View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 361

Which protocol enables secure remote administrative command-line access sessions?

1. Unencrypted Telnet remote management session protocol
2. Secure Shell (SSH) cryptographic network management protocol
3. Trivial File Transfer Protocol file utility daemon
4. Simple Network Management Protocol version 1 service

Correct Answer: 2

Explanation:

Secure Shell (SSH) is a cryptographic network protocol that enables secure administrative sessions, remote command execution, and file transfers over an unsecured network. Operating by default on TCP port 22, SSH replaces legacy plaintext protocols like Telnet by wrapping all communications—including login credentials and command outputs—in robust cryptographic encryption. This prevents eavesdropping, credential harvesting, and session hijacking by malicious threat actors positioned on the network path. Administrators rely heavily on SSH for secure switch and router management across enterprise infrastructure, ensuring operational integrity and strict compliance with organizational security hardening standards.

Question 362

What network service automates IP address assignment dynamically?

1. Dynamic Host Configuration Protocol (DHCP) service
2. Domain Name System resolution server daemon
3. Network Time Protocol synchronization utility service
4. Unmanaged Layer 2 Ethernet bridge switch

Correct Answer: 1

Explanation:

The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used to automate the process of configuring devices on IP networks, allowing them to use network services such as DNS, NTP, and any other communication protocol based on UDP. DHCP eliminates the need for network administrators to manually assign static IP addresses to every client endpoint, printer, or server entering the enterprise environment. By managing a centralized pool of IP addresses and leasing them out for defined time intervals, DHCP ensures efficient address utilization, prevents configuration conflicts, and integrates smoothly with security features like DHCP snooping and IP Source Guard.

Question 363

Which cryptographic algorithm provides asymmetric public-key encryption services?

1. Advanced Encryption Standard symmetric block cipher
2. Rivest-Shamir-Adleman (RSA) asymmetric cryptographic algorithm
3. Message Digest 5 cryptographic hashing function
4. Secure Hash Algorithm 256-bit message digest

Correct Answer: 2

Explanation:

The Rivest-Shamir-Adleman (RSA) cryptosystem is one of the earliest and most widely utilized public-key cryptographic algorithms. It relies on the mathematical difficulty of factoring the product of two large prime numbers. RSA is foundational to modern cybersecurity, providing robust mechanisms for secure data encryption, digital signatures, and key exchange protocols such as establishing TLS sessions. While newer elliptic-curve cryptography offers equivalent security with smaller key sizes, RSA remains a foundational cornerstone of enterprise Public Key Infrastructure deployments and digital certificate authentication mechanisms worldwide.

Question 364

What security feature protects switch ports against flooding?

1. Port security MAC address limiting filter
2. Dynamic Host Configuration Protocol snooping daemon
3. Unicast Reverse Path Forwarding route check
4. Address Resolution Protocol dynamic inspection filter

Correct Answer: 1

Explanation:

Port security is a foundational Layer 2 hardening feature implemented on enterprise network switches to restrict input to an interface by limiting and identifying the maximum number of source MAC addresses allowed on a specific port. By restricting access to authorized physical endpoints, port security prevents CAM table exhaustion attacks—where malicious actors flood switches with thousands of randomized MAC addresses to force hub-like broadcast behavior. When an unauthorized device attempts to connect or when the configured MAC limit is exceeded, port security can trigger automated defensive mitigations such as shutting down the port or dropping offending frames, safeguarding enterprise network integrity against unauthorized physical access.

Question 365

Which cloud security model enforces multi-cloud configuration compliance?

1. Cloud Access Security Broker proxy inspection tool
2. Cloud Security Posture Management (CSPM) solution
3. Firewall Management Center policy administration appliance
4. Dynamic Host Configuration server lease daemon

Correct Answer: 2

Explanation:

Cloud Security Posture Management (CSPM) tools are specialized security solutions designed to automate the continuous monitoring of multi-cloud environments—such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform—to detect configuration flaws, security risks, compliance violations, and identity management gaps. CSPM platforms provide automated remediation guidance and deep visibility into complex cloud asset inventories, helping security teams maintain a strong, compliant security posture across distributed cloud infrastructure without manual audits or operational delays. By evaluating environments against regulatory standards like CIS benchmarks and NIST frameworks, CSPM tools ensure that cloud misconfigurations are identified and remediated before adversaries can exploit them.

Question 366

What IEEE standard defines port-based network access control?

1. IEEE 802.1Q VLAN trunking specification
2. IEEE 802.1X port-based access control standard
3. IEEE 802.11ac wireless local area network
4. IEEE 802.1w Rapid Spanning Tree protocol

Correct Answer: 2

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a wired LAN or wireless WLAN. 802.1X uses the Extensible Authentication Protocol to pass authentication messages between the supplicant client, the network access device acting as an authenticator, and a centralized authentication server such as RADIUS or Cisco ISE. Until the client successfully authenticates, the switch port blocks all non-EAP traffic, preventing unauthorized or rogue endpoints from accessing enterprise network resources. This enforces strict device compliance before granting access to internal corporate network segments.

Question 367

Which Cisco ISE node handles central policy configuration?

1. Policy Administration Node (PAN) within Cisco ISE
2. Policy Service Node processing network access requests
3. Monitoring and Analytics Node data repository
4. Unmanaged Layer 2 Ethernet switch device

Correct Answer: 1

Explanation:

Within a distributed Cisco Identity Services Engine deployment, the Policy Administration Node (PAN) serves as the central administrative interface responsible for system configuration, policy creation, profiling management, and administrative reporting. Deploying ISE in a distributed architecture separates administration, policy service, and monitoring functions across dedicated nodes to ensure high availability, scalability, and robust performance across large enterprise environments. The PAN pushes compiled policies down to Policy Service Nodes, allowing network access control rules to be enforced uniformly and efficiently across multi-site campus and branch deployments.

Question 368

What protocol provides secure directory service queries?

1. Unencrypted Lightweight Directory Access Protocol (LDAP)
2. Lightweight Directory Access Protocol Secure (LDAPS)
3. Trivial File Transfer Protocol directory utility
4. Simple Network Management Protocol daemon service

Correct Answer: 2

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of LDAP that encrypts all communications between client applications and directory service servers using Transport Layer Security or Secure Sockets Layer. Standard LDAP transmits directory queries, user attributes, and passwords in clear text over TCP port 389, leaving them vulnerable to packet sniffing and credential harvesting. LDAPS operates by default over TCP port 636, wrapping directory transactions in cryptographic privacy to protect enterprise authentication data and user directory attributes from internal and external adversaries.

Question 369

Which metric group captures intrinsic vulnerability severity characteristics?

1. Temporal vulnerability metrics measurement group
2. Environmental vulnerability metrics evaluation group
3. Base vulnerability metrics characterization group
4. Exploitability operational index metrics collection

Correct Answer: 3

Explanation:

The Common Vulnerability Scoring System is divided into three core metric groups: Base, Temporal, and Environmental. The Base metrics group captures the intrinsic characteristics of a vulnerability that remain constant over time and are invariant across user environments, such as Attack Vector, Privileges Required, and Confidentiality Impact. Temporal metrics measure characteristics that evolve over time, such as exploit code maturity and remediation availability, while Environmental metrics customize scores to specific organizational deployments. Understanding the Base metric group allows security teams to evaluate the fundamental severity of a software flaw objectively regardless of where it is deployed across enterprise networks.

Question 370

What network hardening practice rate-limits control plane traffic?

1. Flat unsegmented network bridging topology
2. Unencrypted Telnet console remote management
3. Control Plane Policing (CoPP) security feature
4. Passive optical network signal tapping hub

Correct Answer: 3

Explanation:

Control Plane Policing (CoPP) is a security and Quality of Service feature implemented on Cisco network hardware that utilizes QoS mechanisms to manage and rate-limit control plane traffic destined for the device’s CPU. By prioritizing legitimate routing protocols—like BGP and OSPF—and throttling excessive or malicious traffic streams—such as ARP floods or Denial of Service attacks—CoPP prevents CPU resource exhaustion and ensures network device stability. Protecting the control plane prevents malicious actors from crashing core routers and switches, maintaining continuous network availability across enterprise architecture.

Question 371

Which mechanism prevents rogue DHCP servers on switches?

1. Port security MAC address limiting filter
2. DHCP snooping Layer 2 security technology
3. Dynamic ARP Inspection port verification check
4. Unicast Reverse Path Forwarding routing check

Correct Answer: 2

Explanation:

DHCP snooping is a Layer 2 security technology built into enterprise switches that acts as a firewall between untrusted host devices and trusted DHCP servers. When enabled, DHCP snooping intercepts DHCP traffic, drops malicious DHCP server replies originating from untrusted ports (mitigating rogue DHCP server attacks), and builds a dynamic binding database tracking client IP addresses, MAC addresses, switch ports, and VLANs. This database is subsequently utilized by features like Dynamic ARP Inspection and IP Source Guard to ensure comprehensive Layer 2 network integrity and prevent rogue server attacks across campus environments.

Question 372

What protocol exchanges cyber threat intelligence data securely?

1. Trusted Automated Exchange of Intelligence Information (TAXII)
2. Simple Network Management Protocol version 3 daemon
3. Dynamic Host Configuration Protocol service utility
4. Trivial File Transfer Protocol transfer mechanism

Correct Answer: 1

Explanation:

Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol designed for the secure, automated transmission and exchange of cyber threat intelligence information. Standardized as a RESTful web service operating over HTTPS, TAXII works hand-in-hand with Structured Threat Information Expression formatted data, allowing security systems, SOC platforms, and intelligence feeds to share indicators of compromise and threat actor profiles seamlessly. By automating intelligence feeds, TAXII enables security infrastructure to ingest new threat data rapidly and update defensive rules without manual administrative intervention.

Question 373

Which security assessment simulates real-world targeted cyber attacks?

1. Static application source code review analysis
2. Automated vulnerability port scanning utility scan
3. Penetration testing assessment engagement
4. Passive network traffic log sniffing capture

Correct Answer: 3

Explanation:

Penetration testing is an authorized, simulated cyber attack launched against a computer system, network, or web application to evaluate security posture and identify exploitable vulnerabilities. Performed by ethical hackers, penetration testing mimics the tactics, techniques, and procedures utilized by real-world threat actors to bypass defenses. The assessment uncovers weak configurations, unpatched software flaws, and architectural security gaps before malicious attackers can exploit them. Organizations utilize penetration testing findings to prioritize remediation efforts, validate security controls, and ensure compliance with various regulatory frameworks and industry standards.

Question 374

What Kubernetes feature restricts pod network traffic flows?

1. Kubernetes Network Policies specification
2. Container bridge network interface
3. Pod volume storage mount configuration
4. Docker swarm cluster orchestration

Correct Answer: 1

Explanation:

Kubernetes Network Policies are specifications that dictate how groups of pods are allowed to communicate with each other and with other network endpoints. By default, container communication in Kubernetes is non-namespaced and unisolated, allowing any pod to reach any other pod across the cluster. Implementing Network Policies enables micro-segmentation at the container level, ensuring that workloads only accept authorized traffic and restricting lateral movement within containerized microservices architectures, protecting applications from compromise even if a single microservice is breached.

Question 375

Which DNS extension implements cryptographic signature data verification?

1. Domain Name System Security Extensions (DNSSEC)
2. Dynamic Host Configuration Protocol option string
3. Dynamic DNS record update mechanism protocol
4. Network Time Protocol synchronization utility

Correct Answer: 1

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the IETF to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in authentication, leaving them vulnerable to cache poisoning, spoofing, and man-in-the-middle attacks where users are redirected to malicious websites. DNSSEC addresses this by cryptographically signing DNS records using public key cryptography. This allows client resolvers to verify the authenticity and integrity of responses, ensuring users connect to legitimate destination servers without malicious interception or data tampering across the internet.

Question 376

What encryption mode provides simultaneous confidentiality and integrity?

1. Electronic Codebook cipher mode implementation
2. Cipher Block Chaining standard mechanism
3. Galois/Counter Mode (GCM) authenticated encryption
4. Plaintext session key sharing method

Correct Answer: 3

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly. Because of its high performance and robust security guarantees, GCM is heavily utilized in modern protocols such as TLS 1.3 to protect data in transit.

Question 377

Which email authentication standard utilizes cryptographic domain signatures?

1. Sender Policy Framework (SPF)
2. Domain-based Message Authentication and Reporting
3. DomainKeys Identified Mail (DKIM)
4. Simple Mail Transfer Protocol (SMTP)

Correct Answer: 3

Explanation:

DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect email spoofing by providing a cryptographic mechanism to validate a domain name identity associated with a message through digital signing. The sending mail server signs the email header and body hashes with a private key, and the receiving server validates the signature using the sender’s public key published in the domain’s DNS records. DKIM ensures that the email was genuinely sent by the domain owner and that the message payload was not altered in transit, preventing sophisticated phishing attacks.

Question 378

What device inspects application-layer HTTP web traffic?

1. Unmanaged Layer 2 Ethernet bridge switch device
2. Web Application Firewall (WAF) appliance or service
3. Passive network packet sniffing capture probe
4. Unshielded twisted-pair patch cable network link

Correct Answer: 2

Explanation:

A Web Application Firewall (WAF) is a specialized security appliance or cloud service designed to protect web applications by filtering, monitoring, and blocking HTTP/HTTPS traffic traveling between web applications and client browsers. Unlike traditional network firewalls that operate at lower OSI layers, a WAF inspects Layer 7 application traffic specifically to detect and prevent common web exploits—such as SQL injection, cross-site scripting, local file inclusion, and cookie tampering—before malicious requests reach application backend databases. By utilizing signature matching, behavioral analysis, and negative/positive security models, a WAF ensures that web services remain resilient against sophisticated application-layer cyber attacks.

Question 379

Which IPsec protocol provides data confidentiality and integrity?

1. Encapsulating Security Payload (ESP) protocol
2. Authentication Header (AH) integrity protocol
3. Transport Layer Security (TLS) handshake
4. Secure Shell (SSH) remote protocol session

Correct Answer: 1

Explanation:

The Encapsulating Security Payload (ESP) is an IPsec protocol designed to provide comprehensive security services, including data confidentiality (encryption), data integrity, data origin authentication, and anti-replay protection. In contrast, the IPsec Authentication Header (AH) protocol provides integrity and authentication but lacks encryption capabilities, leaving packet payloads transmitted in clear text. ESP encapsulates the original IP packet and encrypts the payload, ensuring that data transmitted across untrusted public networks remains secure from eavesdropping and tampering.

Question 380

What technology records endpoint behavioral telemetry for analysis?

1. Basic static signature-based antivirus software
2. Endpoint Detection and Response (EDR) platform
3. Unmanaged Layer 2 Ethernet bridge switch
4. Passive network signal tap hub device

Correct Answer: 2

Explanation:

Endpoint Detection and Response (EDR) is a sophisticated cybersecurity technology that continuously monitors end-user devices, servers, and hosts to collect deep behavioral telemetry, detect suspicious activities, and provide automated containment capabilities. Unlike traditional signature-based antivirus software that relied on static file matching to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This granular behavioral visibility enables security operations teams and threat hunters to identify zero-day exploits, fileless malware attacks, and advanced persistent threats that successfully evade traditional perimeter defenses, enabling rapid isolation and remediation.