View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 41

Which security technology is designed to identify and block unauthorized access attempts to a network?

1. Intrusion Prevention System
2. DNS resolver
3. NTP server
4. File server

Correct Answer: 1

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic and compares activity against known attack signatures, suspicious patterns, and configured security rules. When malicious activity is detected, an IPS can take action such as dropping packets, terminating connections, or blocking the source. This makes IPS different from an Intrusion Detection System, which primarily detects and reports suspicious activity without automatically blocking it. DNS resolvers, NTP servers, and file servers perform other network functions. Therefore, an Intrusion Prevention System is designed to identify and block unauthorized or malicious network activity.

Question 42

Which type of attack attempts to gain access to an account by using a password obtained from another compromised service?

1. DDoS
2. Credential stuffing
3. ARP poisoning
4. Shoulder surfing

Correct Answer: 2

Explanation

Credential stuffing is an attack in which criminals use previously stolen usernames and passwords to attempt access to other websites or services. The attack relies on the fact that many users reuse the same password across multiple accounts. If the credentials work on another service, the attacker may gain unauthorized access without needing to crack the password. DDoS attacks target availability, ARP poisoning manipulates local network address resolution, and shoulder surfing involves observing someone entering sensitive information. Multifactor authentication and unique passwords can reduce credential-stuffing risks. Therefore, credential stuffing is the correct answer.

Question 43

Which protocol is used to resolve a domain name such as www.example.com into an IP address?

1. DHCP
2. DNS
3. SSH
4. SNMP

Correct Answer: 2

Explanation

The Domain Name System, or DNS, translates human-readable domain names into IP addresses that computers use to communicate across networks. When a user enters a website address, a DNS resolver helps locate the IP address associated with that domain. DNS can also perform reverse lookups and provide other records, such as mail-server information. DHCP assigns IP configuration details, SSH provides secure remote access, and SNMP supports network monitoring and management. DNS is essential because users can access services using understandable names instead of remembering numerical IP addresses. Therefore, DNS is the correct protocol.

Question 44

Which security method uses a one-way mathematical function to verify data integrity?

1. Encryption
2. Authentication
3. Hashing
4. Tokenization

Correct Answer: 3

Explanation

Hashing uses a mathematical function to convert data into a fixed-length value known as a hash or digest. When the same data is processed with the same hashing algorithm, it should produce the same result. By comparing calculated hashes, systems can detect whether data has changed or become corrupted. Hashing is commonly used for file integrity verification, digital signatures, and password protection when combined with appropriate password-hashing techniques. Encryption is designed to protect confidentiality, authentication verifies identity, and tokenization replaces sensitive data with tokens. Therefore, hashing is the correct method for verifying data integrity.

Question 45

Which security control is most effective for reducing the risk of unauthorized access when a password is stolen?

1. Multifactor authentication
2. Disabling system logs
3. Using shared accounts
4. Removing account monitoring

Correct Answer: 1

Explanation

Multifactor authentication adds another verification requirement beyond a password. The additional factor may be a security token, mobile authentication application, hardware key, or biometric characteristic. If an attacker obtains a user’s password, access may still be prevented because the attacker does not possess the additional authentication factor. Shared accounts reduce accountability, disabling logs removes valuable evidence, and removing monitoring makes suspicious activity harder to detect. MFA does not eliminate every security risk, but it significantly improves protection against many password-based attacks. Therefore, multifactor authentication is the most effective option listed.

Question 46

Which type of firewall examines the state of active connections when deciding whether to allow or deny traffic?

1. Stateless firewall
2. Packet generator
3. Stateful firewall
4. Network hub

Correct Answer: 3

Explanation

A stateful firewall maintains information about active network connections and uses that information when evaluating traffic. For example, it can recognize whether a packet belongs to an established and permitted connection or represents an unexpected communication attempt. This provides more context than a basic stateless firewall, which evaluates packets individually according to configured rules. A packet generator creates network traffic, and a network hub forwards signals without providing advanced security inspection. Therefore, a stateful firewall is the technology that considers the state of active connections when filtering traffic.

Question 47

Which attack technique attempts to deceive an employee into transferring money or revealing confidential business information through a fraudulent email?

1. Business email compromise
2. Port scanning
3. Fragmentation attack
4. MAC flooding

Correct Answer: 1

Explanation

Business Email Compromise, or BEC, is a targeted social engineering attack in which criminals impersonate executives, vendors, business partners, or employees. The attacker may request a fraudulent payment, changes to banking information, confidential documents, or other sensitive actions. BEC messages often use convincing language and may rely on compromised email accounts or lookalike domains. Port scanning identifies network services, fragmentation attacks manipulate packet handling, and MAC flooding targets switch forwarding behavior. Verification procedures, payment approval controls, and employee awareness training can reduce BEC risks. Therefore, Business Email Compromise is the correct answer.

Question 48

Which security principle ensures that a user or system is permitted to perform only approved actions after identity verification?

1. Confidentiality
2. Authorization
3. Availability
4. Data retention

Correct Answer: 2

Explanation

Authorization determines what an authenticated user, device, or application is allowed to access or perform. Authentication verifies identity, while authorization evaluates permissions after the identity has been established. For example, a user may successfully sign in to a company system but be authorized to view financial records without being allowed to modify them. Confidentiality protects information from unauthorized disclosure, availability focuses on access to resources, and data retention defines how long information is stored. Therefore, authorization is the security process that controls approved actions and resource access.

Question 49

Which technology can separate users into logical broadcast domains on a managed switch?

1. VLAN
2. VPN
3. RAID
4. NAT

Correct Answer: 1

Explanation

A Virtual Local Area Network, or VLAN, logically separates devices into different broadcast domains on a managed switch. Devices in separate VLANs generally require routing to communicate with one another. VLANs can improve network organization, performance, and security by separating departments, guest users, voice traffic, and sensitive systems. A VPN provides secure connectivity across networks, RAID provides storage redundancy, and NAT translates IP addresses. VLANs alone do not provide complete security, so access-control policies and routing restrictions may also be required. Therefore, VLAN is the correct technology for creating logical broadcast domains.

Question 50

Which security technology can identify suspicious files and processes running on workstations and servers?

1. Network switch
2. Endpoint Detection and Response
3. DHCP relay
4. Load balancer

Correct Answer: 2

Explanation

Endpoint Detection and Response, or EDR, continuously monitors endpoint activity such as processes, files, network connections, and system changes. It can identify suspicious behavior, investigate potential threats, and support response actions such as isolating a compromised endpoint. EDR provides more visibility than traditional signature-based antivirus alone because it can analyze behavior and activity over time. A network switch connects devices, DHCP relay forwards address-assignment messages, and a load balancer distributes traffic. Therefore, Endpoint Detection and Response is the appropriate technology for identifying suspicious activity on workstations and servers.

Question 51

Which attack attempts to exploit a weakness in an operating system or application before a security patch is available?

1. Zero-day attack
2. Password spraying
3. Phishing
4. Brute-force attack

Correct Answer: 1

Explanation

A zero-day attack exploits a previously unknown vulnerability or a vulnerability for which no effective security patch was available when the attack occurred. Because defenders may not yet know about the weakness, detecting and preventing the attack can be difficult. Organizations can reduce exposure through application isolation, endpoint monitoring, least privilege, threat intelligence, network segmentation, and layered security controls. Password spraying targets many accounts with common passwords, phishing relies on deception, and brute-force attacks try many credential combinations. Therefore, a zero-day attack is associated with exploiting an unpatched or newly discovered vulnerability.

Question 52

Which protocol is commonly used to securely access and transfer files through an SSH-based connection?

1. FTP
2. TFTP
3. SFTP
4. HTTP

Correct Answer: 3

Explanation

Secure File Transfer Protocol, or SFTP, provides file-management and file-transfer capabilities through an SSH connection. It encrypts authentication information and transferred data, helping protect files from interception on untrusted networks. FTP does not inherently encrypt its traffic, TFTP is a lightweight file-transfer protocol without strong security features, and HTTP is primarily used for web communication. SFTP supports operations such as uploading, downloading, renaming, and deleting files, depending on user permissions. Therefore, SFTP is the correct protocol for secure file transfer through an SSH-based connection.

Question 53

Which type of attack attempts to make a wireless network unusable by sending repeated disassociation or deauthentication frames?

1. Evil twin attack
2. Wireless jamming
3. Deauthentication attack
4. Password spraying

Correct Answer: 3

Explanation

A deauthentication attack sends forged deauthentication frames to disconnect wireless clients from an access point. Repeated disconnections can prevent users from maintaining a stable wireless connection and may be used as part of other attacks. Wireless jamming disrupts communication by generating radio-frequency interference, an evil twin attack creates a fraudulent access point that imitates a legitimate network, and password spraying targets user credentials. Wireless security improvements may include protected management frames, strong authentication, monitoring, and appropriate access-point configuration. Therefore, a deauthentication attack is the technique specifically associated with forged disassociation or deauthentication frames.

Question 54

Which security practice helps ensure that vulnerabilities are corrected by installing vendor-provided updates?

1. Network segmentation
2. Patch management
3. Data classification
4. Password sharing

Correct Answer: 2

Explanation

Patch management is the process of identifying, testing, approving, deploying, and monitoring software and firmware updates. Vendors release patches to correct security vulnerabilities, fix software defects, and improve reliability. A structured patch-management program helps organizations reduce exposure to known vulnerabilities while minimizing the risk of unexpected compatibility problems. Network segmentation separates network environments, data classification categorizes information according to sensitivity, and password sharing weakens accountability and security. Patch management should include asset identification, prioritization of critical updates, testing, deployment, and verification. Therefore, patch management is the correct security practice.

Question 55

Which security mechanism verifies that a message was created by a trusted sender and has not been modified?

1. Digital signature
2. Network Address Translation
3. Compression
4. Load balancing

Correct Answer: 1

Explanation

A digital signature uses public-key cryptography to provide evidence of message authenticity and integrity. The sender signs data using a private key, and the recipient can use the corresponding public key to verify the signature. If the data changes after signing, the verification process should fail. Digital signatures can also support nonrepudiation, depending on the surrounding legal and technical framework. Network Address Translation changes addressing information, compression reduces data size, and load balancing distributes traffic. Therefore, a digital signature is the appropriate mechanism for verifying both the sender and the integrity of a message.

Question 56

Which security control provides a record of user activity that can be reviewed during an investigation?

1. Network segmentation
2. Audit logging
3. Data compression
4. Load balancing

Correct Answer: 2

Explanation

Audit logging records events such as successful and failed logins, administrative changes, file access, configuration modifications, and other user or system activities. Security teams can review these records to investigate incidents, identify suspicious behavior, establish timelines, and support compliance requirements. Logs should be protected against unauthorized modification and retained according to organizational policies. Network segmentation limits communication between systems, data compression reduces file size, and load balancing distributes workloads. Centralized logging and accurate time synchronization improve the usefulness of audit records. Therefore, audit logging is the correct security control for recording user activity.

Question 57

Which attack uses fraudulent websites or messages to trick users into entering credentials on a fake login page?

1. Phishing
2. MAC flooding
3. IP fragmentation
4. Port scanning

Correct Answer: 1

Explanation

Phishing attacks use deceptive messages, websites, or communications to persuade users to disclose sensitive information. A common phishing technique directs victims to a fraudulent login page that resembles a legitimate service. When users enter their credentials, the attacker captures the information. Security awareness training, email filtering, multifactor authentication, password managers, and careful inspection of links can reduce phishing risks. MAC flooding targets switch forwarding tables, IP fragmentation concerns packet processing, and port scanning identifies accessible services. Therefore, phishing is the correct attack type involving fake login pages and deceptive messages.

Question 58

Which network security feature helps protect against unauthorized DHCP servers providing incorrect IP configuration information?

1. Port security
2. DHCP snooping
3. NAT
4. DNSSEC

Correct Answer: 2

Explanation

DHCP snooping is a switch security feature that identifies trusted and untrusted switch ports for DHCP traffic. It can block DHCP server responses arriving from untrusted ports, helping prevent rogue DHCP servers from assigning incorrect gateways, DNS servers, or IP addresses to clients. DHCP snooping can also provide information used by other security features, such as Dynamic ARP Inspection. Port security limits MAC addresses on switch ports, NAT translates IP addresses, and DNSSEC helps validate DNS data. Therefore, DHCP snooping is the appropriate feature for protecting against rogue DHCP servers.

Question 59

Which security model assumes that no user or device should be trusted automatically, even when located inside the corporate network?

1. Perimeter-only security
2. Open access model
3. Zero Trust
4. Shared authentication

Correct Answer: 3

Explanation

The Zero Trust security model assumes that users, devices, applications, and network locations should not receive automatic trust. Access decisions are based on continuous verification, identity, device posture, context, least privilege, and policy enforcement. Zero Trust commonly includes strong authentication, segmentation, monitoring, and verification of every access request. A perimeter-only model places excessive reliance on the network boundary, open access allows broad permissions, and shared authentication reduces individual accountability. Therefore, Zero Trust is the security model that avoids automatic trust and continuously evaluates access requests.

Question 60

Which type of backup contains all selected data and does not depend on a previous backup to restore that backup set?

1. Incremental backup
2. Differential backup
3. Full backup
4. Transaction-log backup

Correct Answer: 3

Explanation

A full backup copies all selected data included in the backup operation. Because it contains the complete backup set, restoring it does not require an earlier full or incremental backup for the same set of data. Full backups can require more storage space and take longer to complete than other backup types, but they simplify restoration. An incremental backup stores changes since the most recent backup, while a differential backup stores changes since the last full backup. Transaction-log backups record database transaction information. Therefore, a full backup is the correct answer.