View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 261

What feature within the Cisco Identity Services Engine (ISE) collects endpoint attributes passively or actively to classify device types without requiring user authentication?

1. IEEE 802.1X port access control
2. Dynamic ARP Inspection filtering
3. Cisco ISE endpoint profiling service
4. Unicast Reverse Path Forwarding check

Correct Answer: 3

Explanation:

The Cisco Identity Services Engine (ISE) profiling service dynamically collects attributes from endpoints—using active probes like SNMP and HTTP, and passive listeners like DHCP, NetFlow, and MAC OUI lookups—to identify and classify device types (such as IP phones, printers, medical devices, or personal smartphones). This profiling data enables security administrators to enforce granular, role-based access control policies across the enterprise network automatically.

Question 262

Which XML-based open standard protocol is used for exchanging authentication and authorization data between an identity provider and a service provider for Single Sign-On?

1. Security Assertion Markup Language (SAML)
2. Simple Network Management Protocol v3
3. Lightweight Directory Access Protocol Secure
4. Dynamic Host Configuration Protocol daemon

Correct Answer: 1

Explanation:

Security Assertion Markup Language (SAML) is an open standard designed for exchanging authentication and authorization data securely in XML format, primarily used to enable web-based Single Sign-On (SSO) across disparate administrative domains. SAML allows users to log in once at an Identity Provider (IdP) and gain seamless access to multiple independent Service Providers (SPs) without re-entering credentials, improving user experience and centralizing credential management.

Question 263

What component of a Next-Generation Intrusion Prevention System rule defines the action, protocol, source/destination IP addresses, and port numbers?

1. Snort rule option metadata block
2. Application layer payload regex filter
3. Cryptographic hash file verification tag
4. Snort rule header structure

Correct Answer: 4

Explanation:

A Snort intrusion detection/prevention rule is structured into two main sections: the rule header and the rule options. The rule header defines the core characteristics of the packet filter, including the action (e.g., alert, drop, pass, log), the networking protocol (e.g., TCP, UDP, ICMP), source and destination IP addresses, and port numbers. The rule options section contains specific content matching patterns, thresholds, and message strings used to inspect payloads.

Question 264

Which feature on the Cisco Secure Email Gateway uses advanced heuristics and sandboxing to detect zero-day malware hidden within inbound email attachments?

1. Static sender domain blacklist blocking
2. Cisco Secure Email Outbreak Filters
3. Unencrypted Simple Mail Transfer relay
4. Dynamic Host Configuration lease table

Correct Answer: 2

Explanation:

Cisco Secure Email Outbreak Filters provide proactive protection against emerging email threats and zero-day malware campaigns before traditional signature updates become available. When a suspicious attachment or URL is detected, the Outbreak Filter quarantines the message and evaluates it in real time against threat intelligence feeds and sandbox threat engines. Once verified or remediated, the email is released to the recipient, effectively stopping advanced phishing and malware payloads.

Question 265

Within the IEEE 802.1X framework, what role does the intermediate network switch or wireless access point assume during the authentication exchange?

1. The Supplicant client endpoint device
2. The Authentication server database backend
3. The Authenticator gateway interface
4. The Certificate Authority validation server

Correct Answer: 3

Explanation:

The IEEE 802.1X framework consists of three core components: the Supplicant (the client device requesting access), the Authenticator (the network access device, such as a switch or wireless access point acting as a gatekeeper), and the Authentication Server (typically a RADIUS server like Cisco ISE). The Authenticator controls physical or logical port access, blocking traffic until the Supplicant successfully passes credentials to the Authentication Server.

Question 266

What Kubernetes security feature enforces network isolation by restricting traffic flow between pods based on namespace and label selectors?

1. Kubernetes Network Policies
2. Flat unsegmented container bridge
3. Unshielded twisted-pair patch link
4. Passive network packet capture tap

Correct Answer: 1

Explanation:

Kubernetes Network Policies are specifications that dictate how groups of pods are allowed to communicate with each other and with other network endpoints. By default, container communication in Kubernetes is non-namespaced and unisolated. Implementing Network Policies enables micro-segmentation at the container level, ensuring that workloads only accept authorized traffic and restricting lateral movement within containerized microservices architectures.

Question 267

Which metric group within the Common Vulnerability Scoring System (CVSS) evaluates characteristics of a vulnerability that remain constant over time and across user environments?

1. Temporal vulnerability metrics group
2. Environmental vulnerability metrics group
3. Exploitability operational index metrics
4. Base vulnerability metrics group

Correct Answer: 4

Explanation:

The Common Vulnerability Scoring System (CVSS) is divided into three metric groups: Base, Temporal, and Environmental. The Base metrics group captures the intrinsic characteristics of a vulnerability that are constant over time and invariant across user environments (such as Attack Vector, Privileges Required, and Confidentiality Impact). Temporal metrics measure characteristics that evolve over time (like exploit code maturity), while Environmental metrics customize scores to specific organizational deployments.

Question 268

What authentication and authorization protocol operates over TCP port 49, provides granular command-line authorization, and encrypts the entire packet payload?

1. Remote Authentication Dial-In User Service
2. Terminal Access Controller Access-Control System Plus (TACACS+)
3. Lightweight Directory Access Protocol Secure
4. Simple Network Management Protocol v3

Correct Answer: 2

Explanation:

TACACS+ (Terminal Access Controller Access-Control System Plus) is a Cisco-developed AAA protocol that operates over TCP port 49. Unlike RADIUS, which combines authentication and authorization and encrypts only the password field, TACACS+ separates AAA functions entirely, encrypts the entire packet payload for enhanced security, and provides granular command-line authorization down to individual device configuration commands.

Question 269

What cloud-based malware analysis platform provides automated behavioral sandboxing and threat intelligence integration for Cisco security products?

1. Cisco Firewall Management Center
2. Cisco Identity Services Engine
3. Cisco Secure Malware Analytics (Threat Grid)
4. Cisco Secure Network Analytics

Correct Answer: 3

Explanation:

Cisco Secure Malware Analytics—formerly known as Threat Grid—is a cloud-delivered threat intelligence and malware analysis platform that combines advanced static and dynamic sandbox analysis with comprehensive global threat intelligence feeds. It evaluates suspicious files and artifacts in isolated virtual environments, generating threat scores and indicators of compromise (IoCs) that integrate seamlessly across Cisco’s security portfolio.

Question 270

Which IPsec protocol provides data confidentiality, integrity, and anti-replay protection by encrypting the entire packet payload?

1. Encapsulating Security Payload (ESP) protocol
2. Authentication Header (AH) integrity protocol
3. Transport Layer Security (TLS) handshake
4. Secure Shell (SSH) remote protocol session

Correct Answer: 1

Explanation:

The Encapsulating Security Payload (ESP) is an IPsec protocol designed to provide comprehensive security services, including data confidentiality (encryption), data integrity, data origin authentication, and anti-replay protection. In contrast, the IPsec Authentication Header (AH) protocol provides integrity and authentication but lacks encryption capabilities, leaving packet payloads transmitted in clear text.

Question 271

What hardware-based security technology establishes a secure root of trust by storing cryptographic keys and validating firmware integrity during system boot?

1. Layer 2 unmanaged switch architecture
2. Passive network tapping signal hub
3. Unshielded twisted-pair patch cable
4. Hardware Trust Anchor / Secure Boot module

Correct Answer: 4

Explanation:

A hardware Trust Anchor—often implemented using a Trusted Platform Module (TPM) or specialized secure crypto-processor—provides an immutable hardware-based foundation for system security. During device startup, Secure Boot utilizes cryptographic keys stored in the hardware trust anchor to verify the digital signature of operating system boot loaders and firmware images. If any component has been tampered with or modified maliciously, the device halts the boot process, preventing compromised firmware execution.

Question 272

Within the Cisco Software-Defined Access (SDA) architecture, what centralized management platform orchestrates fabric provisioning, policy enforcement, and automation?

1. Cisco Firewall Management Center
2. Cisco Catalyst Center (formerly DNA Center)
3. Cisco Secure Client endpoint agent
4. Cisco Identity Services Engine node

Correct Answer: 2

Explanation:

Cisco Catalyst Center (formerly known as Cisco Digital Network Architecture Center or DNA Center) serves as the core management, automation, and orchestration engine for Cisco Software-Defined Access (SDA) networks. Catalyst Center works in tandem with the Cisco Identity Services Engine (ISE) to translate business intent into network policies, automate provisioning across campus fabrics, and monitor end-to-end network assurance.

Question 273

Which protocol acts as a simple identity verification layer built on top of the OAuth 2.0 authorization framework?

1. Simple Network Management Protocol v3
2. Unencrypted Lightweight Directory Access
3. OpenID Connect (OIDC) protocol
4. Trivial File Transfer Protocol utility

Correct Answer: 3

Explanation:

OpenID Connect (OIDC) is an interoperable authentication protocol built on top of the OAuth 2.0 framework. While OAuth 2.0 is strictly designed for authorization (granting third-party apps limited resource access), OIDC adds a standardized identity layer that allows client applications to verify user identity via secure JSON Web Tokens (JWT) known as ID tokens, enabling secure Single Sign-On.

Question 274

What vulnerability management process evaluates reported software flaws based on exploitability, asset criticality, and business impact to schedule patching?

1. Risk-based vulnerability prioritization and remediation
2. Passive network packet capture sniffing
3. Static source code fuzz testing
4. MAC address port security limiting

Correct Answer: 1

Explanation:

Risk-based vulnerability prioritization is a structured security methodology that moves beyond simple CVSS scoring by factoring in real-world exploitability intelligence, internal asset criticality, network exposure, and potential business impact. Because organizations cannot patch every discovered vulnerability simultaneously, risk-based prioritization ensures security teams focus remediation efforts on flaws actively being targeted by threat actors on critical assets.

Question 275

What network hardening practice isolates control plane traffic on Cisco routers and switches to prevent CPU resource exhaustion attacks?

1. Flat unsegmented network bridging
2. Unencrypted Telnet console access
3. Passive optical signal tapping
4. Control Plane Policing (CoPP)

Correct Answer: 4

Explanation:

Control Plane Policing (CoPP) is a security and QoS feature implemented on Cisco network hardware that utilizes Quality of Service (QoS) mechanisms to manage and rate-limit control plane traffic destined for the device’s CPU. By prioritizing legitimate routing protocols (like BGP and OSPF) and throttling excessive or malicious traffic streams (like ARP floods or DoS attacks), CoPP prevents CPU resource exhaustion and ensures network device stability.

Question 276

What SIEM data management process extracts specific log fields, converts timestamps, and assigns standardized event categories during ingestion?

1. Passive network sniffing capture
2. Log parsing and normalization
3. Cryptographic file hash verification
4. Dynamic IP address lease tracking

Correct Answer: 2

Explanation:

Log parsing and normalization is the foundational data ingestion pipeline within a SIEM platform where raw, unstructured log messages from diverse vendor systems are dissected. Parsing extracts specific attributes (such as source IP, username, and event ID), while normalization maps these fields into a unified schema, enabling efficient event correlation and multi-vendor threat analysis.

Question 277

During the SSL/TLS 1.3 handshake, which cryptographic mechanism is negotiated to ensure that session keys remain secure even if long-term private keys are compromised later?

1. Static RSA public key encryption
2. Plaintext symmetric session sharing
3. Ephemeral Diffie-Hellman Key Exchange (Forward Secrecy)
4. Electronic Codebook cipher mode

Correct Answer: 3

Explanation:

TLS 1.3 mandates the use of ephemeral Diffie-Hellman key exchange algorithms during the handshake process. Because keys are generated dynamically per session and discarded after connection termination, the protocol guarantees Forward Secrecy (Perfect Forward Secrecy). This ensures that an attacker who records encrypted traffic and later compromises the server’s long-term private key cannot decrypt past recorded sessions.

Question 278

What Cloud Access Security Broker (CASB) deployment mode utilizes direct API integrations with cloud service providers to inspect stored data and user configurations?

1. API-based CASB deployment mode
2. Inline forward proxy deployment
3. Reverse proxy authentication gateway
4. Passive network tap sniffing probe

Correct Answer: 1

Explanation:

API-based Cloud Access Security Broker (CASB) deployments connect directly to cloud service providers (such as Microsoft 365, Salesforce, or AWS) via administrative APIs. This out-of-band architecture allows security teams to scan stored data at rest, detect configuration drift, audit user permissions, and identify shadow IT usage without sitting in the inline traffic path or impacting user network latency.

Question 279

What incident response containment strategy involves logically or physically isolating a compromised endpoint from the network while preserving system memory for forensic analysis?

1. Disabling all enterprise internet circuits
2. Re-imaging the host operating system immediately
3. Deleting critical system log repositories
4. Endpoint isolation / network quarantine

Correct Answer: 4

Explanation:

Endpoint isolation—often executed via automated Endpoint Detection and Response (EDR) platforms—logically or physically quarantines a compromised host from the wider network while maintaining a secure management tunnel for security analysts. This containment strategy stops malware from spreading laterally across enterprise systems while preserving active RAM memory and local artifacts necessary for thorough digital forensics investigations.

Question 280

What threat intelligence framework provides standardized, structured JSON serialization formats for exchanging cyber threat indicators and actor profiles?

1. Common Vulnerability Scoring System (CVSS)
2. Structured Threat Information Expression (STIX)
3. Open Web Application Security Project (OWASP)
4. National Institute of Standards framework (NIST)

Correct Answer: 2

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed in a consistent manner. STIX covers threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions, working hand-in-hand with TAXII transport protocols.