View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 181

Which IPv6 first-hop security feature helps prevent unauthorized devices from sending forged IPv6 Router Advertisement messages?

1. IPv6 RA Guard
2. IPv6 source routing
3. IPv6 NAT
4. IPv6 multicast routing

Correct Answer: 1

Explanation

IPv6 RA Guard protects hosts from unauthorized Router Advertisement messages by inspecting IPv6 traffic arriving through switch ports and applying configured policies. Rogue Router Advertisements can redirect hosts toward an attacker-controlled default gateway or otherwise manipulate IPv6 network configuration. RA Guard is therefore an important first-hop security control in IPv6-enabled networks. IPv6 source routing concerns packet forwarding behavior, NAT modifies addressing, and multicast routing manages multicast traffic. By filtering unauthorized Router Advertisements, RA Guard helps reduce IPv6 first-hop attack risks.

Question 182

A security administrator wants to ensure that packets entering an interface have a source address reachable through the same interface according to the routing table. Which feature should be considered?

1. DHCP snooping
2. Unicast Reverse Path Forwarding
3. Port mirroring
4. VLAN pruning

Correct Answer: 2

Explanation

Unicast Reverse Path Forwarding, or uRPF, validates the source address of incoming packets by checking the routing information available to the device. Depending on the configured mode, packets may be accepted only when the source is reachable through the receiving interface or when a valid route to the source exists. This helps mitigate source-address spoofing attacks. DHCP snooping protects DHCP operations, port mirroring copies traffic for analysis, and VLAN pruning restricts VLAN propagation across trunks. Therefore, uRPF provides the required source-validation capability.

Question 183

Which switching security feature can automatically suppress excessive broadcast, multicast, or unknown-unicast traffic arriving on a switch port?

1. BPDU Guard
2. Storm control
3. Root Guard
4. DHCP relay

Correct Answer: 2

Explanation

Storm control monitors traffic levels for specified Layer 2 traffic types and can take action when configured thresholds are exceeded. It is commonly used to limit excessive broadcast, multicast, or unknown-unicast traffic that could consume network resources and affect availability. Such traffic surges may result from loops, misconfigurations, or malicious activity. BPDU Guard protects access ports from unexpected spanning-tree BPDUs, Root Guard controls which ports can become spanning-tree root paths, and DHCP relay forwards DHCP messages. Therefore, storm control addresses excessive Layer 2 traffic.

Question 184

Which switch security feature places an access port into an error-disabled state when an unexpected spanning-tree BPDU is received?

1. Root Guard
2. Storm control
3. BPDU Guard
4. Port mirroring

Correct Answer: 3

Explanation

BPDU Guard is designed for ports that should not participate in spanning-tree topology changes, such as end-user access ports. When an unexpected BPDU is received on a protected port, BPDU Guard can place the interface into an error-disabled state. This helps prevent unauthorized switches from influencing the spanning-tree topology. Root Guard serves a different purpose by preventing an interface from becoming a path toward an unauthorized spanning-tree root. Storm control limits excessive traffic, while port mirroring copies traffic for analysis. Therefore, BPDU Guard provides the described protection.

Question 185

Which attack technique attempts to place an unauthorized VLAN tag inside an Ethernet frame so that traffic can cross VLAN boundaries?

1. VLAN hopping
2. ARP poisoning
3. DNS poisoning
4. Session hijacking

Correct Answer: 1

Explanation

VLAN hopping is an attack in which an attacker attempts to gain access to traffic belonging to another VLAN. One technique involves manipulating trunk negotiation or using double-tagged Ethernet frames to exploit native-VLAN behavior. Appropriate switch configuration, including disabling unnecessary trunk negotiation and carefully selecting native VLAN settings, can reduce this risk. ARP poisoning targets address-resolution information, DNS poisoning manipulates name-resolution data, and session hijacking attempts to take over an established session. Therefore, VLAN hopping is the attack described.

Question 186

Which security architecture separates administrative access to network infrastructure from ordinary user traffic by placing management interfaces in a dedicated network?

1. Management-plane segmentation
2. Route summarization
3. Load balancing
4. Traffic compression

Correct Answer: 1

Explanation

Management-plane segmentation separates network-device administration from ordinary production traffic. Management interfaces can be placed into dedicated networks or VRFs and protected with restrictive access-control policies. This reduces the exposure of administrative services and limits the possibility that a compromise of user-facing infrastructure will directly expose device-management interfaces. Route summarization reduces routing-table size, load balancing distributes traffic across resources, and compression reduces data size. Therefore, management-plane segmentation provides the architectural separation required for secure infrastructure administration.

Question 187

Which PKI component is responsible for signing and issuing digital certificates after validating certificate requests according to organizational policy?

1. Certificate Authority
2. Syslog server
3. DNS resolver
4. RADIUS client

Correct Answer: 1

Explanation

A Certificate Authority, or CA, issues and digitally signs certificates within a public key infrastructure. The CA establishes trust by validating certificate requests according to defined policies and then signing certificates that bind public keys to identities. Clients can use the CA’s trusted certificate chain to determine whether presented certificates originate from an accepted authority. A Syslog server collects logs, a DNS resolver performs name resolution, and a RADIUS client communicates with an authentication server. Therefore, the Certificate Authority performs the certificate-issuance role.

Question 188

Which certificate-related mechanism allows a client to check with a certificate authority whether a specific certificate has been revoked?

1. CSR
2. OCSP
3. SAN
4. EKU

Correct Answer: 2

Explanation

The Online Certificate Status Protocol, or OCSP, allows a client or security application to query a certificate authority or designated responder about the current revocation status of a certificate. This can provide more timely status information than relying solely on periodically downloaded certificate revocation lists. A CSR is a certificate signing request, SAN identifies additional certificate subject names, and EKU specifies permitted certificate purposes. Therefore, OCSP is the mechanism used to obtain the current revocation status of an individual certificate.

Question 189

Which IPsec component provides confidentiality by encrypting the protected payload of an IP packet?

1. ESP
2. AH
3. IKE
4. GRE

Correct Answer: 1

Explanation

Encapsulating Security Payload, or ESP, provides confidentiality through encryption and can also provide integrity, authentication, and anti-replay protection. ESP is commonly used in IPsec VPN implementations to secure data traversing untrusted networks. Authentication Header, or AH, provides integrity and authentication but does not provide payload encryption. IKE negotiates security associations and cryptographic parameters, while GRE provides tunneling but does not inherently encrypt traffic. Therefore, ESP is the IPsec component responsible for providing confidentiality through encryption.

Question 190

Which IKEv2 feature allows a VPN peer to determine whether the remote peer is still reachable and responsive?

1. DPD
2. NAT
3. PFS
4. QoS

Correct Answer: 1

Explanation

Dead Peer Detection, or DPD, helps an IPsec VPN device determine whether its remote peer is still reachable. If the peer stops responding, the local device can identify the stale security association and take appropriate action according to its configuration. This helps prevent inactive VPN sessions from remaining indefinitely and consuming resources. NAT translates addresses, Perfect Forward Secrecy provides additional key independence, and QoS manages traffic treatment. Therefore, DPD provides the peer-liveness detection capability described.

Question 191

Which cloud security model requires the cloud customer to manage operating-system security while the provider manages the underlying physical infrastructure?

1. IaaS
2. SaaS
3. PaaS
4. DNSaaS

Correct Answer: 1

Explanation

Infrastructure as a Service, or IaaS, provides virtualized computing resources while leaving customers responsible for a larger portion of the software stack. Depending on the provider and service, customers commonly manage guest operating systems, applications, identities, and security configurations, while the provider manages physical facilities, hardware, and core virtualization infrastructure. SaaS places more responsibility on the provider, while PaaS shifts additional platform responsibilities to the provider. Therefore, IaaS best matches the responsibility model described.

Question 192

Which security practice helps identify vulnerable software components in an application’s dependency chain before the application is deployed?

1. Software composition analysis
2. Network Address Translation
3. Port security
4. Traffic shaping

Correct Answer: 1

Explanation

Software Composition Analysis, or SCA, examines an application’s third-party and open-source dependencies to identify known vulnerabilities, licensing concerns, and outdated components. Integrating SCA into development pipelines allows organizations to identify risky dependencies before applications reach production. This supports DevSecOps by moving security checks earlier in the software-development lifecycle. NAT translates network addresses, port security restricts switch-port access, and traffic shaping controls bandwidth usage. Therefore, SCA is the security practice that addresses vulnerabilities in application dependencies.

Question 193

Which security control is designed to prevent unauthorized applications from executing on an endpoint?

1. Application allowlisting
2. DNS forwarding
3. Route redistribution
4. VLAN trunking

Correct Answer: 1

Explanation

Application allowlisting permits only approved applications or software components to execute on an endpoint. By establishing an approved software baseline, organizations can prevent unknown or unauthorized programs from running even when those programs reach the endpoint through malicious downloads or other attack paths. This approach can significantly reduce the available execution paths for malware. DNS forwarding handles name-resolution requests, route redistribution exchanges routing information, and VLAN trunking transports multiple VLANs. Therefore, application allowlisting directly provides the required execution-control capability.

Question 194

Which security mechanism provides cryptographic proof that a message was created by the holder of a particular private key and has not been modified?

1. Digital signature
2. Hash lookup
3. NAT translation
4. MAC learning

Correct Answer: 1

Explanation

A digital signature uses a private key to create cryptographic evidence associated with a message or document. A recipient can use the corresponding public key to verify the signature and determine whether the signed content was altered after signing. Digital signatures also provide evidence that the signer possessed the private key associated with the signing identity. A hash provides an integrity value but does not by itself identify the signer, NAT translates addresses, and MAC learning supports Ethernet forwarding. Therefore, a digital signature provides the described cryptographic proof.

Question 195

Which incident-response activity focuses on determining the sequence of events that occurred during a security compromise?

1. Timeline reconstruction
2. VLAN pruning
3. Route aggregation
4. Certificate enrollment

Correct Answer: 1

Explanation

Timeline reconstruction is an incident-response and forensic activity used to establish the sequence and timing of events during a security incident. Analysts can correlate endpoint records, authentication logs, network telemetry, file timestamps, and other evidence to understand how an attack progressed. Establishing an accurate timeline can help identify the initial access point, subsequent actions, affected systems, and containment requirements. VLAN pruning controls VLAN propagation, route aggregation reduces routing information, and certificate enrollment obtains certificates. Therefore, timeline reconstruction addresses the investigation requirement.

Question 196

Which recovery metric defines the maximum acceptable amount of data that an organization can afford to lose after a disruption?

1. RTO
2. RPO
3. MTTR
4. SLA

Correct Answer: 2

Explanation

Recovery Point Objective, or RPO, defines the maximum acceptable amount of data loss measured in time. For example, an organization with an RPO of 15 minutes may require backup or replication mechanisms capable of restoring data to a point no more than approximately 15 minutes before a disruption. Recovery Time Objective, or RTO, instead defines how quickly a service should be restored. MTTR measures repair or recovery duration, while an SLA defines agreed service commitments. Therefore, RPO is the metric associated with acceptable data loss.

Question 197

Which security orchestration capability can automatically execute a predefined response after receiving a confirmed security alert?

1. SOAR
2. DHCP
3. NTP
4. SNMP

Correct Answer: 1

Explanation

Security Orchestration, Automation, and Response, or SOAR, can automate repetitive security-response actions through predefined workflows or playbooks. For example, a SOAR platform may receive a confirmed alert, enrich it with threat intelligence, disable a compromised account, isolate an endpoint, or create an incident ticket according to organizational policy. This reduces manual effort and can improve consistency during incident response. DHCP provides network configuration, NTP synchronizes time, and SNMP provides management telemetry. Therefore, SOAR provides the described automated response capability.

Question 198

Which security capability uses behavioral analysis to identify activity that deviates significantly from an established baseline for a user or entity?

1. UEBA
2. NAT
3. GRE
4. STP

Correct Answer: 1

Explanation

User and Entity Behavior Analytics, or UEBA, analyzes behavioral patterns associated with users, devices, applications, or other entities. It can establish baselines and identify unusual deviations that may indicate compromised credentials, insider threats, privilege misuse, or other suspicious activity. UEBA is particularly useful when an event does not match a simple signature but differs substantially from normal behavior. NAT translates addresses, GRE provides tunneling, and STP prevents Layer 2 loops. Therefore, UEBA provides the behavioral-analysis capability described.

Question 199

Which network security design places users or workloads into isolated security zones so that communication between zones can be explicitly controlled?

1. Network segmentation
2. Route redistribution
3. Link aggregation
4. DNS caching

Correct Answer: 1

Explanation

Network segmentation divides a network into separate security zones and applies policies controlling communication between them. Segmentation can limit lateral movement by preventing compromised systems from freely communicating with sensitive servers, administrative networks, or other critical resources. Organizations may implement segmentation using VLANs, VRFs, firewalls, security groups, or other policy-enforcement mechanisms. Route redistribution exchanges routing information, link aggregation combines physical links, and DNS caching stores name-resolution results. Therefore, network segmentation provides the isolation and policy-control model described.

Question 200

Which security principle requires multiple independent controls so that failure of one protection does not automatically compromise the protected resource?

1. Defense in depth
2. Single sign-on
3. Network Address Translation
4. Data normalization

Correct Answer: 1

Explanation

Defense in depth uses multiple complementary security controls so that one failed or bypassed mechanism does not leave a resource completely unprotected. An organization might combine identity controls, endpoint protection, network segmentation, firewalls, monitoring, encryption, and incident-response processes. The layered approach reduces dependence on any single security mechanism and can provide opportunities to detect or stop an attack at different stages. Single sign-on focuses on authentication convenience, NAT translates addresses, and data normalization organizes information. Therefore, defense in depth represents the described layered security principle.