View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 301

What protocol provides secure encrypted remote management console access?

1. Unencrypted Telnet remote management session
2. Secure Shell (SSH) cryptographic protocol
3. Trivial File Transfer Protocol utility
4. Simple Network Management Protocol v1

Correct Answer: 2

Explanation:

Secure Shell (SSH) is a cryptographic network protocol that enables secure administrative sessions, remote command execution, and file transfers over an unsecured network. Operating by default on TCP port 22, SSH replaces legacy plaintext protocols like Telnet by wrapping all communications—including login credentials and command outputs—in robust cryptographic encryption. This prevents eavesdropping, credential harvesting, and session hijacking by malicious threat actors positioned on the network path. Administrators rely heavily on SSH for secure switch and router management across enterprise infrastructure, ensuring operational integrity and strict compliance with organizational security hardening standards.

Question 302

Which tool captures raw network frames for forensic analysis?

1. Layer 2 unmanaged Ethernet switch
2. Packet analyzer utility such as Wireshark
3. Unshielded twisted-pair patch cable link
4. Passive optical network signal repeating hub

Correct Answer: 2

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications and detect unauthorized anomalies or data exfiltration attempts.

Question 303

What cryptographic algorithm is widely used for digital signatures?

1. Rivest-Shamir-Adleman (RSA) asymmetric cryptosystem
2. Message Digest 5 hashing algorithm
3. Advanced Encryption Standard symmetric cipher
4. Internet Protocol Security transport wrapper

Correct Answer: 1

Explanation:

The Rivest-Shamir-Adleman (RSA) cryptosystem is one of the earliest and most widely utilized public-key cryptographic algorithms. It relies on the mathematical difficulty of factoring the product of two large prime numbers. RSA is foundational to modern cybersecurity, providing robust mechanisms for secure data encryption, digital signatures, and key exchange protocols such as establishing TLS sessions. While newer elliptic-curve cryptography offers equivalent security with smaller key sizes, RSA remains a foundational cornerstone of enterprise Public Key Infrastructure deployments and digital certificate authentication mechanisms worldwide.

Question 304

Which protocol automates digital certificate lifecycle management over HTTP?

1. Simple Network Management Protocol version 3
2. Automated Certificate Management Environment (ACME) protocol
3. Lightweight Directory Access Protocol Secure
4. Dynamic Host Configuration Protocol daemon service

Correct Answer: 2

Explanation:

The Automated Certificate Management Environment (ACME) protocol is a communications protocol designed for automating interactions between certificate authorities and web servers, enabling the automated deployment of Public Key Infrastructure certificates without human intervention. Standardized and popularized by Let’s Encrypt, ACME allows web servers to verify domain ownership and request, renew, or revoke digital certificates securely over HTTPS, drastically reducing administrative overhead and eliminating catastrophic operational outages caused by expired digital certificates across enterprise environments.

Question 305

What switch security feature prevents unauthorized dynamic host servers?

1. Dynamic Host Configuration Protocol snooping
2. Port security MAC address limiting filter
3. Unicast Reverse Path Forwarding route check
4. Address Resolution Protocol dynamic inspection

Correct Answer: 1

Explanation:

DHCP snooping is a Layer 2 security technology built into enterprise switches that acts as a firewall between untrusted host devices and trusted DHCP servers. When enabled, DHCP snooping intercepts DHCP traffic, drops malicious DHCP server replies originating from untrusted ports, and builds a dynamic binding database tracking client IP addresses, MAC addresses, switch ports, and VLANs. This database is subsequently utilized by advanced features like Dynamic ARP Inspection and IP Source Guard to ensure comprehensive Layer 2 network integrity and prevent rogue server attacks.

Question 306

Which mechanism secures BGP routing sessions with cryptographic hashes?

1. Resource Public Key Infrastructure authorization
2. TCP MD5 Signature Option RFC 2385
3. Unicast Reverse Path Forwarding verification check
4. Dynamic ARP Inspection port filtering

Correct Answer: 2

Explanation:

The TCP MD5 Signature Option—defined in RFC 2385—allows routers to authenticate BGP peering sessions by embedding a cryptographic hash or message authentication code inside the TCP header of every BGP segment exchanged between peers. Both routers are pre-configured with a shared secret key, and any routing packet lacking the correct MD5 signature hash is automatically dropped by the receiving router. This prevents malicious actors from injecting forged BGP routing updates, hijacking network prefixes, or conducting TCP reset attacks against critical core routing infrastructure across global internet exchanges.

Question 307

What cloud security category continuously monitors configuration compliance posture?

1. Cloud Access Security Broker proxy
2. Firewall Management Center appliance
3. Cloud Security Posture Management tool
4. Dynamic Host Configuration server daemon

Correct Answer: 3

Explanation:

Cloud Security Posture Management (CSPM) tools are specialized security solutions designed to automate the continuous monitoring of multi-cloud environments—such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform—to detect configuration flaws, security risks, compliance violations, and identity management gaps. CSPM platforms provide automated remediation guidance and deep visibility into complex cloud asset inventories, helping security teams maintain a strong, compliant security posture across distributed cloud infrastructure without manual audits or operational delays.

Question 308

Which protocol provides centralized AAA services using UDP transport?

1. Terminal Access Controller Access-Control System Plus
2. Remote Authentication Dial-In User Service
3. Secure Shell remote administration console
4. Lightweight Directory Access Protocol Secure

Correct Answer: 2

Explanation:

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service. Operating primarily over UDP ports 1812 and 1813, traditional RADIUS encrypts only the user’s password within the access-request packet, while leaving the rest of the packet payload unencrypted. RADIUS combines authentication and authorization into a single process, making it widely deployed for enterprise network access control and remote VPN environments.

Question 309

What memory vulnerability occurs when applications overwrite adjacent buffers?

1. Structured Query Language injection flaw
2. Cross-site scripting web application bug
3. Buffer overflow vulnerability exploit
4. Address Resolution Protocol poisoning attack

Correct Answer: 3

Explanation:

A buffer overflow is a software vulnerability that occurs when a program or application attempts to store more data in a fixed-length memory buffer than the buffer was allocated to hold. Excess data overflows into adjacent memory locations, overwriting stored execution pointers or critical application data. Skilled attackers can craft malicious payloads that exploit buffer overflows to inject and execute arbitrary machine code, granting them system access or causing application crashes. Defending against buffer overflows requires rigorous bounds checking, safe programming practices, and compiler protections.

Question 310

Which protocol synchronizes network clocks securely using cryptographic keys?

1. Simple Network Management Protocol version 1
2. Dynamic Host Configuration Protocol daemon
3. Network Time Security protocol
4. Trivial File Transfer Protocol utility

Correct Answer: 3

Explanation:

Network Time Security (NTS) is a cryptographic extension of the Network Time Protocol designed to provide secure, authenticated time synchronization across computer networks. Traditional time synchronization protocols were highly vulnerable to spoofing, tampering, and man-in-the-middle attacks, allowing malicious actors to manipulate system clocks and disrupt time-sensitive security logs or Kerberos tickets. NTS addresses this by utilizing Transport Layer Security and authenticated encryption to secure time packets between clients and time servers, guaranteeing absolute temporal integrity.

Question 311

What threat intelligence format expresses observables using JSON serialization?

1. Structured Threat Information Expression
2. Common Vulnerability Scoring System
3. Syslog event logging stream format
4. Simple Network Management Protocol trap

Correct Answer: 1

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed consistently across security platforms. STIX covers a comprehensive range of threat data, including threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions. When paired with trusted automated exchange protocols like TAXII, STIX enables organizations to share real-time threat intelligence seamlessly and automate defensive security postures across enterprise environments.

Question 312

Which NIST incident response phase focuses on containment actions?

1. Preparation incident management phase
2. Detection and analysis phase
3. Containment, eradication, and recovery phase
4. Post-incident activity review phase

Correct Answer: 3

Explanation:

The National Institute of Standards and Technology incident response framework outlines four core operational phases: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity. The containment phase is critical during an active security breach, as it involves isolating affected network segments, disabling compromised user accounts, or taking infected hosts offline to prevent malware from spreading laterally across enterprise infrastructure prior to executing thorough eradication and system recovery steps, minimizing overall business disruption and data loss.

Question 313

What technology records endpoint behavioral telemetry for threat hunting?

1. Basic static antivirus software
2. Endpoint Detection and Response platform
3. Unmanaged Layer 2 Ethernet switch
4. Passive network signal tap hub

Correct Answer: 2

Explanation:

Endpoint Detection and Response (EDR) is a sophisticated cybersecurity technology that continuously monitors end-user devices, servers, and hosts to collect deep behavioral telemetry, detect suspicious activities, and provide automated containment capabilities. Unlike traditional signature-based antivirus software that relied on static file matching to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This granular behavioral visibility enables security operations teams and threat hunters to identify zero-day exploits, fileless malware attacks, and advanced persistent threats that successfully evade traditional perimeter defenses.

Question 314

Which security assessment technique simulates real-world targeted cyber attacks?

1. Static application source code review
2. Automated vulnerability port scanning
3. Penetration testing assessment engagement
4. Passive network traffic log sniffing

Correct Answer: 3

Explanation:

Penetration testing is an authorized, simulated cyber attack launched against a computer system, network, or web application to evaluate security posture and identify exploitable vulnerabilities. Performed by ethical hackers, penetration testing mimics the tactics, techniques, and procedures utilized by real-world threat actors to bypass defenses. The assessment uncovers weak configurations, unpatched software flaws, and architectural security gaps before malicious attackers can exploit them, ensuring organizations can remediate risks proactively.

Question 315

What enterprise network design limits lateral movement via micro-zones?

1. Flat unsegmented network topology
2. Micro-segmentation firewall policy
3. Passive signal repeating hub architecture
4. Unencrypted remote administration Telnet

Correct Answer: 2

Explanation:

Enterprise network micro-segmentation is an advanced security architecture that divides a data center or cloud environment into distinct, highly secure zones down to the workload or container level. By enforcing granular, perimeter-less firewall policies between individual servers and application tiers, micro-segmentation restricts lateral movement for attackers who manage to breach the initial network perimeter. Even if a single endpoint or server is compromised, containment policies prevent malware from spreading laterally across adjacent systems, protecting critical business data assets.

Question 316

Which tool automatically injects malformed inputs to discover crashes?

1. Static code review analysis tool
2. Passive network traffic logging agent
3. Application fuzz testing framework
4. Active network port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing or fuzzing is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook, ensuring robust application resilience against malicious input vectors.

Question 317

What cloud security gateway enforces enterprise policies for cloud services?

1. Cloud Access Security Broker (CASB)
2. Layer 2 unmanaged Ethernet switch
3. Basic passive network signal repeater
4. Unshielded twisted-pair patch cable

Correct Answer: 1

Explanation:

A Cloud Access Security Broker (CASB) is a software tool or service deployed between enterprise network consumers and cloud service providers to enforce security, governance, and compliance policies. As organizations transition workloads and data to Software-as-a-Service, Platform-as-a-Service, and Infrastructure-as-a-Service environments, CASBs provide critical visibility into shadow IT, monitor user behavior, detect data exfiltration attempts, enforce data loss prevention rules, and ensure encryption of sensitive corporate data across cloud perimeters.

Question 318

Which Wi-Fi security standard uses SAE for key establishment?

1. Wired Equivalent Privacy standard
2. Wi-Fi Protected Access 2 protocol
3. Wi-Fi Protected Access 3 Enterprise
4. Wi-Fi Protected Access 3 Personal

Correct Answer: 4

Explanation:

Wi-Fi Protected Access 3 Personal replaces traditional pre-shared key exchanges with Simultaneous Authentication of Equals (SAE), a secure key establishment protocol based on elliptic-curve cryptography. SAE ensures that even if users select weak or simple passphrases, attackers cannot capture over-the-air handshake packets and execute offline dictionary or brute-force attacks to recover the password, providing robust forward secrecy and significantly enhancing wireless network security across home and small office deployments.

Question 319

What routing security framework uses cryptographic Route Origin Authorizations?

1. Resource Public Key Infrastructure framework
2. Simple Network Management Protocol version 3
3. Dynamic ARP Inspection port mechanism
4. Port-based 802.1X network access control

Correct Answer: 1

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers, allowing routers to validate digital signatures before accepting routing updates.

Question 320

Which switch security feature drops IP traffic from unverified sources?

1. Dynamic Host Configuration Protocol snooping
2. IP Source Guard traffic filter
3. Port security MAC address limiting
4. Dynamic ARP Inspection mechanism

Correct Answer: 2

Explanation:

IP Source Guard is a Layer 2 security technology implemented on Cisco switches that filters out malicious or spoofed IP traffic by leveraging the binding database created by DHCP snooping and static IP source entries. When enabled on untrusted ports, IP Source Guard compares incoming IP packets against authorized IP-MAC-port bindings. Any packet arriving with a source IP address that does not match the binding database is immediately dropped, preventing malicious IP spoofing attacks at the access layer.