View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 141

Which security mechanism allows a receiving system to verify that a message was created by a trusted sender and was not modified in transit?

1. Digital signature
2. NAT
3. VLAN tagging
4. Traffic shaping

Correct Answer: 1

Explanation

A digital signature provides cryptographic evidence that can be used to verify the origin and integrity of signed information. The sender uses a private key to create the signature, and the recipient uses the corresponding public key to verify it. If the signed content is changed after signing, verification should fail. Digital signatures are commonly used with certificates, software packages, documents, and secure communications. NAT translates addresses, VLAN tagging identifies Layer 2 segments, and traffic shaping controls bandwidth. Therefore, a digital signature provides the described verification mechanism.

Question 142

Which Cisco security technology can enforce access policies by using Security Group Tags rather than requiring policies to be based entirely on IP addresses?

1. Cisco Secure Endpoint
2. Cisco TrustSec
3. Cisco Umbrella
4. Cisco Secure Malware Analytics

Correct Answer: 2

Explanation

Cisco TrustSec uses Security Group Tags to associate users, devices, or traffic with security classifications that can be used in policy decisions. This allows organizations to apply segmentation and access policies based on security group identity instead of relying exclusively on IP addressing. Such an approach can remain useful when devices move between network locations or receive different addresses. Cisco Secure Endpoint focuses on endpoint protection, Umbrella provides cloud-delivered security services, and Secure Malware Analytics analyzes suspicious content. Therefore, Cisco TrustSec provides the described capability.

Question 143

Which attack attempts to overwhelm a target by sending a large number of connection requests that remain partially open?

1. DNS poisoning
2. SQL injection
3. SYN flood
4. Credential stuffing

Correct Answer: 3

Explanation

A SYN flood is a denial-of-service technique that abuses the TCP connection-establishment process. An attacker sends large numbers of TCP SYN requests without completing the corresponding handshake, causing the target to maintain many incomplete connection states. If resources become exhausted, legitimate clients may experience delays or be unable to establish connections. Network security controls can use rate limiting, filtering, and other mitigation techniques to reduce the impact. DNS poisoning manipulates name resolution, SQL injection targets databases, and credential stuffing abuses reused credentials.

Question 144

Which security practice ensures that an organization’s security controls remain effective after changes are made to systems or applications?

1. Security validation testing
2. Address translation
3. Route summarization
4. Packet switching

Correct Answer: 1

Explanation

Security validation testing evaluates whether security controls continue to operate as intended after changes are introduced. Changes to applications, infrastructure, policies, software versions, or network architecture can unintentionally create new weaknesses or disable existing protections. Validation activities may include configuration reviews, vulnerability testing, control testing, and security-focused functional tests. Address translation changes network addressing, route summarization reduces routing information, and packet switching forwards frames or packets. Therefore, security validation testing is the practice that confirms security controls remain effective after changes.

Question 145

Which security technology can provide encrypted communication between two Layer 3 network endpoints while protecting application traffic from intermediate networks?

1. IPsec
2. STP
3. DHCP
4. ARP

Correct Answer: 1

Explanation

IPsec provides network-layer security mechanisms that can protect IP traffic between communicating endpoints. It can provide confidentiality, integrity, authentication, and anti-replay protection depending on the selected configuration. IPsec is commonly used to establish secure site-to-site and remote-access VPN connections across untrusted networks. STP prevents Layer 2 loops, DHCP provides host configuration, and ARP resolves IPv4 addresses to MAC addresses. Therefore, IPsec is the technology designed to protect Layer 3 communication between network endpoints.

Question 146

A security team wants to identify vulnerabilities in a newly deployed application before attackers discover them. Which activity should be performed?

1. Vulnerability assessment
2. Traffic mirroring
3. DNS forwarding
4. Link aggregation

Correct Answer: 1

Explanation

A vulnerability assessment systematically identifies weaknesses in applications, systems, configurations, and supporting infrastructure. Security teams can use scanning tools, configuration reviews, and other assessment techniques to identify known vulnerabilities before they are exploited. Findings can then be prioritized according to factors such as severity, exposure, exploitability, and business impact. Traffic mirroring copies network packets, DNS forwarding handles name-resolution requests, and link aggregation combines physical interfaces. Therefore, vulnerability assessment is the appropriate activity for proactively identifying weaknesses in a newly deployed application.

Question 147

Which security property ensures that authorized users can access systems and information when they are needed?

1. Confidentiality
2. Integrity
3. Availability
4. Authentication

Correct Answer: 3

Explanation

Availability is the security property concerned with ensuring that authorized users can access systems, applications, and information when required. Security incidents such as denial-of-service attacks, hardware failures, ransomware, and infrastructure outages can affect availability. Organizations can improve availability through redundancy, backups, disaster recovery planning, resilient architectures, monitoring, and appropriate capacity management. Confidentiality protects information from unauthorized disclosure, integrity protects information from unauthorized modification, and authentication verifies identity. Therefore, availability is the property described in the question.

Question 148

Which Cisco firewall capability can block traffic based on known malicious IP addresses or domains before more detailed inspection occurs?

1. Security intelligence
2. DHCP snooping
3. Port security
4. MACsec

Correct Answer: 4

Explanation

Security intelligence can use reputation information and known threat indicators to identify potentially malicious destinations or sources. A firewall can use feeds containing indicators such as malicious IP addresses and domains to block associated traffic according to configured policy. This provides a preventive layer that can stop known threats efficiently before additional processing is performed. DHCP snooping protects against rogue DHCP servers, port security restricts switch-port access, and MACsec encrypts Ethernet traffic. Therefore, security intelligence provides the described threat-indicator blocking capability.

Question 149

Which cloud security control continuously evaluates whether cloud identities have more permissions than required for their assigned responsibilities?

1. Cloud access governance
2. Packet filtering
3. MAC learning
4. Traffic mirroring

Correct Answer: 1

Explanation

Cloud access governance helps organizations review and control permissions assigned to cloud identities, applications, and services. Excessive permissions can increase the impact of compromised credentials or malicious activity, so security teams should regularly identify unnecessary privileges and reduce them according to business requirements. Effective governance can include access reviews, policy enforcement, role analysis, and monitoring for abnormal privilege changes. Packet filtering controls network traffic, MAC learning supports switching, and traffic mirroring copies packets for analysis. Therefore, cloud access governance addresses excessive cloud permissions.

Question 150

Which protocol is designed to provide secure web communication by combining HTTP with TLS?

1. FTP
2. HTTPS
3. TFTP
4. SNMP

Correct Answer: 2

Explanation

HTTPS combines HTTP with Transport Layer Security to protect web communications. TLS can provide encryption, integrity protection, and server authentication through digital certificates. This helps protect sensitive information such as credentials, session data, and application content from unauthorized observation or modification while traveling across networks. FTP and TFTP are file-transfer protocols, while SNMP is used for network management. HTTPS is therefore the standard protocol used when HTTP traffic requires cryptographic protection between a client and server.

Question 151

Which security technique divides a large network into smaller security zones so that access between zones can be explicitly controlled?

1. Network segmentation
2. DNS recursion
3. Load balancing
4. Route aggregation

Correct Answer: 1

Explanation

Network segmentation divides an environment into smaller logical or physical security zones and places controls between those zones. Segmentation can restrict unnecessary communication and reduce the ability of an attacker to move laterally after compromising one system. Firewalls, VLANs, VRFs, security groups, and identity-based policies can all support segmentation depending on the architecture. DNS recursion handles name-resolution queries, load balancing distributes application requests, and route aggregation reduces routing information. Therefore, network segmentation is the appropriate technique for separating security zones.

Question 152

Which security technology is specifically designed to protect email users from malicious messages, phishing attempts, spam, and harmful attachments?

1. Secure Email Gateway
2. VRRP
3. OSPF
4. DHCP relay

Correct Answer: 1

Explanation

A Secure Email Gateway provides security controls for inbound and outbound email traffic. Depending on the implementation, it can inspect messages for spam, phishing indicators, malicious attachments, suspicious links, malware, and policy violations. Email security is important because attackers frequently use messages to deliver credentials-stealing pages or malicious files. VRRP provides gateway redundancy, OSPF exchanges routing information, and DHCP relay forwards address-configuration requests. Therefore, Secure Email Gateway technology is designed specifically to protect organizational email communications.

Question 153

Which security process prioritizes vulnerabilities according to factors such as severity, exploitability, exposure, and business impact?

1. Vulnerability prioritization
2. Data replication
3. Packet forwarding
4. Network address translation

Correct Answer: 1

Explanation

Vulnerability prioritization helps security teams determine which weaknesses should receive attention first. Severity alone may not provide enough information because a vulnerability with a high technical score may have limited exposure, while a moderately rated weakness on an Internet-facing critical system may represent a more immediate concern. Organizations can consider exploit availability, asset criticality, exposure, business impact, and compensating controls when prioritizing remediation. Data replication copies information, packet forwarding moves traffic, and NAT translates addresses. Therefore, vulnerability prioritization provides the described risk-management function.

Question 154

Which Cisco technology can provide centralized identity-based access control and endpoint profiling for devices attempting to connect to an enterprise network?

1. Cisco ISE
2. Cisco Talos
3. Cisco Secure Malware Analytics
4. Cisco Secure Firewall

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or ISE, provides centralized identity and access-control capabilities for enterprise networks. It can authenticate users and devices, apply authorization policies, profile endpoints, and integrate with other security controls. These capabilities allow organizations to make access decisions based on identity, device characteristics, and security requirements rather than simply granting unrestricted network connectivity. Cisco Talos provides threat intelligence, Secure Malware Analytics analyzes suspicious content, and Secure Firewall provides network security enforcement. Therefore, Cisco ISE provides the described identity-based access-control capabilities.

Question 155

Which security mechanism protects against unauthorized modification of a message by generating a keyed integrity value that the recipient can verify?

1. MAC
2. NAT
3. VLAN
4. GRE

Correct Answer: 1

Explanation

A Message Authentication Code, or MAC, provides integrity protection and authentication using a shared secret key. The sender calculates the MAC over the protected data, and the recipient uses the shared key to calculate and compare the expected value. If the values do not match, the message may have been modified or the sender may not possess the correct secret. NAT performs address translation, VLANs provide Layer 2 segmentation, and GRE provides tunneling. Therefore, a MAC provides the described keyed integrity mechanism.

Question 156

Which security architecture uses continuous verification of users, devices, and access requests instead of granting broad trust based only on network location?

1. Traditional perimeter security
2. Zero Trust
3. Open network access
4. Static routing

Correct Answer: 2

Explanation

Zero Trust treats every access request as requiring appropriate verification rather than automatically trusting a user or device because it is inside a particular network boundary. Identity, device posture, application context, resource sensitivity, and other signals can be considered when making authorization decisions. Access is generally limited to the resources necessary for the request, and trust can be continuously evaluated. Traditional perimeter security places greater emphasis on network boundaries, while static routing controls packet paths. Therefore, Zero Trust uses the continuous-verification approach described.

Question 157

Which security control can prevent unauthorized users from modifying the configuration of a network device by requiring appropriate administrative authorization?

1. Role-based administrative access
2. DNS caching
3. Packet fragmentation
4. Link aggregation

Correct Answer: 1

Explanation

Role-based administrative access assigns management permissions according to defined roles and responsibilities. Instead of giving every administrator unrestricted privileges, organizations can provide only the commands or configuration capabilities required for each person’s job. This supports least privilege and reduces the potential impact of compromised administrative accounts. Strong authentication, centralized authorization, and logging can further strengthen administrative access. DNS caching stores name-resolution information, packet fragmentation divides packets, and link aggregation combines interfaces. Therefore, role-based administrative access provides the described configuration protection.

Question 158

Which security technology can inspect network traffic and identify applications, users, and content to support granular security policies?

1. Next-generation firewall
2. Basic Layer 2 switch
3. DHCP server
4. NTP server

Correct Answer: 3

Explanation

A next-generation firewall can provide security inspection beyond traditional source, destination, and port-based filtering. Depending on the platform, it may identify applications, users, URLs, files, threats, and other traffic characteristics to support granular policy decisions. This allows organizations to apply security controls according to business and security context rather than relying only on transport-layer ports. A basic Layer 2 switch primarily forwards Ethernet frames, DHCP provides address configuration, and NTP synchronizes clocks. Therefore, a next-generation firewall provides the described inspection capabilities.

Question 159

Which security control can reduce the likelihood that a stolen session cookie will remain useful for an extended period?

1. Session timeout
2. Route summarization
3. DHCP reservation
4. VLAN pruning

Correct Answer: 4

Explanation

Session timeout limits how long an authenticated session remains valid without requiring renewed authentication or activity. Shorter or appropriately configured session lifetimes can reduce the period during which a stolen session token or cookie may be useful to an attacker. Organizations can combine session timeouts with secure cookie attributes, reauthentication requirements, and session revocation mechanisms for stronger protection. Route summarization affects routing information, DHCP reservations provide predictable addressing, and VLAN pruning limits VLAN propagation. Therefore, session timeout is the relevant security control.

Question 160

Which security monitoring capability collects detailed records about network conversations, including source, destination, ports, and traffic volume, without storing every packet?

1. Flow telemetry
2. Full packet capture
3. Port security
4. Certificate revocation

Correct Answer: 4

Explanation

Flow telemetry records metadata about network conversations rather than storing the complete contents of every packet. Typical information can include source and destination addresses, source and destination ports, protocol, timestamps, packet counts, and byte counts. This provides useful visibility into traffic patterns while generally requiring less storage than full packet capture. Full packet capture stores packet-level information, port security controls switch access, and certificate revocation invalidates digital certificates. Therefore, flow telemetry provides the described network-monitoring capability.