View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 381

What protocol negotiates cryptographic keys for IPsec VPNs securely?

1. Internet Key Exchange version 2 (IKEv2)
2. Simple Network Management Protocol version 3 daemon
3. Dynamic Host Configuration Protocol lease utility
4. Trivial File Transfer Protocol transfer mechanism

Correct Answer: 1

Explanation:

Internet Key Exchange version 2 (IKEv2) is a standardized request/response protocol designed within the IPsec protocol suite to securely negotiate security associations, establish cryptographic keys, and authenticate peers for Virtual Private Network connections. IKEv2 streamlines the handshake process significantly compared to its predecessor, reducing message exchanges, providing built-in NAT traversal support, and ensuring robust mobility and multihoming capabilities via MOBIKE. By establishing shared secret keys through secure Diffie-Hellman exchanges authenticated with digital certificates or pre-shared keys, IKEv2 lays a dependable cryptographic foundation for encrypted data tunnels traversing untrusted public networks.

Question 382

Which security architecture defines scalable group tags for micro-segmentation?

1. Flat unsegmented network bridging topology
2. Cisco TrustSec (Scalable Group Tagging) architecture
3. Unencrypted Telnet remote administrative console
4. Passive optical network signal tapping hub

Correct Answer: 2

Explanation:

Cisco TrustSec technology implements Software-Defined Segmentation using Scalable Group Tags (SGTs) to enforce access control policies across enterprise networks independently of physical IP subnets. Instead of relying on complex access control lists tied to frequently changing IP addresses, TrustSec classifies users and devices based on their authenticated role or function, tagging traffic at the ingress switch port with a secure hardware-based SGT header. Destination devices or egress enforcement points evaluate this tag against centralized policy matrices managed by Cisco ISE, enabling granular, micro-segmented security enforcement across campus and data center environments.

Question 383

What certificate validation mechanism queries real-time revocation status?

1. Online Certificate Status Protocol (OCSP) responder
2. Static Certificate Revocation List (CRL) file download
3. Unencrypted Lightweight Directory Access Protocol query
4. Dynamic Host Configuration Protocol address lease table

Correct Answer: 1

Explanation:

The Online Certificate Status Protocol (OCSP) is an internet protocol used for obtaining the real-time revocation status of digital certificates in Public Key Infrastructure environments. Unlike traditional Certificate Revocation Lists—which require client applications to download large, periodically updated lists containing all revoked serial numbers—OCSP allows applications to send a targeted query to an OCSP responder and receive an immediate, cryptographically signed response indicating whether a specific certificate remains valid, has been revoked, or is unknown. This real-time validation mechanism minimizes security windows and optimizes bandwidth consumption across enterprise networks.

Question 384

Which automated security platform orchestrates incident response playbooks?

1. Security Orchestration, Automation, and Response (SOAR)
2. Unmanaged Layer 2 Ethernet bridge switch device
3. Passive network traffic packet sniffing tool
4. Unshielded twisted-pair patch cable network link

Correct Answer: 1

Explanation:

Security Orchestration, Automation, and Response (SOAR) platforms are advanced cybersecurity software solutions designed to streamline Security Operations Center workflows by integrating disparate security tools, automating repetitive investigative tasks, and executing predefined machine-driven incident response playbooks. When a security alert is triggered, SOAR platforms automatically aggregate threat telemetry, enrich event data with intelligence feeds, run containment scripts, and coordinate remediation actions across firewalls, endpoint protection systems, and email gateways without manual intervention, dramatically reducing mean time to respond.

Question 385

What security feature prevents ARP cache poisoning attacks on switches?

1. Port security MAC address limiting filter
2. Dynamic ARP Inspection (DAI) security feature
3. Unicast Reverse Path Forwarding route check
4. DHCP snooping Layer 2 binding cache

Correct Answer: 2

Explanation:

Dynamic ARP Inspection (DAI) is a Layer 2 security feature built into enterprise switches that prevents Address Resolution Protocol spoofing and cache poisoning attacks. DAI leverages the trusted binding database established by DHCP snooping to intercept, log, and validate all ARP packets traversing untrusted ports. If an incoming ARP packet contains IP-to-MAC address mappings that conflict with the trusted DHCP binding database, DAI drops the packet immediately. This prevents malicious threat actors from intercepting local network traffic, conducting man-in-the-middle exploits, or hijacking default gateway communications.

Question 386

Which wireless security protocol mandates enterprise EAP-TLS authentication?

1. Wired Equivalent Privacy encryption protocol
2. Wi-Fi Protected Access 2 pre-shared key
3. Wi-Fi Protected Access 3 Enterprise (WPA3-Enterprise)
4. Unencrypted open guest wireless network

Correct Answer: 3

Explanation:

Wi-Fi Protected Access 3 Enterprise (WPA3-Enterprise) provides enhanced cryptographic protection for corporate wireless networks by requiring robust authentication mechanisms such as the Extensible Authentication Protocol with Transport Layer Security (EAP-TLS). Unlike personal wireless modes that rely on shared passphrases, WPA3-Enterprise authenticates individual users or client devices against a centralized authentication server using unique digital certificates. Furthermore, WPA3-Enterprise enforces a minimum cryptographic strength baseline, mandating protected management frames and optional 192-bit cryptographic suites to secure enterprise wireless communications against eavesdropping and advanced impersonation attacks.

Question 387

What security assessment tool evaluates container image vulnerabilities?

1. Container image vulnerability scanning tool
2. Passive network traffic packet sniffing probe
3. Static application source code review utility
4. Active network port scanning utility scanner

Correct Answer: 1

Explanation:

Container image vulnerability scanners are specialized security tools designed to inspect container images—including application binaries, operating system packages, third-party libraries, and configuration files—prior to deployment in production container orchestration environments like Kubernetes. These scanners compare software bill of materials against known vulnerability databases, Common Vulnerabilities and Exposures feeds, and security baselines to identify outdated dependencies or unpatched flaws. Integrating image scanning into CI/CD pipelines ensures that insecure container workloads are intercepted and remediated before reaching runtime environments.

Question 388

Which protocol records user accounting data in centralized AAA?

1. Remote Authentication Dial-In User Service (RADIUS) Accounting
2. Simple Network Management Protocol trap message
3. Dynamic Host Configuration Protocol lease record
4. Trivial File Transfer Protocol utility file transfer

Correct Answer: 1

Explanation:

RADIUS Accounting is a core component of the Remote Authentication Dial-In User Service protocol responsible for tracking and recording resource consumption, connection durations, data transfer volumes, and session start/stop events for network users and devices. When a user authenticates and accesses network services, the network access device transmits accounting start packets to the RADIUS server, followed by periodic updates and stop packets upon session termination. Security and administrative teams utilize RADIUS accounting logs for compliance auditing, billing reconciliation, capacity planning, and forensic tracking of user sessions across enterprise networks.

Question 389

What cloud proxy mode intercepts inline web traffic actively?

1. API-based Cloud Access Security Broker mode
2. Inline Forward Proxy Cloud Access Security Broker mode
3. Passive network sniffing capture tap probe
4. Unmanaged Layer 2 Ethernet bridge switch

Correct Answer: 2

Explanation:

An Inline Forward Proxy Cloud Access Security Broker (CASB) deployment mode sits directly in the network traffic path between enterprise user devices and cloud service providers. As users attempt to access web applications or cloud platforms, the forward proxy inspects outgoing HTTP/HTTPS traffic in real time, enforcing granular Data Loss Prevention policies, blocking unauthorized shadow IT services, decrypting TLS traffic for deep inspection, and applying access controls based on user identity and device posture. This active inline positioning ensures immediate threat mitigation and strict adherence to corporate cloud governance policies.

Question 390

Which routing security filter blocks unauthorized prefix advertisements?

1. BGP Route Filtering using prefix lists and route maps
2. Unicast Reverse Path Forwarding interface check
3. Dynamic ARP Inspection port verification filter
4. Port security MAC address limiting filter

Correct Answer: 1

Explanation:

Border Gateway Protocol route filtering—implemented using prefix lists, AS-path access lists, and route maps—is an essential routing security practice used by network operators to control which routing update information is accepted or advertised to external peers. Without strict filtering, autonomous systems risk accepting malicious or accidental prefix announcements that could lead to global traffic hijacking or denial of service. By explicitly defining permitted IP address ranges and validating route origins, BGP filtering ensures that routers only propagate legitimate routing paths across the public internet infrastructure.

Question 391

What hardware security technology provides secure boot root of trust?

1. Unmanaged Layer 2 Ethernet bridge switch
2. Trusted Platform Module (TPM) / Hardware Trust Anchor
3. Passive network tapping signal hub device
4. Unshielded twisted-pair patch cable link

Correct Answer: 2

Explanation:

A Trusted Platform Module (TPM) or hardware Trust Anchor provides an immutable hardware-based foundation for system security and cryptographic operations. During device startup, Secure Boot utilizes cryptographic public keys stored securely within the hardware trust anchor to verify the digital signature of operating system boot loaders, firmware images, and hypervisor components. If any firmware component has been tampered with or modified maliciously, the device halts the boot process, preventing compromised code execution. This hardware-level validation guarantees that the underlying platform has not been subverted by persistent firmware rootkits.

Question 392

Which incident response phase captures post-incident root cause analysis?

1. Preparation incident management phase
2. Detection and analysis response phase
3. Containment, eradication, and recovery phase
4. Post-Incident Activity (Lessons Learned) phase

Correct Answer: 4

Explanation:

The Post-Incident Activity phase—often referred to as the Lessons Learned phase—is the final and critical stage of the National Institute of Standards and Technology incident response lifecycle. Following the successful containment, eradication, and recovery of a security breach, the incident response team conducts a comprehensive post-mortem review. This involves analyzing what went wrong, evaluating the effectiveness of detection tools and response procedures, documenting root causes, and implementing preventative security improvements to ensure that similar attacks cannot succeed in the future.

Question 393

What network hardening practice disables unnecessary device discovery protocols?

1. Disabling Cisco Discovery Protocol (CDP) and LLDP on untrusted ports
2. Flat unsegmented network bridging topology configuration
3. Unencrypted Telnet remote console management service
4. Passive optical network signal tapping hub installation

Correct Answer: 1

Explanation:

Disabling discovery protocols such as Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) on untrusted access switch ports connected to end-user devices is a foundational network hardening practice. While discovery protocols are useful for mapping internal network topologies between enterprise switches, leaving them enabled on edge ports allows malicious actors to plug in devices, gather detailed hardware models, operating system versions, and IP addresses, and leverage that intelligence to launch targeted exploits. Restricting discovery protocols to internal infrastructure links minimizes reconnaissance exposure.

Question 394

Which vulnerability metric captures exploit code maturity changes?

1. Base vulnerability metrics characterization group
2. Environmental vulnerability metrics evaluation group
3. Temporal vulnerability metrics measurement group
4. Exploitability operational index metrics collection

Correct Answer: 3

Explanation:

The Common Vulnerability Scoring System Temporal metrics group measures the characteristics of a vulnerability that evolve over time as remediation data and exploit availability change. While Base metrics remain constant, Temporal metrics account for factors such as Exploit Code Maturity (whether functional exploit code is publicly available), Remediation Level (whether an official patch, workaround, or official fix exists), and Report Confidence (the degree of validation concerning the vulnerability’s existence). These metrics allow security teams to dynamically adjust vulnerability risk scores based on real-world threat landscape evolutions.

Question 395

What endpoint technology automatically isolates compromised host connections?

1. Endpoint Detection and Response (EDR) automated quarantine
2. Basic static signature-based antivirus software scanner
3. Unmanaged Layer 2 Ethernet bridge switch hardware
4. Passive network signal tap hub monitoring device

Correct Answer: 1

Explanation:

Endpoint Detection and Response platforms provide automated containment capabilities that can logically or physically isolate a compromised host from the broader corporate network instantly upon detecting malicious activity. While isolation disconnects the infected machine from lateral network access and external command-and-control servers, it maintains a secure, dedicated management tunnel for security analysts to execute forensic data collections, memory dumps, and remote remediation actions. This rapid containment prevents malware from spreading across adjacent endpoints while preserving critical forensic artifacts.

Question 396

Which cryptographic property ensures past sessions remain uncompromised?

1. Static RSA public key encryption mechanism
2. Forward Secrecy (Perfect Forward Secrecy) property
3. Electronic Codebook cipher mode implementation
4. Plaintext symmetric session key sharing method

Correct Answer: 2

Explanation:

Forward Secrecy—frequently referred to as Perfect Forward Secrecy—is a cryptographic property of specific key agreement protocols that ensures session keys derived from public key cryptography are not compromised even if the long-term private key of the server is compromised at a later date. Ephemeral Diffie-Hellman key exchanges achieve this by generating a unique, temporary session key for every individual communication session and discarding it immediately afterwards. Because the long-term private key is never used directly to encrypt session data, past recorded ciphertexts remain completely secure against retrospective decryption attempts.

Question 397

What web security feature blocks inappropriate URL categories dynamically?

1. URL filtering and web reputation filtering service
2. Unmanaged Layer 2 Ethernet bridge switch hardware
3. Passive network packet sniffing capture probe tool
4. Unshielded twisted-pair patch cable network link

Correct Answer: 1

Explanation:

URL filtering and web reputation filtering is a core security service deployed on Next-Generation Firewalls and Secure Web Gateways that inspects HTTP/HTTPS traffic to control user access to specific websites based on predefined organizational policies. Cloud-based intelligence engines categorize millions of URLs in real time—spanning categories such as malware distribution sites, phishing portals, adult content, and social media. When a user attempts to access a restricted or low-reputation domain, the security gateway blocks the request instantly and presents a warning page, protecting enterprise employees from web-based threats.

Question 398

Which AAA framework component evaluates user authorization policies?

1. Policy Service Node (PSN) within Cisco ISE
2. Unmanaged Layer 2 Ethernet bridge switch device
3. Passive network traffic signal analyzer monitoring tool
4. Unshielded twisted-pair network patch cable link

Correct Answer: 1

Explanation:

Within a distributed Cisco Identity Services Engine architecture, the Policy Service Node (PSN) is responsible for handling network access requests, evaluating user credentials, performing endpoint profiling, and executing centralized authorization policy decisions. When a supplicant requests network access, the authenticator passes the credentials to the PSN, which compares the request against configured authorization rules and pushes back access attributes—such as VLAN assignments, downloadable access control lists, or scalable group tags—ensuring dynamic and consistent policy enforcement at the network edge.

Question 399

What threat hunting framework categorizes attacker tactics and techniques?

1. MITRE ATT&CK adversary knowledge base framework
2. Open Web Application Security Project standard guide
3. National Institute of Standards risk framework model
4. Information Technology Infrastructure Library framework

Correct Answer: 1

Explanation:

MITRE ATT&CK is a globally accessible, curated knowledge base of adversary tactics and techniques based on real-world observation. Security operations teams, threat hunters, and defenders utilize the ATT&CK framework to understand attacker behavior, map enterprise security monitoring coverage, evaluate detection tool effectiveness, and simulate adversary tactics during threat emulation and penetration testing exercises. By categorizing methods from initial compromise to data exfiltration, ATT&CK provides a common taxonomy that empowers security professionals to strengthen defenses against specific threat actor behaviors.

Question 400

Which firewall deployment mode operates transparently at Layer 2?

1. Layer 3 routed firewall gateway deployment mode
2. Transparent Firewall mode (Layer 2 bridge mode)
3. Inline forward proxy Cloud Access Security Broker mode
4. Passive network packet sniffing capture probe mode

Correct Answer: 2

Explanation:

A Transparent Firewall—often referred to as a bridged firewall—is a specialized security deployment mode where a firewall operates as a Layer 2 bridge rather than a traditional Layer 3 routed interface. Because the firewall does not alter IP addresses or act as a router hop, it can be inserted seamlessly into an existing network topology with minimal re-addressing or configuration changes. It inspects traffic passing across the bridge, applying stateful filtering, access control lists, and intrusion prevention rules between network segments while remaining completely invisible to surrounding routing protocols.