View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 141

Which security mechanism can prevent users from accessing websites based on predefined URL categories or security policies?

1. Web security filtering
2. NTP
3. DHCP
4. RAID

Correct Answer: 1

Explanation

Web security filtering controls access to websites and web resources according to organizational security policies. It can classify websites into categories such as malware, phishing, gambling, social networking, or business-related content and apply appropriate access rules. Web filtering can also inspect URLs, domains, and potentially other web-related indicators to block known malicious destinations. NTP synchronizes system clocks, DHCP provides IP configuration, and RAID provides storage redundancy. Web security filtering is commonly used as one layer of defense against malicious websites and inappropriate content. Therefore, web security filtering is correct.

Question 142

Which security technology can inspect encrypted web traffic by decrypting and re-encrypting it for security inspection?

1. DHCP snooping
2. TLS inspection
3. Port security
4. NetFlow

Correct Answer: 2

Explanation

TLS inspection allows a security device to decrypt protected traffic, inspect the contents according to security policies, and then establish or maintain encrypted communication with the destination. This can help security controls detect malware, malicious web activity, or policy violations hidden inside encrypted traffic. TLS inspection requires careful certificate management and should consider privacy, performance, and application compatibility requirements. DHCP snooping protects against rogue DHCP servers, port security restricts MAC addresses, and NetFlow provides traffic metadata. Therefore, TLS inspection is the correct technology for inspecting encrypted web traffic.

Question 143

Which security mechanism helps protect web applications from common attacks such as malicious HTTP requests and SQL injection?

1. WAF
2. DHCP
3. NTP
4. RADIUS

Correct Answer: 1

Explanation

A Web Application Firewall, or WAF, is designed to protect web applications by inspecting HTTP and HTTPS requests and applying security rules. A WAF can help detect and block attacks such as SQL injection, cross-site scripting, malicious input, and other application-layer threats. It operates differently from a traditional network firewall, which primarily controls network traffic based on addresses, protocols, and ports. DHCP provides IP configuration, NTP synchronizes time, and RADIUS provides centralized authentication services. Therefore, a WAF is the appropriate technology for protecting web applications from malicious HTTP requests.

Question 144

Which attack involves injecting malicious script content into a web page that is later executed in a victim’s browser?

1. SQL injection
2. Cross-site scripting
3. ARP spoofing
4. DHCP starvation

Correct Answer: 2

Explanation

Cross-Site Scripting, or XSS, occurs when an attacker manages to inject malicious script content into a web page that is delivered to users. When the victim’s browser executes the injected script, the attacker may be able to steal information, manipulate page content, or perform actions within the user’s browser context, depending on the vulnerability. Input validation, output encoding, secure application design, and appropriate browser security controls can help reduce XSS risks. SQL injection targets database queries, ARP spoofing targets local address resolution, and DHCP starvation targets address pools. Therefore, XSS is correct.

Question 145

Which security technique protects sensitive data by replacing the original value with a non-sensitive substitute value?

1. Tokenization
2. Hash flooding
3. Packet filtering
4. Port scanning

Correct Answer: 1

Explanation

Tokenization replaces sensitive information with a substitute value called a token. The token can be used by systems that do not need direct access to the original sensitive information. For example, payment systems can use tokens instead of storing actual payment-card information in every application. Tokenization differs from encryption because the token does not necessarily contain a mathematically reversible representation of the original value. Hashing produces a digest, while packet filtering controls network traffic and port scanning identifies accessible services. Therefore, tokenization is the correct technique for replacing sensitive values with substitutes.

Question 146

Which data protection technique transforms readable information into an encoded form that can be restored using an appropriate key?

1. Encryption
2. Logging
3. Segmentation
4. Monitoring

Correct Answer: 1

Explanation

Encryption transforms readable plaintext into ciphertext using a cryptographic algorithm and key. Authorized parties can decrypt the ciphertext using the appropriate key to recover the original information. Encryption is widely used to protect data in transit and data at rest. Strong encryption depends not only on the algorithm but also on secure key management and proper configuration. Logging records events, segmentation separates network resources, and monitoring observes system activity. Encryption primarily supports confidentiality, helping prevent unauthorized parties from understanding protected information. Therefore, encryption is the correct data-protection technique.

Question 147

Which cryptographic function produces a fixed-length digest from input data and is designed to be computationally difficult to reverse?

1. Hashing
2. Routing
3. NAT
4. Compression

Correct Answer: 1

Explanation

Hashing transforms input data into a fixed-length value known as a hash or digest. A secure cryptographic hash function is designed so that it is computationally difficult to derive the original input from the digest and difficult to find another input producing the same digest. Hashes can be used for integrity verification, digital signatures, and secure password-storage mechanisms when appropriate password-hashing algorithms are used. Routing determines network paths, NAT translates addresses, and compression reduces data size. Therefore, hashing is the correct cryptographic function.

Question 148

Which security property prevents unauthorized disclosure of sensitive information?

1. Availability
2. Confidentiality
3. Integrity
4. Nonrepudiation

Correct Answer: 2

Explanation

Confidentiality ensures that information is accessible only to authorized individuals, systems, or processes. Controls supporting confidentiality include encryption, access control, authentication, data classification, and secure communication protocols. Integrity focuses on preventing unauthorized modification, while availability ensures resources remain accessible when needed. Nonrepudiation provides evidence that an action or transaction was associated with a particular party. For example, encrypting a confidential file protects its contents from unauthorized users who may obtain the file. Therefore, confidentiality is the security property concerned with preventing unauthorized disclosure.

Question 149

Which security property ensures that information has not been changed without authorization?

1. Integrity
2. Availability
3. Confidentiality
4. Scalability

Correct Answer: 1

Explanation

Integrity ensures that information remains accurate and has not been modified, deleted, or manipulated without authorization. Cryptographic hashes, digital signatures, access controls, and file-integrity monitoring can help protect or verify integrity. Confidentiality prevents unauthorized disclosure, while availability focuses on ensuring that systems and data remain accessible to authorized users. Scalability is a system-design characteristic rather than a core information-security property. Maintaining integrity is especially important for configuration files, financial records, system software, and security logs. Therefore, integrity is the correct security property.

Question 150

Which security property ensures that authorized users can access systems and data when required?

1. Integrity
2. Confidentiality
3. Availability
4. Authentication

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, applications, and information when they need them. Threats to availability include denial-of-service attacks, hardware failures, power interruptions, network failures, and destructive malware. Organizations can improve availability through redundancy, backups, load balancing, disaster recovery plans, monitoring, and resilient infrastructure. Integrity protects against unauthorized modification, confidentiality protects against unauthorized disclosure, and authentication verifies identity. Availability is particularly important for critical services where prolonged downtime can disrupt business operations. Therefore, availability is the correct security property.

Question 151

Which type of firewall filters traffic based on rules involving IP addresses, protocols, and ports?

1. Network firewall
2. File server
3. DNS resolver
4. Backup server

Correct Answer: 1

Explanation

A network firewall controls traffic between networks or security zones according to configured policies. Depending on the firewall type and configuration, rules can evaluate source and destination IP addresses, protocols, TCP or UDP ports, connection state, and other attributes. Firewalls can be deployed at network boundaries or between internal security zones to enforce segmentation. A DNS resolver performs name resolution, a file server provides file services, and a backup server stores recovery copies. Therefore, a network firewall is the technology designed to filter traffic using network security rules.

Question 152

Which firewall architecture places an additional security layer between an internal network and the public Internet?

1. Dual-firewall DMZ architecture
2. Flat network
3. Open network architecture
4. Direct host connection

Correct Answer: 1

Explanation

A dual-firewall DMZ architecture can place publicly accessible services in a separate DMZ between an external firewall and an internal firewall. The design creates multiple security boundaries and can limit direct communication between the Internet and internal systems. For example, a public web server may be placed in the DMZ while database servers remain in a protected internal segment. A flat network provides less segmentation, while direct host connections do not establish equivalent security boundaries. Therefore, a dual-firewall DMZ architecture provides the described layered network protection.

Question 153

Which security control can prevent traffic from an untrusted network from directly reaching protected internal systems?

1. Firewall ACL
2. DNS record
3. NTP server
4. File compression

Correct Answer: 1

Explanation

A firewall access-control rule can restrict traffic between trusted and untrusted networks. Administrators can define which source addresses, destination addresses, protocols, and ports are allowed or denied. This prevents unauthorized traffic from directly reaching protected systems and can enforce segmentation between different security zones. DNS records provide name-resolution information, NTP synchronizes system time, and file compression reduces data size. Firewall rules should follow least-privilege principles and allow only required communication. Therefore, a firewall ACL is the appropriate control for restricting direct access from untrusted networks.

Question 154

Which network security mechanism can block traffic from known malicious IP addresses?

1. IP-based access control
2. RAID
3. NTP
4. Data compression

Correct Answer: 1

Explanation

IP-based access control can use firewall or ACL rules to block communication from specified source IP addresses. Security teams may use such rules when an address has been identified as malicious or when a specific source should not communicate with a protected system. However, IP addresses can change, be shared, or be spoofed, so IP-based blocking is usually one part of a broader security strategy. RAID protects storage, NTP synchronizes clocks, and compression reduces data size. Therefore, IP-based access control is the mechanism that can block traffic from specified malicious addresses.

Question 155

Which security technology monitors network traffic and compares it against known attack signatures?

1. IPS
2. DHCP
3. DNS
4. NAT

Correct Answer: 1

Explanation

An Intrusion Prevention System can inspect network traffic and compare observed activity against known attack signatures and other detection rules. When malicious activity is identified, the IPS can take preventive action such as dropping packets or blocking connections. Signature-based detection is useful for known threats, although modern security systems may also use behavioral or anomaly-based techniques. DHCP assigns network configuration, DNS resolves domain names, and NAT translates addresses. IPS should be deployed with appropriate policies to minimize false positives while maintaining effective threat detection. Therefore, IPS is correct.

Question 156

Which monitoring technology collects and stores system and network event messages for later analysis?

1. Syslog
2. FTP
3. DHCP
4. ARP

Correct Answer: 1

Explanation

Syslog is a standard mechanism commonly used to transport and collect event messages from network devices, servers, applications, and other systems. Centralized Syslog collection provides security teams with a single location for reviewing events and investigating incidents. Logs can reveal authentication failures, configuration changes, connection attempts, and other security-relevant activity. DHCP provides IP configuration, FTP transfers files, and ARP maps IPv4 addresses to MAC addresses on local networks. Accurate time synchronization is important when correlating logs from multiple systems. Therefore, Syslog is the correct monitoring technology.

Question 157

Which protocol is commonly used to synchronize the clocks of network devices?

1. SNMP
2. NTP
3. SMTP
4. SCP

Correct Answer: 2

Explanation

Network Time Protocol, or NTP, synchronizes system clocks across networked devices. Accurate time is important for security because logs from different devices can be correlated more reliably when they use synchronized timestamps. Incident responders can use synchronized logs to reconstruct timelines and understand the sequence of events during an attack. SNMP is used for network management, SMTP transports email, and SCP securely transfers files. Organizations should use trusted time sources and appropriate security configurations for time synchronization. Therefore, NTP is the correct protocol for synchronizing network-device clocks.

Question 158

Which security control provides visibility into network connections by recording source and destination flow information?

1. NetFlow
2. RAID
3. NAT
4. DHCP

Correct Answer: 1

Explanation

NetFlow provides information about network traffic flows, including details such as source and destination addresses, ports, protocols, packet counts, byte counts, and timing information. Security teams can analyze this metadata to identify unusual traffic patterns, scanning behavior, large data transfers, or unexpected communications. NetFlow does not normally provide the complete contents of each packet, making it different from full packet capture. RAID provides storage redundancy, NAT translates addresses, and DHCP assigns network configuration. Therefore, NetFlow is the correct technology for gaining visibility into network communication flows.

Question 159

Which security technique limits an application or service so that a compromise cannot easily access the entire operating system?

1. Application sandboxing
2. Password reuse
3. Open authentication
4. Flat networking

Correct Answer: 1

Explanation

Application sandboxing isolates an application or process from other parts of the operating system and environment. If the application is compromised, the sandbox can limit what the malicious code is able to access or modify. Sandboxing can therefore reduce the potential impact of vulnerable applications and untrusted content. Strong access controls and system hardening can further strengthen isolation. Password reuse increases account compromise risk, open authentication provides weak access protection, and flat networking reduces network segmentation. Therefore, application sandboxing is the security technique described in the question.

Question 160

Which security principle requires organizations to use multiple different security controls rather than relying on a single protective mechanism?

1. Defense in depth
2. Single-factor authentication
3. Open access
4. Flat network design

Correct Answer: 1

Explanation

Defense in depth is a security strategy that uses multiple layers of protection so that the failure of one control does not automatically result in a complete compromise. An organization may combine authentication, endpoint protection, firewalls, network segmentation, encryption, monitoring, backups, and security awareness. Each layer addresses different risks and can provide additional prevention, detection, or recovery capabilities. Single-factor authentication provides fewer authentication layers, open access weakens restrictions, and flat network designs reduce segmentation. Therefore, defense in depth is the principle that requires multiple complementary security controls.