View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 41

Which security technology allows an organization to inspect encrypted traffic so that security policies can be applied to otherwise hidden application activity?

1. TLS inspection
2. DHCP snooping
3. Port security
4. MAC learning

Correct Answer: 1

Explanation

TLS inspection allows a security device to decrypt and inspect protected traffic before re-encrypting it for its destination. This capability can provide visibility into threats hidden inside encrypted sessions and allow security policies, malware detection, URL filtering, and application controls to operate on inspected content. Proper certificate deployment and privacy considerations are important because inspection involves access to decrypted traffic. DHCP snooping protects against rogue DHCP servers, port security restricts switch-port identities, and MAC learning supports normal switching. Therefore, TLS inspection provides the described capability.

Question 42

Which Cisco technology can provide secure web access by enforcing cloud-based security policies for users regardless of whether they are connected from a corporate office or a remote location?

1. HSRP
2. Cisco Secure Access
3. EtherChannel
4. STP

Correct Answer: 2

Explanation

Cisco Secure Access is a cloud-delivered security service designed to provide secure access to applications and resources while enforcing centralized security policies. It supports security requirements associated with distributed users, applications, and hybrid work environments. Cloud-based security controls can reduce dependence on sending all user traffic through a traditional centralized network perimeter. HSRP provides first-hop gateway redundancy, EtherChannel combines physical links, and STP prevents Layer 2 switching loops. Therefore, Cisco Secure Access is the appropriate technology for cloud-delivered secure access.

Question 43

Which protocol is commonly used by a RADIUS client to communicate authentication requests with a centralized authentication server?

1. TCP 22
2. UDP 1812
3. TCP 443
4. UDP 53

Correct Answer: 2

Explanation

RADIUS commonly uses UDP port 1812 for authentication and authorization traffic between a network access device and a RADIUS server. Accounting traffic commonly uses UDP port 1813. Network devices such as wireless controllers, switches, and VPN gateways can act as RADIUS clients and forward user authentication requests to the centralized server. TCP 22 is associated with SSH, TCP 443 is commonly used for HTTPS, and UDP 53 is used for DNS. Therefore, UDP 1812 is the expected RADIUS authentication port.

Question 44

Which attack attempts to exploit a weakness in an application by inserting malicious database commands into user-supplied input?

1. Cross-site scripting
2. SQL injection
3. ARP poisoning
4. DNS tunneling

Correct Answer: 2

Explanation

SQL injection occurs when an attacker manipulates application input so that malicious SQL statements are interpreted by a backend database. Depending on the vulnerability and database permissions, an attack may allow unauthorized data retrieval, modification, deletion, or other unintended database operations. Secure coding practices such as parameterized queries, input validation, and appropriate database privileges can reduce this risk. Cross-site scripting targets browser-side script execution, while ARP poisoning and DNS tunneling involve network-layer or protocol-based attacks. Therefore, SQL injection matches the described scenario.

Question 45

Which security control helps prevent an unauthorized device from connecting to a switch port by limiting the MAC addresses permitted on that port?

1. Port security
2. DHCP relay
3. NetFlow
4. GRE

Correct Answer: 1

Explanation

Switch port security can restrict which MAC addresses are allowed to use a particular switch port. Administrators can configure limits on the number of MAC addresses and specify how the switch should respond when an unauthorized address is detected. This can help prevent unauthorized devices from gaining normal network access through unused or controlled switch ports. DHCP relay forwards DHCP requests, NetFlow provides traffic-flow information, and GRE creates tunnels. Therefore, port security is the appropriate Layer 2 control for restricting devices based on MAC addresses.

Question 46

Which security architecture combines multiple independent security controls so that failure of one control does not necessarily expose the entire environment?

1. Single sign-on
2. Defense in depth
3. Network Address Translation
4. Load balancing

Correct Answer: 2

Explanation

Defense in depth uses multiple layers of security controls so that an attacker must overcome more than one protection mechanism. For example, an organization may combine identity authentication, endpoint protection, network segmentation, firewalls, intrusion prevention, encryption, monitoring, and physical security. If one control fails, additional layers may still detect or prevent the attack. Single sign-on addresses authentication convenience, NAT translates addresses, and load balancing distributes application traffic. Therefore, defense in depth represents the security architecture based on multiple complementary protection layers.

Question 47

Which Cisco security capability can classify traffic into security groups so that policy can be applied according to the identity or role associated with the traffic?

1. Security Group Tags
2. DHCP leases
3. ARP cache
4. DNS records

Correct Answer: 1

Explanation

Security Group Tags, or SGTs, are used with Cisco TrustSec to associate traffic with a security group classification. Instead of depending solely on IP addresses, policies can be based on the role or identity represented by the security group. This approach can simplify segmentation and policy enforcement in environments where users and devices frequently change locations or addresses. DHCP leases provide IP configuration information, ARP maps IP addresses to MAC addresses, and DNS resolves names. Therefore, Security Group Tags provide the described identity-oriented traffic classification.

Question 48

Which security technology is primarily designed to identify and protect sensitive data as it moves through email, web, cloud, and endpoint channels?

1. DLP
2. STP
3. NTP
4. VRRP

Correct Answer: 1

Explanation

Data Loss Prevention, or DLP, identifies and protects sensitive information according to organizational policies. DLP controls can inspect data in different states and channels, including data being transmitted through email, web applications, cloud services, or endpoints. Policies may identify information using patterns, classifications, keywords, or other content characteristics. This allows organizations to detect or prevent unauthorized transmission of sensitive information. STP prevents switching loops, NTP synchronizes system clocks, and VRRP provides gateway redundancy. Therefore, DLP is the security technology focused on protecting sensitive data.

Question 49

Which type of malware can encrypt a victim’s files and demand payment in exchange for a recovery mechanism?

1. Spyware
2. Ransomware
3. Rootkit
4. Adware

Correct Answer: 2

Explanation

Ransomware is malware that can encrypt files or otherwise deny access to systems and then demand payment from victims. Modern ransomware campaigns may also involve data theft and threats to publicly release stolen information. Organizations can reduce the impact of ransomware through strong access controls, endpoint protection, network segmentation, patch management, user awareness, and reliable offline or otherwise protected backups. Spyware focuses on secretly collecting information, rootkits attempt to hide malicious activity, and adware primarily displays unwanted advertising. Therefore, ransomware matches the described behavior.

Question 50

Which cloud service model provides customers with virtual machines, storage, and networking resources while leaving much of the underlying physical infrastructure managed by the provider?

1. SaaS
2. PaaS
3. IaaS
4. DaaS

Correct Answer: 3

Explanation

Infrastructure as a Service, or IaaS, provides customers with virtualized computing resources such as virtual machines, storage, and networking. The cloud provider manages the underlying physical infrastructure, while the customer generally remains responsible for operating systems, applications, configurations, and other components depending on the service. SaaS provides complete applications, while PaaS provides a managed application-development platform. DaaS can refer to desktop delivery services depending on the provider. Therefore, IaaS is the cloud service model described.

Question 51

Which protocol provides secure command-line administration of network devices through an encrypted session?

1. Telnet
2. FTP
3. SSH
4. TFTP

Correct Answer: 3

Explanation

SSH, or Secure Shell, provides encrypted remote command-line access to network devices and servers. It protects authentication credentials and interactive session data from being transmitted as clear text across the network. SSH is therefore preferred over Telnet for secure device administration. FTP and TFTP are file-transfer protocols rather than general-purpose secure management protocols, and TFTP does not provide strong authentication or encryption. Administrators commonly use SSH to configure routers, switches, firewalls, and other infrastructure devices remotely while reducing the risk of credential interception.

Question 52

Which security mechanism can identify users and devices before assigning them to an appropriate network access policy?

1. Identity-based access control
2. Static routing
3. Load balancing
4. Port aggregation

Correct Answer: 1

Explanation

Identity-based access control makes authorization decisions using information about the user, device, or associated identity rather than relying exclusively on network location. In an enterprise environment, identity information can be obtained through authentication systems and combined with device attributes, group membership, posture, or other contextual information. This allows organizations to apply different access policies to different users and devices. Static routing determines packet paths, load balancing distributes traffic, and port aggregation combines links. Therefore, identity-based access control provides the required policy approach.

Question 53

Which security technology can identify malicious behavior on an endpoint by analyzing processes, files, network connections, and other endpoint activity?

1. EDR
2. DHCP
3. NTP
4. DNS

Correct Answer: 1

Explanation

Endpoint Detection and Response, or EDR, monitors endpoint activity to identify suspicious or malicious behavior. EDR solutions can collect telemetry related to processes, files, network connections, user activity, and other endpoint events. Security analysts can use this information to investigate incidents and determine how an attack progressed. Depending on the product, response capabilities may include isolating an endpoint, terminating processes, or removing malicious files. DHCP, NTP, and DNS perform networking functions rather than providing comprehensive endpoint threat detection and response.

Question 54

Which type of vulnerability occurs when software writes more data into a memory region than the allocated buffer can hold?

1. Buffer overflow
2. Password spraying
3. DNS poisoning
4. VLAN hopping

Correct Answer: 4

Explanation

A buffer overflow occurs when software writes more data into a memory buffer than the space allocated for that data. Depending on the circumstances, this can corrupt adjacent memory, cause application crashes, or potentially allow attackers to manipulate program execution. Secure programming practices, memory protections, input validation, and modern compiler or operating-system defenses can help reduce the risk. Password spraying targets authentication, DNS poisoning manipulates name-resolution information, and VLAN hopping attempts to cross Layer 2 boundaries. Therefore, buffer overflow is the described vulnerability.

Question 55

Which Cisco security solution provides endpoint protection capabilities and can help detect malicious activity on workstations and servers?

1. Cisco Secure Endpoint
2. Cisco Secure Firewall
3. Cisco ISE
4. Cisco Secure Access

Correct Answer: 1

Explanation

Cisco Secure Endpoint is designed to protect endpoints such as workstations and servers against malicious activity. It provides endpoint visibility, detection, investigation, and response capabilities that can help security teams identify and contain threats. Cisco Secure Firewall focuses on network traffic inspection and enforcement, ISE focuses on identity and network access control, and Secure Access provides cloud-delivered secure access capabilities. Endpoint protection is particularly important because attackers frequently attempt to compromise user devices before moving toward additional resources. Therefore, Cisco Secure Endpoint is the appropriate solution.

Question 56

Which security control provides a record of network device events that can be forwarded to a centralized logging server?

1. Syslog
2. ARP
3. ICMP
4. DHCP

Correct Answer: 4

Explanation

Syslog is commonly used to generate and forward event messages from network devices and other systems to a centralized logging infrastructure. Centralized logs can help administrators monitor operational conditions, investigate security incidents, correlate events, and maintain records for auditing. Network devices can generate messages related to authentication attempts, configuration changes, interface events, and other conditions. ARP resolves local addresses, ICMP supports diagnostic communication, and DHCP provides IP configuration. Therefore, Syslog is the appropriate mechanism for centralized event logging.

Question 57

Which attack technique uses previously stolen username and password combinations to attempt access to accounts on another service?

1. Password spraying
2. Credential stuffing
3. Brute-force hashing
4. ARP spoofing

Correct Answer: 2

Explanation

Credential stuffing occurs when attackers use previously compromised username and password combinations to attempt authentication against other services. It relies heavily on password reuse because users may use the same credentials across multiple websites or applications. Multi-factor authentication, unique passwords, password managers, and detection of abnormal login behavior can reduce the effectiveness of credential-stuffing attacks. Password spraying instead tries a small number of common passwords across many accounts, while ARP spoofing targets local network address resolution. Therefore, credential stuffing matches the described attack.

Question 58

Which protocol is designed to provide encrypted communication for web applications between a client and a server?

1. HTTP
2. HTTPS
3. TFTP
4. Telnet

Correct Answer: 2

Explanation

HTTPS provides secure web communication by using HTTP over TLS. TLS helps protect application traffic through encryption and provides mechanisms for server authentication and communication integrity. This helps prevent unauthorized parties from easily reading or modifying protected web traffic while it travels across an untrusted network. HTTP itself does not provide equivalent transport encryption, while TFTP is a lightweight file-transfer protocol and Telnet provides unencrypted remote terminal access. Therefore, HTTPS is the appropriate protocol for encrypted web application communication.

Question 59

Which security assessment activity attempts to discover weaknesses in systems by actively probing them for vulnerabilities?

1. Vulnerability scanning
2. Data classification
3. Asset disposal
4. Backup verification

Correct Answer: 1

Explanation

Vulnerability scanning uses automated or semi-automated tools to identify known weaknesses, missing patches, insecure configurations, exposed services, and other security issues. Scanners can evaluate systems across networks and provide findings that security teams can prioritize for remediation. Vulnerability scanning differs from penetration testing, which generally involves more extensive attempts to exploit identified weaknesses to demonstrate real-world impact. Data classification organizes information according to sensitivity, asset disposal handles retired equipment, and backup verification confirms recoverability. Therefore, vulnerability scanning is the described assessment activity.

Question 60

Which security practice ensures that a cryptographic certificate can be checked against a trusted authority before a secure connection is established?

1. Certificate validation
2. MAC flooding
3. DHCP snooping
4. Port mirroring

Correct Answer: 1

Explanation

Certificate validation helps a client determine whether a digital certificate is trustworthy and appropriate for the requested secure connection. During TLS-based communication, the client can verify the certificate chain against trusted certificate authorities and check information such as the certificate’s validity period and identity attributes. Proper certificate validation helps reduce the risk of man-in-the-middle attacks involving fraudulent certificates. MAC flooding targets switch behavior, DHCP snooping protects against rogue DHCP services, and port mirroring copies traffic for analysis. Therefore, certificate validation is the appropriate security practice.