol snooping
2. Address Resolution Protocol dynamic inspection
3. Unicast Reverse Path Forwarding (uRPF)
4. Port security MAC address limiting

Correct Answer: 3

Explanation:

Unicast Reverse Path Forwarding (uRPF) is a security and routing feature implemented on Cisco network devices to mitigate problems caused by malicious or accidental IP address spoofing. When uRPF is enabled on an interface, the router examines incoming packets and checks its routing table to determine if the packet arrived on the optimal interface back to the source IP address. If the packet arrives on an unexpected interface or if no valid routing entry exists for that source IP, the router drops the packet.

Question 244

Which security assessment technique involves an ethical hacker simulating real-world cyber attacks against an organization?

1. Static application source code review
2. Penetration testing assessment engagement
3. Passive network traffic log sniffing
4. Automated vulnerability port scanning

Correct Answer: 2

Explanation:

Penetration testing is an authorized, simulated cyber attack launched against a computer system, network, or web application to evaluate security posture and identify exploitable vulnerabilities. Performed by ethical hackers, penetration testing mimics the tactics, techniques, and procedures utilized by real-world threat actors to bypass defenses. The assessment uncovers weak configurations, unpatched software flaws, and architectural security gaps before malicious attackers can exploit them.

Question 245

What enterprise network design divides infrastructure into micro-zones to limit lateral movement after a security breach?

1. Flat unsegmented network topology
2. Micro-segmentation firewall policy
3. Passive signal repeating hub architecture
4. Unencrypted remote administration Telnet

Correct Answer: 2

Explanation:

Enterprise network micro-segmentation is an advanced security architecture that divides a data center or cloud environment into distinct, highly secure zones down to the workload or container level. By enforcing granular, perimeter-less firewall policies between individual servers and application tiers, micro-segmentation restricts lateral movement for attackers who manage to breach the initial network perimeter. Even if a single endpoint or server is compromised, containment policies prevent malware from spreading laterally across adjacent systems.

Question 246

Which automated tool injects malformed inputs into programs to discover memory exceptions and crashes?

1. Static code review analysis tool
2. Passive network traffic logging agent
3. Application fuzz testing (Fuzzing)
4. Active network port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing—or fuzzing—is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook.

Question 247

What endpoint security technology provides behavioral telemetry recording and automated process containment?

1. Basic static antivirus software
2. Passive network packet sniffer
3. Unshielded twisted-pair patch cable
4. Endpoint Detection and Response (EDR)

Correct Answer: 4

Explanation:

Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors end-user devices and hosts to collect telemetry, detect suspicious behaviors, and provide automated containment and remediation capabilities. Unlike traditional antivirus software that relied primarily on static file signatures to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This behavioral visibility enables security analysts to identify zero-day exploits and fileless malware attacks.

Question 248

Which threat intelligence schema standardizes the sharing of cyber threat information in JSON or XML format?

1. Structured Threat Information Expression (STIX)
2. Common Vulnerability Scoring System (CVSS)
3. Open Web Application Security Project (OWASP)
4. National Institute of Standards (NIST) framework

Correct Answer: 1

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed in a consistent manner. STIX covers a comprehensive range of threat data, including threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions. When paired with trusted automated exchange protocols like TAXII, STIX enables seamless sharing of real-time threat intelligence.

Question 249

What cryptographic mechanism generates unique session keys for every communication session to ensure past ciphertexts remain secure if long-term keys are compromised?

1. Static RSA public key encryption
2. Forward secrecy (Perfect Forward Secrecy)
3. Plaintext symmetric session key sharing
4. Electronic Codebook mode cipher encryption

Correct Answer: 2

Explanation:

Forward secrecy—often referred to as Perfect Forward Secrecy (PFS)—is a security feature of specific key agreement protocols that ensures session keys derived from public key cryptography are not compromised even if the private key of the server is compromised at a later date. PFS achieves this by generating a unique, temporary session key for every individual communication session using ephemeral Diffie-Hellman key exchanges. Because the long-term private key is never used directly to encrypt session data, past recorded ciphertexts remain completely secure.

Question 250

Which cloud deployment model provides computing resources exclusively managed and hosted for a single organization?

1. Public cloud shared multi-tenant environment
2. Hybrid cloud federated infrastructure
3. Community cloud collaborative platform
4. Private cloud dedicated hardware environment

Correct Answer: 4

Explanation:

A private cloud deployment model provides cloud computing resources dedicated exclusively to a single business organization, hosted either on-premises or managed externally by a third-party vendor. Unlike public cloud environments that pool virtualized infrastructure across multiple tenants, a private cloud maintains dedicated physical hardware, storage arrays, and network fabrics. This architecture delivers superior control, customization, and data privacy, making it an ideal choice for enterprises operating under strict regulatory compliance mandates.

Question 251

What security protocol synchronizes network clocks securely using cryptographic keys and TLS protection?

1. Simple Network Management Protocol v1
2. Dynamic Host Configuration Protocol
3. Network Time Security (NTS) protocol
4. Trivial File Transfer Protocol utility

Correct Answer: 3

Explanation:

Network Time Security (NTS) is a cryptographic extension of the Network Time Protocol designed to provide secure, authenticated time synchronization across computer networks. Traditional time synchronization protocols were highly vulnerable to spoofing, tampering, and man-in-the-middle attacks, allowing malicious actors to manipulate system clocks and disrupt time-sensitive security logs or Kerberos tickets. NTS addresses this by utilizing Transport Layer Security and authenticated encryption to secure time packets between clients and time servers.

Question 252

Which targeted phishing attack focuses specifically on high-profile corporate executives and decision-makers?

1. Low-volume automated credential stuffing
2. General broadcast spam email campaign
3. Whaling executive phishing attack
4. Standard network port scanning script

Correct Answer: 3

Explanation:

Whaling is a specialized form of spear phishing that specifically targets high-profile senior executives, chief executive officers, or individuals with privileged administrative access within an organization. Because these targets possess access to highly sensitive corporate data and financial authorization controls, attackers craft highly sophisticated, personalized social engineering messages—often masquerading as legal subpoenas, executive directives, or urgent board communications—to trick victims into transferring funds or divulging credentials.

Question 253

What specialized network appliance decrypts and inspects HTTPS traffic inline to detect hidden malware payloads?

1. Layer 2 unmanaged Ethernet switch
2. Basic passive network signal repeater hub
3. Unshielded twisted-pair patch cable
4. SSL/TLS decryption proxy appliance

Correct Answer: 4

Explanation:

An SSL/TLS decryption proxy is a specialized network security appliance placed inline to intercept, decrypt, inspect, and re-encrypt HTTPS web traffic passing between internal clients and external web servers. Because modern cyber threats frequently utilize encryption to evade traditional perimeter defenses, security teams deploy SSL decryption to allow next-generation firewalls and intrusion prevention systems to analyze underlying application payloads, detect embedded malware, and enforce organizational data loss prevention policies.

Question 254

Which discipline encompasses the collection, preservation, and analysis of digital evidence for legal investigations?

1. Network traffic packet sniffing
2. Computer digital forensics investigation
3. Static application source code review
4. Vulnerability assessment scanning

Correct Answer: 2

Explanation:

Computer digital forensics is a specialized branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often in relation to computer crime and security breaches. Digital forensics professionals follow strict chain-of-custody protocols to ensure that digital evidence—such as hard disk images, memory dumps, and log files—is collected, preserved, and analyzed without altering or contaminating the original data, ensuring legal admissibility.

Question 255

What security control calculates and compares cryptographic file hashes to detect unauthorized system file tampering?

1. Passive network traffic log analyzer
2. File integrity monitoring (FIM) software
3. Dynamic IP address leasing daemon
4. Unshielded twisted-pair cabling link

Correct Answer: 2

Explanation:

File integrity monitoring (FIM) is an automated security control and software mechanism that examines operating system files, application binaries, and configuration files to detect unauthorized modifications, tampering, or corruption. FIM tools typically calculate cryptographic hash baselines of critical system files during known-good states and continuously compare current file hashes against these baseline references. If an attacker modifies a system binary or alters configuration settings, the FIM engine instantly flags the discrepancy.

Question 256

Which framework defines organizational security guidelines structured around Identify, Protect, Detect, Respond, and Recover?

1. National Institute of Standards and Technology framework
2. Layer 2 Ethernet switching standard specification
3. Dynamic Host Configuration Protocol server protocol
4. Structured cabling patch panel wiring guide

Correct Answer: 1

Explanation:

The National Institute of Standards and Technology (NIST) Cybersecurity Framework provides a comprehensive, policy-based standard of guidelines, standards, and best practices designed to help organizations manage and reduce cybersecurity risk. Structured around five core functions—Identify, Protect, Detect, Respond, and Recover—the framework enables organizations of all sizes to assess their current security posture, establish target maturity levels, and communicate security requirements across business units.

Question 257

What centralized identity service provides Single Sign-On and federation across multiple enterprise cloud applications?

1. Active Directory federation and SSO
2. Passive packet analyzer diagnostic tool
3. Unshielded twisted-pair patch cable link
4. Layer 2 unmanaged Ethernet switch device

Correct Answer: 1

Explanation:

Active Directory federation and Single Sign-On (SSO) services provide centralized identity management and authentication validation across multiple disparate security domains, cloud platforms, and enterprise applications. Instead of requiring users to maintain separate credentials for every service, federation utilizes standardized protocols like Security Assertion Markup Language and OpenID Connect to securely pass authenticated identity tokens between trusted identity providers and service providers, reducing password fatigue.

Question 258

Which protocol provides centralized AAA services using UDP and encrypts only the password field within access-request packets?

1. TACACS+ protocol secure daemon
2. Secure Shell remote console service
3. Remote Authentication Dial-In User Service (RADIUS)
4. Lightweight Directory Access Protocol Secure

Correct Answer: 3

Explanation:

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service. Operating primarily over UDP ports 1812 and 1813, traditional RADIUS encrypts only the user’s password within the access-request packet, while leaving the rest of the packet payload unencrypted. RADIUS combines authentication and authorization into a single process, making it widely deployed for network access control and VPN environments.

Question 259

What cryptographic exploit attempts to find two distinct inputs that generate identical hash digests under a hash function?

1. Brute-force password decryption
2. Dictionary key recovery attack
3. Man-in-the-middle interception
4. Hash collision attack

Correct Answer: 4

Explanation:

A hash collision attack is a cryptographic exploit where an attacker attempts to find two distinct plaintext inputs that produce identical cryptographic hash values under a specific hash function (such as MD5 or SHA-1). Because cryptographic hash functions map arbitrarily large data sets to fixed-size outputs, collisions are mathematically possible, but a secure hash function makes finding them computationally infeasible. When a hashing algorithm suffers from collision vulnerabilities, it undermines digital signatures and certificate integrity.

Question 260

Which routing security framework uses cryptographic Route Origin Authorizations to prevent BGP prefix hijacking?

1. Resource Public Key Infrastructure (RPKI)
2. Simple Network Management Protocol v3
3. Dynamic ARP Inspection mechanism
4. Port-based 802.1X network access control

Correct Answer: 1

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers, allowing routers to validate digital signatures before accepting updates.