View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 261

Which security feature can prevent an endpoint from sending traffic with an IP address that does not match its authorized DHCP binding?

1. Root Guard
2. IP Source Guard
3. SPAN
4. CoPP

Correct Answer: 2

Explanation

IP Source Guard validates the source IP address of traffic entering a switch interface against trusted binding information. In many deployments, these bindings are learned through DHCP snooping. If a host attempts to use an unauthorized source address, the switch can discard the traffic. This helps reduce IP address spoofing and certain forms of unauthorized network access. Root Guard protects spanning-tree topology, SPAN copies traffic for monitoring, and CoPP protects the control plane. Therefore, IP Source Guard provides the required source-address validation.

Question 262

An organization wants to inspect network traffic for malicious patterns but does not want the security device to automatically block detected traffic. Which technology should be used?

1. IPS
2. Firewall NAT
3. IDS
4. Port security

Correct Answer: 3

Explanation

An Intrusion Detection System, or IDS, monitors network activity and identifies suspicious or malicious patterns while primarily generating alerts for security personnel. It differs from an Intrusion Prevention System, which can actively block or disrupt traffic based on configured policies. IDS sensors can provide valuable visibility into attack attempts, reconnaissance, and policy violations without becoming an inline enforcement point. Firewall NAT translates addresses, port security controls Layer 2 access, and IPS provides active prevention. Therefore, IDS best matches the stated requirement.

Question 263

Which security protocol is commonly used to provide centralized authentication for network-access users while using a separate server for authorization decisions?

1. RADIUS
2. GRE
3. SNMP
4. Syslog

Correct Answer: 1

Explanation

RADIUS is widely used for centralized authentication, authorization, and accounting in network-access environments. It is commonly integrated with wireless networks, VPN services, and 802.1X deployments. A RADIUS server can authenticate users and return authorization attributes that influence the access granted to the requesting endpoint. GRE provides tunneling, SNMP supports network management, and Syslog transports event messages. Therefore, RADIUS is the protocol that most directly supports centralized authentication for network-access users.

Question 264

Which security mechanism can protect a network device from excessive unauthorized management traffic by applying rate limits to packets destined for the control plane?

1. DNSSEC
2. DLP
3. CoPP
4. SFTP

Correct Answer: 3

Explanation

Control Plane Policing, or CoPP, protects the control plane of network infrastructure by classifying and controlling traffic destined for CPU-bound functions. Administrators can establish policies that rate-limit or otherwise handle excessive management and control-plane traffic. This can reduce the effect of denial-of-service attempts targeting routing protocols, management services, or other control-plane processes. DNSSEC protects DNS data, DLP protects sensitive information, and SFTP provides secure file transfer. Therefore, CoPP provides the required protection for the device control plane.

Question 265

Which cloud security capability continuously checks cloud resources for configuration weaknesses such as publicly accessible storage or overly permissive security groups?

1. SWG
2. CSPM
3. MACsec
4. TACACS+

Correct Answer: 2

Explanation

Cloud Security Posture Management, or CSPM, evaluates cloud resources and configurations against security policies and recommended practices. It can identify issues such as publicly exposed storage, excessive permissions, missing encryption, insecure network rules, and other configuration weaknesses. Continuous posture monitoring is valuable because cloud environments change frequently as resources are deployed and modified. SWG protects web traffic, MACsec secures Ethernet communications, and TACACS+ provides administrative AAA. Therefore, CSPM is the appropriate technology for continuous cloud-configuration assessment.

Question 266

Which security technology can authenticate an administrator using a digital certificate rather than relying solely on a password?

1. Certificate-based authentication
2. DHCP snooping
3. VLAN pruning
4. NetFlow

Correct Answer: 1

Explanation

Certificate-based authentication uses asymmetric cryptography to establish the identity of an administrator or device. The authentication process can require proof that the requester possesses the private key associated with a trusted certificate. This avoids depending entirely on reusable passwords and can provide strong authentication when certificates are properly issued, protected, and validated. DHCP snooping protects against rogue DHCP services, VLAN pruning limits VLAN propagation, and NetFlow provides traffic telemetry. Therefore, certificate-based authentication provides the described administrator authentication mechanism.

Question 267

Which security mechanism helps ensure that a remote VPN peer does not reuse old cryptographic keys indefinitely by establishing new keys during an IPsec session?

1. DNSSEC
2. IKE rekeying
3. SPAN
4. Port security

Correct Answer: 2

Explanation

IKE rekeying establishes fresh cryptographic keying material for an IPsec security association before or when the existing keys reach their configured lifetime. Regular rekeying limits the amount of traffic protected by a single key and reduces the exposure associated with long-lived cryptographic material. DNSSEC protects DNS records, SPAN copies traffic for monitoring, and port security controls switch access. Therefore, IKE rekeying provides the mechanism that refreshes cryptographic keys during an IPsec VPN session.

Question 268

Which security approach moves vulnerability and security checks into the software development pipeline so problems can be identified before production deployment?

1. DevSecOps
2. NAT traversal
3. VLAN trunking
4. HSRP

Correct Answer: 1

Explanation

DevSecOps integrates security activities into the software development and delivery lifecycle rather than treating security as a final-stage activity. Automated checks can examine source code, dependencies, infrastructure-as-code templates, container images, secrets, and other components before deployment. Finding weaknesses earlier generally gives development teams more opportunity to correct them before production use. NAT traversal supports connectivity through translated networks, VLAN trunking transports multiple VLANs, and HSRP provides gateway redundancy. Therefore, DevSecOps represents the described security-integrated development approach.

Question 269

Which security capability can detect when a user attempts to upload confidential information to an unauthorized cloud service?

1. RADIUS
2. Cloud DLP
3. STP
4. BGP

Correct Answer: 2

Explanation

Cloud Data Loss Prevention can inspect data moving into or through cloud services and identify content that matches defined sensitive-information policies. Depending on the deployment, it may detect confidential documents, financial information, personal data, or other protected content and then alert, block, quarantine, or restrict the transfer. RADIUS supports authentication, STP prevents switching loops, and BGP exchanges routing information. Therefore, Cloud DLP is the security capability most directly suited to detecting unauthorized uploads of sensitive information.

Question 270

Which security feature can help prevent an attacker from changing the spanning-tree topology by connecting an unauthorized switch to an edge port?

1. DNSSEC
2. BPDU Guard
3. IPsec
4. DLP

Correct Answer: 2

Explanation

BPDU Guard protects switch edge ports by reacting when unexpected spanning-tree BPDUs are received. An unauthorized switch connected to an access port could otherwise participate in spanning-tree operations and potentially influence the topology. BPDU Guard can place the affected interface into an error-disabled state, preventing the unauthorized device from influencing the spanning-tree domain through that port. DNSSEC protects DNS integrity, IPsec protects IP communications, and DLP controls sensitive data. Therefore, BPDU Guard provides the required Layer 2 protection.

Question 271

Which security capability allows a firewall to make access decisions based on the actual application generating the traffic rather than only on TCP or UDP port numbers?

1. Application-aware firewall policy
2. NTP authentication
3. DHCP relay
4. MAC learning

Correct Answer: 1

Explanation

Application-aware firewall policies identify applications and use that information when enforcing access rules. This is more precise than relying only on TCP or UDP port numbers because modern applications may use dynamic ports, shared protocols, or encrypted connections. Application identification allows administrators to create policies based on business applications and their associated security requirements. NTP authentication protects time synchronization, DHCP relay forwards DHCP messages, and MAC learning supports Layer 2 forwarding. Therefore, application-aware firewall policy provides the described control.

Question 272

Which security technology can provide secure access to private applications for remote users while applying identity and device-context policies instead of granting broad network-level access?

1. GRE
2. ZTNA
3. FTP
4. SNMP

Correct Answer: 2

Explanation

Zero Trust Network Access, or ZTNA, provides access to specific applications according to policies based on identity, device posture, context, and authorization requirements. Unlike traditional approaches that may place a remote user broadly onto an internal network, ZTNA can limit access to only the resources required by that user. This supports least privilege and reduces unnecessary network exposure. GRE provides tunneling, FTP transfers files, and SNMP provides network-management functions. Therefore, ZTNA provides the described application-specific remote-access model.

Question 273

Which security control can identify unusual authentication patterns by comparing current user activity with previously established behavioral baselines?

1. UEBA
2. MACsec
3. VRRP
4. TFTP

Correct Answer: 1

Explanation

User and Entity Behavior Analytics, or UEBA, establishes behavioral baselines for users and other entities and identifies significant deviations. Examples can include unusual login times, unexpected locations, unfamiliar devices, abnormal access volumes, or unusual resource usage. These deviations can provide indicators of compromised credentials or suspicious activity that may not be detected through simple signature-based rules. MACsec protects Ethernet traffic, VRRP provides gateway redundancy, and TFTP provides basic file transfer. Therefore, UEBA provides the required behavioral-analysis capability.

Question 274

Which security control is most appropriate for protecting sensitive administrative interfaces by separating them from general user traffic?

1. Management VRF
2. DNS caching
3. VLAN trunking
4. NetFlow

Correct Answer: 1

Explanation

A management VRF provides a separate routing context for management traffic. Administrative interfaces can use this dedicated routing environment so that management access is logically isolated from ordinary production traffic. Additional ACLs, authentication controls, and secure management protocols can further restrict access. DNS caching stores name-resolution results, VLAN trunking transports multiple VLANs, and NetFlow provides flow telemetry. Therefore, a management VRF is an effective mechanism for separating sensitive administrative communications from general user traffic.

Question 275

Which security technology can detect malicious behavior by executing a suspicious file in an isolated environment and observing its actions?

1. Sandbox analysis
2. RADIUS
3. HSRP
4. ARP

Correct Answer: 1

Explanation

Sandbox analysis examines suspicious files in an isolated environment where their behavior can be observed without exposing production endpoints to the same activity. Analysts or automated security systems can evaluate process execution, file changes, network connections, persistence mechanisms, and other behaviors. This can help identify previously unknown or evasive malware that may not be detected by simple signatures. RADIUS provides authentication services, HSRP provides gateway redundancy, and ARP maps IPv4 addresses to MAC addresses. Therefore, sandbox analysis provides the described malware-analysis capability.

Question 276

Which security mechanism can prevent unauthorized changes to a cloud resource by continuously comparing its configuration against an approved security policy?

1. CSPM
2. GRE
3. LACP
4. SNMP

Correct Answer: 1

Explanation

CSPM continuously evaluates cloud resources and their configurations against defined security policies. When a resource becomes misconfigured, CSPM can identify the deviation and generate an alert or, depending on the implementation, initiate remediation. This is particularly useful in dynamic cloud environments where infrastructure can change rapidly through automation or user activity. GRE provides tunneling, LACP manages link aggregation, and SNMP supports network management. Therefore, CSPM provides the required continuous cloud-configuration monitoring capability.

Question 277

Which security mechanism can reduce the risk of unauthorized route advertisements by allowing only approved network prefixes to be accepted from a BGP neighbor?

1. BGP prefix filtering
2. DNSSEC
3. IP Source Guard
4. Storm control

Correct Answer: 1

Explanation

BGP prefix filtering allows administrators to define which routes are acceptable from a particular BGP neighbor. By rejecting prefixes outside the approved policy, organizations can reduce the risk of accidental or malicious route advertisements affecting routing decisions. Prefix filters can be applied to inbound and outbound BGP updates according to the network’s routing requirements. DNSSEC protects DNS records, IP Source Guard validates source addresses, and storm control limits excessive Layer 2 traffic. Therefore, BGP prefix filtering provides the required routing-security control.

Question 278

Which security capability can correlate endpoint, network, identity, and cloud telemetry to provide a broader view of a multi-stage attack?

1. XDR
2. DHCP
3. FTP
4. VRRP

Correct Answer: 1

Explanation

Extended Detection and Response, or XDR, combines security telemetry from multiple domains to provide broader detection and investigation capabilities. Correlating endpoint activity with network connections, identity events, cloud activity, and other signals can help security teams recognize attack chains that might appear as unrelated alerts when viewed individually. XDR can also support investigation and response workflows. DHCP provides network configuration, FTP transfers files, and VRRP provides gateway redundancy. Therefore, XDR provides the cross-domain security visibility described.

Question 279

Which security practice ensures that only approved software components and dependencies are included in a production application build?

1. Software supply-chain security
2. NAT overload
3. VLAN pruning
4. Port mirroring

Correct Answer: 1

Explanation

Software supply-chain security focuses on protecting the components, dependencies, tools, and processes used to build and distribute applications. Controls can include dependency verification, software composition analysis, signed artifacts, trusted repositories, build integrity checks, and provenance tracking. These measures help reduce the risk that compromised or unauthorized components enter production applications through development or deployment pipelines. NAT overload translates multiple addresses, VLAN pruning restricts VLAN propagation, and port mirroring copies traffic for monitoring. Therefore, software supply-chain security addresses the described requirement.

Question 280

Which security control can provide evidence of who performed a configuration change on a network device and when the change occurred?

1. Command accounting
2. DNSSEC
3. MACsec
4. DHCP snooping

Correct Answer: 1

Explanation

Command accounting records administrative commands and associated user activity, providing an audit trail of actions performed on network devices. When combined with centralized AAA and synchronized system time, it can help identify which administrator executed a configuration command and establish when the activity occurred. This information supports accountability, incident investigation, compliance, and change auditing. DNSSEC protects DNS information, MACsec protects Ethernet traffic, and DHCP snooping validates DHCP behavior. Therefore, command accounting provides the required administrative audit capability.