View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 281

Which AAA component determines what resources or services an authenticated user is permitted to access?

1. Authentication
2. Accounting
3. Authorization
4. Auditing

Correct Answer: 3

Explanation

Authorization determines what an authenticated user or device is allowed to access and what actions it may perform. In an AAA framework, authentication verifies the identity of the user, while authorization determines the permissions granted after successful authentication. Accounting records information about user activity, such as login times or accessed resources. Authorization policies can be based on user roles, groups, device attributes, or other conditions. For example, a network administrator may be permitted to configure routers, while a regular employee may only access approved applications. Therefore, authorization is responsible for controlling access privileges.

Question 282

Which protocol is commonly used by Cisco devices to securely communicate authentication, authorization, and accounting information with a centralized AAA server?

1. TACACS+
2. FTP
3. DNS
4. TFTP

Correct Answer: 1

Explanation

TACACS+ is a Cisco-supported AAA protocol that provides centralized authentication, authorization, and accounting services. It is particularly useful for controlling administrative access to network devices. TACACS+ separates authentication and authorization functions and encrypts the entire body of the authentication packet between the client and server. This allows administrators to apply detailed command authorization policies. FTP and TFTP are file-transfer protocols, while DNS resolves domain names to network addresses. TACACS+ is therefore the protocol most directly associated with centralized AAA management for network-device administration.

Question 283

Which 802.1X component acts as the intermediary between an endpoint and the authentication server?

1. Supplicant
2. Authenticator
3. Certificate Authority
4. DNS server

Correct Answer: 2

Explanation

In an 802.1X architecture, the authenticator serves as the intermediary between the supplicant and the authentication server. A network switch or wireless access point commonly performs the authenticator role. The endpoint requesting network access is the supplicant, while the authentication server, commonly a RADIUS server, makes or supports the authentication decision. The authenticator controls access to the network based on the authentication process. A Certificate Authority issues and manages digital certificates, while a DNS server resolves domain names. Therefore, the authenticator is the correct component.

Question 284

Which authentication technique allows a device’s MAC address to be used for network access when 802.1X authentication is not supported?

1. EAP
2. MAB
3. SFTP
4. IPsec

Correct Answer: 2

Explanation

MAC Authentication Bypass (MAB) provides a method for allowing devices that cannot perform traditional 802.1X authentication to gain controlled network access. The switch can use the endpoint’s MAC address as an identity and send the information to an authentication server for authorization. MAB is often used for devices such as printers, cameras, phones, or specialized equipment that may not support an 802.1X supplicant. EAP is an authentication framework, SFTP provides secure file transfer, and IPsec secures IP communications. Therefore, MAB is the appropriate technique.

Question 285

Which security feature can prevent a switch interface from accepting DHCP server responses from an unauthorized device?

1. DHCP snooping
2. Root Guard
3. PortFast
4. DNSSEC

Correct Answer: 1

Explanation

DHCP snooping helps protect networks from unauthorized or rogue DHCP servers. Switch interfaces can be configured as trusted or untrusted. DHCP server responses such as DHCPOFFER and DHCPACK messages are normally permitted only through trusted interfaces. This prevents an attacker from connecting an unauthorized DHCP server to an access port and providing malicious network configuration information. Root Guard protects Spanning Tree topology, PortFast speeds up edge-port transitions, and DNSSEC protects DNS data integrity. Therefore, DHCP snooping is the correct security feature for controlling DHCP server responses.

Question 286

Which attack attempts to exhaust the available IP addresses in a DHCP address pool?

1. DNS poisoning
2. DHCP starvation
3. ARP spoofing
4. MAC flooding

Correct Answer: 2

Explanation

DHCP starvation is an attack in which an attacker sends numerous DHCP requests, often using spoofed MAC addresses, to consume the available addresses in a DHCP scope. Once the pool is exhausted, legitimate clients may be unable to obtain an IP address. This can cause denial of service and may also be used as a step toward deploying a rogue DHCP server. DNS poisoning manipulates DNS information, ARP spoofing manipulates IP-to-MAC mappings, and MAC flooding targets a switch’s CAM table. Therefore, DHCP starvation is the correct answer.

Question 287

Which security feature helps prevent attackers from sending forged ARP messages by validating ARP packets against a trusted IP-to-MAC binding database?

1. BPDU Guard
2. IP Source Guard
3. Dynamic ARP Inspection
4. PortFast

Correct Answer: 3

Explanation

Dynamic ARP Inspection (DAI) helps protect against ARP spoofing by validating ARP packets before allowing them through a switch. DAI can compare the information in ARP messages with trusted bindings, commonly supplied by the DHCP snooping binding database. If an ARP packet contains inconsistent or invalid information, the switch can drop it. BPDU Guard protects against unexpected Spanning Tree BPDUs, IP Source Guard helps prevent IP address spoofing, and PortFast accelerates edge-port forwarding. Therefore, Dynamic ARP Inspection is the appropriate control for validating ARP messages.

Question 288

Which feature can prevent a host from using an IP address that does not match the address assigned to its switch port?

1. IP Source Guard
2. DNSSEC
3. Root Guard
4. WAF

Correct Answer: 1

Explanation

IP Source Guard helps prevent IP address spoofing by filtering traffic based on trusted IP-to-MAC bindings associated with a switch interface. The feature can use information learned through DHCP snooping to determine which IP address is legitimately associated with a particular port. If a host attempts to send traffic using an unauthorized source IP address, the switch can block the traffic. DNSSEC protects DNS information, Root Guard protects Spanning Tree topology, and WAF protects web applications. Therefore, IP Source Guard is the correct security mechanism.

Question 289

Which wireless security option uses a pre-shared key for authentication?

1. WPA2-Enterprise
2. WPA2-Personal
3. 802.1X with RADIUS
4. Certificate-based authentication

Correct Answer: 2

Explanation

WPA2-Personal commonly uses a pre-shared key (PSK) for wireless authentication. The same configured passphrase is used by authorized users or devices to join the wireless network. This differs from WPA2-Enterprise, which typically uses 802.1X and a centralized authentication server such as RADIUS. Enterprise authentication provides individual authentication credentials and can support stronger centralized access control. Certificate-based authentication can also be used with enterprise wireless environments. Therefore, WPA2-Personal is the wireless security option associated with a pre-shared key.

Question 290

Which wireless attack creates a fraudulent access point that imitates a legitimate wireless network?

1. DHCP starvation
2. Evil twin
3. MAC flooding
4. DNS tunneling

Correct Answer: 2

Explanation

An evil twin attack involves creating a fraudulent wireless access point that imitates a legitimate network. Attackers may use a similar or identical network name to trick users into connecting. Once connected, the attacker may attempt to intercept traffic, collect credentials, redirect users, or perform other malicious activities. Users should verify trusted wireless networks and avoid entering sensitive information over suspicious connections. DHCP starvation targets DHCP resources, MAC flooding targets switch CAM tables, and DNS tunneling abuses DNS communications. Therefore, the fraudulent wireless access point described is an evil twin.

Question 291

Which IPsec component provides authentication and integrity for IP packets but does not provide encryption of the packet payload?

1. ESP
2. AH
3. TLS
4. SSH

Correct Answer: 2

Explanation

Authentication Header (AH) is an IPsec protocol that provides authentication and integrity protection for IP packets. AH does not encrypt the packet payload, so it does not provide confidentiality. Encapsulating Security Payload (ESP), in contrast, can provide confidentiality through encryption along with integrity and authentication features. TLS is used primarily to secure application-layer communications, while SSH provides secure remote administration and related services. Therefore, when the requirement is IPsec authentication and integrity without payload encryption, AH is the appropriate choice.

Question 292

Which IPsec protocol can provide confidentiality by encrypting the payload of an IP packet?

1. ESP
2. ARP
3. ICMP
4. DHCP

Correct Answer: 1

Explanation

Encapsulating Security Payload (ESP) is an IPsec protocol capable of providing confidentiality by encrypting the protected payload. ESP can also provide integrity, authentication, and anti-replay protection depending on the configuration and algorithms used. This makes ESP widely used in IPsec VPN implementations. ARP resolves IPv4 addresses to MAC addresses, ICMP supports network control and diagnostic messaging, and DHCP provides automatic network configuration. None of these protocols provides IPsec-style payload encryption. Therefore, ESP is the correct protocol for providing confidentiality in an IPsec connection.

Question 293

Which type of certificate authority is responsible for issuing and signing digital certificates in a PKI environment?

1. Registration Authority
2. Certificate Authority
3. Supplicant
4. Authentication Proxy

Correct Answer: 2

Explanation

A Certificate Authority (CA) is a trusted entity within a Public Key Infrastructure that issues and digitally signs certificates. The CA verifies information according to its certificate policies and uses its private key to sign issued certificates. Systems can then use the CA’s trusted public key to validate certificate signatures. A Registration Authority may assist with identity verification and certificate requests, but it does not normally perform the final certificate-signing function. A supplicant is an endpoint seeking network authentication. Therefore, the Certificate Authority performs the certificate issuance and signing role.

Question 294

Which property of a digital signature helps demonstrate that a message was not modified after it was signed?

1. Confidentiality
2. Availability
3. Integrity
4. Compression

Correct Answer: 3

Explanation

Integrity ensures that information has not been altered without authorization. Digital signatures support integrity by using a cryptographic process involving the sender’s private key and a representation of the original data. A recipient can use the corresponding public key and the received data to verify whether the signature remains valid. If the message changes after signing, signature verification can fail. Confidentiality concerns preventing unauthorized disclosure, availability concerns access to resources, and compression reduces data size. Therefore, integrity is the security property most directly associated with detecting unauthorized modification of signed data.

Question 295

Which protocol is considered insecure because it transmits remote terminal sessions without encryption?

1. SSH
2. HTTPS
3. Telnet
4. SFTP

Correct Answer: 3

Explanation

Telnet provides remote terminal access but does not encrypt the session by default. As a result, usernames, passwords, commands, and other session information can potentially be intercepted by attackers monitoring network traffic. SSH was developed to provide secure encrypted remote administration and should generally be used instead of Telnet for administrative access. HTTPS secures web communications through TLS, while SFTP provides secure file transfer through SSH. Therefore, Telnet is the insecure remote-access protocol described in the question.

Question 296

Which technology monitors endpoint activity and can provide detailed telemetry for detecting and investigating suspicious behavior?

1. EDR
2. NAT
3. DHCP
4. NTP

Correct Answer: 1

Explanation

Endpoint Detection and Response (EDR) technology continuously monitors endpoint activity and collects telemetry such as process execution, file activity, network connections, and other security-related events. Security teams can use this information to identify suspicious behavior, investigate incidents, and perform response actions such as isolating compromised endpoints. NAT translates network addresses, DHCP provides IP configuration, and NTP synchronizes system clocks. EDR therefore provides the endpoint-focused monitoring and investigation capabilities described in the question.

Question 297

Which security monitoring system collects and correlates logs from multiple devices and applications to identify potential security incidents?

1. SIEM
2. FTP server
3. DHCP server
4. Proxy ARP

Correct Answer: 1

Explanation

A Security Information and Event Management (SIEM) system collects security events and logs from multiple sources and correlates them to identify patterns that may indicate an attack or policy violation. Sources can include firewalls, servers, endpoints, authentication systems, and network devices. Correlation helps security analysts identify relationships between individual events that might not appear suspicious when viewed separately. A SIEM can also support alerting, investigation, reporting, and compliance activities. FTP and DHCP servers provide specific network services, while Proxy ARP is a network communication function. Therefore, SIEM is correct.

Question 298

Which security principle assumes that no user or device should automatically be trusted simply because it is inside the corporate network?

1. Defense in depth
2. Zero Trust
3. Network Address Translation
4. Open access

Correct Answer: 2

Explanation

Zero Trust is a security approach based on the principle that users and devices should not automatically be trusted based solely on their network location. Access decisions should consider factors such as identity, device posture, resource sensitivity, authentication status, and policy. Access should be continuously evaluated and limited according to the user’s actual requirements. This approach reduces reliance on the traditional assumption that an internal network is inherently trusted. Defense in depth uses multiple security layers, while NAT translates addresses. Therefore, Zero Trust is the correct principle.

Question 299

Which network architecture places publicly accessible services on a separate network segment between trusted and untrusted networks?

1. DMZ
2. VLAN trunk
3. Loopback interface
4. Management console

Correct Answer: 4

Explanation

A Demilitarized Zone (DMZ) is a network segment designed to host services that need to be reachable from less-trusted networks, such as public web or email servers. The DMZ provides an additional separation layer between external networks and the internal trusted network. Firewalls can enforce different security policies between the Internet, DMZ, and internal network. A VLAN trunk carries multiple VLANs across a connection, a loopback interface is a logical interface, and a management console provides administrative access. Therefore, the described segmented architecture is a DMZ.

Question 300

Which security practice reduces the potential damage caused by a compromised user account by granting only the permissions necessary to perform the user’s tasks?

1. Least privilege
2. Port mirroring
3. Network broadcasting
4. Open authentication

Correct Answer: 1

Explanation

The principle of least privilege requires users, applications, and systems to receive only the permissions necessary to perform their intended functions. If an account is compromised, limiting its privileges can reduce the attacker’s ability to access sensitive resources, modify configurations, or move laterally through the environment. Least privilege should be applied to normal users as well as administrative accounts and service identities. Port mirroring is used for traffic monitoring, broadcasting distributes network traffic to multiple hosts, and open authentication does not provide restrictive access control. Therefore, least privilege is the correct security practice.