View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 61

Which protocol provides centralized authentication, authorization, and accounting for network access?

1. RADIUS
2. FTP
3. DNS
4. NTP

Correct Answer: 1

Explanation

RADIUS, or Remote Authentication Dial-In User Service, provides centralized AAA services for users accessing network resources. It can authenticate users, apply authorization policies, and maintain accounting information about sessions. RADIUS is commonly used with wireless networks, VPNs, and network access control solutions. Centralized authentication allows administrators to manage access policies from a central service rather than configuring every network device separately. FTP is a file-transfer protocol, DNS resolves domain names, and NTP synchronizes system clocks. Therefore, RADIUS is the appropriate protocol for centralized authentication, authorization, and accounting.

Question 62

Which protocol is specifically designed to provide secure centralized AAA services for network devices using TCP?

1. SNMPv3
2. TACACS+
3. DHCP
4. TFTP

Correct Answer: 2

Explanation

TACACS+ is a Cisco-supported AAA protocol commonly used to control administrative access to network devices. It uses TCP and separates authentication, authorization, and accounting functions, allowing detailed authorization policies to be applied. TACACS+ encrypts the entire body of the authentication and authorization packet, providing stronger protection for administrative communications than older insecure methods. SNMPv3 is used for secure network management, DHCP provides IP configuration, and TFTP provides simple file transfers. Therefore, TACACS+ is the correct choice for centralized AAA services for network-device administration.

Question 63

Which technology allows a network switch to require a device to authenticate before granting access to a network port?

1. 802.1X
2. NAT
3. GRE
4. Syslog

Correct Answer: 1

Explanation

IEEE 802.1X provides port-based network access control. It can require a user or endpoint to authenticate before the switch permits normal network access. The endpoint acts as the supplicant, the switch acts as the authenticator, and an authentication server such as Cisco ISE can validate credentials. 802.1X is widely used to strengthen wired and wireless network access and prevent unauthorized devices from simply connecting to an active network port. NAT translates addresses, GRE provides tunneling, and Syslog transports event messages. Therefore, 802.1X is the correct technology.

Question 64

Which Cisco ISE feature can evaluate endpoint compliance with security requirements before granting network access?

1. Port Address Translation
2. Network Time Protocol
3. Posture assessment
4. Static routing

Correct Answer: 3

Explanation

Cisco Identity Services Engine can use posture assessment to evaluate whether an endpoint meets defined security requirements. These requirements can include security software status, operating-system conditions, or other compliance criteria. Based on the result, access policies can permit, restrict, or redirect the endpoint for remediation. This approach helps organizations prevent noncompliant devices from receiving unrestricted network access. Port Address Translation modifies address information, NTP synchronizes clocks, and static routing defines fixed network paths. Therefore, posture assessment is the feature associated with evaluating endpoint compliance before granting appropriate access.

Question 65

Which switch security feature can limit the number of MAC addresses learned on a switch port?

1. DHCP snooping
2. Port security
3. DNSSEC
4. IPsec

Correct Answer: 2

Explanation

Port security allows administrators to control which and how many MAC addresses can be associated with a switch port. This can help reduce risks such as unauthorized device connections and certain MAC-address flooding attacks. Administrators can configure limits and define actions when a violation occurs, depending on the switch platform and configuration. DHCP snooping protects against rogue DHCP servers, DNSSEC validates DNS information, and IPsec provides security for IP communications. Port security should be configured carefully because legitimate changes in connected devices can also trigger violations. Therefore, port security is the correct answer.

Question 66

Which attack attempts to overwhelm a switch’s CAM table with many fake MAC addresses?

1. DNS poisoning
2. MAC flooding
3. Password spraying
4. SQL injection

Correct Answer: 2

Explanation

A MAC flooding attack attempts to fill a switch’s Content Addressable Memory, or CAM, table with numerous fabricated MAC addresses. When the table becomes overwhelmed, the switch may behave differently when forwarding unknown destination traffic, potentially causing traffic to be flooded within the VLAN. This can create opportunities for traffic interception on poorly protected networks. Port security and appropriate switch configurations can help mitigate this threat. DNS poisoning targets name-resolution information, password spraying targets authentication systems, and SQL injection targets vulnerable applications and databases. Therefore, MAC flooding is the correct attack type.

Question 67

Which feature helps prevent a switch port from accepting unauthorized DHCP server responses?

1. DHCP snooping
2. Port mirroring
3. NAT
4. EtherChannel

Correct Answer: 1

Explanation

DHCP snooping protects against rogue DHCP servers by identifying trusted and untrusted switch interfaces. DHCP server responses are normally expected from trusted interfaces, while responses received on untrusted interfaces can be blocked. This prevents an unauthorized device from acting as a DHCP server and distributing incorrect IP addresses, gateways, or DNS settings to clients. DHCP snooping can also create bindings that support other security features. Port mirroring copies traffic for monitoring, NAT translates addresses, and EtherChannel combines multiple physical links. Therefore, DHCP snooping provides the required protection against unauthorized DHCP responses.

Question 68

Which security feature can inspect ARP messages and use DHCP snooping bindings to prevent ARP spoofing?

1. Dynamic ARP Inspection
2. NAT
3. BPDU Guard
4. DNS caching

Correct Answer: 1

Explanation

Dynamic ARP Inspection, or DAI, helps protect Layer 2 networks from ARP spoofing and poisoning attacks. It can compare ARP messages against trusted information, such as DHCP snooping bindings, to determine whether the claimed IP-to-MAC mapping is legitimate. Invalid ARP packets can be dropped, reducing the ability of an attacker to impersonate another device on the local network. NAT performs address translation, BPDU Guard protects against unexpected spanning-tree BPDUs, and DNS caching stores name-resolution information. Therefore, Dynamic ARP Inspection is the appropriate security feature.

Question 69

Which switch security feature can prevent an endpoint from using an unauthorized source IP address?

1. DNSSEC
2. IP Source Guard
3. WPA3
4. TACACS+

Correct Answer: 2

Explanation

IP Source Guard is a Layer 2 security feature that helps prevent IP address spoofing by filtering traffic based on source IP information. It can use DHCP snooping bindings to determine which IP address is legitimately associated with a particular switch port. Traffic using an unauthorized source address can then be blocked. DNSSEC protects DNS integrity, WPA3 secures wireless access, and TACACS+ provides centralized AAA. IP Source Guard is particularly useful when combined with DHCP snooping and other switch security controls. Therefore, IP Source Guard is the correct answer.

Question 70

Which attack involves sending numerous DHCP requests using different spoofed MAC addresses to exhaust the available IP address pool?

1. DNS poisoning
2. DHCP starvation
3. ARP inspection
4. Session hijacking

Correct Answer: 2

Explanation

DHCP starvation is an attack in which an attacker generates a large number of DHCP requests, often using spoofed or changing MAC addresses. The DHCP server may allocate its available addresses to these requests, eventually exhausting the address pool and preventing legitimate clients from obtaining IP configuration. DHCP snooping, rate limiting, and appropriate network access controls can help mitigate this type of attack. DNS poisoning manipulates DNS information, ARP inspection protects ARP operations, and session hijacking targets existing communication sessions. Therefore, DHCP starvation is the correct attack.

Question 71

Which wireless security standard provides stronger protection than WPA2 by introducing improved cryptographic mechanisms and security features?

1. WEP
2. WPA
3. WPA3
4. Open authentication

Correct Answer: 3

Explanation

WPA3 is a modern wireless security standard designed to improve protection compared with earlier standards such as WEP and WPA. WPA3-Personal uses Simultaneous Authentication of Equals, which provides stronger protection against password-guessing attacks than the older WPA2-PSK approach. WPA3 also includes security improvements for enterprise environments and other wireless scenarios. WEP is an outdated and insecure wireless security mechanism, while open authentication does not provide meaningful wireless encryption by itself. Therefore, WPA3 is the correct choice for stronger modern wireless security.

Question 72

What is the primary purpose of a rogue access point on a corporate network?

1. To provide authorized network management
2. To improve routing performance
3. To provide an unauthorized wireless entry point
4. To synchronize wireless clocks

Correct Answer: 3

Explanation

A rogue access point is an unauthorized wireless access point connected to an organization’s network. It can create an unintended pathway into the corporate environment and may bypass established security controls. Attackers may also deploy rogue devices to intercept traffic or conduct further attacks. Organizations can reduce the risk through wireless monitoring, network access control, switch security, and policies that prevent unauthorized equipment from being connected. Authorized access points should be centrally managed and monitored. Therefore, the primary purpose or risk of a rogue access point is providing an unauthorized wireless entry point into the network.

Question 73

Which wireless attack uses a fraudulent access point that imitates the SSID of a legitimate network to trick users into connecting?

1. Evil twin attack
2. MAC flooding
3. DHCP starvation
4. Smurf attack

Correct Answer: 1

Explanation

An evil twin attack uses a fraudulent wireless access point that imitates a legitimate network, often by using the same or a very similar SSID. Users may unknowingly connect to the attacker’s access point, allowing the attacker to attempt traffic interception, credential theft, or other malicious activities. Wireless monitoring and strong authentication can help reduce the risk. MAC flooding targets switch CAM tables, DHCP starvation exhausts address pools, and Smurf attacks involve traffic amplification using ICMP. Therefore, an evil twin attack is the technique involving a deceptive wireless access point.

Question 74

Which VPN technology commonly provides encryption and authentication for IP traffic at the network layer?

1. FTP
2. IPsec
3. SMTP
4. Telnet

Correct Answer: 2

Explanation

IPsec is a collection of protocols and mechanisms designed to protect IP communications. It can provide confidentiality, integrity, authentication, and anti-replay protection depending on the selected configuration. IPsec is widely used for site-to-site VPNs and can also support remote-access VPN solutions. It operates at the network layer and can protect IP traffic between communicating endpoints or gateways. FTP transfers files, SMTP transports email, and Telnet provides insecure remote terminal access. Therefore, IPsec is the correct VPN technology for protecting IP traffic at the network layer.

Question 75

Which VPN type is typically used to securely connect two separate corporate networks over the Internet?

1. Site-to-site VPN
2. Personal hotspot
3. Local loopback
4. Port mirroring

Correct Answer: 1

Explanation

A site-to-site VPN creates an encrypted connection between two networks, commonly through VPN gateways or firewalls. It allows users and systems in one organization or branch network to communicate securely with resources in another network across an untrusted medium such as the Internet. IPsec is frequently used for this purpose. A remote-access VPN, in contrast, is generally designed for an individual user or endpoint connecting to an organization’s network. Personal hotspots provide Internet connectivity, loopback addresses are local host addresses, and port mirroring copies traffic for analysis. Therefore, a site-to-site VPN is correct.

Question 76

Which cryptographic approach uses the same secret key for both encryption and decryption?

1. Asymmetric cryptography
2. Digital signatures
3. Symmetric cryptography
4. Hashing

Correct Answer: 3

Explanation

Symmetric cryptography uses the same secret key, or a closely related shared secret, for encryption and decryption. Because symmetric algorithms are generally efficient, they are commonly used to protect large amounts of data. The major challenge is securely distributing and managing the shared key between communicating parties. Asymmetric cryptography uses a public/private key pair, digital signatures use asymmetric mechanisms to provide authentication and integrity, and hashing is a one-way operation rather than encryption. Therefore, symmetric cryptography is the approach that uses the same secret key for encryption and decryption.

Question 77

Which cryptographic method uses a public key and a corresponding private key?

1. Symmetric encryption
2. Hashing
3. Asymmetric cryptography
4. Data compression

Correct Answer: 3

Explanation

Asymmetric cryptography uses a mathematically related public key and private key. The public key can be distributed openly, while the private key must remain protected. This approach supports applications such as digital signatures, secure key exchange, and certificate-based authentication. Public-key cryptography generally requires more computational resources than symmetric encryption, so modern secure protocols often use asymmetric techniques to establish trust or exchange keys and then use symmetric encryption for bulk data. Hashing creates one-way digests, while data compression reduces data size. Therefore, asymmetric cryptography is the correct answer.

Question 78

Which component of a PKI is responsible for issuing and signing digital certificates?

1. Certificate Authority
2. DHCP server
3. Syslog collector
4. Proxy server

Correct Answer: 1

Explanation

A Certificate Authority, or CA, is a trusted component of a Public Key Infrastructure that issues and digitally signs certificates. The CA verifies information according to its certificate policies and binds an identity to a public key through the certificate. Systems use trusted CA certificates to validate certificates presented by servers, users, or devices. DHCP servers provide network configuration, Syslog collectors receive event messages, and proxy servers relay application traffic. A properly managed PKI also includes certificate lifecycle processes such as issuance, renewal, revocation, and expiration. Therefore, the Certificate Authority is the correct answer.

Question 79

Which DNS security mechanism allows recipients to verify that DNS responses have not been modified and originated from an authenticated DNS zone?

1. DNSSEC
2. FTP
3. SNMPv2c
4. Telnet

Correct Answer: 1

Explanation

DNSSEC, or Domain Name System Security Extensions, adds cryptographic authentication to DNS data. It allows validating resolvers to verify that DNS records have not been modified and that the responses are associated with the correct DNS zone. This helps protect against attacks such as DNS cache poisoning and certain forms of DNS spoofing. DNSSEC does not encrypt normal DNS queries or hide the queried domain. FTP provides file transfer, SNMPv2c supports network management with community strings, and Telnet provides insecure remote access. Therefore, DNSSEC is the correct technology for DNS data validation.

Question 80

Which email security technology allows a receiving mail server to verify that an email server is authorized to send messages for a domain?

1. DKIM
2. SPF
3. DMARC
4. SFTP

Correct Answer: 2

Explanation

Sender Policy Framework, or SPF, allows a domain owner to publish information identifying which mail servers are authorized to send email on behalf of that domain. Receiving mail systems can check the sending server against the domain’s SPF record and use the result as part of their anti-spoofing decisions. DKIM uses cryptographic signatures to verify message integrity and domain association, while DMARC builds on authentication mechanisms such as SPF and DKIM and provides policy and reporting capabilities. SFTP is unrelated to email security. Therefore, SPF is the correct answer.