View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 161

Which security mechanism can prevent unauthorized users from accessing a network device through repeated password-guessing attempts?

1. Login blocking
2. Route redistribution
3. VLAN tagging
4. DNS forwarding

Correct Answer: 1

Explanation

Login blocking can temporarily restrict authentication attempts after a defined number of failed login attempts. This helps reduce the effectiveness of automated password-guessing and brute-force attacks against network-device management interfaces. Administrators can combine login protections with strong passwords, multifactor authentication, centralized AAA, and secure management protocols. Route redistribution exchanges routing information, VLAN tagging identifies Layer 2 membership, and DNS forwarding handles name-resolution requests. Therefore, login blocking is the security mechanism designed to limit repeated unauthorized authentication attempts.

Question 162

Which security technology can use endpoint telemetry to investigate how a malicious process entered a system and what actions it performed afterward?

1. Network Address Translation
2. Endpoint Detection and Response
3. DHCP snooping
4. VLAN trunking

Correct Answer: 2

Explanation

Endpoint Detection and Response, or EDR, collects detailed endpoint telemetry that can help analysts investigate suspicious processes, files, network connections, and user activity. Security teams can use this information to reconstruct attack activity and understand how a threat entered a device, what processes were executed, and what additional systems may have been contacted. NAT translates addresses, DHCP snooping protects against rogue DHCP servers, and VLAN trunking transports multiple VLANs. Therefore, EDR provides the endpoint investigation capability described.

Question 163

Which security control can help protect a network device from excessive traffic directed at its management and control-plane functions?

1. DNSSEC
2. CoPP
3. Port security
4. DLP

Correct Answer: 2

Explanation

Control Plane Policing, or CoPP, controls traffic destined for the control plane of a network device. Security policies can classify traffic and apply rate limits or other actions to prevent excessive packets from overwhelming CPU resources. This is particularly useful for protecting routing protocols, management services, and other control-plane functions from abuse or denial-of-service conditions. DNSSEC protects DNS integrity, port security controls switch-port access, and DLP protects sensitive information. Therefore, CoPP provides the required protection for control-plane resources.

Question 164

Which authentication protocol commonly separates authentication, authorization, and accounting functions for network-device administrators?

1. TACACS+
2. HTTP
3. SNMP
4. DHCP

Correct Answer: 1

Explanation

TACACS+ is designed to provide centralized authentication, authorization, and accounting for administrative access to network devices. Its separation of these functions allows organizations to apply granular authorization policies and maintain records of administrator activity. This can be particularly useful when different administrators require different command privileges. HTTP is an application protocol, SNMP provides network-management functions, and DHCP provides host configuration. Therefore, TACACS+ is the protocol that best matches centralized administrative AAA requirements.

Question 165

Which security capability can identify malicious behavior by analyzing files in an isolated environment before allowing them to reach users?

1. Sandbox analysis
2. Route filtering
3. NAT traversal
4. VLAN pruning

Correct Answer: 1

Explanation

Sandbox analysis executes or examines suspicious files in an isolated environment to observe their behavior without exposing production systems to the same risk. Security solutions can analyze actions such as process creation, file modification, network communication, and other behaviors to determine whether a file is malicious. This approach can help identify threats that may evade simple signature-based detection. Route filtering controls routing information, NAT traversal supports communication through address translation, and VLAN pruning limits VLAN propagation. Therefore, sandbox analysis provides the described security capability.

Question 166

Which security technology can verify the identity of a server during a TLS connection by validating its digital certificate?

1. Digital certificate validation
2. MAC address learning
3. DHCP relay
4. Traffic shaping

Correct Answer: 1

Explanation

During a TLS connection, certificate validation allows a client to verify whether a server certificate is trusted and whether it corresponds to the intended identity. Validation can include checking the certificate chain, validity period, trusted certificate authority, and hostname or other identity attributes. This helps reduce the risk of connecting to an unauthorized server through a man-in-the-middle attack. MAC learning supports Ethernet switching, DHCP relay forwards configuration requests, and traffic shaping controls bandwidth. Therefore, certificate validation provides the described server-authentication mechanism.

Question 167

Which security control is most directly concerned with preventing sensitive information from leaving an organization through unauthorized channels?

1. DLP
2. STP
3. OSPF
4. VRRP

Correct Answer: 1

Explanation

Data Loss Prevention, or DLP, is designed to identify and protect sensitive information as it is stored, processed, or transmitted. DLP policies can inspect content and detect information such as confidential documents, financial data, personally identifiable information, or other organizationally defined sensitive content. Depending on the implementation, DLP can alert, block, quarantine, or otherwise control unauthorized transfers. STP prevents Layer 2 loops, OSPF exchanges routing information, and VRRP provides gateway redundancy. Therefore, DLP directly addresses unauthorized data movement.

Question 168

Which cloud security capability identifies publicly exposed cloud resources and configuration settings that violate organizational security policies?

1. CSPM
2. SFTP
3. MACsec
4. GRE

Correct Answer: 1

Explanation

Cloud Security Posture Management, or CSPM, continuously evaluates cloud environments for configuration weaknesses and policy violations. It can identify issues such as publicly exposed storage, overly permissive security rules, missing encryption controls, weak identity permissions, and other insecure settings. CSPM helps security teams maintain a consistent security posture across dynamic cloud environments where resources can be created or modified rapidly. SFTP provides secure file transfer, MACsec protects Ethernet traffic, and GRE provides tunneling. Therefore, CSPM is the appropriate cloud-security capability.

Question 169

Which network security technology can create an encrypted tunnel between two sites while allowing their internal hosts to communicate across an untrusted Internet connection?

1. Site-to-site VPN
2. DNS caching
3. SPAN
4. Port security

Correct Answer: 1

Explanation

A site-to-site VPN establishes a secure tunnel between network gateways so that hosts in separate locations can communicate across an untrusted network. IPsec is commonly used to provide encryption, integrity, authentication, and anti-replay protection for this type of connection. The gateways handle VPN processing so that individual internal hosts generally do not need separate VPN software. DNS caching stores name-resolution results, SPAN copies traffic for monitoring, and port security restricts switch-port access. Therefore, site-to-site VPN provides the described connectivity.

Question 170

Which security principle requires that a user should receive access only to the applications and resources necessary for their assigned duties?

1. Defense in depth
2. Least privilege
3. Availability
4. Nonrepudiation

Correct Answer: 2

Explanation

Least privilege limits a user’s, application’s, or system’s permissions to only what is necessary for authorized responsibilities. Restricting access in this way reduces the potential damage caused by compromised credentials, malicious insiders, application vulnerabilities, or accidental misuse. Access should be reviewed periodically because job responsibilities and organizational requirements can change. Defense in depth uses multiple security layers, availability focuses on access to resources, and nonrepudiation provides evidence associated with actions. Therefore, least privilege directly describes the required access-control principle.

Question 171

Which security technology provides visibility into encrypted application traffic by inspecting TLS sessions at a security enforcement point?

1. TLS inspection
2. DHCP snooping
3. HSRP
4. LACP

Correct Answer: 1

Explanation

TLS inspection allows a security enforcement point to decrypt, inspect, and re-encrypt protected traffic so that security policies can evaluate content that would otherwise remain encrypted. This can support malware detection, application identification, URL filtering, and other inspection functions. Organizations must carefully manage certificates and privacy requirements because inspection involves access to decrypted traffic. DHCP snooping protects against rogue DHCP servers, HSRP provides gateway redundancy, and LACP manages link aggregation. Therefore, TLS inspection provides visibility into encrypted application traffic.

Question 172

Which security technology can automatically quarantine an endpoint after it is determined to be infected with malware?

1. Endpoint isolation
2. Route summarization
3. DNS recursion
4. NAT overload

Correct Answer: 1

Explanation

Endpoint isolation restricts a compromised device’s network communication to contain the threat and reduce opportunities for lateral movement. Modern endpoint-security platforms can isolate a device while preserving controlled communication with security-management infrastructure so that analysts can investigate and remediate the incident. Route summarization reduces routing information, DNS recursion processes name-resolution queries, and NAT overload translates multiple private addresses through a shared public address. Therefore, endpoint isolation is the capability used to quarantine a potentially infected endpoint.

Question 173

Which security service provides centralized protection for users accessing websites from locations outside the traditional corporate network?

1. Secure Web Gateway
2. STP
3. VRRP
4. OSPF

Correct Answer: 1

Explanation

A Secure Web Gateway, or SWG, provides security inspection and policy enforcement for web traffic. Cloud-delivered SWG services can protect users regardless of whether they are working from a corporate office, home, or another remote location. Depending on the implementation, SWG capabilities can include URL filtering, malware inspection, content controls, and data-protection policies. STP prevents switching loops, VRRP provides gateway redundancy, and OSPF exchanges routing information. Therefore, Secure Web Gateway is the service designed to secure web access from distributed locations.

Question 174

Which security control can detect and block unauthorized ARP messages by comparing them with trusted IP-to-MAC address bindings?

1. Dynamic ARP Inspection
2. DNSSEC
3. TLS
4. IPsec

Correct Answer: 1

Explanation

Dynamic ARP Inspection, or DAI, validates ARP messages against trusted IP-to-MAC address information. In many deployments, the required bindings are obtained from DHCP snooping. ARP messages that do not match expected bindings can be dropped, reducing the risk of ARP spoofing and man-in-the-middle attacks within a local network. DNSSEC protects DNS data, TLS protects application communications, and IPsec protects IP traffic. Therefore, Dynamic ARP Inspection provides the Layer 2 protection described.

Question 175

Which security technology provides cryptographic protection for Ethernet frames between directly connected network devices?

1. MACsec
2. FTP
3. GRE
4. SNMP

Correct Answer: 1

Explanation

MACsec, based on IEEE 802.1AE, provides Layer 2 security for Ethernet frames. It can protect traffic against unauthorized observation and tampering as frames travel across a secured Ethernet link. MACsec is useful when organizations require protection for traffic within campus, data-center, or other switched environments. FTP provides file transfer, GRE provides tunneling without inherent encryption, and SNMP provides network-management capabilities. Therefore, MACsec is the technology that provides cryptographic protection directly at the Ethernet layer.

Question 176

Which security mechanism can prevent a user from accessing a network until the user’s identity has been authenticated?

1. 802.1X
2. SPAN
3. GRE
4. EtherChannel

Correct Answer: 1

Explanation

802.1X provides port-based network access control and requires authentication before normal network access is granted. It can be used in both wired and wireless environments and commonly integrates with centralized authentication systems. This allows organizations to associate access decisions with user or device identity and apply appropriate authorization policies after successful authentication. SPAN copies traffic for monitoring, GRE creates tunnels, and EtherChannel combines multiple physical links. Therefore, 802.1X provides the authentication-based network-access control described.

Question 177

Which security capability helps an organization detect suspicious activity by correlating authentication events, firewall alerts, endpoint events, and other security logs?

1. SIEM
2. DHCP
3. NAT
4. STP

Correct Answer: 1

Explanation

A Security Information and Event Management, or SIEM, platform aggregates security events from multiple systems and correlates them to identify patterns that may indicate an attack. Authentication failures, firewall blocks, endpoint alerts, and other events can be analyzed together to provide broader context than any individual log source. SIEM systems can support alerting, investigation, compliance reporting, and incident response. DHCP provides network configuration, NAT translates addresses, and STP prevents switching loops. Therefore, SIEM provides the centralized event-correlation capability described.

Question 178

Which attack involves sending a large number of authentication requests using many different usernames but a small number of commonly used passwords?

1. Credential stuffing
2. Password spraying
3. SQL injection
4. Buffer overflow

Correct Answer: 2

Explanation

Password spraying attempts to avoid account lockout controls by trying a small number of commonly used passwords against many different accounts. Instead of repeatedly attacking one username, the attacker distributes attempts across a broad set of accounts. This technique can exploit weak passwords while generating fewer attempts against each individual account. Credential stuffing uses previously compromised username-and-password combinations, SQL injection targets vulnerable database queries, and buffer overflow exploits memory-handling weaknesses. Therefore, password spraying matches the described authentication attack.

Question 179

Which security technology can provide secure access to private applications without requiring a traditional full-network VPN connection?

1. ZTNA
2. FTP
3. ARP
4. LACP

Correct Answer: 1

Explanation

Zero Trust Network Access, or ZTNA, provides controlled access to specific private applications based on identity, device context, policy, and other security signals. Instead of automatically placing a remote user on a broad internal network, ZTNA can provide access only to applications that the user is authorized to use. This supports least-privilege access and reduces unnecessary network exposure. FTP provides file transfer, ARP performs address resolution, and LACP manages link aggregation. Therefore, ZTNA provides the described application-specific secure-access model.

Question 180

Which security technology can identify whether a cloud application is being used by employees and provide policy controls over that application’s use?

1. CASB
2. HSRP
3. OSPF
4. LACP

Correct Answer: 1

Explanation

A Cloud Access Security Broker, or CASB, provides visibility and policy enforcement for cloud-service usage. It can help organizations identify cloud applications, monitor how they are being used, and apply controls related to access, data protection, compliance, and security. CASB capabilities can be especially useful when employees use cloud services outside traditional corporate infrastructure. HSRP provides gateway redundancy, OSPF is a routing protocol, and LACP manages link aggregation. Therefore, CASB provides the cloud-application visibility and control described.