View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 101

Which protocol provides secure remote command-line access to a network device?

1. Telnet
2. SSH
3. FTP
4. TFTP

Correct Answer: 2

Explanation

Secure Shell, or SSH, provides encrypted remote access to network devices and servers. It protects authentication credentials and interactive session data while they are transmitted across the network. SSH commonly uses TCP port 22 and supports secure command-line administration. Unlike Telnet, SSH encrypts the communication channel, reducing the risk of credentials and commands being captured by attackers. FTP and TFTP are file-transfer protocols rather than remote administration protocols. SSH is therefore the preferred protocol for securely managing network infrastructure remotely. Administrators should also use strong authentication, appropriate access controls, and current cryptographic configurations.

Question 102

Which protocol version provides encrypted and authenticated network management communication?

1. SNMPv1
2. SNMPv2c
3. SNMPv3
4. TFTP

Correct Answer: 3

Explanation

SNMPv3 provides security features for network management communications, including authentication, integrity protection, and optional confidentiality through encryption. Earlier versions such as SNMPv1 and SNMPv2c commonly rely on community strings and do not provide the same level of security. SNMPv3 can therefore help protect management information and reduce the risk of attackers intercepting or manipulating network-management traffic. TFTP is a simple file-transfer protocol and does not provide secure network management. Organizations should configure SNMPv3 with strong credentials and appropriate security settings. Therefore, SNMPv3 is the correct answer.

Question 103

Which protocol is considered insecure for transferring files because it normally sends data and credentials without encryption?

1. SFTP
2. SCP
3. FTP
4. HTTPS

Correct Answer: 3

Explanation

File Transfer Protocol, or FTP, traditionally transmits authentication credentials and file-transfer information without encryption. An attacker who can monitor the communication path may therefore capture usernames, passwords, or transferred data. Secure alternatives include SFTP, which operates through SSH, and SCP, which also uses SSH-based protection. HTTPS is designed for secure web communication rather than traditional FTP-style file transfers. Organizations should avoid using unencrypted FTP for sensitive information and should select secure protocols based on operational requirements. Therefore, FTP is the insecure file-transfer protocol described in the question.

Question 104

Which access-control model assigns permissions based on a user’s organizational role?

1. Role-Based Access Control
2. Discretionary Routing Control
3. Network Address Translation
4. Open Access Control

Correct Answer: 1

Explanation

Role-Based Access Control, or RBAC, assigns permissions according to predefined organizational roles. For example, users assigned to an accounting role may receive access to financial applications, while network administrators may receive permissions for network-management systems. RBAC simplifies permission management because administrators can manage roles instead of individually assigning every permission to every user. It can also support least privilege when roles are carefully designed. Network Address Translation is unrelated to authorization, and the other listed options do not describe a standard access-control model. Therefore, RBAC is the correct answer.

Question 105

Which authentication factor is represented by a fingerprint or facial scan?

1. Something you know
2. Something you have
3. Something you are
4. Somewhere you are

Correct Answer: 3

Explanation

Biometric characteristics such as fingerprints, facial recognition, and iris patterns are examples of the “something you are” authentication factor. Authentication factors are commonly grouped into categories including something you know, such as a password; something you have, such as a security token; and something you are, such as a biometric characteristic. Using multiple categories can strengthen authentication because compromising one factor does not necessarily provide everything required for access. Biometrics should still be implemented carefully because biometric characteristics cannot be changed as easily as passwords. Therefore, a fingerprint or facial scan represents something you are.

Question 106

Which authentication factor is represented by a hardware security token?

1. Something you know
2. Something you have
3. Something you are
4. Something you do

Correct Answer: 2

Explanation

A hardware security token is an example of the “something you have” authentication factor. This category represents a physical object that the authorized user possesses, such as a hardware token, smart card, or security key. It can be combined with a password or biometric factor to provide multifactor authentication. “Something you know” refers to information such as a password or PIN, while “something you are” refers to biometrics. Using multiple independent factors makes unauthorized access more difficult when one credential is compromised. Therefore, a hardware security token represents something you have.

Question 107

Which technology can enforce network access policies based on the identity and security posture of connecting endpoints?

1. NAC
2. RAID
3. NAT
4. CDN

Correct Answer: 1

Explanation

Network Access Control, or NAC, evaluates users and devices before or during network access and can enforce policies based on identity, device characteristics, authentication status, or security posture. Cisco Identity Services Engine is an example of a platform that can support NAC-related functions. NAC can place devices into appropriate network segments, restrict noncompliant endpoints, or provide limited access for remediation. RAID provides storage redundancy, NAT translates network addresses, and CDN technology distributes content. Therefore, NAC is the technology designed to enforce network access policies based on endpoint and user information.

Question 108

Which control prevents unauthorized devices from connecting to a switch port by restricting allowed MAC addresses?

1. DNSSEC
2. Port security
3. SPF
4. IPsec

Correct Answer: 2

Explanation

Switch port security can restrict the MAC addresses permitted on a particular switch interface. Administrators can configure a maximum number of addresses and, depending on the platform, specify how violations should be handled. This can help prevent unauthorized devices from connecting to sensitive network ports and can reduce certain Layer 2 attack risks. DNSSEC protects DNS information, SPF supports email sender validation, and IPsec protects IP communications. Port security is not a replacement for comprehensive network access control, but it provides an important Layer 2 protection mechanism. Therefore, port security is correct.

Question 109

Which spanning-tree security feature shuts down or places a port into an error-disabled state when unexpected BPDUs are received?

1. Root Guard
2. BPDU Guard
3. Loop Guard
4. PortFast

Correct Answer: 2

Explanation

BPDU Guard protects ports that are expected to connect to end devices rather than other switches. If a BPDU is received on a port configured with BPDU Guard, the switch can place the interface into an error-disabled state, depending on the configuration. This helps prevent an unauthorized switch from influencing the spanning-tree topology. Root Guard is used to prevent an interface from becoming an alternative path to an unauthorized root bridge, while Loop Guard helps protect against certain unidirectional link failures. Therefore, BPDU Guard is the correct feature.

Question 110

Which spanning-tree security feature prevents a downstream switch from becoming the root bridge through superior BPDUs?

1. Root Guard
2. DHCP snooping
3. IP Source Guard
4. Port security

Correct Answer: 1

Explanation

Root Guard is a spanning-tree protection mechanism that prevents a designated interface from accepting superior Bridge Protocol Data Units that could cause an unauthorized switch to become the root bridge. When an unexpected superior BPDU is received, the protected interface can enter a root-inconsistent state rather than allowing the topology to change as intended by the attacker or misconfigured device. DHCP snooping protects DHCP operations, IP Source Guard helps prevent IP spoofing, and port security controls MAC addresses. Therefore, Root Guard is the correct spanning-tree security feature.

Question 111

Which attack attempts to place an attacker into a different VLAN by exploiting switch trunking behavior?

1. VLAN hopping
2. Session hijacking
3. Credential stuffing
4. DNS poisoning

Correct Answer: 1

Explanation

VLAN hopping is an attack technique intended to allow traffic from one VLAN to reach another VLAN without the normal routing or security controls. It can involve exploiting trunking configurations or VLAN tagging behavior. Proper switch configuration, disabling unnecessary trunking, explicitly configuring trunk ports, and avoiding inappropriate native VLAN configurations can reduce the risk. Session hijacking targets authenticated sessions, credential stuffing uses previously stolen credentials, and DNS poisoning manipulates DNS information. Therefore, VLAN hopping is the attack associated with unauthorized movement between VLANs through switch behavior.

Question 112

Which IPv6 security feature can help prevent rogue Router Advertisement messages from unauthorized devices?

1. RA Guard
2. NAT overload
3. SPF
4. Port mirroring

Correct Answer: 1

Explanation

RA Guard is a security feature designed to protect IPv6 networks from unauthorized Router Advertisement messages. An attacker could otherwise send fraudulent advertisements that cause clients to learn incorrect IPv6 network configuration, potentially redirecting traffic or disrupting connectivity. RA Guard can be configured on appropriate switch interfaces to distinguish trusted router-facing ports from untrusted access ports and block unauthorized advertisements. NAT overload translates many private addresses through a shared public address, SPF relates to email security, and port mirroring copies traffic for monitoring. Therefore, RA Guard is the correct answer.

Question 113

Which IPv6 attack can involve an attacker sending fraudulent Neighbor Discovery messages to manipulate local address mappings?

1. IPv6 neighbor spoofing
2. Password spraying
3. SQL injection
4. DHCP starvation

Correct Answer: 1

Explanation

IPv6 uses Neighbor Discovery Protocol, or NDP, for functions that include discovering neighboring devices and resolving link-layer addresses. An attacker can attempt to send fraudulent Neighbor Discovery messages to manipulate the information maintained by other hosts. Such attacks can redirect traffic, disrupt communication, or facilitate interception. IPv6 security mechanisms and appropriate switch protections can reduce exposure. Password spraying targets authentication systems, SQL injection targets vulnerable database applications, and DHCP starvation attempts to exhaust address pools. Therefore, IPv6 neighbor spoofing is the attack described in the question.

Question 114

Which technology provides encrypted communication for websites and commonly uses digital certificates?

1. HTTP
2. HTTPS
3. TFTP
4. Telnet

Correct Answer: 2

Explanation

HTTPS is HTTP carried over a secure TLS connection. It provides encryption for web communications and uses digital certificates to support server authentication and establish cryptographic trust. When a user connects to an HTTPS website, the browser validates the server certificate according to its trust configuration and establishes a protected communication channel. HTTP without TLS does not provide the same confidentiality and integrity protections. TFTP is a simple file-transfer protocol, while Telnet provides insecure remote terminal access. Therefore, HTTPS is the correct protocol for encrypted website communication using digital certificates.

Question 115

Which TLS security property helps ensure that data cannot be modified undetected while traveling between two endpoints?

1. Integrity
2. Availability
3. Compression
4. Address translation

Correct Answer: 1

Explanation

Integrity ensures that data has not been altered in an unauthorized or undetected manner during transmission or storage. TLS uses cryptographic mechanisms to protect the integrity of communications between endpoints. If an attacker attempts to modify protected data, the receiving system should be able to detect that the message no longer satisfies the required integrity checks. Confidentiality protects information from unauthorized disclosure, while availability focuses on ensuring services remain accessible. Compression and address translation are not security properties of TLS. Therefore, integrity is the property that helps detect unauthorized modification of protected data.

Question 116

Which type of attack attempts to reuse a previously captured valid authentication message or token?

1. Replay attack
2. Watering-hole attack
3. SQL injection
4. MAC flooding

Correct Answer: 1

Explanation

A replay attack occurs when an attacker captures valid authentication information or communication data and later retransmits it in an attempt to gain unauthorized access or repeat an action. Security protocols can use timestamps, nonces, sequence numbers, and other mechanisms to make previously captured messages unusable or detectable when replayed. A watering-hole attack compromises websites visited by a target group, SQL injection targets database-driven applications, and MAC flooding targets switch CAM tables. Therefore, a replay attack is the technique involving reuse of previously captured valid communication.

Question 117

Which security control is designed to detect malicious activity on a network but generally does not automatically block the traffic?

1. IDS
2. IPS
3. Firewall
4. NAC

Correct Answer: 1

Explanation

An Intrusion Detection System, or IDS, monitors network or system activity and generates alerts when suspicious behavior or known attack patterns are detected. Unlike an Intrusion Prevention System, an IDS generally operates in a detection and alerting role rather than automatically blocking the traffic. Security teams can investigate IDS alerts and take appropriate response actions. Firewalls enforce traffic-control policies, IPS solutions can actively block detected threats, and NAC controls network access based on defined policies. Therefore, IDS is the correct technology for detecting malicious activity without necessarily blocking it automatically.

Question 118

Which security control can automatically block traffic identified as malicious based on configured rules or detected attack signatures?

1. IDS
2. IPS
3. Syslog
4. NetFlow

Correct Answer: 2

Explanation

An Intrusion Prevention System, or IPS, monitors traffic for malicious patterns and can automatically take preventive action. Depending on the configuration, an IPS may drop malicious packets, terminate connections, or block an offending source. This differs from an IDS, which generally detects and reports suspicious activity without directly preventing the traffic. Syslog provides event-message transport and NetFlow provides traffic-flow metadata. IPS technologies can use signatures, behavioral analysis, and other detection methods to identify threats. Therefore, IPS is the correct security control for automatically blocking identified malicious traffic.

Question 119

Which security concept describes ensuring that systems and services remain accessible to authorized users when needed?

1. Confidentiality
2. Integrity
3. Availability
4. Nonrepudiation

Correct Answer: 3

Explanation

Availability is the security principle concerned with ensuring that authorized users can access systems, applications, and information when required. Threats to availability include denial-of-service attacks, hardware failures, power outages, software failures, and certain types of malware. Organizations can improve availability through redundancy, backups, disaster recovery planning, load balancing, monitoring, and resilient infrastructure. Confidentiality protects information from unauthorized disclosure, integrity protects against unauthorized modification, and nonrepudiation provides evidence related to an action or transaction. Therefore, availability is the correct security concept.

Question 120

Which control is primarily intended to restore lost data after accidental deletion, hardware failure, or a security incident?

1. Backup
2. Firewall
3. VLAN
4. IDS

Correct Answer: 1

Explanation

Backups create recoverable copies of data that can be used after accidental deletion, hardware failure, corruption, ransomware, or other incidents. Effective backup strategies consider backup frequency, retention, storage locations, access controls, and regular restoration testing. Organizations may use full, incremental, or differential backups depending on their recovery requirements. A firewall controls network traffic, a VLAN provides logical network segmentation, and an IDS detects suspicious activity. Backups are especially important for recovery from ransomware and destructive incidents because they can provide a clean copy of important information. Therefore, backup is the correct control.