View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 361

Which network security mechanism validates the source address of incoming IPv4 packets by checking whether the source is reachable through the interface on which the packet arrived?

1. uRPF
2. DHCP snooping
3. DNSSEC
4. MACsec

Correct Answer: 1

Explanation

Unicast Reverse Path Forwarding, or uRPF, helps protect networks against source-address spoofing. It checks whether the source IP address of an incoming packet is reachable according to the routing information available to the device. Depending on the configured uRPF mode, packets may be accepted when the expected return path matches the receiving interface or when a valid route exists. DHCP snooping protects DHCP exchanges, DNSSEC protects DNS integrity, and MACsec protects Ethernet frames. Therefore, uRPF provides source-address validation.

Question 362

Which switch security feature can prevent an attacker from creating a rogue trunk link by sending specially crafted frames that attempt to negotiate trunking?

1. Port security
2. VLAN hopping mitigation
3. Storm control
4. Root Guard

Correct Answer: 2

Explanation

VLAN hopping can occur when an attacker manipulates Layer 2 trunking behavior to gain access to VLAN traffic that should otherwise be isolated. Mitigation includes disabling unnecessary trunk negotiation, explicitly configuring required trunk ports, and avoiding insecure native-VLAN practices. Port security limits MAC addresses, storm control limits excessive broadcast or multicast traffic, and Root Guard protects the spanning-tree topology. Therefore, VLAN hopping mitigation directly addresses unauthorized trunk negotiation and VLAN access.

Question 363

Which Layer 2 design can isolate ports from one another while still allowing selected communication through a promiscuous port?

1. Private VLANs
2. VLAN pruning
3. EtherChannel
4. Port mirroring

Correct Answer: 1

Explanation

Private VLANs provide Layer 2 isolation within a larger VLAN domain. Isolated ports can communicate with designated promiscuous ports but are prevented from directly communicating with other isolated ports. This design can be useful for environments such as hosting networks where systems need access to shared services without unrestricted communication with neighboring systems. VLAN pruning limits VLAN propagation across trunks, EtherChannel combines links, and port mirroring copies traffic for analysis. Therefore, private VLANs provide the required communication-isolation model.

Question 364

Which control can restrict access to a network device’s management interface so that only approved source networks can initiate administrative sessions?

1. Infrastructure ACL
2. DNS filtering
3. NetFlow
4. NTP authentication

Correct Answer: 1

Explanation

An infrastructure ACL can restrict traffic destined for network-device management interfaces and other infrastructure services. Administrators can permit management connections from approved source addresses while denying unauthorized sources. This reduces exposure of SSH, HTTPS, SNMP, and other management services to untrusted networks. DNS filtering controls domain access, NetFlow provides traffic telemetry, and NTP authentication protects time synchronization. Therefore, an infrastructure ACL provides the source-based access restriction required for management-plane protection.

Question 365

Which web security control is specifically designed to inspect HTTP requests and responses for attacks targeting application logic and web-server vulnerabilities?

1. Secure Web Gateway
2. Web Application Firewall
3. DNS security
4. CASB

Correct Answer: 2

Explanation

A Web Application Firewall, or WAF, protects web applications by inspecting HTTP and HTTPS traffic for malicious application-layer activity. It can detect and block attacks such as SQL injection, cross-site scripting, malicious request patterns, and certain protocol-abuse techniques. A Secure Web Gateway primarily protects users’ web access, DNS security focuses on domain resolution and reputation, and CASB focuses on cloud application visibility and control. Therefore, WAF is the control specifically designed to protect web applications from application-layer attacks.

Question 366

Which data-protection technique identifies sensitive information based on predefined patterns such as credit-card numbers, national identifiers, or confidential keywords?

1. Exact-match or pattern-based DLP
2. MACsec
3. uRPF
4. RPKI

Correct Answer: 1

Explanation

Data Loss Prevention systems can use predefined patterns, regular expressions, dictionaries, and other matching techniques to identify sensitive information. Examples include payment-card numbers, government identification numbers, confidential project terms, and other regulated data patterns. Once detected, DLP policies can monitor, alert, block, quarantine, or otherwise control the transfer of the information. MACsec protects Ethernet traffic, uRPF validates source addresses, and RPKI validates BGP route origins. Therefore, pattern-based DLP provides the described sensitive-data identification capability.

Question 367

Which endpoint security capability can identify suspicious activity by analyzing the sequence of processes, files, network connections, and other events associated with an endpoint?

1. Device trajectory
2. VLAN tagging
3. DNS forwarding
4. NAT

Correct Answer: 1

Explanation

Device trajectory provides a historical view of endpoint activity, allowing security analysts to examine sequences of events involving processes, files, network connections, and other endpoint actions. This can help investigators understand how an attack progressed, identify related indicators, and determine the scope of a compromise. VLAN tagging identifies Layer 2 network membership, DNS forwarding handles name-resolution requests, and NAT translates addresses. Therefore, device trajectory provides the historical endpoint-activity visibility described.

Question 368

Which security control can block an application from executing when the application is not included in an explicitly approved software list?

1. Application allowlisting
2. URL filtering
3. Network Address Translation
4. DHCP snooping

Correct Answer: 1

Explanation

Application allowlisting permits execution only for software that has been explicitly approved according to organizational policy. Applications outside the approved list can be blocked even if they are not already recognized as malicious. This helps reduce the risk from unauthorized software, unknown executables, and certain malware families. URL filtering controls access to web destinations, NAT translates addresses, and DHCP snooping protects against unauthorized DHCP behavior. Therefore, application allowlisting provides the required execution-control mechanism.

Question 369

Which cloud security capability helps discover secrets such as API keys or passwords accidentally embedded in source code or application repositories?

1. Secrets scanning
2. Traffic shaping
3. SPAN
4. RADIUS

Correct Answer: 1

Explanation

Secrets scanning searches source code, repositories, configuration files, and other development artifacts for sensitive credentials such as API keys, tokens, passwords, and private keys. Detecting exposed secrets before deployment helps prevent attackers from obtaining credentials that could provide unauthorized access to applications or cloud resources. Effective programs can also rotate exposed credentials and prevent future commits containing similar secrets. Traffic shaping controls bandwidth, SPAN mirrors traffic, and RADIUS provides authentication services. Therefore, secrets scanning provides the required development-security control.

Question 370

Which container-security control checks whether a container image contains known vulnerable packages before the image is deployed?

1. Container image vulnerability scanning
2. DNSSEC
3. Port security
4. SGT enforcement

Correct Answer: 1

Explanation

Container image vulnerability scanning examines image contents and identifies known vulnerabilities in operating-system packages, libraries, and application dependencies. Security teams can use the results to prevent high-risk images from progressing into production and to require remediation before deployment. This control is particularly useful when integrated into CI/CD pipelines so that vulnerabilities are detected early. DNSSEC protects DNS information, port security controls switch interfaces, and SGT enforcement applies identity-based network policy. Therefore, container image vulnerability scanning provides the described protection.

Question 371

Which cloud security control focuses on protecting the runtime behavior of virtual machines, containers, and other cloud workloads?

1. CWPP
2. CIEM
3. CASB
4. DNSSEC

Correct Answer: 1

Explanation

Cloud Workload Protection Platforms, or CWPPs, focus on protecting workloads such as virtual machines, containers, and other cloud-hosted computing resources. Depending on the implementation, capabilities may include vulnerability management, malware protection, runtime monitoring, workload isolation, and host-based security controls. CIEM focuses on cloud permissions, CASB provides visibility and policy enforcement for cloud services, and DNSSEC protects DNS integrity. Therefore, CWPP provides the workload-focused cloud security capability described.

Question 372

Which security capability evaluates cloud configurations continuously and alerts administrators when resources violate defined security policies?

1. CSPM
2. SFTP
3. MACsec
4. 802.1X

Correct Answer: 1

Explanation

Cloud Security Posture Management continuously evaluates cloud environments for configuration weaknesses and policy violations. It can identify issues such as publicly exposed storage, insecure network rules, missing encryption, excessive permissions, or other configuration problems depending on the platform. Continuous assessment allows security teams to detect drift from approved security baselines. SFTP protects file transfers, MACsec secures Ethernet frames, and 802.1X provides network access control. Therefore, CSPM provides the continuous cloud-configuration monitoring capability described.

Question 373

Which secure-access service primarily controls and inspects users’ outbound web traffic according to organizational security policies?

1. SWG
2. CIEM
3. CWPP
4. RPKI

Correct Answer: 1

Explanation

A Secure Web Gateway, or SWG, provides security controls for users accessing websites and other web-based resources. It can enforce acceptable-use policies, inspect web traffic, apply URL filtering, identify malicious destinations, and integrate other security controls such as malware inspection. CIEM manages cloud permissions, CWPP protects cloud workloads, and RPKI supports BGP route-origin validation. Therefore, SWG is the service specifically designed to secure and control outbound web access.

Question 374

Which Cisco security service can provide cloud-delivered DNS-layer protection by identifying malicious domains before users establish connections to them?

1. Cisco Umbrella
2. Cisco ISE
3. Cisco Secure Endpoint
4. Cisco Secure Firewall Management Center

Correct Answer: 1

Explanation

Cisco Umbrella provides cloud-delivered security services that can use DNS-layer intelligence to identify and block requests to malicious domains. Because DNS resolution commonly occurs before an application establishes a connection, blocking a malicious domain at this stage can prevent access to phishing sites, malware infrastructure, and other known threats. Cisco ISE focuses on identity and network access control, Secure Endpoint protects endpoints, and Secure Firewall Management Center manages firewall infrastructure. Therefore, Cisco Umbrella provides the described DNS-layer protection.

Question 375

Which security capability can correlate events from multiple security products and provide a centralized view for identifying relationships between seemingly separate alerts?

1. SIEM
2. DHCP relay
3. VLAN trunking
4. NAT

Correct Answer: 1

Explanation

A Security Information and Event Management system aggregates and correlates security events from multiple sources such as firewalls, endpoints, identity systems, servers, applications, and network devices. Correlation can reveal relationships between events that might appear unrelated when viewed separately. SIEM platforms can also provide alerting, dashboards, investigation support, and long-term log analysis. DHCP relay forwards DHCP messages, VLAN trunking carries multiple VLANs, and NAT performs address translation. Therefore, SIEM provides the centralized event-correlation capability described.

Question 376

Which security automation capability can execute predefined response actions automatically after a security alert meets specified conditions?

1. SOAR
2. SPAN
3. NTP
4. GRE

Correct Answer: 1

Explanation

Security Orchestration, Automation, and Response platforms can connect security tools and automate predefined response workflows. For example, a SOAR playbook might receive an alert, enrich it with threat-intelligence information, disable a compromised account, isolate an endpoint, or create an investigation ticket. Automation reduces repetitive manual work and can improve response consistency. SPAN mirrors traffic, NTP synchronizes clocks, and GRE provides tunneling. Therefore, SOAR provides the automated security-response capability described.

Question 377

Which network-visibility technology provides summarized information about communication flows without necessarily capturing every packet’s complete contents?

1. NetFlow
2. SPAN
3. ERSPAN
4. Packet capture

Correct Answer: 1

Explanation

NetFlow provides flow-level telemetry describing communication characteristics such as source and destination addresses, ports, protocol, packet counts, byte counts, and timing information. It offers broad visibility into network behavior without requiring complete packet capture for every communication. SPAN and ERSPAN can mirror traffic for packet-level analysis, while packet capture records detailed packets for inspection. Therefore, NetFlow is appropriate when security teams need scalable information about network communication patterns rather than full packet contents.

Question 378

Which security control protects routing sessions by requiring a valid authentication mechanism between neighboring routing devices?

1. Routing protocol authentication
2. DNSSEC
3. DLP
4. Application allowlisting

Correct Answer: 1

Explanation

Routing protocol authentication helps ensure that routing updates are accepted only from trusted neighbors using the configured authentication mechanism. This can reduce the risk of unauthorized devices injecting false routing information or manipulating routing relationships. Depending on the routing protocol, authentication may use cryptographic mechanisms such as keyed hashes. DNSSEC protects DNS data, DLP protects sensitive information, and application allowlisting controls software execution. Therefore, routing protocol authentication provides the required protection for routing adjacencies.

Question 379

Which incident-response activity focuses on determining what happened during an attack, identifying affected systems, and establishing the sequence of malicious actions?

1. Incident analysis
2. Recovery
3. Preparation
4. Eradication

Correct Answer: 1

Explanation

Incident analysis examines available evidence to understand the nature, scope, timeline, and impact of a security incident. Analysts may review endpoint telemetry, network flows, logs, authentication records, malware artifacts, and other evidence to determine how the attacker gained access and what actions occurred. Preparation establishes capabilities before incidents, eradication removes malicious components, and recovery restores affected systems. Therefore, incident analysis provides the investigative process required to understand an attack and determine its impact.

Question 380

Which security principle requires security controls to remain effective even when one individual control fails or is bypassed?

1. Defense in depth
2. Single sign-on
3. Data minimization
4. Network Address Translation

Correct Answer: 1

Explanation

Defense in depth uses multiple complementary security controls so that the failure of one protection does not automatically result in complete compromise. An organization may combine strong authentication, endpoint protection, segmentation, firewalls, encryption, monitoring, access controls, and incident-response capabilities. Each layer addresses different risks and attack stages. Single sign-on simplifies authentication, data minimization reduces unnecessary information collection, and NAT translates network addresses. Therefore, defense in depth provides resilience through multiple independent or complementary security layers.