View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 281

Which firewall type inspects traffic up to Layer 7?

1. Packet filter firewall
2. Circuit-level gateway proxy
3. Next-Generation Firewall appliance
4. Layer 2 unmanaged bridge

Correct Answer: 3

Explanation:

A Next-Generation Firewall (NGFW) represents a massive evolutionary leap over traditional stateless or stateful inspection firewalls by providing deep packet inspection capabilities up to Layer 7 of the OSI model. While legacy packet filtering firewalls examined only transport-layer ports and network-layer IP addresses, an NGFW analyzes the actual application-layer payload. This allows enterprise security teams to identify specific applications, inspect web traffic, detect complex malware signatures, enforce granular user-based access control policies, and integrate tightly with external threat intelligence feeds and intrusion prevention systems to defend corporate infrastructure against modern, sophisticated cyber threats.

Question 282

What AAA protocol encrypts the entire packet payload?

1. TACACS+ protocol secure daemon
2. Remote Authentication Dial-In User Service
3. Lightweight Directory Access Protocol Secure
4. Unencrypted Telnet console utility

Correct Answer: 1

Explanation:

Terminal Access Controller Access-Control System Plus (TACACS+) is a Cisco-developed AAA protocol that operates over TCP port 49, providing robust, centralized authentication, authorization, and accounting management for administrative access to network devices. Unlike traditional RADIUS—which combines authentication and authorization into a single process and encrypts only the password field within access-request packets—TACACS+ separates all three AAA functions completely. Furthermore, TACACS+ encrypts the entire packet payload of every communication between the network device and the TACACS+ server, ensuring that sensitive command inputs, administrative usernames, and operational data remain entirely secure from network eavesdroppers and packet-sniffing adversaries.

Question 283

Which Wi-Fi standard implements Simultaneous Authentication of Equals?

1. Wired Equivalent Privacy standard
2. Wi-Fi Protected Access 2 (WPA2)
3. Wi-Fi Protected Access 3 (WPA3-Personal)
4. Unencrypted open wireless network

Correct Answer: 3

Explanation:

Wi-Fi Protected Access 3 (WPA3-Personal) introduces modern cryptographic enhancements to wireless security, replacing traditional pre-shared key handshakes with the Simultaneous Authentication of Equals (SAE) protocol based on robust elliptic-curve cryptography. In legacy WPA2 systems, attackers could capture over-the-air 4-way handshakes and execute offline dictionary or brute-force password guessing attacks against weak or short pre-shared passphrases. SAE eliminates this vulnerability by ensuring that each connection establishes a unique, securely negotiated cryptographic key through a peer-to-peer exchange, preventing offline password recovery even when users select simple, human-memorable Wi-Fi passphrases.

Question 284

What SIEM process standardizes disparate log formats together?

1. Log normalization and parsing
2. Passive network traffic sniffing
3. Active vulnerability port scanning
4. Static application source code compilation

Correct Answer: 1

Explanation:

Log normalization and parsing is a foundational data ingestion process within Security Information and Event Management (SIEM) architectures. Because enterprise environments consist of diverse hardware devices, operating systems, applications, and security sensors—each utilizing completely distinct syntax, timestamps, and log formatting conventions—raw logs must be systematically parsed and converted into a unified, structured schema. Normalization ensures that identical security events generated by multi-vendor equipment are represented uniformly. This enables SIEM correlation engines to analyze multi-stage attack patterns efficiently, track threat indicators across disparate platforms, and provide security analysts with clear, actionable insights without syntax confusion.

Question 285

What PKI component issues and signs digital certificates?

1. Registration Authority validator
2. Certificate Authority server
3. Online Certificate Status Protocol responder
4. Hardware Security Module unit

Correct Answer: 2

Explanation:

A Certificate Authority (CA) is a trusted entity within a Public Key Infrastructure (PKI) responsible for issuing, signing, and managing digital certificates used for cryptographic authentication and secure communications. The CA validates the identity of certificate applicants and signs certificates using its private key, establishing a cryptographically verifiable chain of trust across enterprise systems. In addition to initial certificate issuance, the CA manages lifecycle operations, including publishing Certificate Revocation Lists (CRLs), issuing cryptographic updates, and supporting automated validation services to ensure that compromised or expired certificates are immediately invalidated across the enterprise architecture.

Question 286

Which IPsec mode encrypts only the data payload?

1. IPsec Tunnel mode architecture
2. Authentication Header integrity mode
3. IPsec Transport mode implementation
4. Gateway-to-gateway VPN encapsulation

Correct Answer: 3

Explanation:

IPsec Transport mode encrypts only the payload (the data portion) of the IP packet, leaving the original IP header unencrypted so that intermediate routing devices can examine source and destination addresses directly along the transmission path. Transport mode is primarily utilized for secure host-to-host communications, such as secure remote management sessions between an administrator and a server. In contrast, IPsec Tunnel mode encrypts both the entire original IP packet and its header, encapsulating it inside a new IP packet wrapper with a fresh header, making it the preferred choice for secure site-to-site VPN tunnels spanning public networks.

Question 287

What security paradigm enforces the principle of never trusting?

1. Perimeter defense security model
2. Zero Trust Architecture (ZTA)
3. Flat unsegmented network topology
4. Open network trust architecture

Correct Answer: 2

Explanation:

Zero Trust Architecture (ZTA) is a modern cybersecurity paradigm that fundamentally eliminates the concept of implicit trust based solely on network location, such as being physically located inside the corporate perimeter firewall. Under a Zero Trust model, every user, device, and application request—regardless of whether it originates from inside or outside the corporate network—must be continuously authenticated, authorized, and validated before gaining access to enterprise resources. ZTA relies heavily on micro-segmentation, multi-factor authentication, least privilege access policies, and real-time behavioral monitoring to prevent lateral movement and contain breaches effectively.

Question 288

What technology records endpoint behavioral telemetry for threat hunting?

1. Basic static antivirus software
2. Endpoint Detection and Response (EDR)
3. Unmanaged Layer 2 Ethernet switch
4. Passive network signal tap hub

Correct Answer: 2

Explanation:

Endpoint Detection and Response (EDR) is a sophisticated cybersecurity technology that continuously monitors end-user devices, servers, and hosts to collect deep behavioral telemetry, detect suspicious activities, and provide automated containment capabilities. Unlike traditional signature-based antivirus software that relied on static file matching to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This granular behavioral visibility enables security operations teams and threat hunters to identify zero-day exploits, fileless malware attacks, and advanced persistent threats that successfully evade traditional perimeter defenses.

Question 289

What protocol authenticates BGP sessions using MD5 hashes?

1. Resource Public Key Infrastructure framework
2. TCP MD5 Signature Option (RFC 2385)
3. Unicast Reverse Path Forwarding check
4. Spanning Tree Protocol mechanism

Correct Answer: 2

Explanation:

The TCP MD5 Signature Option—defined in RFC 2385—allows routers to authenticate BGP peering sessions by embedding a cryptographic hash (Message Authentication Code) inside the TCP header of every BGP segment exchanged between peers. Both routers are pre-configured with a shared secret key, and any routing packet lacking the correct MD5 signature hash is automatically dropped by the receiving router. This prevents malicious actors from injecting forged BGP routing updates, hijacking network prefixes, or conducting TCP reset attacks against critical core routing infrastructure across internet exchanges.

Question 290

What specialized security device protects web application HTTP traffic?

1. Unmanaged Layer 2 Ethernet switch
2. Web Application Firewall (WAF)
3. Passive network packet sniffer tool
4. Unshielded twisted-pair patch cable

Correct Answer: 2

Explanation:

A Web Application Firewall (WAF) is a specialized security appliance or cloud service designed to protect web applications by filtering, monitoring, and blocking HTTP/HTTPS traffic traveling between web applications and client browsers. Unlike traditional network firewalls that operate at lower OSI layers, a WAF inspects Layer 7 application traffic specifically to detect and prevent common web exploits—such as SQL injection, cross-site scripting, local file inclusion, and cookie tampering—before malicious requests reach application backend databases, ensuring web service integrity.

Question 291

What cloud tool continuously monitors multi-cloud configuration compliance?

1. Cloud Security Posture Management (CSPM) tool
2. Cloud Access Security Broker proxy
3. Firewall Management Center appliance
4. Dynamic Host Configuration server daemon

Correct Answer: 1

Explanation:

Cloud Security Posture Management (CSPM) tools are specialized security solutions designed to automate the continuous monitoring of multi-cloud environments—such as AWS, Microsoft Azure, and Google Cloud Platform—to detect configuration flaws, security risks, compliance violations, and identity management gaps. CSPM platforms provide automated remediation guidance and deep visibility into complex cloud asset inventories, helping security teams maintain a strong, compliant security posture across distributed cloud infrastructure without manual audits.

Question 292

Which block cipher mode provides authenticated encryption simultaneously?

1. Electronic Codebook (ECB) cipher mode
2. Cipher Block Chaining (CBC) standard
3. Galois/Counter Mode (GCM) encryption
4. Plaintext session key sharing method

Correct Answer: 3

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly, making it essential for secure protocols like TLS 1.3.

Question 293

What structured format expresses cyber threat intelligence information?

1. Structured Threat Information Expression (STIX)
2. Common Vulnerability Scoring System (CVSS)
3. Syslog event logging stream format
4. Simple Network Management Protocol trap

Correct Answer: 1

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed consistently across security platforms. STIX covers a comprehensive range of threat data, including threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions. When paired with trusted automated exchange protocols like TAXII, STIX enables organizations to share real-time threat intelligence seamlessly and automate defensive postures.

Question 294

What IEEE standard provides port-based network access control?

1. IEEE 802.1Q trunking specification
2. IEEE 802.1X port-based access control
3. IEEE 802.11ac wireless LAN standard
4. IEEE 802.1w Rapid Spanning Tree

Correct Answer: 2

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a wired LAN or wireless WLAN. 802.1X uses the Extensible Authentication Protocol (EAP) to pass authentication messages between the supplicant client, the network access device (authenticator), and a centralized authentication server (such as RADIUS or Cisco ISE). Until the client successfully authenticates, the switch port blocks all non-EAP traffic, preventing unauthorized or rogue endpoints from accessing enterprise network resources.

Question 295

Which DNS extension uses cryptographic signatures for integrity?

1. Domain Name System Security Extensions (DNSSEC)
2. Dynamic Host Configuration Protocol option
3. Dynamic DNS (DDNS) record update
4. Network Time Protocol synchronization

Correct Answer: 1

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the IETF to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in authentication, leaving them vulnerable to cache poisoning and spoofing attacks. DNSSEC addresses this by cryptographically signing DNS records using public key cryptography. This allows client resolvers to verify the authenticity and integrity of responses, ensuring users connect to legitimate destination servers without interception.

Question 296

Which NIST incident response phase focuses on containment?

1. Preparation incident management phase
2. Detection and analysis phase
3. Containment, eradication, and recovery phase
4. Post-incident activity review phase

Correct Answer: 3

Explanation:

The National Institute of Standards and Technology (NIST) incident response framework outlines four core operational phases: (1) Preparation, (2) Detection and Analysis, (3) Containment, Eradication, and Recovery, and (4) Post-Incident Activity. The containment phase is critical during an active security breach, as it involves isolating affected network segments, disabling compromised user accounts, or taking infected hosts offline to prevent malware from spreading laterally across enterprise infrastructure prior to executing thorough eradication and system recovery steps.

Question 297

What Kubernetes feature restricts pod network traffic flows?

1. Kubernetes Network Policies specification
2. Container bridge network interface
3. Pod volume storage mount configuration
4. Docker swarm cluster orchestration

Correct Answer: 1

Explanation:

Kubernetes Network Policies are specifications that dictate how groups of pods are allowed to communicate with each other and with other network endpoints. By default, container communication in Kubernetes is non-namespaced and unisolated. Implementing Network Policies enables micro-segmentation at the container level, ensuring that workloads only accept authorized traffic and restricting lateral movement within containerized microservices architectures, protecting applications from compromise.

Question 298

What scoring system rates software vulnerability severity characteristics?

1. OWASP Top 10 web vulnerabilities
2. Common Vulnerability Scoring System (CVSS)
3. MITRE ATT&CK adversary framework
4. NIST SP 800-53 security controls

Correct Answer: 2

Explanation:

The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework used to assess and rate the severity of computer system security vulnerabilities. CVSS provides a standardized method for measuring vulnerability characteristics through Base, Temporal, and Environmental metric groups, generating numerical scores ranging from 0.0 to 10.0. Security teams, vulnerability managers, and software vendors rely heavily on CVSS scores to prioritize patching efforts, evaluate risk exposure, and communicate urgency across IT and security operations.

Question 299

Which standard uses cryptographic digital signatures for emails?

1. Sender Policy Framework (SPF)
2. Domain-based Message Authentication and Reporting
3. DomainKeys Identified Mail (DKIM)
4. Simple Mail Transfer Protocol (SMTP)

Correct Answer: 3

Explanation:

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a cryptographic mechanism to validate a domain name identity associated with a message through digital signing. The sending mail server signs the email header and body hashes with a private key, and the receiving server validates the signature using the sender’s public key published in the domain’s DNS records. DKIM ensures that the email was genuinely sent by the domain owner and that the message payload was not altered in transit.

Question 300

What switch feature protects against rogue DHCP servers?

1. Port security MAC address limiting
2. DHCP snooping Layer 2 filter
3. Dynamic ARP Inspection mechanism
4. Unicast Reverse Path Forwarding check

Correct Answer: 2

Explanation:

DHCP snooping is a Layer 2 security technology built into enterprise switches that acts as a firewall between untrusted host devices and trusted DHCP servers. When enabled, DHCP snooping intercepts DHCP traffic, drops malicious DHCP server replies originating from untrusted ports (mitigating rogue DHCP server attacks), and builds a dynamic binding database tracking client IP addresses, MAC addresses, switch ports, and VLANs. This database is subsequently utilized by features like Dynamic ARP Inspection and IP Source Guard to ensure network integrity.