View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 241

Which security mechanism can prevent an unauthorized device from obtaining network configuration information from a rogue DHCP server?

1. DHCP snooping
2. DNSSEC
3. MACsec
4. CoPP

Correct Answer: 1

Explanation

DHCP snooping allows a switch to distinguish trusted DHCP-server-facing interfaces from untrusted access interfaces. DHCP server messages received on an untrusted interface can be blocked, helping prevent rogue DHCP servers from providing malicious gateway, DNS, or addressing information to clients. DHCP snooping can also create trusted IP-to-MAC bindings that support other first-hop security controls. DNSSEC protects DNS data, MACsec secures Ethernet frames, and CoPP protects control-plane resources. Therefore, DHCP snooping provides the required protection against rogue DHCP servers.

Question 242

Which security feature can prevent unauthorized IPv6 neighbors from claiming an address that belongs to another host?

1. IPv6 source guard
2. NAT overload
3. BGP prefix filtering
4. SPAN

Correct Answer: 1

Explanation

IPv6 source guard is a first-hop security mechanism that can validate IPv6 source information associated with traffic arriving on an interface. By restricting traffic according to known IPv6 address and interface bindings, it can help prevent unauthorized hosts from using another device’s IPv6 address. This reduces opportunities for source-address spoofing and certain local-network attacks. NAT overload translates multiple addresses, BGP prefix filtering controls routing advertisements, and SPAN copies traffic for monitoring. Therefore, IPv6 source guard provides the required protection.

Question 243

Which security technique can protect a private VLAN environment by restricting communication between isolated endpoints even when they belong to the same primary VLAN?

1. Private VLANs
2. Route summarization
3. Link aggregation
4. DNS forwarding

Correct Answer: 1

Explanation

Private VLANs provide Layer 2 isolation between endpoints within the same primary VLAN. Depending on the configured private VLAN type, hosts may be isolated from one another while still communicating with an approved promiscuous port or required gateway. This can be useful in environments such as hosting facilities where systems share infrastructure but should not have unrestricted Layer 2 communication. Route summarization reduces routing information, link aggregation combines interfaces, and DNS forwarding handles name-resolution requests. Therefore, private VLANs provide the described endpoint isolation.

Question 244

Which security control can limit administrative access to a network device by allowing management connections only through a designated management interface?

1. Management-plane ACL
2. DNSSEC
3. Storm control
4. DHCP relay

Correct Answer: 1

Explanation

A management-plane ACL can restrict which sources are permitted to access administrative services on network infrastructure. Organizations can apply policies that allow management connections only from designated management networks, jump hosts, or other approved sources. This reduces exposure of SSH, HTTPS, SNMP, and similar services to untrusted users or general production networks. DNSSEC protects DNS integrity, storm control limits excessive Layer 2 traffic, and DHCP relay forwards configuration requests. Therefore, a management-plane ACL directly supports restricted administrative access.

Question 245

Which security capability can identify an attacker attempting to exploit a vulnerable web application by detecting malicious HTTP request patterns?

1. Web application firewall
2. NTP
3. VRRP
4. LACP

Correct Answer: 1

Explanation

A Web Application Firewall, or WAF, monitors and filters HTTP and HTTPS application traffic according to security rules. It can identify patterns associated with attacks such as SQL injection, cross-site scripting, malicious parameter manipulation, and other web-application threats. By applying policies at the application layer, a WAF provides protection that traditional network firewalls may not provide on their own. NTP synchronizes clocks, VRRP provides gateway redundancy, and LACP manages link aggregation. Therefore, WAF provides the application-layer protection described.

Question 246

Which security control can detect when a user attempts to access a website categorized as malicious or inappropriate according to organizational policy?

1. Secure Web Gateway
2. MACsec
3. IP Source Guard
4. CoPP

Correct Answer: 1

Explanation

A Secure Web Gateway, or SWG, can inspect web requests and enforce organizational policies based on URL categories, reputation, malware indicators, and other security criteria. An organization can configure policies to block known malicious websites or restrict categories that violate acceptable-use requirements. SWG services may also integrate malware inspection and data-protection capabilities. MACsec secures Ethernet traffic, IP Source Guard validates source information, and CoPP protects the control plane. Therefore, Secure Web Gateway provides the web-access control described.

Question 247

Which security principle requires an organization to identify and prioritize risks based on their likelihood and potential business impact?

1. Risk assessment
2. Network address translation
3. Traffic mirroring
4. VLAN tagging

Correct Answer: 1

Explanation

Risk assessment involves identifying threats and vulnerabilities, evaluating their likelihood and potential consequences, and determining which risks require attention. Organizations can use risk assessments to prioritize security investments and select controls according to business requirements. The process helps avoid treating every issue as equally important and supports informed security planning. NAT translates addresses, traffic mirroring copies network packets, and VLAN tagging identifies VLAN membership. Therefore, risk assessment provides the structured approach for evaluating and prioritizing organizational security risks.

Question 248

Which security technology can inspect application traffic and identify the application being used rather than relying only on destination port numbers?

1. Application Visibility and Control
2. DHCP snooping
3. Root Guard
4. RPO

Correct Answer: 1

Explanation

Application Visibility and Control, or AVC, identifies applications based on traffic characteristics rather than relying solely on traditional port-based classification. This provides security administrators with greater visibility into the applications operating across the network and can support application-aware security policies. Modern applications may use common ports or dynamically select ports, making simple port-based identification less reliable. DHCP snooping protects DHCP operations, Root Guard protects spanning-tree topology, and RPO defines acceptable data loss. Therefore, AVC provides the required application-level visibility.

Question 249

Which security mechanism allows an administrator to securely transfer configuration files between network devices while protecting the data during transit?

1. SFTP
2. TFTP
3. FTP
4. Telnet

Correct Answer: 1

Explanation

Secure File Transfer Protocol, or SFTP, transfers files through an encrypted SSH-based connection. It provides confidentiality and helps protect credentials and configuration data from interception while files are being transferred. This is particularly important when configuration files contain sensitive information such as authentication settings, network addresses, or security policies. TFTP and traditional FTP do not provide the same built-in protection, while Telnet is designed for remote terminal access rather than secure file transfer. Therefore, SFTP is the appropriate secure file-transfer mechanism.

Question 250

Which security control can prevent unauthorized users from changing the configuration of a network device by requiring appropriate administrative authorization?

1. Role-based access control
2. DNS caching
3. SPAN
4. GRE

Correct Answer: 1

Explanation

Role-based access control, or RBAC, assigns permissions according to defined administrative roles. Instead of giving every administrator unrestricted privileges, organizations can provide only the commands and functions required for a person’s responsibilities. This supports least privilege and reduces the impact of compromised administrative credentials or accidental configuration changes. DNS caching stores name-resolution information, SPAN copies traffic for monitoring, and GRE provides tunneling. Therefore, RBAC provides the authorization mechanism needed to restrict administrative configuration privileges.

Question 251

Which security capability can analyze endpoint behavior across multiple security products to identify coordinated attacks that may not be obvious from a single alert?

1. XDR
2. NAT
3. STP
4. DHCP

Correct Answer: 1

Explanation

Extended Detection and Response, or XDR, correlates security telemetry from multiple security domains such as endpoints, networks, email, cloud services, and identity systems. By combining related events, XDR can provide broader visibility into coordinated attacks and reduce the limitations of analyzing individual alerts separately. This can help analysts investigate attack chains and respond more efficiently. NAT translates addresses, STP prevents Layer 2 loops, and DHCP provides network configuration. Therefore, XDR provides the cross-domain detection capability described.

Question 252

Which security mechanism can protect a routing protocol session by requiring authenticated peers before routing updates are accepted?

1. Routing protocol authentication
2. VLAN pruning
3. DNS caching
4. Port mirroring

Correct Answer: 1

Explanation

Routing protocol authentication allows routers to verify that routing updates originate from an authorized peer. Depending on the routing protocol and implementation, authentication can use cryptographic mechanisms to protect routing exchanges from unauthorized participation or manipulation. This helps prevent attackers from injecting false routes that could redirect traffic or disrupt network connectivity. VLAN pruning limits VLAN propagation, DNS caching stores name-resolution results, and port mirroring copies traffic for monitoring. Therefore, routing protocol authentication provides the required protection for routing exchanges.

Question 253

Which security capability can identify and block a file containing known malware before the file is delivered to an endpoint?

1. Malware inspection
2. Route summarization
3. HSRP
4. NTP

Correct Answer: 1

Explanation

Malware inspection examines files or other content for indicators associated with malicious software. Depending on the security platform, inspection may use signatures, reputation data, behavioral analysis, sandboxing, or combinations of these methods. Blocking a malicious file before it reaches an endpoint can reduce the opportunity for malware execution and subsequent compromise. Route summarization reduces routing information, HSRP provides gateway redundancy, and NTP synchronizes system clocks. Therefore, malware inspection provides the file-level detection and prevention capability described.

Question 254

Which security mechanism can ensure that an IPsec packet cannot simply be captured and resent later to repeat a previously valid communication?

1. Anti-replay protection
2. DNSSEC
3. VLAN tagging
4. Storm control

Correct Answer: 1

Explanation

IPsec anti-replay protection uses sequence information to detect packets that have already been received or that fall outside the acceptable replay window. This helps prevent an attacker from capturing legitimate encrypted packets and retransmitting them later in an attempt to repeat an earlier action. Anti-replay protection is an important part of maintaining the integrity of IPsec-protected communications. DNSSEC protects DNS data, VLAN tagging identifies Layer 2 membership, and storm control limits excessive traffic. Therefore, anti-replay protection addresses the described threat.

Question 255

Which security capability can identify abnormal login behavior, such as a successful authentication from an unusual geographic location or device?

1. UEBA
2. STP
3. GRE
4. LACP

Correct Answer: 1

Explanation

User and Entity Behavior Analytics, or UEBA, establishes behavioral patterns for users and entities and identifies significant deviations from those patterns. An unusual login location, unexpected device, abnormal access time, or sudden change in resource usage may indicate compromised credentials or other suspicious activity. UEBA can provide additional context for security investigations and risk-based decisions. STP prevents switching loops, GRE provides tunneling, and LACP manages link aggregation. Therefore, UEBA is the capability designed to identify abnormal behavioral patterns.

Question 256

Which cloud security approach combines capabilities such as workload protection, cloud posture management, and application security into a broader cloud-native security strategy?

1. CNAPP
2. VRRP
3. CoPP
4. RADIUS

Correct Answer: 1

Explanation

A Cloud-Native Application Protection Platform, or CNAPP, combines multiple cloud-security capabilities into an integrated approach for protecting cloud-native applications and infrastructure. Depending on the platform, capabilities can include cloud security posture management, cloud workload protection, application security, identity controls, vulnerability management, and runtime protection. The goal is to provide security visibility across the cloud application lifecycle rather than relying on isolated tools. VRRP provides gateway redundancy, CoPP protects the control plane, and RADIUS supports authentication. Therefore, CNAPP matches the described cloud-security approach.

Question 257

Which security control can protect a network device from unauthorized configuration changes by recording administrator commands for later review?

1. Command accounting
2. DNS forwarding
3. NAT traversal
4. VLAN pruning

Correct Answer: 1

Explanation

Command accounting records administrative activity such as commands executed by network-device users. When integrated with centralized AAA infrastructure, command accounting can provide an audit trail showing which administrator performed specific actions. This information can support incident investigation, compliance requirements, change tracking, and accountability. DNS forwarding handles name-resolution requests, NAT traversal supports communication through address translation, and VLAN pruning controls VLAN propagation. Therefore, command accounting provides the administrative activity-recording capability described.

Question 258

Which security control can help detect unauthorized software installation by comparing installed applications against an approved endpoint inventory?

1. Endpoint application inventory
2. BGP TTL security
3. DHCP relay
4. MACsec

Correct Answer: 1

Explanation

Endpoint application inventory provides visibility into software installed on managed devices. Security teams can compare observed applications against an approved software baseline to identify unauthorized, outdated, or potentially risky programs. This information can support application allowlisting, vulnerability management, software-removal processes, and compliance activities. BGP TTL security protects routing sessions, DHCP relay forwards DHCP messages, and MACsec secures Ethernet frames. Therefore, endpoint application inventory provides the visibility needed to identify software that should not be present.

Question 259

Which security control can limit the ability of an attacker to move from a compromised user workstation toward sensitive server networks?

1. Network segmentation
2. DNS caching
3. NTP synchronization
4. Link aggregation

Correct Answer: 1

Explanation

Network segmentation separates systems or services into distinct security zones and controls communication between those zones. If a user workstation becomes compromised, segmentation can prevent unrestricted access to sensitive servers, administrative networks, databases, or other critical resources. Firewall policies, VLANs, VRFs, security groups, and other controls can be used to implement segmentation. DNS caching stores name-resolution information, NTP synchronizes time, and link aggregation combines network links. Therefore, network segmentation can reduce opportunities for lateral movement after endpoint compromise.

Question 260

Which security mechanism can verify that a certificate is intended for a particular cryptographic purpose, such as server authentication, before allowing it to be trusted for that purpose?

1. Extended Key Usage
2. DHCP snooping
3. SPAN
4. MAC learning

Correct Answer: 1

Explanation

Extended Key Usage, or EKU, specifies the purposes for which a certificate’s public key may be used. During certificate validation, applications can evaluate EKU values to determine whether a certificate is appropriate for a particular purpose, such as server authentication, client authentication, or code signing. This helps prevent a valid certificate from being incorrectly accepted for an unrelated security function. DHCP snooping protects DHCP operations, SPAN copies traffic for monitoring, and MAC learning supports Ethernet forwarding. Therefore, EKU provides the required certificate-purpose validation.