View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 81

Which email security technology uses cryptographic signatures to help verify that an email message has not been modified after being sent?

1. SPF
2. DHCP
3. DKIM
4. FTP

Correct Answer: 3

Explanation

DomainKeys Identified Mail, or DKIM, uses cryptographic signatures to associate an email message with a sending domain and help verify message integrity. The sending mail server signs selected parts of the message using a private key. The receiving server can retrieve the corresponding public key from DNS and validate the signature. If signed content has been altered, verification may fail. SPF focuses on whether a sending server is authorized for a domain, while DMARC provides policy and reporting using authentication mechanisms such as SPF and DKIM. DHCP and FTP do not provide email authentication. Therefore, DKIM is correct.

Question 82

Which email security standard allows domain owners to specify how receiving systems should handle messages that fail authentication checks?

1. DMARC
2. SFTP
3. SNMP
4. NTP

Correct Answer: 1

Explanation

Domain-based Message Authentication, Reporting, and Conformance, or DMARC, allows domain owners to publish policies describing how receiving mail systems should handle messages that fail authentication requirements. DMARC can use SPF and DKIM results along with domain alignment checks. Organizations can configure policies that request monitoring, quarantine, or rejection of messages that fail the required checks. DMARC also supports reporting, helping domain administrators identify potential spoofing and authentication problems. SFTP, SNMP, and NTP perform unrelated functions. Therefore, DMARC is the correct technology for defining email authentication handling policies.

Question 83

Which malware type is designed to secretly provide unauthorized privileged access to a compromised system?

1. Worm
2. Rootkit
3. Adware
4. Spam

Correct Answer: 2

Explanation

A rootkit is a type of malicious software designed to maintain unauthorized access while hiding its presence from users and security tools. Rootkits may operate at different levels of a system and can attempt to conceal malicious processes, files, network connections, or other activity. Because they are designed for stealth and persistence, detecting them can be challenging. Worms primarily spread automatically between systems, adware displays unwanted advertising, and spam refers to unsolicited messages rather than a specific malware type. Endpoint monitoring, secure configurations, patching, and integrity checking can help reduce rootkit-related risks. Therefore, rootkit is correct.

Question 84

Which malware characteristic allows a malicious program to spread automatically from one vulnerable system to another?

1. Encryption
2. Persistence
3. Self-propagation
4. Authentication

Correct Answer: 3

Explanation

Self-propagation is a characteristic commonly associated with computer worms. A worm can exploit vulnerabilities, weak credentials, or other mechanisms to spread from one system to another without requiring the user to manually execute the malware on every target. This ability can allow infections to spread rapidly across networks. Encryption protects information from unauthorized access, persistence describes the ability of malware to remain active after reboot or other events, and authentication verifies identity. Network segmentation, patch management, endpoint security, and vulnerability remediation can reduce the opportunities available for automated propagation. Therefore, self-propagation is correct.

Question 85

Which attack attempts to redirect users from a legitimate website to a malicious destination by manipulating DNS information?

1. DNS spoofing
2. Password spraying
3. MAC flooding
4. Shoulder surfing

Correct Answer: 1

Explanation

DNS spoofing involves providing fraudulent DNS information so that users or applications resolve a legitimate domain name to an incorrect IP address. This can redirect victims toward malicious websites or services controlled by an attacker. DNS cache poisoning is one method through which false DNS information can be introduced into a resolver’s cache. Security mechanisms such as DNSSEC validation can help protect DNS integrity. Password spraying targets authentication systems, MAC flooding targets switch CAM tables, and shoulder surfing involves observing sensitive information directly. Therefore, DNS spoofing is the correct attack.

Question 86

Which type of attack attempts to steal an authenticated user’s active session and use it to access a service?

1. VLAN hopping
2. Session hijacking
3. DHCP starvation
4. DNS tunneling

Correct Answer: 2

Explanation

Session hijacking occurs when an attacker obtains or takes control of an authenticated user’s active session. If the attacker can acquire a valid session token or otherwise impersonate the established session, the service may treat the attacker as the legitimate user. Secure transport such as HTTPS, protected session cookies, appropriate session expiration, multifactor authentication, and secure application design can reduce this risk. VLAN hopping targets network segmentation, DHCP starvation exhausts address pools, and DNS tunneling can use DNS communications to transfer information or establish covert communication. Therefore, session hijacking is correct.

Question 87

Which attack technique involves compromising a legitimate website that members of a particular organization are likely to visit?

1. Watering-hole attack
2. Brute-force attack
3. Smurf attack
4. Credential stuffing

Correct Answer: 1

Explanation

A watering-hole attack compromises or manipulates a website that a targeted group is known to visit. Instead of directly attacking every intended victim, the attacker places malicious content or exploits on a trusted website and waits for members of the target group to access it. This technique can be effective when attackers have information about their target’s browsing habits. Brute-force attacks attempt many credential combinations, credential stuffing uses previously stolen credentials, and Smurf attacks are denial-of-service attacks involving ICMP traffic amplification. Therefore, a watering-hole attack is the correct answer.

Question 88

Which attack attempts to exploit a web application by inserting malicious database commands into user-supplied input?

1. ARP spoofing
2. SQL injection
3. MAC flooding
4. DHCP starvation

Correct Answer: 2

Explanation

SQL injection occurs when an application improperly handles user-supplied input and allows an attacker to manipulate database queries. Successful SQL injection can potentially expose, modify, or delete database information, depending on application privileges and database configuration. Secure coding practices such as parameterized queries, prepared statements, input validation, and appropriate database permissions help reduce this risk. ARP spoofing targets local network address resolution, MAC flooding targets switch forwarding tables, and DHCP starvation attempts to exhaust IP address assignments. Therefore, SQL injection is the attack involving malicious database commands inserted through application input.

Question 89

Which attack uses many compromised devices to generate traffic against a target simultaneously?

1. DDoS attack
2. DNSSEC
3. Port security
4. Certificate validation

Correct Answer: 1

Explanation

A Distributed Denial-of-Service, or DDoS, attack uses multiple systems, often a botnet or other collection of compromised devices, to send large volumes of traffic or requests toward a target. The objective is generally to consume network bandwidth, server resources, application capacity, or other resources and reduce service availability. DDoS attacks can be difficult to mitigate because traffic originates from many sources. DNSSEC protects DNS integrity, port security controls switch access, and certificate validation helps establish trust in digital certificates. Therefore, a DDoS attack is the correct answer.

Question 90

Which security activity systematically identifies known vulnerabilities in systems and applications?

1. Vulnerability scanning
2. Data encryption
3. Packet forwarding
4. File compression

Correct Answer: 1

Explanation

Vulnerability scanning uses automated tools to examine systems, applications, network services, and configurations for known security weaknesses. Scanners may compare detected software versions or configurations against vulnerability databases and security checks. Organizations can then prioritize identified issues according to factors such as severity, exposure, and business impact. Vulnerability scanning differs from penetration testing because scanning generally focuses on identifying potential weaknesses, while penetration testing involves controlled attempts to exploit vulnerabilities. Encryption protects confidentiality, packet forwarding moves network traffic, and compression reduces data size. Therefore, vulnerability scanning is the correct activity.

Question 91

Which vulnerability scoring system commonly uses a numerical scale to communicate the severity of software vulnerabilities?

1. CVSS
2. DNS
3. DHCP
4. SMTP

Correct Answer: 1

Explanation

The Common Vulnerability Scoring System, or CVSS, provides a standardized framework for describing and scoring the severity of security vulnerabilities. CVSS metrics consider characteristics such as attack complexity, privileges required, user interaction, and the potential impact on confidentiality, integrity, and availability. Organizations can use these scores as one factor when prioritizing vulnerability remediation. CVSS does not itself fix vulnerabilities or determine the complete business risk of an issue. DNS resolves names, DHCP provides network configuration, and SMTP transports email. Therefore, CVSS is the correct vulnerability severity scoring system.

Question 92

Which activity differs from vulnerability scanning because it attempts to actively exploit identified weaknesses in a controlled manner?

1. Asset inventory
2. Penetration testing
3. Log collection
4. Data classification

Correct Answer: 2

Explanation

Penetration testing is an authorized security assessment in which testers attempt to exploit vulnerabilities under controlled conditions. The purpose is to determine whether identified weaknesses can actually be exploited and to understand their potential impact. Penetration testing normally follows defined rules of engagement to prevent unnecessary disruption to production systems. Vulnerability scanning generally identifies potential weaknesses without necessarily exploiting them. Asset inventory identifies systems and devices, log collection gathers security events, and data classification categorizes information. Therefore, penetration testing is the activity that actively tests weaknesses in a controlled manner.

Question 93

Which security monitoring technology commonly collects and correlates logs from multiple systems to identify suspicious activity?

1. SIEM
2. NAT
3. RAID
4. VLAN

Correct Answer: 1

Explanation

A Security Information and Event Management, or SIEM, platform collects security-related logs and events from multiple sources and can correlate them to identify suspicious patterns. Sources may include firewalls, servers, endpoints, authentication systems, applications, and network devices. Centralized analysis can help security teams investigate incidents and identify relationships that might be difficult to recognize when reviewing individual logs separately. NAT translates addresses, RAID provides storage redundancy, and VLANs logically separate network segments. Therefore, SIEM is the technology commonly used to centralize and correlate security events.

Question 94

Which network-flow technology provides information about communication patterns without necessarily capturing the complete contents of every packet?

1. NetFlow
2. FTP
3. Telnet
4. DHCP

Correct Answer: 1

Explanation

NetFlow provides metadata about network traffic flows rather than requiring complete packet-content capture. Information can include source and destination addresses, ports, protocols, packet counts, byte counts, and timing information. Security teams can use flow information to identify unusual communication patterns, large transfers, scanning behavior, and other anomalies. Full packet capture provides significantly more content but generally requires greater storage and processing resources. FTP transfers files, Telnet provides insecure remote access, and DHCP provides IP configuration. Therefore, NetFlow is the appropriate technology for monitoring network communication patterns through flow metadata.

Question 95

Which incident response phase focuses on stopping the spread of an active security incident?

1. Recovery
2. Identification
3. Containment
4. Lessons learned

Correct Answer: 3

Explanation

Containment is the incident response phase focused on limiting the scope and impact of an active security incident. Security teams may isolate compromised endpoints, block malicious traffic, disable affected accounts, or segment portions of the network. The exact action depends on the incident and organizational procedures. Identification focuses on determining whether an incident has occurred and understanding its characteristics. Recovery focuses on restoring affected systems to normal operation, while lessons learned evaluates the incident afterward to improve future response. Therefore, containment is the phase primarily concerned with stopping or limiting the spread of an incident.

Question 96

Which incident response phase involves restoring affected systems and services to normal operation after a security incident?

1. Recovery
2. Containment
3. Detection
4. Preparation

Correct Answer: 1

Explanation

Recovery focuses on restoring systems, applications, and services after an incident has been contained and addressed. Activities can include rebuilding compromised systems, restoring verified backups, removing malicious components, validating system security, and returning services to normal operation. Recovery should be performed carefully to avoid reintroducing compromised files or configurations. Preparation occurs before incidents and involves establishing policies, tools, and procedures. Detection identifies suspicious activity, while containment limits the incident’s spread. Therefore, recovery is the incident response phase associated with restoring affected systems and services.

Question 97

Which security principle requires granting users only the permissions necessary to perform their assigned tasks?

1. Defense in depth
2. Least privilege
3. High availability
4. Data replication

Correct Answer: 2

Explanation

The principle of least privilege means users, applications, and systems should receive only the permissions required to perform legitimate tasks. Limiting privileges reduces the potential damage if an account or application is compromised. For example, a standard employee account generally should not have unnecessary administrative privileges. Least privilege can be implemented through role-based access control, separate administrator accounts, permission reviews, and carefully designed authorization policies. Defense in depth uses multiple security layers, high availability focuses on service uptime, and data replication maintains copies of information. Therefore, least privilege is the correct principle.

Question 98

Which security architecture places publicly accessible services in a separate network segment from an organization’s internal network?

1. DMZ
2. Loopback
3. RAID
4. NAT pool

Correct Answer: 1

Explanation

A demilitarized zone, or DMZ, is a network segment designed to host services that need to be reachable from less-trusted networks, such as the Internet. Common examples include public web servers, mail gateways, and DNS servers. Placing these systems in a separate segment can limit the direct exposure of internal resources if a public-facing server is compromised. Firewalls and access-control policies are typically used to control traffic between the Internet, DMZ, and internal network. Loopback addresses are local host addresses, RAID concerns storage, and NAT pools are used for address translation. Therefore, DMZ is correct.

Question 99

Which security approach uses multiple independent protective mechanisms so that failure of one control does not necessarily expose the entire environment?

1. Single sign-on
2. Open authentication
3. Defense in depth
4. Flat networking

Correct Answer: 3

Explanation

Defense in depth uses multiple layers of security controls rather than depending on a single mechanism. An organization may combine firewalls, endpoint protection, multifactor authentication, network segmentation, access controls, monitoring, encryption, and security awareness training. If one control fails or is bypassed, additional controls may still prevent or detect the attack. This layered approach can reduce the likelihood that one security failure will result in complete compromise. Single sign-on simplifies authentication, open authentication provides little protection, and flat networking reduces segmentation. Therefore, defense in depth is the correct security approach.

Question 100

Which protocol should be avoided for secure remote device administration because it transmits credentials and session data without encryption?

1. SSH
2. HTTPS
3. Telnet
4. SFTP

Correct Answer: 3

Explanation

Telnet provides remote terminal access but does not encrypt the communication between the client and server. As a result, usernames, passwords, commands, and other session information can potentially be intercepted by an attacker with access to the communication path. SSH is the preferred secure alternative because it encrypts remote administration sessions. HTTPS protects web communications, while SFTP provides secure file transfer through SSH. Organizations should disable Telnet where possible and use secure protocols for administrative access. Therefore, Telnet is the protocol that should be avoided for secure remote device administration.