View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 321

Which device acts as an inline packet filtering firewall?

1. Layer 2 unmanaged switch device
2. Passive network traffic sniffing tap
3. Next-Generation Firewall appliance
4. Unshielded twisted-pair patch cable link

Correct Answer: 3

Explanation:

A Next-Generation Firewall appliance serves as an advanced inline network security device that goes far beyond traditional packet filtering by performing deep packet inspection up to Layer 7 of the OSI model. While legacy firewalls evaluated only source and destination IP addresses and port numbers, an NGFW inspects application-layer traffic payloads to identify specific applications, detect sophisticated malware signatures, prevent intrusion attempts, and enforce granular security policies across modern corporate networks. By integrating intrusion prevention, URL filtering, and malware sandboxing capabilities directly into a single unified platform, NGFWs provide robust perimeter and internal segmentation defense for enterprise IT environments.

Question 322

What protocol provides secure remote command-line console access?

1. Unencrypted Telnet remote console service
2. Trivial File Transfer Protocol utility server
3. Simple Network Management Protocol version 1
4. Secure Shell (SSH) cryptographic protocol

Correct Answer: 4

Explanation:

Secure Shell (SSH) is a cryptographic network protocol that enables secure administrative sessions, remote command execution, and file transfers over an unsecured network. Operating by default on TCP port 22, SSH replaces legacy plaintext protocols like Telnet by wrapping all communications—including login credentials and command outputs—in robust cryptographic encryption. This prevents eavesdropping, credential harvesting, and session hijacking by malicious threat actors positioned on the network path. Administrators rely heavily on SSH for secure switch and router management across enterprise infrastructure, ensuring operational integrity and strict compliance with organizational security hardening standards.

Question 323

Which metric group evaluates intrinsic vulnerability characteristics consistently?

1. Temporal vulnerability metrics group
2. Environmental vulnerability metrics group
3. Base vulnerability metrics group
4. Exploitability operational index metrics

Correct Answer: 3

Explanation:

The Common Vulnerability Scoring System (CVSS) is divided into three core metric groups: Base, Temporal, and Environmental. The Base metrics group captures the intrinsic characteristics of a vulnerability that remain constant over time and are invariant across user environments, such as Attack Vector, Privileges Required, and Confidentiality Impact. Temporal metrics measure characteristics that evolve over time, such as exploit code maturity and remediation availability, while Environmental metrics customize scores to specific organizational deployments. Understanding the Base metric group allows security teams to evaluate the fundamental severity of a software flaw objectively regardless of where it is deployed.

Question 324

What security feature protects switch ports against rogue servers?

1. Dynamic Host Configuration Protocol snooping
2. Port security MAC address limiting filter
3. Unicast Reverse Path Forwarding route check
4. Address Resolution Protocol dynamic inspection

Correct Answer: 1

Explanation:

DHCP snooping is a Layer 2 security technology built into enterprise switches that acts as a firewall between untrusted host devices and trusted DHCP servers. When enabled, DHCP snooping intercepts DHCP traffic, drops malicious DHCP server replies originating from untrusted ports, and builds a dynamic binding database tracking client IP addresses, MAC addresses, switch ports, and VLANs. This database is subsequently utilized by advanced features like Dynamic ARP Inspection and IP Source Guard to ensure comprehensive Layer 2 network integrity and prevent rogue server attacks that could otherwise redirect default gateways or facilitate man-in-the-middle exploits across campus environments.

Question 325

Which cryptographic mechanism ensures forward secrecy during handshakes?

1. Static RSA public key encryption
2. Ephemeral Diffie-Hellman Key Exchange
3. Plaintext symmetric session key sharing
4. Electronic Codebook cipher mode encryption

Correct Answer: 2

Explanation:

Forward secrecy—often referred to as Perfect Forward Secrecy—is a security feature of specific key agreement protocols that ensures session keys derived from public key cryptography are not compromised even if the long-term private key of the server is compromised at a later date. Ephemeral Diffie-Hellman key exchanges achieve this by generating a unique, temporary session key for every individual communication session and discarding it afterwards. Because the long-term private key is never used directly to encrypt session data, past recorded ciphertexts remain completely secure against retrospective decryption attempts by advanced threat actors.

Question 326

What framework categorizes real-world adversary tactics and techniques?

1. MITRE ATT&CK knowledge base framework
2. Open Web Application Security Project standard
3. National Institute of Standards risk framework
4. Information Technology Infrastructure Library guide

Correct Answer: 1

Explanation:

MITRE ATT&CK is a globally accessible, curated knowledge base of adversary tactics and techniques based on real-world observation. Security operations teams, threat hunters, and defenders utilize the ATT&CK framework to understand attacker behavior, map enterprise security monitoring coverage, evaluate detection tool effectiveness, and simulate adversary tactics during threat emulation and penetration testing exercises. By categorizing methods from initial compromise to data exfiltration, ATT&CK provides a common taxonomy that empowers security professionals to strengthen defenses against specific threat actor behaviors.

Question 327

Which component within Cisco ISE provides centralized policy administration?

1. Basic unmanaged Layer 2 switch hardware
2. Passive network traffic signal analyzer tool
3. Policy Administration Node (PAN)
4. Unshielded twisted-pair patch cable link

Correct Answer: 3

Explanation:

Within a distributed Cisco Identity Services Engine (ISE) deployment, the Policy Administration Node (PAN) serves as the central administrative interface responsible for system configuration, policy creation, profiling management, and administrative reporting. Deploying ISE in a distributed architecture separates administration, policy service, and monitoring functions across dedicated nodes to ensure high availability, scalability, and robust performance across large enterprise environments. The PAN pushes compiled policies down to Policy Service Nodes, allowing network access control rules to be enforced uniformly and efficiently across multi-site campus and branch deployments.

Question 328

What protocol manages threat intelligence exchange over HTTPS?

1. Trusted Automated Exchange of Intelligence Information (TAXII)
2. Simple Network Management Protocol version 3 daemon
3. Dynamic Host Configuration Protocol service utility
4. Trivial File Transfer Protocol transfer mechanism

Correct Answer: 1

Explanation:

Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol designed for the secure, automated transmission and exchange of cyber threat intelligence information. Standardized as a RESTful web service operating over HTTPS, TAXII works hand-in-hand with Structured Threat Information Expression formatted data, allowing security systems, SOC platforms, and intelligence feeds to share indicators of compromise and threat actor profiles seamlessly. By automating intelligence feeds, TAXII enables security infrastructure to ingest new threat data rapidly and update defensive rules without manual administrative intervention.

Question 329

Which Kubernetes feature restricts pod network traffic communication?

1. Kubernetes Network Policies specification
2. Container bridge network interface
3. Pod volume storage mount configuration
4. Docker swarm cluster orchestration

Correct Answer: 1

Explanation:

Kubernetes Network Policies are specifications that dictate how groups of pods are allowed to communicate with each other and with other network endpoints. By default, container communication in Kubernetes is non-namespaced and unisolated, allowing any pod to reach any other pod across the cluster. Implementing Network Policies enables micro-segmentation at the container level, ensuring that workloads only accept authorized traffic and restricting lateral movement within containerized microservices architectures, protecting applications from compromise even if a single microservice is breached.

Question 330

What tool monitors cloud configurations for compliance posture?

1. Cloud Security Posture Management (CSPM) tool
2. Cloud Access Security Broker proxy
3. Firewall Management Center appliance
4. Dynamic Host Configuration server daemon

Correct Answer: 1

Explanation:

Cloud Security Posture Management (CSPM) tools are specialized security solutions designed to automate the continuous monitoring of multi-cloud environments—such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform—to detect configuration flaws, security risks, compliance violations, and identity management gaps. CSPM platforms provide automated remediation guidance and deep visibility into complex cloud asset inventories, helping security teams maintain a strong, compliant security posture across distributed cloud infrastructure without manual audits or operational delays.

Question 331

Which email authentication standard utilizes cryptographic digital signatures?

1. Sender Policy Framework (SPF)
2. Domain-based Message Authentication and Reporting
3. DomainKeys Identified Mail (DKIM)
4. Simple Mail Transfer Protocol (SMTP)

Correct Answer: 3

Explanation:

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a cryptographic mechanism to validate a domain name identity associated with a message through digital signing. The sending mail server signs the email header and body hashes with a private key, and the receiving server validates the signature using the sender’s public key published in the domain’s DNS records. DKIM ensures that the email was genuinely sent by the domain owner and that the message payload was not altered in transit, preventing sophisticated phishing attacks.

Question 332

What encryption mode provides simultaneous data confidentiality and integrity?

1. Electronic Codebook (ECB) cipher mode
2. Cipher Block Chaining (CBC) standard
3. Galois/Counter Mode (GCM) encryption
4. Plaintext session key sharing method

Correct Answer: 3

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly, making it essential for secure protocols like TLS 1.3.

Question 333

Which protocol secures directory service queries over TLS?

1. Unencrypted Lightweight Directory Access Protocol (LDAP)
2. Lightweight Directory Access Protocol Secure (LDAPS)
3. Trivial File Transfer Protocol directory utility
4. Simple Network Management Protocol daemon

Correct Answer: 2

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of LDAP that encrypts all communications between client applications and directory service servers using Transport Layer Security or Secure Sockets Layer. Standard LDAP transmits directory queries, user attributes, and passwords in clear text over TCP port 389, leaving them vulnerable to packet sniffing and credential harvesting. LDAPS operates by default over TCP port 636, wrapping directory transactions in cryptographic privacy to protect enterprise authentication data and user directory attributes from internal and external adversaries.

Question 334

What routing security feature drops packets with spoofed sources?

1. Dynamic Host Configuration Protocol snooping
2. Unicast Reverse Path Forwarding (uRPF)
3. Port security MAC address limiting
4. Address Resolution Protocol dynamic inspection

Correct Answer: 2

Explanation:

Unicast Reverse Path Forwarding (uRPF) is a security and routing feature implemented on Cisco network devices to mitigate problems caused by malicious or accidental IP address spoofing. When uRPF is enabled on an interface, the router examines incoming packets and checks its routing table to determine if the packet arrived on the optimal interface back to the source IP address. If the packet arrives on an unexpected interface or if no valid routing entry exists for that source IP, the router drops the packet. This prevents attackers from launching spoofed DoS attacks or bypassing perimeter access controls.

Question 335

Which standard defines port-based network access control authentication?

1. IEEE 802.1Q trunking specification
2. IEEE 802.1X port-based access control
3. IEEE 802.11ac wireless LAN standard
4. IEEE 802.1w Rapid Spanning Tree

Correct Answer: 2

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a wired LAN or wireless WLAN. 802.1X uses the Extensible Authentication Protocol to pass authentication messages between the supplicant client, the network access device acting as an authenticator, and a centralized authentication server such as RADIUS or Cisco ISE. Until the client successfully authenticates, the switch port blocks all non-EAP traffic, preventing unauthorized or rogue endpoints from accessing enterprise network resources.

Question 336

What security device actively blocks malicious network intrusion attempts?

1. Layer 2 unmanaged Ethernet bridge switch
2. Passive network signal sniffing tap hub
3. Intrusion Prevention System (IPS) appliance
4. Unshielded twisted-pair patch cable link

Correct Answer: 3

Explanation:

An Intrusion Prevention System (IPS) is an advanced inline security appliance designed to monitor network traffic for malicious activities, policy violations, and known attack signatures with the capability to actively block or drop identified threats in real time. Unlike passive Intrusion Detection Systems that merely generate alerts, an IPS sits directly in the data path of network traffic flows to terminate malicious connection sessions instantly. By executing signature matching, protocol anomaly detection, and heuristic analysis inline, an IPS provides critical frontline defense against network exploits.

Question 337

Which automated testing technique injects malformed inputs into programs?

1. Static code review analysis tool
2. Passive network traffic logging agent
3. Application fuzz testing (Fuzzing)
4. Active network port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing or fuzzing is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook, ensuring robust application resilience against malicious input vectors.

Question 338

What hardware module establishes a secure boot root of trust?

1. Layer 2 unmanaged switch architecture
2. Passive network tapping signal hub
3. Unshielded twisted-pair patch cable
4. Trusted Platform Module (TPM) / Trust Anchor

Correct Answer: 4

Explanation:

A hardware Trust Anchor or Trusted Platform Module provides an immutable hardware-based foundation for system security. During device startup, Secure Boot utilizes cryptographic keys stored in the hardware trust anchor to verify the digital signature of operating system boot loaders and firmware images. If any component has been tampered with or modified maliciously, the device halts the boot process, preventing compromised firmware execution. This hardware-level validation guarantees that the underlying platform has not been subverted by rootkits or persistent firmware implants.

Question 339

Which SIEM component aggregates and normalizes raw log data?

1. SIEM event collection and normalization engine
2. Passive network packet capture sniffer tool
3. Static cryptographic file integrity hash scanner
4. Dynamic IP address lease tracking daemon

Correct Answer: 1

Explanation:

The SIEM event collection and normalization engine is a foundational data ingestion pipeline within a Security Information and Event Management platform where raw, unstructured log messages from diverse vendor systems are dissected and standardized. Parsing extracts specific attributes such as source IP, username, and event ID, while normalization maps these fields into a unified schema, enabling efficient event correlation and multi-vendor threat analysis. This ensures security analysts can review standardized events across heterogeneous operating systems and network devices without syntax confusion.

Question 340

What governance principle divides critical operational responsibilities among individuals?

1. Principle of least privilege access
2. Defense in depth architectural strategy
3. Separation of duties governance policy
4. Zero Trust network verification model

Correct Answer: 3

Explanation:

Separation of duties is a foundational internal control and governance principle designed to prevent fraud, errors, and malicious activities by ensuring that no single individual maintains end-to-end control over a critical operational or financial transaction. By dividing sensitive workflows—such as financial authorizations, code deployments, or cryptographic key management—across multiple distinct roles, organizations enforce accountability and require collusion for malicious actions to succeed, significantly enhancing enterprise security posture and compliance alignment.