View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 321

Which protocol is commonly used to securely transfer files between a client and server using SSH encryption?

1. SFTP
2. TFTP
3. FTP
4. HTTP

Correct Answer: 1

Explanation

Secure File Transfer Protocol (SFTP) provides encrypted file-transfer capabilities through the SSH protocol. It protects authentication credentials and transferred data from interception when properly configured. SFTP is different from traditional FTP, which does not encrypt credentials or data by default. TFTP is a lightweight file-transfer protocol that does not provide built-in encryption, while HTTP is primarily used for web communication. SFTP is commonly used when organizations need to securely transfer configuration files, documents, backups, or other sensitive information across networks. Therefore, SFTP is the correct answer.

Question 322

Which Cisco security solution can provide DNS-layer protection by blocking access to malicious or unwanted domains?

1. Cisco ISE
2. Cisco Secure Endpoint
3. Cisco Umbrella
4. Cisco Secure Firewall

Correct Answer: 3

Explanation

Cisco Umbrella provides DNS-layer security that can help prevent users and devices from accessing malicious, phishing, malware, and other policy-restricted domains. Because DNS requests occur before many application connections are established, DNS-layer filtering can provide an additional security control against threats. Cisco ISE focuses on identity and network access control, Cisco Secure Endpoint provides endpoint detection and response capabilities, and Cisco Secure Firewall provides network traffic filtering and firewall functions. Therefore, Cisco Umbrella is the Cisco security solution most directly associated with DNS-layer protection.

Question 323

Which protocol provides secure web communication by using TLS to encrypt HTTP traffic?

1. FTP
2. Telnet
3. HTTP
4. HTTPS

Correct Answer: 4

Explanation

HTTPS is the secure version of HTTP and uses Transport Layer Security (TLS) to protect web communications. TLS can provide confidentiality, integrity, and server authentication when certificates are properly validated. This helps protect sensitive information such as login credentials, payment information, and session data from network interception or modification. HTTP itself does not provide encryption, while FTP is designed for file transfer and Telnet provides unencrypted remote terminal access. Therefore, HTTPS is the protocol used for secure web communication through TLS.

Question 324

Which access-control model allows the owner of a resource to decide who can access it?

1. RBAC
2. DAC
3. ABAC
4. MAC

Correct Answer: 2

Explanation

Discretionary Access Control (DAC) allows the owner or controller of a resource to determine which users or groups can access it and what permissions they receive. For example, a file owner may grant another user read or write access. Role-Based Access Control assigns permissions based primarily on roles, while Attribute-Based Access Control evaluates multiple attributes and policies. Mandatory Access Control uses centrally enforced classifications and rules that users generally cannot change themselves. Therefore, DAC is the access-control model in which the resource owner has significant authority over access permissions.

Question 325

Which security technology can identify suspicious processes, files, and network connections on an endpoint and provide response capabilities?

1. EDR
2. DNSSEC
3. DHCP snooping
4. RADIUS

Correct Answer: 1

Explanation

Endpoint Detection and Response (EDR) continuously monitors endpoint activity and collects security telemetry such as process execution, file modifications, network connections, and other events. Security teams can use this information to detect suspicious behavior and investigate potential compromises. Many EDR platforms also provide response capabilities, such as isolating a compromised endpoint or terminating a malicious process. DNSSEC protects DNS integrity, DHCP snooping protects against unauthorized DHCP activity, and RADIUS provides centralized authentication services. Therefore, EDR is the technology designed for endpoint detection, investigation, and response.

Question 326

Which type of attack uses fraudulent emails or messages to trick victims into revealing sensitive information?

1. Phishing
2. Port scanning
3. MAC flooding
4. DNS tunneling

Correct Answer: 1

Explanation

Phishing is a social-engineering attack in which an attacker uses fraudulent emails, messages, websites, or other communications to deceive victims. The attacker may attempt to obtain passwords, payment information, authentication codes, or other sensitive data. Phishing messages often use urgency, impersonation, or misleading links to encourage the victim to take an unsafe action. Port scanning is used to identify accessible network services, MAC flooding targets switch CAM tables, and DNS tunneling abuses DNS communications. Therefore, phishing is the attack described in the question.

Question 327

Which technology can provide centralized authentication for users connecting to an organization’s wireless network through 802.1X?

1. Syslog
2. NetFlow
3. RADIUS
4. SNMP

Correct Answer: 3

Explanation

RADIUS is commonly used as the centralized authentication server in enterprise 802.1X deployments. When a user attempts to access a protected wireless network, the wireless access point acts as the authenticator and forwards authentication information toward the RADIUS server. The server evaluates the credentials or authentication method and returns an authorization decision. Syslog is used for event logging, NetFlow provides traffic-flow information, and SNMP supports network monitoring and management. Therefore, RADIUS is the technology commonly used to provide centralized authentication for enterprise 802.1X wireless access.

Question 328

Which security mechanism protects a network from unauthorized DHCP servers by identifying trusted switch interfaces?

1. Port security
2. DHCP snooping
3. Root Guard
4. WAF

Correct Answer: 2

Explanation

DHCP snooping helps protect against rogue DHCP servers by distinguishing trusted and untrusted switch interfaces. Legitimate DHCP server responses are expected to arrive through trusted interfaces, while client-facing interfaces can be treated as untrusted. The switch can drop unauthorized DHCP server messages received on untrusted ports. DHCP snooping can also create a binding database used by security mechanisms such as Dynamic ARP Inspection and IP Source Guard. Port security controls MAC addresses, Root Guard protects Spanning Tree, and WAF protects web applications. Therefore, DHCP snooping is correct.

Question 329

Which attack involves compromising a website that members of a specific target group are likely to visit?

1. Credential stuffing
2. Watering-hole attack
3. Brute-force attack
4. Password spraying

Correct Answer: 2

Explanation

A watering-hole attack involves compromising or manipulating a website that members of a particular target group are likely to visit. Instead of directly attacking every intended victim, the attacker places malicious content or exploits on a website already trusted or frequently visited by the target population. Visitors may then be exposed to malware, credential theft, or exploitation attempts. Credential stuffing uses previously stolen credentials, brute-force attacks repeatedly guess credentials, and password spraying attempts a small number of common passwords across many accounts. Therefore, the described attack is a watering-hole attack.

Question 330

Which security control can block web requests containing patterns associated with SQL injection attacks?

1. DNS server
2. RADIUS server
3. NTP server
4. Web Application Firewall

Correct Answer: 4

Explanation

A Web Application Firewall (WAF) can inspect HTTP and HTTPS requests and apply rules designed to identify malicious application-layer traffic. WAF policies can detect patterns commonly associated with SQL injection, cross-site scripting, malicious file uploads, and other web application attacks. A DNS server resolves domain names, RADIUS provides centralized authentication services, and NTP synchronizes system clocks. Because SQL injection targets web applications and their database queries, a WAF is specifically suited to inspect and filter this type of traffic. Therefore, the Web Application Firewall is correct.

Question 331

Which security concept ensures that sensitive information is accessible only to authorized individuals?

1. Confidentiality
2. Integrity
3. Availability
4. Nonrepudiation

Correct Answer: 1

Explanation

Confidentiality is the security principle concerned with preventing unauthorized disclosure of information. Controls such as encryption, access control, authentication, and data classification can help maintain confidentiality. Integrity focuses on ensuring that information has not been improperly modified, while availability ensures that authorized users can access resources when needed. Nonrepudiation provides evidence that can help establish the origin or participation in an action. Organizations typically use all of these security principles together to protect information. Therefore, confidentiality is the property that ensures sensitive information is accessible only to authorized individuals.

Question 332

Which security principle ensures that data has not been altered without authorization?

1. Availability
2. Integrity
3. Confidentiality
4. Authentication

Correct Answer: 2

Explanation

Integrity ensures that data remains accurate, complete, and protected from unauthorized modification. Security mechanisms such as cryptographic hashes, digital signatures, file integrity monitoring, and access controls can help maintain integrity. Confidentiality protects information from unauthorized disclosure, while availability ensures resources remain accessible when needed. Authentication verifies the identity of a user or device. Maintaining integrity is particularly important for configuration files, financial records, software packages, and other information where unauthorized changes could have significant consequences. Therefore, integrity is the correct security property.

Question 333

Which technology provides visibility into network conversations by recording information about traffic flows rather than the complete contents of every packet?

1. NetFlow
2. Telnet
3. FTP
4. DHCP

Correct Answer: 1

Explanation

NetFlow provides information about network traffic flows, including details such as source and destination addresses, ports, protocols, packet counts, and byte counts. This information can help security and network teams identify unusual traffic patterns, investigate incidents, monitor bandwidth usage, and detect potential command-and-control activity. NetFlow does not normally capture the complete content of every packet. Telnet provides remote terminal access, FTP provides file transfer, and DHCP provides automatic IP configuration. Therefore, NetFlow is the technology used to provide flow-level network visibility.

Question 334

Which security measure is most directly intended to prevent unauthorized users from guessing passwords through repeated login attempts?

1. Data encryption
2. Account lockout
3. Network segmentation
4. File hashing

Correct Answer: 2

Explanation

Account lockout can help defend against repeated password-guessing attempts by temporarily disabling an account after a configured number of unsuccessful login attempts. This makes automated brute-force attacks more difficult and can alert security teams to suspicious authentication activity. Organizations must configure lockout policies carefully because overly aggressive settings can also be abused to cause denial of service against legitimate accounts. Data encryption protects information, network segmentation separates systems, and file hashing helps detect data changes. Therefore, account lockout is the control most directly associated with limiting repeated password-guessing attempts.

Question 335

Which technology can use digital certificates to authenticate a user or device without relying solely on a password?

1. Certificate-based authentication
2. MAC flooding
3. DHCP snooping
4. DNS filtering

Correct Answer: 1

Explanation

Certificate-based authentication uses digital certificates to establish the identity of a user, device, or service. The certificate is typically issued by a trusted Certificate Authority and contains identity information and a public key. During authentication, the endpoint can demonstrate possession of the corresponding private key. This can provide stronger authentication than relying solely on passwords and is commonly used in enterprise wireless access, VPNs, and other secure environments. MAC flooding targets switch tables, DHCP snooping protects DHCP operations, and DNS filtering controls domain access. Therefore, certificate-based authentication is correct.

Question 336

Which security mechanism can separate users or systems into different network segments to reduce lateral movement after a compromise?

1. Network segmentation
2. Password hashing
3. Certificate revocation
4. Email filtering

Correct Answer: 1

Explanation

Network segmentation divides a network into separate security zones or segments with controlled communication between them. Examples include VLANs, firewalls, security groups, and other access-control mechanisms. Segmentation can limit lateral movement because compromising one system does not automatically provide unrestricted access to every other system. Sensitive servers, user devices, guest networks, and management systems can be placed into separate segments with different security policies. Password hashing protects stored credentials, certificate revocation invalidates certificates, and email filtering controls malicious messages. Therefore, network segmentation is the appropriate security mechanism.

Question 337

Which attack attempts to gain access to an account by trying a small number of commonly used passwords against many different accounts?

1. Credential stuffing
2. Brute-force attack
3. Password spraying
4. Session hijacking

Correct Answer: 3

Explanation

Password spraying is an attack in which an attacker tries one or a small number of commonly used passwords against many different accounts. This differs from a traditional brute-force attack, which may attempt many passwords against a single account. Password spraying can help attackers avoid account-lockout thresholds that trigger after many failed attempts against one account. Credential stuffing uses previously stolen username-and-password combinations, while session hijacking attempts to take over an already authenticated session. Therefore, the technique described is password spraying.

Question 338

Which security control can prevent an attacker from using a compromised account to access resources beyond the permissions required for that user’s job?

1. Least privilege
2. Port mirroring
3. DNS caching
4. Load balancing

Correct Answer: 1

Explanation

Least privilege limits users, applications, and services to only the permissions necessary to perform their assigned tasks. If an account is compromised, this restriction can reduce the attacker’s ability to access sensitive resources or perform unauthorized administrative actions. Least privilege should be applied to regular users, privileged administrators, service accounts, and applications where practical. Port mirroring is used for traffic analysis, DNS caching stores DNS responses for faster resolution, and load balancing distributes traffic across systems. Therefore, least privilege is the appropriate control for limiting the impact of a compromised account.

Question 339

Which security technology can analyze endpoint behavior and automatically isolate a compromised device from the network?

1. DNSSEC
2. EDR
3. NTP
4. DHCP

Correct Answer: 2

Explanation

Endpoint Detection and Response (EDR) solutions monitor endpoint activity and can identify suspicious behavior such as malicious processes, unusual network connections, or unauthorized file modifications. Many EDR platforms provide response capabilities that allow security teams or automated policies to isolate a compromised endpoint from normal network communication. Isolation helps contain threats and can prevent malware from spreading laterally while investigators examine the system. DNSSEC protects DNS integrity, NTP synchronizes system clocks, and DHCP assigns network configuration. Therefore, EDR is the technology capable of providing endpoint monitoring and isolation.

Question 340

Which security control helps ensure that an organization can restore critical data after ransomware encrypts production files?

1. Network Address Translation
2. Full and tested backups
3. Port security
4. DNS filtering

Correct Answer: 2

Explanation

Maintaining reliable and tested backups is an important defense against ransomware and other destructive incidents. Backups allow organizations to restore affected data without necessarily relying on attackers to provide decryption capabilities. Backups should be protected from unauthorized modification or deletion and should be tested periodically to verify that restoration actually works. Depending on organizational requirements, offline or otherwise isolated backup copies can provide additional protection against ransomware. NAT translates addresses, port security controls switch interfaces, and DNS filtering blocks selected domains. Therefore, full and tested backups provide the recovery capability described.