View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 301

Which email authentication mechanism allows a receiving mail server to verify that the sending domain authorizes a particular server to send email on its behalf?

1. SPF
2. DKIM
3. DMARC
4. S/MIME

Correct Answer: 1

Explanation

Sender Policy Framework, or SPF, allows a domain owner to publish a DNS record identifying the mail servers authorized to send messages for that domain. A receiving mail system can compare the connecting mail server’s address against the published policy. This can help detect unauthorized senders attempting to impersonate a legitimate domain. DKIM validates a cryptographic signature, DMARC defines domain-based policies using SPF and DKIM results, and S/MIME protects individual messages. Therefore, SPF provides the authorization mechanism described.

Question 302

Which email security mechanism uses a cryptographic signature attached to a message so the recipient can verify that the message was associated with an authorized sending domain and was not modified after signing?

1. SPF
2. DKIM
3. DMARC
4. DNSSEC

Correct Answer: 2

Explanation

DomainKeys Identified Mail, or DKIM, uses a cryptographic signature associated with an email message. The sending organization publishes a public key in DNS, while the corresponding private key is used to create the signature. A receiving mail server can retrieve the public key and verify the signature. This helps validate message integrity and associate the message with the signing domain. SPF validates sending infrastructure, DMARC applies domain-level policy, and DNSSEC protects DNS data. Therefore, DKIM provides the described cryptographic message validation.

Question 303

An organization wants receiving mail systems to reject or quarantine messages that fail both SPF and DKIM alignment for its domain. Which technology provides the policy framework for this requirement?

1. S/MIME
2. SPF
3. DMARC
4. DKIM

Correct Answer: 3

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, provides a policy framework that uses authentication results from SPF and DKIM along with domain alignment requirements. Domain owners can publish policies that instruct receiving systems how to handle messages that fail authentication, such as monitoring, quarantining, or rejecting them. DMARC can also provide reporting information about authentication activity. SPF and DKIM perform individual authentication functions, while S/MIME provides message-level cryptographic protection. Therefore, DMARC supplies the required policy framework.

Question 304

Which BGP security mechanism allows a router to reject routes that are not authorized by the legitimate holder of the advertised IP prefix?

1. RPKI-based route origin validation
2. DNSSEC
3. DHCP snooping
4. MACsec

Correct Answer: 1

Explanation

Resource Public Key Infrastructure, or RPKI, can be used for BGP route origin validation. Resource certificates and Route Origin Authorizations identify which autonomous system is authorized to originate particular IP prefixes. A router can validate received BGP announcements against this information and classify routes as valid, invalid, or unknown. DNSSEC protects DNS information, DHCP snooping protects DHCP operations, and MACsec secures Ethernet frames. Therefore, RPKI-based route origin validation helps protect routing infrastructure from unauthorized prefix origination.

Question 305

A network administrator wants to prevent a BGP peer from overwhelming a router by advertising an unexpectedly large number of prefixes. Which control should be configured?

1. Route redistribution
2. Maximum-prefix limit
3. DNS sinkholing
4. DHCP relay

Correct Answer: 2

Explanation

A BGP maximum-prefix limit establishes an upper boundary for the number of routes a router will accept from a particular neighbor. If the number of received prefixes exceeds the configured threshold, the router can take a predefined protective action, depending on configuration. This reduces the risk of excessive routing-table growth caused by configuration mistakes, malicious advertisements, or other abnormal conditions. Route redistribution exchanges routing information, DNS sinkholing redirects malicious domains, and DHCP relay forwards DHCP messages. Therefore, maximum-prefix protection addresses the described BGP risk.

Question 306

Which IPv6 first-hop security feature can inspect Neighbor Discovery messages and help prevent attackers from impersonating legitimate IPv6 neighbors?

1. IPv6 ND inspection
2. NAT overload
3. GRE
4. NetFlow

Correct Answer: 1

Explanation

IPv6 Neighbor Discovery inspection can validate Neighbor Discovery messages and help protect networks from attacks that manipulate IPv6 neighbor information. Attackers can otherwise attempt to send forged Neighbor Advertisement or related messages to redirect traffic or interfere with local communication. First-hop security mechanisms can use trusted information and validation rules to reduce this risk. NAT overload translates multiple addresses, GRE provides tunneling, and NetFlow provides traffic telemetry. Therefore, IPv6 ND inspection provides protection against forged Neighbor Discovery activity.

Question 307

Which IPv6 security feature is designed to block unauthorized DHCPv6 server messages from untrusted switch ports?

1. IPv6 RA Guard
2. DHCPv6 Guard
3. IPv6 source guard
4. Port security

Correct Answer: 2

Explanation

DHCPv6 Guard helps prevent unauthorized DHCPv6 servers from responding to clients through untrusted network interfaces. An attacker could otherwise introduce a rogue DHCPv6 service and provide malicious network parameters to connected hosts. By distinguishing trusted and untrusted interfaces, the feature can restrict DHCPv6 server-related messages to approved locations. IPv6 RA Guard focuses on Router Advertisement messages, IPv6 source guard validates source information, and port security controls Layer 2 address usage. Therefore, DHCPv6 Guard specifically addresses rogue DHCPv6 server activity.

Question 308

Which network visibility technology extends mirrored traffic across an IP network so that a remote monitoring system can analyze packets from another location?

1. SPAN
2. RSPAN
3. ERSPAN
4. NetFlow

Correct Answer: 3

Explanation

Encapsulated Remote Switched Port Analyzer, or ERSPAN, allows mirrored traffic to be transported across an IP network to a remote monitoring destination. This is useful when the analyzer is not directly connected to the switch where the traffic originates. ERSPAN encapsulates the mirrored frames so they can traverse routed infrastructure. Traditional SPAN mirrors traffic locally, RSPAN extends SPAN over a Layer 2 infrastructure using a dedicated VLAN, and NetFlow provides summarized flow information rather than complete packet copies. Therefore, ERSPAN fits the requirement.

Question 309

Which network management protocol provides a structured mechanism for configuring network devices using XML-based data and secure transport mechanisms?

1. NETCONF
2. TFTP
3. Telnet
4. FTP

Correct Answer: 1

Explanation

NETCONF is a network management protocol designed for structured configuration and management of network devices. It uses a defined data model and commonly represents configuration information using XML. NETCONF can operate over secure transports such as SSH, providing protected management communication. This makes it useful for automation and consistent configuration workflows. TFTP and FTP are file-transfer protocols, while Telnet provides remote terminal access without the same level of cryptographic protection. Therefore, NETCONF provides the structured configuration capability described.

Question 310

Which protocol provides REST-style programmatic access to network device configuration and operational data?

1. SNMPv2
2. RESTCONF
3. RADIUS
4. Syslog

Correct Answer: 2

Explanation

RESTCONF provides RESTful access to network configuration and operational data. It commonly uses HTTP or HTTPS methods and structured data representations such as JSON or XML. RESTCONF is useful for automation because applications can interact with network devices through standardized web-style interfaces instead of relying on manual command-line configuration. SNMP is primarily used for monitoring and management information, RADIUS provides authentication and authorization services, and Syslog transports event messages. Therefore, RESTCONF provides the required programmatic interface.

Question 311

Which technology can securely transport system log messages over an encrypted connection to reduce the risk of exposing sensitive log information in transit?

1. Syslog over TLS
2. TFTP
3. SNMPv1
4. Telnet

Correct Answer: 1

Explanation

Syslog over TLS protects log messages while they travel between a network device or application and a centralized logging system. Encryption helps prevent unauthorized parties from reading potentially sensitive information contained in logs, while authenticated connections can help protect against unauthorized log collectors. Plain Syslog does not inherently provide encryption, TFTP is an insecure file-transfer protocol, SNMPv1 provides limited security, and Telnet is an insecure remote-access protocol. Therefore, Syslog over TLS provides protected transport for centralized logging.

Question 312

Which IKEv2 capability allows a remote-access VPN client to authenticate using an Extensible Authentication Protocol method rather than relying only on a pre-shared key?

1. PFS
2. EAP authentication
3. DPD
4. NAT-T

Correct Answer: 2

Explanation

IKEv2 supports Extensible Authentication Protocol methods for flexible user or device authentication. EAP can integrate VPN authentication with external identity systems and mechanisms such as username-based authentication, certificates, or other supported methods. This is particularly useful for remote-access VPN deployments that require stronger or centralized identity validation. Perfect Forward Secrecy protects later key exchanges, Dead Peer Detection identifies unreachable peers, and NAT Traversal helps IPsec operate through address translation. Therefore, EAP authentication provides the described IKEv2 capability.

Question 313

Which IPsec feature ensures that compromise of a long-term key does not automatically allow an attacker to derive previously established session keys?

1. NAT-T
2. DPD
3. Perfect Forward Secrecy
4. Tunnel mode

Correct Answer: 3

Explanation

Perfect Forward Secrecy, or PFS, uses fresh key-exchange material when establishing new IPsec security associations. This reduces the impact of a later compromise of long-term authentication or keying material because previously established session keys are not simply derived from the compromised long-term key. PFS is commonly associated with additional Diffie-Hellman exchanges during key establishment. NAT-T enables IPsec through NAT devices, DPD detects unreachable peers, and tunnel mode encapsulates IP packets. Therefore, PFS provides the required protection for past sessions.

Question 314

Which IPsec deployment method creates a routable virtual interface that can be used to forward traffic through an encrypted tunnel?

1. VTI
2. SPAN
3. SVI
4. Loopback

Correct Answer: 1

Explanation

A Virtual Tunnel Interface, or VTI, represents an IPsec tunnel as a logical routed interface. Routing decisions can direct traffic toward the VTI, while IPsec provides encryption for traffic traversing the associated tunnel. This design can simplify routing and security policy compared with traditional crypto-map-based configurations in some deployments. SPAN is used for traffic monitoring, an SVI provides Layer 3 functionality for a VLAN, and a loopback is a logical interface commonly used for stable addressing. Therefore, VTI provides the described IPsec routing model.

Question 315

Which GETVPN characteristic allows authorized group members to communicate securely while avoiding the creation of a separate point-to-point tunnel between every pair of sites?

1. Centralized web proxying
2. Group-based key management
3. Port security
4. DNS filtering

Correct Answer: 2

Explanation

GETVPN uses group-based key management to provide encryption across an IP network while preserving the original source and destination addressing needed for certain routed environments. Group members obtain security associations and keys through the GETVPN key-management infrastructure. This avoids requiring a separate point-to-point IPsec tunnel between every pair of participating sites and can simplify large-scale network designs. Centralized web proxying handles web traffic, port security protects switch interfaces, and DNS filtering controls domain access. Therefore, group-based key management is central to GETVPN operation.

Question 316

Which MACsec component is responsible for establishing and maintaining secure connectivity between devices using the MACsec Key Agreement process?

1. MKA
2. DHCP
3. BGP
4. NTP

Correct Answer: 1

Explanation

MACsec Key Agreement, or MKA, establishes the cryptographic relationships required for MACsec-protected communication between participating devices. It uses security credentials and key-management procedures to establish secure associations and maintain the keys needed for protected Ethernet communication. MACsec then provides confidentiality and integrity for eligible frames. DHCP provides address configuration, BGP exchanges routing information, and NTP synchronizes clocks. Therefore, MKA is the component responsible for the key-agreement process supporting MACsec secure connectivity.

Question 317

Which Cisco TrustSec capability allows a network device to apply access policies based on Security Group Tags rather than depending exclusively on IP addresses?

1. SGT-based policy enforcement
2. DNS recursion
3. DHCP relay
4. Route summarization

Correct Answer: 1

Explanation

SGT-based policy enforcement allows Cisco TrustSec environments to make authorization decisions using Security Group Tags. An SGT can represent a security classification associated with a user, endpoint, or traffic flow. Policy enforcement devices can then permit or deny communication based on the source and destination security groups. This approach can remain consistent even when endpoint IP addresses change. DNS recursion resolves domain queries, DHCP relay forwards address-assignment traffic, and route summarization reduces routing information. Therefore, SGT-based policy enforcement provides the described identity-aware control.

Question 318

A NAC deployment automatically assigns different network access policies after identifying a device as a printer, IP phone, or workstation. Which capability enables this classification?

1. Device profiling
2. NAT
3. DNSSEC
4. IPsec transport mode

Correct Answer: 1

Explanation

Device profiling identifies endpoint characteristics and uses available information to classify devices into categories such as printers, IP phones, workstations, or other endpoint types. Network Access Control systems can use this classification to apply different authorization policies and place devices into appropriate network segments. This improves visibility and helps enforce differentiated access based on device identity and role. NAT translates addresses, DNSSEC protects DNS integrity, and IPsec transport mode protects IP payloads between endpoints. Therefore, device profiling provides the required classification capability.

Question 319

Which cloud security capability focuses on controlling and monitoring permissions assigned to identities across multiple cloud platforms?

1. CIEM
2. SWG
3. WAF
4. MACsec

Correct Answer: 1

Explanation

Cloud Infrastructure Entitlement Management, or CIEM, focuses on identifying, managing, and reducing excessive permissions associated with cloud identities. It can help organizations discover unused privileges, identify over-permissioned accounts, and enforce least-privilege access across cloud environments. This is especially important when organizations operate multiple cloud platforms with complex identity and authorization structures. SWG secures web access, WAF protects web applications, and MACsec protects Ethernet traffic. Therefore, CIEM provides the cloud entitlement-management capability described.

Question 320

Which cloud security approach combines capabilities such as cloud workload protection, cloud posture management, and application security into a broader security framework?

1. CNAPP
2. RADIUS
3. SPAN
4. BPDU Guard

Correct Answer: 1

Explanation

Cloud-Native Application Protection Platform, or CNAPP, combines multiple cloud security capabilities into an integrated approach for protecting cloud-native applications and workloads. Depending on the platform, CNAPP can incorporate areas such as Cloud Security Posture Management, Cloud Workload Protection, application security, identity-related controls, and vulnerability management. This helps organizations address security throughout the cloud application lifecycle rather than relying on isolated tools. RADIUS handles authentication, SPAN supports traffic monitoring, and BPDU Guard protects against unauthorized spanning-tree participation. Therefore, CNAPP provides the broader cloud-native security framework described.