View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 281

Which security technology can inspect email messages and attachments for malware, spam, phishing attempts, and other threats before delivery to users?

1. Cisco Secure Email Gateway
2. Cisco HSRP
3. Cisco IP SLA
4. Cisco SPAN

Correct Answer: 1

Explanation

Cisco Secure Email Gateway provides security inspection for email traffic and can help identify threats such as spam, malware, phishing attempts, and potentially dangerous attachments. Email security controls can use reputation information, content inspection, malware analysis, and policy enforcement to reduce the risk of malicious messages reaching users. HSRP provides gateway redundancy, IP SLA monitors network performance, and SPAN copies network traffic for analysis. Therefore, Cisco Secure Email Gateway is designed to protect organizational email communications.

Question 282

Which security control can prevent a user from accessing a sensitive application unless the endpoint satisfies predefined security requirements?

1. DNS forwarding
2. Device posture assessment
3. VLAN trunking
4. Traffic shaping

Correct Answer: 2

Explanation

Device posture assessment evaluates the security state of an endpoint before access is granted. Depending on organizational policy, posture checks can examine factors such as operating-system versions, security software, encryption status, device management, or other required controls. Access can then be allowed, restricted, or denied based on the result. DNS forwarding handles name resolution, VLAN trunking transports multiple VLANs, and traffic shaping manages bandwidth. Therefore, device posture assessment provides the endpoint-condition check required for policy-based access.

Question 283

Which security mechanism can protect sensitive information by replacing the original value with a non-sensitive substitute that can be mapped back when authorized?

1. Hashing
2. Encryption
3. Tokenization
4. Compression

Correct Answer: 3

Explanation

Tokenization replaces sensitive information with a surrogate value called a token. The original data is stored separately in a protected system, and authorized applications can use the token without directly handling the sensitive value. This approach is commonly used for protecting payment information and other sensitive data. Hashing is generally one-way, encryption transforms data using cryptographic keys, and compression reduces data size. Therefore, tokenization provides the substitution mechanism described while allowing controlled recovery of the original value.

Question 284

Which network security mechanism can prevent an attacker from sending unauthorized packets to a router’s infrastructure services by filtering traffic destined for the device itself?

1. Infrastructure ACL
2. DNSSEC
3. SFTP
4. MACsec

Correct Answer: 1

Explanation

An infrastructure ACL can restrict traffic destined for network infrastructure services such as routing protocols, management interfaces, and other device-local functions. By allowing only expected sources and required protocols, administrators can reduce exposure to unauthorized access and certain control-plane attacks. DNSSEC protects DNS integrity, SFTP provides secure file transfer, and MACsec protects Ethernet frames. Therefore, an infrastructure ACL provides the traffic filtering required to protect infrastructure services from unauthorized sources.

Question 285

Which security technology provides encrypted communication between a user’s endpoint and a remote VPN gateway across an untrusted network?

1. GRE
2. Remote-access IPsec VPN
3. TFTP
4. SNMP

Correct Answer: 2

Explanation

A remote-access IPsec VPN establishes a protected connection between an individual endpoint and a VPN gateway across an untrusted network such as the Internet. IPsec can provide confidentiality, integrity, authentication, and anti-replay protection for the communication. This allows authorized remote users to securely access organizational resources according to configured policies. GRE provides tunneling without inherent encryption, TFTP transfers files without strong security, and SNMP supports management. Therefore, a remote-access IPsec VPN provides the required encrypted connectivity.

Question 286

Which security mechanism can detect when a certificate has passed its validity period and should no longer be accepted?

1. Certificate expiration validation
2. DHCP snooping
3. SPAN
4. BGP filtering

Correct Answer: 1

Explanation

Certificate validation includes checking the certificate’s validity period to determine whether it is currently valid. Certificates contain defined start and expiration dates, and applications should reject certificates that are outside their permitted validity period unless an appropriate policy provides another trusted mechanism. This check helps prevent the use of outdated credentials for authentication or encrypted communications. DHCP snooping protects DHCP operations, SPAN copies traffic, and BGP filtering controls routing information. Therefore, certificate expiration validation provides the required security check.

Question 287

Which security control can restrict network access based on the security group or policy tag associated with an authenticated device?

1. Security Group Tag policy
2. DNS caching
3. NTP
4. NAT overload

Correct Answer: 1

Explanation

Security Group Tags, or SGTs, can associate users, devices, or traffic with logical security classifications. Policy enforcement points can then use these classifications to determine whether communication between different security groups should be permitted or denied. This allows organizations to apply identity-aware policies without depending exclusively on IP addresses. DNS caching stores name-resolution information, NTP synchronizes system clocks, and NAT overload translates multiple private addresses. Therefore, SGT-based policy provides the identity-aware access control described.

Question 288

Which security capability can identify vulnerabilities in containers before images are deployed into a production environment?

1. Container image security scanning
2. HSRP
3. VRRP
4. DHCP relay

Correct Answer: 1

Explanation

Container image security scanning examines container images for known vulnerabilities, insecure packages, configuration problems, embedded secrets, and other risks before deployment. Integrating these checks into development and CI/CD pipelines allows organizations to identify issues earlier in the application lifecycle. This supports DevSecOps and helps prevent vulnerable components from reaching production environments. HSRP and VRRP provide gateway redundancy, while DHCP relay forwards DHCP requests between network segments. Therefore, container image security scanning provides the required pre-deployment security assessment.

Question 289

Which security feature can prevent unauthorized users from gaining administrative access even when they know another administrator’s password?

1. Password complexity
2. Multifactor authentication
3. Route filtering
4. Port mirroring

Correct Answer: 2

Explanation

Multifactor authentication requires an additional authentication factor beyond the password. If an attacker obtains another administrator’s password, the attacker may still be unable to authenticate without the additional factor, such as an approved authentication application, hardware token, or biometric factor. Password complexity makes passwords harder to guess but does not protect against a password that has already been stolen. Route filtering controls routing information, while port mirroring copies traffic. Therefore, multifactor authentication provides the additional protection described.

Question 290

Which security mechanism helps ensure that only authenticated and authorized devices can participate in a wired enterprise network?

1. 802.1X
2. DNSSEC
3. GRE
4. Syslog

Correct Answer: 1

Explanation

802.1X provides port-based network access control by requiring an endpoint to authenticate before receiving normal network access. It can work with a centralized authentication service and can use identity or device information to determine authorization. This makes it useful for enterprise wired networks where unauthorized devices should not automatically receive connectivity simply because they can physically connect to a switch port. DNSSEC protects DNS records, GRE provides tunneling, and Syslog transports event messages. Therefore, 802.1X provides the required access-control mechanism.

Question 291

Which security technology can inspect cloud service usage and identify unsanctioned applications being accessed by employees?

1. CASB
2. MACsec
3. CoPP
4. IP Source Guard

Correct Answer: 1

Explanation

A Cloud Access Security Broker, or CASB, provides visibility into cloud-service usage and can help organizations identify sanctioned and unsanctioned applications. Security teams can use CASB capabilities to monitor cloud activity, enforce access policies, protect sensitive information, and apply compliance controls. MACsec protects Ethernet traffic, CoPP protects the network-device control plane, and IP Source Guard validates source-address information. Therefore, CASB provides the cloud-application discovery and policy-enforcement capability described.

Question 292

Which security control can detect an attacker attempting to exploit a vulnerable database application through specially crafted input parameters?

1. Secure Web Gateway
2. Web Application Firewall
3. NTP
4. RADIUS

Correct Answer: 2

Explanation

A Web Application Firewall can inspect HTTP and HTTPS requests for malicious patterns associated with attacks against web applications. It can detect techniques such as SQL injection by analyzing request parameters and other application-layer information. Depending on the configured policy, malicious requests can be blocked or logged for investigation. Secure Web Gateway focuses primarily on securing user web access, NTP synchronizes clocks, and RADIUS provides centralized authentication. Therefore, WAF is the most appropriate control for the described database-application attack.

Question 293

Which security technology provides encrypted protection for Ethernet traffic between supported network interfaces at Layer 2?

1. IPsec
2. TLS
3. MACsec
4. SSH

Correct Answer: 3

Explanation

MACsec provides cryptographic protection for Ethernet frames at Layer 2. It can provide confidentiality and integrity for traffic traveling across a supported Ethernet link and is useful in campus, data-center, and other switched environments. IPsec protects traffic at the IP layer, TLS protects application-layer sessions, and SSH provides secure remote administration and related secure communications. Therefore, MACsec is the technology specifically designed to protect Ethernet traffic at Layer 2.

Question 294

Which security practice helps determine which assets are affected by a newly discovered vulnerability before remediation priorities are assigned?

1. Asset inventory and vulnerability correlation
2. Traffic shaping
3. VLAN tagging
4. DNS forwarding

Correct Answer: 1

Explanation

Asset inventory and vulnerability correlation combine information about organizational assets with vulnerability findings. By determining which systems, applications, devices, and workloads are affected, security teams can understand the scope of a vulnerability and identify systems that require remediation. This information can then be combined with severity, exposure, exploit availability, and business importance to establish appropriate remediation priorities. Traffic shaping manages bandwidth, VLAN tagging identifies VLAN membership, and DNS forwarding handles name resolution. Therefore, asset-vulnerability correlation provides the required visibility.

Question 295

Which security mechanism can detect unauthorized access attempts by comparing incoming authentication activity against known user behavior and access patterns?

1. UEBA
2. LACP
3. GRE
4. STP

Correct Answer: 1

Explanation

User and Entity Behavior Analytics can compare current activity with established behavioral patterns for users and entities. Significant deviations, such as unexpected login locations, unusual access times, abnormal resource usage, or unfamiliar devices, can generate security alerts. This can help identify compromised credentials or suspicious account activity even when valid authentication credentials are being used. LACP manages link aggregation, GRE provides tunneling, and STP prevents Layer 2 loops. Therefore, UEBA provides the behavioral-analysis capability described.

Question 296

Which security control can help ensure that a network device accepts management connections only through encrypted protocols?

1. Service minimization
2. Secure management policy
3. Route summarization
4. VLAN pruning

Correct Answer: 2

Explanation

A secure management policy can require administrators to use encrypted protocols such as SSH or HTTPS while disabling insecure management services such as Telnet and plain HTTP. Combining secure protocols with AAA, management-plane ACLs, and dedicated management networks provides stronger protection for administrative access. Service minimization reduces unnecessary services, but it does not by itself define which management protocols must be encrypted. Route summarization reduces routing information, while VLAN pruning controls VLAN propagation. Therefore, a secure management policy provides the described control.

Question 297

Which security technology can identify malicious domains using reputation information and block users from connecting to known harmful destinations?

1. DNS security filtering
2. LACP
3. VRRP
4. SPAN

Correct Answer: 1

Explanation

DNS security filtering can use domain reputation and threat-intelligence information to identify domains associated with malware, phishing, command-and-control infrastructure, or other threats. Requests for known malicious destinations can be blocked, redirected, or logged according to organizational policy. This provides protection before a user’s application establishes a connection to the destination. LACP manages link aggregation, VRRP provides gateway redundancy, and SPAN copies traffic for monitoring. Therefore, DNS security filtering provides the described domain-based protection.

Question 298

Which security control provides evidence that a specific administrator performed a particular action on a network device?

1. Network Address Translation
2. Command accounting
3. DHCP relay
4. VLAN trunking

Correct Answer: 2

Explanation

Command accounting records administrative commands and associates those actions with authenticated users. When combined with accurate time synchronization and centralized AAA, it can provide a useful audit trail showing who performed a particular administrative action and when it occurred. This supports accountability, troubleshooting, compliance, and incident investigation. NAT translates addresses, DHCP relay forwards DHCP messages, and VLAN trunking transports traffic from multiple VLANs. Therefore, command accounting provides the required evidence of administrator activity.

Question 299

Which security capability can automatically isolate a compromised endpoint from most network communication while still allowing security administrators to investigate it?

1. Endpoint isolation
2. Route redistribution
3. DNS caching
4. Traffic shaping

Correct Answer: 1

Explanation

Endpoint isolation restricts a compromised device’s network communications to contain an active threat and prevent lateral movement. Modern endpoint-security platforms can isolate an endpoint while maintaining limited communication with security-management infrastructure so that administrators can investigate, collect evidence, and remediate the device. Route redistribution exchanges routing information, DNS caching stores name-resolution results, and traffic shaping controls bandwidth. Therefore, endpoint isolation provides the containment capability required for a compromised endpoint.

Question 300

Which security principle requires organizations to protect systems using several complementary controls rather than relying on a single defensive mechanism?

1. Least privilege
2. Nonrepudiation
3. Defense in depth
4. Separation of duties

Correct Answer: 3

Explanation

Defense in depth uses multiple layers of security controls so that the failure or bypass of one control does not automatically expose the protected resource. An organization may combine identity verification, endpoint protection, firewalls, segmentation, encryption, monitoring, and incident-response procedures. Each layer addresses different attack paths or stages of an intrusion. Least privilege limits permissions, nonrepudiation provides evidence associated with actions, and separation of duties distributes sensitive responsibilities. Therefore, defense in depth describes the use of multiple complementary security protections.