View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 181

Which technology can identify the security posture of an endpoint before allowing it to access network resources?

1. Network Address Translation
2. Network Time Protocol
3. Network Access Control
4. File Transfer Protocol

Correct Answer: 3

Explanation

Network Access Control, or NAC, evaluates devices before or during network access and can use information such as authentication status, device identity, operating-system information, and security posture. NAC can restrict, quarantine, or provide limited access to endpoints that do not meet organizational requirements. For example, an organization may require antivirus protection and current security patches before granting normal network access. NAT translates IP addresses, NTP synchronizes clocks, and FTP transfers files. NAC therefore provides a mechanism for enforcing security requirements before allowing endpoints to access protected network resources.

Question 182

Which Cisco security solution is designed to provide DNS-layer security and help block access to malicious domains?

1. Cisco Umbrella
2. Cisco ISE
3. Cisco Secure Endpoint
4. Cisco Secure Firewall

Correct Answer: 1

Explanation

Cisco Umbrella provides cloud-delivered security services that can protect users and devices by analyzing DNS requests and blocking connections to known malicious or unwanted destinations. Because DNS requests often occur before a connection is established, DNS-layer security can prevent users from reaching certain malicious domains. Cisco ISE focuses on identity and network access control, Secure Endpoint focuses on endpoint protection, and Secure Firewall provides network firewall and security capabilities. Therefore, Cisco Umbrella is the solution specifically associated with DNS-layer security and blocking access to malicious domains.

Question 183

Which endpoint security capability continuously monitors a system for suspicious behavior and can help investigate security incidents?

1. Static routing
2. Endpoint Detection and Response
3. DNS caching
4. Network Address Translation

Correct Answer: 2

Explanation

Endpoint Detection and Response, or EDR, continuously monitors endpoint activity and collects telemetry related to processes, files, connections, and other system behavior. Security teams can use this information to detect suspicious activity, investigate incidents, identify affected systems, and take response actions such as isolating a compromised endpoint. Static routing determines network paths, DNS caching stores name-resolution information, and NAT translates addresses. EDR is particularly useful because it provides visibility beyond traditional antivirus detection and can help security analysts investigate potentially malicious activity on endpoints.

Question 184

Which type of malware encrypts or otherwise blocks access to files and commonly demands payment from victims?

1. Spyware
2. Adware
3. Ransomware
4. Rootkit

Correct Answer: 3

Explanation

Ransomware is malware designed to prevent victims from accessing systems or data, commonly by encrypting files and demanding payment for a claimed recovery mechanism. Modern ransomware attacks may also involve data theft before encryption, creating additional pressure on victims. Effective defenses include offline or immutable backups, endpoint security, patch management, least privilege, network segmentation, and user awareness. Spyware focuses on secretly collecting information, adware commonly displays unwanted advertisements, and rootkits focus on stealth and unauthorized privileged access. Therefore, ransomware is the malware category described in the question.

Question 185

Which security control helps prevent unauthorized devices from connecting to a switch port by restricting allowed MAC addresses?

1. Port security
2. DNSSEC
3. IPsec
4. Syslog

Correct Answer: 1

Explanation

Switch port security allows administrators to control which MAC addresses can use a particular switch port. The switch can learn or be configured with permitted MAC addresses and can take action when an unauthorized address appears. Depending on the configuration, violating traffic may be dropped or the port may be disabled. Port security helps reduce risks from unauthorized physical connections and certain MAC-address-based attacks. DNSSEC protects DNS information, IPsec secures IP communications, and Syslog collects event messages. Therefore, port security is the correct control for restricting devices by MAC address.

Question 186

Which protocol extension helps protect DNS responses against tampering by providing authentication and integrity mechanisms?

1. SMTP
2. DNSSEC
3. SNMP
4. FTP

Correct Answer: 2

Explanation

DNS Security Extensions, or DNSSEC, adds cryptographic authentication and integrity protection to DNS data. It allows DNS clients to validate that DNS responses originate from an authorized source and have not been modified during transmission. DNSSEC helps reduce risks such as DNS cache poisoning and certain forms of DNS spoofing. SMTP is used for email transmission, SNMP provides network management capabilities, and FTP transfers files. DNSSEC does not encrypt normal DNS queries; instead, its primary purpose is to provide authenticity and integrity for DNS information.

Question 187

Which wireless security standard introduced stronger protection than WPA2 and uses the Simultaneous Authentication of Equals mechanism for personal networks?

1. WPA
2. WPA2
3. WEP
4. WPA3

Correct Answer: 4

Explanation

WPA3 is a newer Wi-Fi security standard that provides stronger protections than earlier standards. For WPA3-Personal, the Simultaneous Authentication of Equals, or SAE, mechanism replaces the traditional WPA2-PSK authentication approach. SAE improves resistance to certain offline password-guessing attacks and provides stronger authentication characteristics. WEP is an older and insecure wireless security protocol, while WPA and WPA2 are earlier generations of Wi-Fi security standards. Organizations should select wireless security configurations appropriate to their devices and operational requirements. Therefore, WPA3 is the correct answer.

Question 188

Which wireless attack involves creating a fraudulent access point that imitates a legitimate wireless network?

1. Evil twin attack
2. DHCP starvation
3. SQL injection
4. Password spraying

Correct Answer: 1

Explanation

An evil twin attack involves creating a fraudulent wireless access point designed to imitate a legitimate network. Attackers may use a similar or identical SSID to persuade users to connect. Once connected, the attacker may attempt to capture credentials, monitor traffic, redirect users, or perform other malicious activities. Users should verify trusted wireless networks and avoid entering sensitive information over suspicious connections. DHCP starvation consumes available addresses from a DHCP pool, SQL injection targets database queries, and password spraying targets authentication systems. Therefore, an evil twin attack matches the described wireless threat.

Question 189

Which protocol is commonly used to securely manage network devices through an encrypted command-line session?

1. Telnet
2. HTTP
3. SSH
4. TFTP

Correct Answer: 3

Explanation

Secure Shell, or SSH, provides encrypted remote access to network devices and servers. It protects authentication credentials and interactive management traffic from interception when properly configured. Network administrators commonly use SSH to securely manage routers, switches, firewalls, and Linux systems. Telnet provides remote command-line access without encryption, making it unsuitable for secure administrative access over untrusted networks. HTTP is primarily a web protocol, while TFTP provides simple file transfer without strong security features. Therefore, SSH is the appropriate protocol for encrypted command-line management.

Question 190

Which protocol should replace Telnet when secure remote administration of network devices is required?

1. FTP
2. SSH
3. TFTP
4. HTTP

Correct Answer: 2

Explanation

SSH should generally be used instead of Telnet for secure remote administration. SSH encrypts the management session, including authentication information and commands exchanged between the administrator and the device. Telnet sends information without encryption, which can allow attackers monitoring the communication path to capture credentials and other sensitive information. FTP and TFTP are file-transfer protocols, while HTTP is primarily used for web communication. Using SSH with strong authentication and appropriate access controls provides a much safer method for remotely managing network infrastructure.

Question 191

Which attack occurs when an attacker secretly intercepts and potentially modifies communication between two parties?

1. Man-in-the-middle attack
2. Ransomware attack
3. Password spraying
4. Watering-hole attack

Correct Answer: 1

Explanation

A Man-in-the-Middle, or MitM, attack occurs when an attacker positions themselves between two communicating parties and intercepts their traffic. Depending on the circumstances, the attacker may observe, modify, or redirect communications without the victims realizing that the connection has been compromised. Encryption, certificate validation, secure protocols, and strong authentication can help reduce MitM risks. Ransomware focuses on denying access to data, password spraying attempts common passwords across accounts, and watering-hole attacks compromise websites likely to be visited by specific targets. Therefore, the first option describes a MitM attack.

Question 192

Which security mechanism verifies that a digital certificate was issued by a trusted authority?

1. NAT
2. Certificate chain validation
3. DHCP snooping
4. Port mirroring

Correct Answer: 2

Explanation

Certificate chain validation verifies whether a digital certificate can be traced through a trusted chain to a recognized Certificate Authority. During validation, systems can check signatures, certificate validity periods, trust relationships, and other certificate properties. This process helps determine whether a certificate should be trusted for a secure connection. NAT translates addresses, DHCP snooping protects against unauthorized DHCP servers, and port mirroring copies traffic for monitoring. Proper certificate validation is important for technologies such as HTTPS and TLS because it helps prevent users from unknowingly establishing secure sessions with untrusted entities.

Question 193

Which security mechanism uses a public and private key pair to protect communications or support digital signatures?

1. Symmetric encryption
2. Hashing
3. Asymmetric cryptography
4. Tokenization

Correct Answer: 3

Explanation

Asymmetric cryptography uses a mathematically related public and private key pair. The public key can be distributed openly, while the private key must be protected by its owner. Asymmetric cryptography can support secure key exchange, encryption, authentication, and digital signatures. Symmetric encryption uses the same secret key for encryption and decryption, while hashing produces a digest rather than a reversible encrypted representation. Tokenization replaces sensitive data with substitute values. Therefore, asymmetric cryptography is the mechanism that uses public and private key pairs.

Question 194

Which cryptographic approach uses the same secret key for both encryption and decryption?

1. Asymmetric cryptography
2. Symmetric cryptography
3. Digital signature
4. Hashing

Correct Answer: 2

Explanation

Symmetric cryptography uses the same secret key, or corresponding shared secret, to encrypt and decrypt information. It is generally efficient and well suited for protecting large amounts of data. A major challenge is securely distributing and managing the shared key between communicating parties. Asymmetric cryptography uses separate public and private keys, while hashing produces a fixed-length digest and is not normally used for reversible encryption. Digital signatures use asymmetric cryptographic mechanisms to provide authenticity and integrity. Therefore, symmetric cryptography is the correct answer.

Question 195

Which security control helps ensure that a user cannot access a resource unless the user has been granted the required permissions?

1. Authorization
2. Encryption
3. Compression
4. Network monitoring

Correct Answer: 1

Explanation

Authorization determines what an authenticated user or device is permitted to access or perform. Authentication establishes or verifies identity, while authorization determines the permissions associated with that identity. For example, a user may successfully authenticate to an application but still be denied access to administrative functions because the required authorization privileges are absent. Encryption protects information from unauthorized disclosure, compression reduces data size, and network monitoring observes traffic and activity. Therefore, authorization is the security control responsible for determining whether an authenticated entity has permission to access a resource.

Question 196

Which access-control model assigns permissions based on the user’s organizational role?

1. Discretionary Access Control
2. Mandatory Access Control
3. Role-Based Access Control
4. Attribute-Based Access Control

Correct Answer: 3

Explanation

Role-Based Access Control, or RBAC, assigns permissions according to predefined organizational roles. Users receive permissions because they are members of roles such as administrator, analyst, manager, or employee. This approach can simplify permission management because administrators can modify role permissions instead of individually configuring every user’s access. Discretionary Access Control is generally based on resource owners deciding access, while Mandatory Access Control uses centrally defined classifications and policies. Attribute-Based Access Control uses attributes about users, resources, actions, or environments. Therefore, RBAC is the model based primarily on organizational roles.

Question 197

Which security practice separates sensitive systems from general user networks to reduce the potential impact of a compromise?

1. Network segmentation
2. Password sharing
3. Open routing
4. Data duplication

Correct Answer: 1

Explanation

Network segmentation divides a network into separate security zones or segments and controls communication between them. Sensitive systems can be isolated from general user devices so that a compromise in one segment does not automatically provide unrestricted access to another. Segmentation can be implemented using VLANs, firewalls, ACLs, routing policies, and other controls. Password sharing weakens accountability, open routing does not provide appropriate security boundaries, and data duplication is primarily a data-management concept. Therefore, network segmentation is an effective practice for limiting the potential spread of a compromise.

Question 198

Which security technology can automatically isolate a compromised endpoint from the network while allowing security administrators to investigate it?

1. DNSSEC
2. EDR
3. NTP
4. SMTP

Correct Answer: 2

Explanation

Endpoint Detection and Response, or EDR, can monitor endpoint activity and provide response capabilities. Depending on the product and configuration, EDR can isolate a compromised endpoint from network communication while maintaining a management connection that allows security personnel to investigate the incident. This can help contain malware and prevent further communication with attackers or other systems. DNSSEC protects DNS integrity, NTP synchronizes system clocks, and SMTP handles email transport. Therefore, EDR is the technology that can provide endpoint isolation as part of an incident-response process.

Question 199

Which security measure helps protect an organization if its primary data becomes unavailable because of hardware failure or malware?

1. Backups
2. Port scanning
3. Packet filtering
4. DNS caching

Correct Answer: 1

Explanation

Regular backups provide recoverable copies of important data that can be used after hardware failures, accidental deletion, ransomware incidents, or other disruptive events. Effective backup strategies should consider backup frequency, retention, storage locations, access controls, and recovery testing. Offline or immutable backups can provide additional protection against attacks that attempt to delete or encrypt backup data. Port scanning identifies accessible services, packet filtering controls network traffic, and DNS caching stores previously resolved DNS information. Therefore, backups are an important control for recovering data after availability or integrity incidents.

Question 200

Which security principle requires security controls to be applied continuously rather than assuming that a user or device is trusted after initial authentication?

1. Perimeter security
2. Zero Trust
3. Implicit trust
4. Open authentication

Correct Answer: 2

Explanation

Zero Trust follows the principle that trust should not be automatically granted based solely on network location or previous authentication. Access decisions can continuously consider identity, device posture, requested resource, context, and other relevant security signals. Users and devices should receive only the access required for legitimate activities, and security controls can continuously verify access conditions. Traditional perimeter security may place greater trust in internal network locations, while implicit trust assumes that previously authenticated entities remain trusted. Therefore, Zero Trust is the security principle described in the question.