View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 21

Which Cisco security technology provides centralized identity-based policy enforcement for users and devices connecting to a network?

1. Cisco Identity Services Engine
2. Cisco Secure Firewall
3. Cisco Umbrella
4. Cisco Secure Endpoint

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or ISE, provides centralized identity and policy management for network access. It can authenticate users and devices, evaluate endpoint attributes, and apply authorization policies based on identity, device type, location, and security posture. ISE commonly integrates with technologies such as 802.1X, RADIUS, and Cisco TrustSec to control network access. Cisco Secure Firewall focuses on network security enforcement, Secure Endpoint focuses on endpoint protection, and Cisco Umbrella provides cloud-delivered security services. Therefore, ISE is the appropriate platform.

Question 22

Which attack attempts to overwhelm a network service by sending a large volume of traffic from multiple compromised systems?

1. ARP spoofing
2. DDoS
3. DNS poisoning
4. VLAN hopping

Correct Answer: 2

Explanation

A Distributed Denial-of-Service, or DDoS, attack attempts to make a service unavailable by overwhelming it with traffic or requests from multiple sources. Attackers commonly use networks of compromised systems, known as botnets, to generate distributed traffic. This can consume bandwidth, processing capacity, connection tables, or application resources. ARP spoofing targets local address-resolution behavior, DNS poisoning manipulates name-resolution information, and VLAN hopping attempts to cross VLAN boundaries. Therefore, a coordinated flood originating from multiple compromised systems represents a DDoS attack.

Question 23

Which Cisco security solution provides DNS-layer protection by blocking requests to known malicious domains before users connect to those destinations?

1. Cisco Secure Endpoint
2. Cisco ISE
3. Cisco Umbrella
4. Cisco Secure Firewall

Correct Answer: 3

Explanation

Cisco Umbrella provides cloud-delivered security services that can enforce security policies at the DNS layer. It can identify requests associated with known malicious domains and prevent users from reaching destinations associated with malware, phishing, command-and-control infrastructure, and other threats. Blocking threats at the DNS layer can stop connections before a full session is established. Secure Endpoint focuses on endpoint security, ISE provides identity and network access control, and Secure Firewall provides network traffic inspection and policy enforcement. Therefore, Cisco Umbrella matches this requirement.

Question 24

Which security control is primarily intended to prevent unauthorized physical access to a restricted server room?

1. Firewall
2. IDS
3. Access control system
4. DLP

Correct Answer: 3

Explanation

A physical access control system restricts entry to protected areas such as server rooms, data centers, and network closets. Examples include badge readers, biometric scanners, electronic locks, and security gates. These controls help ensure that only authorized personnel can physically access sensitive equipment. Firewalls and intrusion detection systems protect network traffic, while data loss prevention focuses on controlling sensitive information. Physical security is an important part of defense in depth because an attacker who gains direct physical access may bypass many logical security controls. Therefore, an access control system is appropriate.

Question 25

Which cryptographic property ensures that a message has not been altered after it was created?

1. Confidentiality
2. Integrity
3. Availability
4. Nonrepudiation

Correct Answer: 2

Explanation

Integrity ensures that information has not been modified in an unauthorized or unexpected manner. Cryptographic hashes, message authentication codes, and digital signatures can help detect changes to data. Confidentiality protects information from unauthorized disclosure, availability ensures that resources remain accessible when needed, and nonrepudiation provides evidence that a particular party performed an action or created a message. In security design, protecting integrity is especially important for configuration files, software packages, communications, and stored data because unauthorized modification can cause serious security or operational consequences.

Question 26

Which protocol is commonly used to securely transfer files between network devices while providing encryption through SSH?

1. FTP
2. TFTP
3. SFTP
4. HTTP

Correct Answer: 3

Explanation

SFTP, or SSH File Transfer Protocol, provides secure file transfers through the SSH protocol. It encrypts authentication credentials and file-transfer data, helping protect information from interception while it travels across an untrusted network. FTP does not inherently encrypt its traffic, TFTP is a lightweight transfer protocol without built-in authentication and encryption, and HTTP is primarily used for web communication. SFTP is therefore useful when network administrators need to securely transfer configuration files, software packages, logs, or other files between systems.

Question 27

Which Cisco security architecture uses software-defined policies to separate users, devices, and applications into logical groups while reducing dependence on traditional VLAN-based segmentation?

1. Cisco TrustSec
2. Cisco NAT
3. Cisco HSRP
4. Cisco EtherChannel

Correct Answer: 1

Explanation

Cisco TrustSec provides identity-based access control and segmentation by associating security group information with users, devices, and traffic. Security Group Tags, or SGTs, can be used to classify traffic according to policy rather than relying exclusively on IP addresses or VLAN membership. This approach can simplify segmentation in environments where users and devices frequently move between locations. NAT translates network addresses, HSRP provides gateway redundancy, and EtherChannel combines physical links. Therefore, Cisco TrustSec is the technology designed for policy-based logical segmentation described here.

Question 28

A security analyst wants to determine whether a suspicious file matches a previously identified malicious sample. Which technique can provide a compact value for comparison?

1. Hashing
2. Compression
3. Encoding
4. Fragmentation

Correct Answer: 1

Explanation

Hashing produces a fixed-length value derived from the contents of data. Security analysts can calculate a cryptographic hash for a suspicious file and compare it with hashes associated with known malicious or trusted files. If the contents change, a secure cryptographic hash should normally change as well, making hashes useful for integrity verification and file identification. Compression reduces file size, encoding changes representation without providing security by itself, and fragmentation divides data into smaller portions. Therefore, hashing is the appropriate technique for comparing file contents.

Question 29

Which security solution is specifically designed to prevent sensitive information from leaving an organization through monitored channels?

1. DLP
2. NTP
3. DHCP
4. STP

Correct Answer: 1

Explanation

Data Loss Prevention, or DLP, technologies help organizations identify, monitor, and protect sensitive information. DLP policies can inspect data based on content, context, or predefined patterns and may prevent sensitive information from being transferred through channels such as email, web applications, cloud services, or removable media. NTP synchronizes time, DHCP provides network configuration, and STP prevents certain Layer 2 switching loops. DLP is particularly useful for protecting confidential documents, financial information, personally identifiable information, and intellectual property. Therefore, DLP is the appropriate security solution.

Question 30

Which type of firewall policy identifies traffic based on application characteristics rather than relying exclusively on Layer 3 and Layer 4 information?

1. Port-based filtering
2. Application-aware policy
3. Static routing
4. MAC address learning

Correct Answer: 2

Explanation

An application-aware security policy identifies applications using characteristics beyond basic source and destination addresses or transport ports. This allows administrators to create policies that distinguish between applications even when they use common ports or dynamically selected ports. Application awareness can provide more granular control over permitted activities and improve visibility into user traffic. Port-based filtering primarily evaluates transport-layer information, static routing determines packet paths, and MAC learning is a switching function. Therefore, an application-aware policy provides the type of control described.

Question 31

Which attack involves sending fraudulent ARP messages so that a victim associates an attacker’s MAC address with another device’s IP address?

1. ARP spoofing
2. DNS tunneling
3. Password spraying
4. SQL injection

Correct Answer: 1

Explanation

ARP spoofing occurs when an attacker sends forged Address Resolution Protocol messages to manipulate IP-to-MAC address associations. A successful attack can cause traffic intended for another host, such as a default gateway, to be redirected through the attacker’s system. This can support traffic interception, man-in-the-middle attacks, or denial of service. Dynamic ARP Inspection can help mitigate this threat by validating ARP messages against trusted bindings. DNS tunneling and SQL injection target different mechanisms, while password spraying attempts to compromise accounts.

Question 32

Which authentication method uses a centralized server to validate credentials and authorize network access for users connecting through a network access device?

1. RADIUS
2. ARP
3. ICMP
4. GRE

Correct Answer: 1

Explanation

RADIUS is a AAA protocol commonly used for centralized authentication and authorization of network access. Network devices such as wireless controllers, switches, and VPN gateways can forward authentication requests to a RADIUS server rather than maintaining individual user credentials locally. The centralized approach simplifies account management and supports consistent access policies. ARP resolves local IP-to-MAC mappings, ICMP supports network diagnostics, and GRE provides tunneling. Therefore, RADIUS is the protocol most closely associated with centralized authentication for network access.

Question 33

Which security control is designed to detect and alert on suspicious network activity but does not normally block the traffic itself?

1. IPS
2. IDS
3. DLP
4. NAC

Correct Answer: 2

Explanation

An Intrusion Detection System, or IDS, monitors network or system activity and generates alerts when it identifies patterns associated with suspicious or malicious behavior. An IDS generally operates in a detection and monitoring role rather than directly blocking traffic. An Intrusion Prevention System, or IPS, can actively prevent or block detected malicious traffic. DLP focuses on protecting sensitive information, while Network Access Control manages access to network resources. Therefore, IDS is the appropriate technology when the primary requirement is detection and alerting without direct traffic blocking.

Question 34

Which security control can actively block malicious network traffic after identifying an intrusion attempt?

1. Syslog
2. IDS
3. IPS
4. NetFlow

Correct Answer: 3

Explanation

An Intrusion Prevention System, or IPS, is designed to detect malicious or suspicious network activity and take preventive action, such as dropping or blocking the offending traffic. IPS functionality can be deployed inline so that traffic passes through the security device before reaching the protected destination. IDS generally focuses on detection and alerting, while Syslog provides event logging and NetFlow provides flow-level traffic information. Therefore, IPS is the appropriate technology when the security control must actively prevent an identified intrusion.

Question 35

Which Cisco technology provides encrypted remote-access connectivity for users who need secure access to internal resources from an untrusted network?

1. Remote-access VPN
2. DHCP
3. EtherChannel
4. Port mirroring

Correct Answer: 1

Explanation

A remote-access VPN provides an encrypted connection between an authorized remote user and an organization’s network. This allows users to securely access internal applications and resources while connected through an untrusted network such as the public Internet. VPN technologies can use authentication and encryption to protect traffic and verify user identity. DHCP provides IP configuration, EtherChannel combines network links, and port mirroring copies traffic for monitoring purposes. Therefore, a remote-access VPN is the appropriate technology for secure remote connectivity.

Question 36

Which protocol is commonly used to collect detailed flow information about network traffic for visibility and analysis?

1. NetFlow
2. SMTP
3. SFTP
4. LDAP

Correct Answer: 1

Explanation

NetFlow provides information about network traffic flows, including characteristics such as source and destination addresses, ports, protocols, interfaces, and traffic volume. Security and network teams can analyze flow records to identify unusual communication patterns, bandwidth usage, potential scanning activity, and other indicators. NetFlow does not normally capture complete packet contents; instead, it provides metadata about traffic flows. SMTP is used for email transmission, SFTP provides secure file transfer, and LDAP provides directory services. Therefore, NetFlow is the appropriate technology for flow visibility.

Question 37

Which security mechanism can prevent users from accessing network resources until their endpoint meets defined security or compliance requirements?

1. Network Access Control
2. DNS caching
3. NAT overload
4. Link aggregation

Correct Answer: 1

Explanation

Network Access Control, or NAC, can evaluate users and endpoints before granting access to network resources. Policies may consider authentication status, device identity, operating-system characteristics, security software, patch level, or other posture information. A device that fails the required checks can be denied access, placed into a restricted segment, or given limited remediation access. DNS caching improves name-resolution performance, NAT overload translates multiple private addresses, and link aggregation combines physical links. Therefore, NAC provides the described security enforcement capability.

Question 38

Which type of attack attempts to gain access to an account by trying a small number of commonly used passwords against many different usernames?

1. Credential stuffing
2. Password spraying
3. Session hijacking
4. Phishing

Correct Answer: 2

Explanation

Password spraying attempts to compromise multiple accounts by trying a limited number of commonly used passwords across many usernames. This approach differs from traditional brute-force attacks, which may try many passwords against a single account and can trigger account lockout mechanisms. Credential stuffing instead uses previously stolen username-and-password combinations from another breach. Phishing attempts to deceive users into revealing credentials or sensitive information. Password spraying is particularly dangerous in environments with weak or reused passwords because one commonly used password may work against multiple accounts.

Question 39

Which security principle requires administrators to provide only the access rights necessary for a user, application, or service to perform its intended function?

1. Least privilege
2. Maximum availability
3. Open access
4. Shared administration

Correct Answer: 1

Explanation

The principle of least privilege limits users, applications, and services to the minimum permissions required to perform their authorized functions. This reduces the potential damage caused by compromised credentials, vulnerable applications, malicious insiders, or accidental actions. For example, an application that only needs to read specific data should not receive unrestricted administrative privileges. Least privilege is an important security principle in identity management, operating systems, cloud environments, and network infrastructure. Therefore, limiting access to necessary permissions directly represents the principle of least privilege.

Question 40

Which protocol is commonly used to securely synchronize the system time of network devices when authentication and integrity protection are required?

1. SNMP
2. NTP
3. Secure NTP with authentication
4. TFTP

Correct Answer: 3

Explanation

Accurate time synchronization is important for security logging, certificate validation, event correlation, and incident investigation. Standard NTP provides time synchronization, while authenticated NTP configurations can add protection against unauthorized or manipulated time sources. In security-sensitive environments, authenticated time synchronization helps ensure that devices receive trustworthy time information. SNMP is used for network management, TFTP provides basic file transfers without strong security, and ordinary NTP does not inherently provide the same level of authentication protection. Therefore, authenticated NTP is the appropriate choice when secure time synchronization is required.