View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 161

Which authentication method allows a user to prove identity using a certificate instead of a traditional password?

1. PAP
2. CHAP
3. Certificate-based authentication
4. MAC filtering

Correct Answer: 3

Explanation

Certificate-based authentication uses digital certificates to verify the identity of a user, device, or system. A certificate is typically issued by a trusted Certificate Authority and contains identity information along with a public key. During authentication, the entity proves possession of the corresponding private key. This method can provide strong authentication without requiring users to repeatedly enter passwords. PAP and CHAP are older authentication mechanisms, while MAC filtering identifies devices based on hardware addresses rather than cryptographic certificates. Certificate-based authentication is commonly used with technologies such as 802.1X and secure VPN deployments.

Question 162

Which protocol is commonly used to securely transfer files between a local system and a remote server over an SSH connection?

1. FTP
2. SCP
3. TFTP
4. HTTP

Correct Answer: 2

Explanation

Secure Copy Protocol, or SCP, provides secure file transfer using the SSH protocol. It encrypts authentication credentials and transferred data, helping protect files from interception during transmission. SCP is commonly used by administrators to securely move configuration files, software packages, logs, and other data between systems. Traditional FTP does not encrypt credentials or data by default, while TFTP provides simple file transfer without built-in authentication or encryption. HTTP is primarily a web communication protocol. Therefore, SCP is the appropriate protocol for securely transferring files over an SSH connection.

Question 163

Which authentication protocol uses a challenge-response mechanism to avoid sending the user’s password directly across the network?

1. PAP
2. FTP
3. CHAP
4. Telnet

Correct Answer: 3

Explanation

Challenge Handshake Authentication Protocol, or CHAP, uses a challenge-response process during authentication. The server sends a challenge, and the client responds using a value calculated from the challenge and a shared secret. This helps avoid transmitting the password directly over the network. PAP generally sends credentials using a simpler authentication process and does not provide the same challenge-response protection. FTP and Telnet are application protocols rather than authentication protocols designed around this mechanism. CHAP is therefore the correct answer when a challenge-response authentication process is required.

Question 164

Which security control automatically disables a switch port when an unauthorized device violates a configured port-security policy?

1. Port-security violation action
2. DNS filtering
3. NTP authentication
4. Web proxy

Correct Answer: 1

Explanation

Switch port security can restrict which MAC addresses are allowed on a specific switch port. When an unauthorized MAC address violates the configured policy, the switch can take an action such as shutting down the port, dropping violating traffic, or generating notifications, depending on the configured violation mode. This helps prevent unauthorized devices from gaining network access through protected switch ports. DNS filtering controls domain resolution, NTP authentication protects time synchronization, and web proxies manage web traffic. Therefore, the port-security violation action is the control responsible for responding to unauthorized devices.

Question 165

Which protocol is commonly used by network devices to securely communicate authentication, authorization, and accounting information with a centralized server?

1. TACACS+
2. HTTP
3. TFTP
4. ARP

Correct Answer: 1

Explanation

TACACS+ is a centralized AAA protocol commonly used for managing administrative access to network devices. It separates authentication, authorization, and accounting functions and encrypts the entire body of the AAA packet. This allows organizations to centrally control administrator access and record administrative activity. HTTP is primarily used for web communication, TFTP provides basic file transfers, and ARP maps IPv4 addresses to MAC addresses on local networks. TACACS+ is especially useful in environments where detailed authorization policies are required for network administrators. Therefore, TACACS+ is the correct answer.

Question 166

Which network access control method requires a device to authenticate before receiving normal access to a protected network?

1. NAT
2. 802.1X
3. DNS
4. ICMP

Correct Answer: 2

Explanation

IEEE 802.1X provides port-based network access control. It requires an endpoint to authenticate before the network infrastructure grants normal access to protected network resources. In a typical deployment, the endpoint acts as the supplicant, the switch or wireless access point acts as the authenticator, and an authentication server such as RADIUS validates credentials. NAT translates IP addresses, DNS resolves domain names, and ICMP is primarily used for network control and diagnostic messaging. Therefore, 802.1X is the appropriate technology for requiring authentication before granting network access.

Question 167

Which component of an 802.1X deployment is responsible for requesting authentication information from the endpoint and controlling the network port?

1. Supplicant
2. Certificate Authority
3. Authenticator
4. SIEM

Correct Answer: 3

Explanation

In an 802.1X architecture, the authenticator is typically a network switch or wireless access point. It controls access to the network port and communicates with the supplicant while forwarding authentication information to the authentication server. The supplicant is the endpoint requesting access, while the authentication server, commonly a RADIUS server, validates the credentials. A Certificate Authority can issue certificates but does not normally control the network port, and a SIEM collects and analyzes security events. Therefore, the authenticator is the component responsible for controlling access at the network connection.

Question 168

Which Cisco technology can centrally enforce identity-based network access policies using AAA and endpoint information?

1. Cisco Secure Endpoint
2. Cisco Secure Network Analytics
3. Cisco Identity Services Engine
4. Cisco Umbrella

Correct Answer: 3

Explanation

Cisco Identity Services Engine, or Cisco ISE, provides centralized identity and access-control capabilities. It can use authentication, authorization, endpoint profiling, posture information, and policy rules to determine what network access should be granted to a device or user. ISE commonly works with technologies such as 802.1X and RADIUS. Cisco Secure Endpoint focuses primarily on endpoint security, Secure Network Analytics provides network visibility and behavioral analysis, and Cisco Umbrella provides cloud-based security services including DNS-layer protection. Therefore, Cisco ISE is the correct technology for centralized identity-based network access policies.

Question 169

Which type of malware disguises itself as legitimate software to trick a user into installing or executing it?

1. Worm
2. Trojan horse
3. Rootkit
4. Ransomware

Correct Answer: 2

Explanation

A Trojan horse is malware that disguises itself as legitimate or useful software to persuade a user to install or execute it. Once executed, the malicious program may perform activities such as stealing information, installing additional malware, or providing unauthorized access. Unlike worms, Trojans generally depend on social engineering or another delivery method rather than automatically spreading themselves across networks. Rootkits focus on maintaining stealth and privileged access, while ransomware typically encrypts or otherwise restricts access to data and demands payment. Therefore, a Trojan horse is the malware type described.

Question 170

Which malware type is specifically designed to secretly maintain privileged access while hiding its presence from users and security tools?

1. Adware
2. Worm
3. Spyware
4. Rootkit

Correct Answer: 4

Explanation

A rootkit is designed to maintain unauthorized privileged access while attempting to conceal its presence. Rootkits may modify operating-system components or use other techniques to hide files, processes, network connections, or malicious activity. Because they can operate at deep system levels, detecting and removing them may require specialized security tools or rebuilding the affected system. Adware primarily displays unwanted advertising, worms are designed to self-propagate, and spyware focuses on secretly collecting information. Therefore, a rootkit best matches the description of malware that hides privileged unauthorized access.

Question 171

Which attack attempts to overwhelm a service with more requests or traffic than it can effectively handle?

1. Denial-of-service attack
2. Phishing attack
3. Credential stuffing
4. SQL injection

Correct Answer: 1

Explanation

A Denial-of-Service, or DoS, attack attempts to make a system, application, or network service unavailable to legitimate users. Attackers may overwhelm resources such as bandwidth, CPU, memory, connection tables, or application processes. A Distributed Denial-of-Service attack uses multiple compromised systems to generate traffic or requests, making the attack more difficult to mitigate. Phishing targets users through deceptive communication, credential stuffing uses previously compromised credentials, and SQL injection targets vulnerable database queries. Therefore, a denial-of-service attack is the attack type that attempts to overwhelm a service.

Question 172

Which technique attempts to gain unauthorized access by trying many different passwords against a single account?

1. Password spraying
2. Brute-force attack
3. Phishing
4. Session hijacking

Correct Answer: 2

Explanation

A brute-force attack attempts to discover a password by systematically trying many possible password combinations against an account or authentication system. The attack can be effective when passwords are weak or when authentication controls do not sufficiently limit repeated attempts. Password spraying differs because it generally tries a small number of commonly used passwords across many accounts to avoid account lockouts. Phishing attempts to trick users into revealing information, while session hijacking attempts to take over an already authenticated session. Therefore, brute force is the technique described in the question.

Question 173

Which security measure helps reduce the risk of successful password attacks by temporarily locking an account after repeated failed login attempts?

1. Network segmentation
2. Encryption
3. Account lockout
4. Data masking

Correct Answer: 3

Explanation

Account lockout is an authentication control that temporarily disables an account after a configured number of unsuccessful login attempts. It can reduce the effectiveness of repeated password-guessing attacks by preventing attackers from continuously trying credentials. Organizations must configure lockout thresholds carefully because overly aggressive policies can allow attackers to intentionally lock legitimate users out of their accounts. Network segmentation separates network zones, encryption protects information, and data masking hides sensitive values. Account lockout is therefore the security measure specifically designed to restrict repeated failed authentication attempts.

Question 174

Which security practice requires administrators to install vendor updates that fix known security vulnerabilities?

1. Patch management
2. Port mirroring
3. Packet fragmentation
4. Address translation

Correct Answer: 1

Explanation

Patch management is the process of identifying, testing, deploying, and maintaining software updates that address bugs, security vulnerabilities, and other issues. Regular patching reduces the period during which systems remain exposed to publicly known vulnerabilities. Effective patch management should include asset identification, vulnerability prioritization, testing, deployment, verification, and documentation. Port mirroring copies traffic for monitoring, packet fragmentation divides network packets, and address translation modifies IP addressing information. Therefore, patch management is the practice responsible for ensuring that security updates are applied to vulnerable systems.

Question 175

Which vulnerability-management standard provides a numerical severity score for security vulnerabilities?

1. CVE
2. CVSS
3. DNSSEC
4. AES

Correct Answer: 2

Explanation

The Common Vulnerability Scoring System, or CVSS, provides a standardized method for describing the severity of security vulnerabilities using numerical scores and associated metrics. Security teams can use CVSS information to help prioritize remediation efforts based on factors such as attack complexity, privileges required, user interaction, and impact. CVE is primarily a system for identifying publicly known vulnerabilities using standardized identifiers. DNSSEC protects DNS integrity, while AES is a symmetric encryption algorithm. Therefore, CVSS is the standard associated with numerical vulnerability-severity scoring.

Question 176

Which system collects security events from multiple sources and correlates them to help identify suspicious activity?

1. SIEM
2. DHCP server
3. DNS server
4. Proxy ARP

Correct Answer: 1

Explanation

A Security Information and Event Management system, or SIEM, collects and analyzes security events from multiple sources such as firewalls, servers, endpoints, authentication systems, and network devices. SIEM platforms can correlate events, generate alerts, support investigations, and provide centralized security visibility. For example, multiple failed logins followed by successful authentication from an unusual source could trigger an investigation. DHCP servers provide IP configuration, DNS servers resolve names, and Proxy ARP handles address-resolution behavior. Therefore, SIEM is the system designed to aggregate and correlate security events from multiple sources.

Question 177

Which incident-response phase focuses on stopping an active threat from spreading further through the environment?

1. Identification
2. Recovery
3. Containment
4. Preparation

Correct Answer: 3

Explanation

Containment is the incident-response phase focused on limiting the spread and impact of an active security incident. Security teams may isolate compromised endpoints, block malicious network connections, disable affected accounts, or segment portions of the network. The objective is to prevent additional damage while allowing investigation and remediation to continue. Identification focuses on recognizing and analyzing the incident, recovery restores normal operations, and preparation establishes capabilities before incidents occur. Therefore, containment is the phase specifically concerned with preventing an active threat from spreading further.

Question 178

Which backup strategy maintains a complete copy of selected data each time the backup is performed?

1. Differential backup
2. Incremental backup
3. Full backup
4. Snapshot-only backup

Correct Answer: 3

Explanation

A full backup creates a complete copy of the selected data during each backup operation. Restoring from a full backup is generally straightforward because all required data is contained in that backup set. An incremental backup normally contains data changed since the previous backup, while a differential backup contains changes made since the last full backup. Organizations may combine these methods to balance storage requirements, backup time, and recovery objectives. Full backups typically require more storage and time than incremental backups. Therefore, the backup strategy described is a full backup.

Question 179

Which security concept requires users and devices to receive only the permissions necessary to perform their assigned tasks?

1. Least privilege
2. Open authorization
3. Maximum access
4. Shared administration

Correct Answer: 1

Explanation

The principle of least privilege requires users, applications, and devices to receive only the permissions necessary to perform their legitimate tasks. Limiting privileges reduces the potential damage caused by compromised accounts, malicious software, or accidental actions. For example, a standard employee account should not automatically have administrative privileges on every workstation or server. Least privilege should be reviewed regularly as responsibilities change. Granting maximum access or sharing administrative accounts increases security risks. Therefore, least privilege is the security concept that limits permissions to only what is necessary.

Question 180

Which security model assumes that no user or device should be automatically trusted simply because it is inside the corporate network?

1. Perimeter-only security
2. Zero Trust
3. Open access
4. Implicit trust

Correct Answer: 2

Explanation

Zero Trust is a security model based on the principle that access should not be automatically trusted simply because a user or device is located inside an organization’s network. Access decisions can consider identity, device security posture, application, location, risk, and other contextual information. Users and devices are continuously evaluated and granted only the access required for the requested resource. This approach differs from traditional perimeter-only models that place greater trust in internal network locations. Therefore, Zero Trust is the model described in the question.