View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 201

Which Cisco security capability can use threat intelligence to identify connections to known malicious domains, IP addresses, and URLs?

1. Cisco Security Intelligence
2. Cisco EtherChannel
3. Cisco HSRP
4. Cisco IP SLA

Correct Answer: 1

Explanation

Cisco Security Intelligence uses reputation and threat-intelligence information to identify potentially malicious network destinations and other indicators. Security policies can use this intelligence to block or otherwise control connections associated with known threats. This approach allows security devices to respond to continuously updated information about malicious infrastructure without relying only on locally created rules. EtherChannel combines physical links, HSRP provides gateway redundancy, and IP SLA measures network performance. Therefore, Cisco Security Intelligence provides the threat-informed enforcement capability described.

Question 202

An administrator wants to prevent an unauthorized switch from becoming the spanning-tree root while still allowing the interface to receive BPDUs. Which feature is appropriate?

1. BPDU Guard
2. Root Guard
3. PortFast
4. Storm control

Correct Answer: 2

Explanation

Root Guard protects the intended spanning-tree topology by preventing a port from becoming an alternative path toward an unauthorized root bridge. If superior BPDUs are received on a Root Guard-protected interface, the port can enter a root-inconsistent state rather than accepting the new root information. BPDU Guard is generally used to protect edge ports by disabling them when BPDUs are received. PortFast accelerates edge-port transition, while storm control limits excessive Layer 2 traffic. Therefore, Root Guard matches the requirement.

Question 203

Which protocol can securely transport network-management information by using encryption and message authentication between an administrator and a network device?

1. SNMPv1
2. SNMPv2c
3. SNMPv3
4. TFTP

Correct Answer: 3

Explanation

SNMPv3 provides security features for network-management communications, including authentication and privacy mechanisms. These capabilities help protect management information from unauthorized modification, impersonation, and disclosure when appropriately configured. SNMPv1 and SNMPv2c commonly rely on community strings and do not provide the same security framework, while TFTP is a simple file-transfer protocol without built-in encryption. For secure monitoring and management of network infrastructure, SNMPv3 provides the strongest security model among these choices.

Question 204

Which security control can restrict access to network services based on the source and destination IP addresses, protocols, and ports?

1. Access Control List
2. NTP
3. DHCP
4. Syslog

Correct Answer: 1

Explanation

An Access Control List, or ACL, can define traffic-control rules using attributes such as source address, destination address, protocol, and port number. ACLs can be applied at different points in a network to permit or deny specific traffic flows according to organizational requirements. This makes them useful for enforcing infrastructure security policies and limiting unnecessary communication. NTP synchronizes system clocks, DHCP provides addressing information, and Syslog transports event messages. Therefore, an ACL provides the traffic-filtering capability described.

Question 205

Which security approach continuously verifies access requests instead of assuming that a user or device is trusted simply because it is inside the corporate network?

1. Traditional perimeter security
2. Zero Trust
3. Static routing
4. Network Address Translation

Correct Answer: 2

Explanation

Zero Trust is based on the principle that access should not be automatically trusted because a user or device is located inside a particular network boundary. Access decisions can consider identity, device posture, application, resource sensitivity, context, and other signals, with authorization continuously enforced according to policy. This approach reduces reliance on a trusted internal perimeter and supports least-privilege access. Traditional perimeter security emphasizes network boundaries, while static routing and NAT address connectivity functions rather than trust decisions.

Question 206

Which mechanism can protect BGP sessions by limiting the accepted time-to-live value of incoming packets from an expected peer?

1. BGP TTL security
2. DHCP snooping
3. DNSSEC
4. MACsec

Correct Answer: 1

Explanation

BGP TTL security can help protect external BGP sessions from certain spoofed or forged packets by using the IP time-to-live field to ensure that packets originate within an expected hop distance. The mechanism is particularly useful when protecting BGP control-plane sessions from attacks originating farther away than the legitimate peer. DHCP snooping validates DHCP behavior, DNSSEC protects DNS integrity and authenticity, and MACsec secures Ethernet frames. Therefore, BGP TTL security is the feature that provides the described routing-session protection.

Question 207

Which security measure helps prevent a compromised endpoint from communicating directly with other endpoints that it does not need to access?

1. Microsegmentation
2. Route summarization
3. Link aggregation
4. DNS caching

Correct Answer: 1

Explanation

Microsegmentation divides workloads, users, or endpoints into smaller security boundaries and applies granular policies between them. Instead of allowing broad lateral connectivity, policies can restrict communication to only the applications and services that are required. This can significantly reduce the potential spread of malware after an endpoint compromise. Route summarization reduces routing-table information, link aggregation combines network links, and DNS caching stores name-resolution results. Therefore, microsegmentation provides the granular isolation required to restrict unnecessary endpoint-to-endpoint communication.

Question 208

Which cloud security technology focuses on protecting workloads such as virtual machines and applications while they are running in cloud environments?

1. CWPP
2. CASB
3. SWG
4. DNSSEC

Correct Answer: 1

Explanation

Cloud Workload Protection Platforms, or CWPPs, are designed to protect cloud workloads such as virtual machines, containers, and other application environments. Depending on the implementation, capabilities can include vulnerability assessment, malware protection, runtime monitoring, workload visibility, and policy enforcement. CASB focuses primarily on cloud-service usage and access, SWG protects web traffic, and DNSSEC protects DNS integrity. Therefore, CWPP is the technology most directly associated with protecting workloads operating in cloud environments.

Question 209

Which security practice reduces an attack surface by disabling network services and applications that are not required?

1. Service minimization
2. Load balancing
3. Route redistribution
4. Traffic mirroring

Correct Answer: 1

Explanation

Service minimization reduces attack surface by disabling unnecessary services, applications, ports, and protocols. Every active service can potentially contain vulnerabilities or provide an entry point for attackers, so removing functions that are not required reduces the number of opportunities available for exploitation. Administrators should review systems periodically because requirements can change over time. Load balancing distributes traffic, route redistribution exchanges routing information, and traffic mirroring copies packets for analysis. Therefore, service minimization directly supports attack-surface reduction.

Question 210

Which security technology can detect malicious activity on a network and automatically take action to prevent the traffic from continuing?

1. IDS
2. IPS
3. SPAN
4. NetFlow

Correct Answer: 2

Explanation

An Intrusion Prevention System, or IPS, monitors network traffic for malicious or suspicious activity and can actively block or otherwise prevent identified threats according to configured policies. This differentiates IPS from a traditional Intrusion Detection System, which primarily detects and generates alerts without necessarily blocking traffic. SPAN copies traffic to another interface for monitoring, while NetFlow provides flow telemetry rather than directly preventing malicious connections. Therefore, IPS provides the active detection-and-prevention capability described.

Question 211

Which DNS security technology uses cryptographic signatures to provide authenticity and integrity for DNS records?

1. DNSSEC
2. DNS caching
3. DHCP
4. NAT

Correct Answer: 1

Explanation

DNS Security Extensions, or DNSSEC, use digital signatures to provide authentication and integrity for DNS data. DNSSEC allows validating resolvers to determine whether DNS responses originate from an authoritative source and whether the records have been modified during transmission. It helps address attacks that rely on forged or manipulated DNS responses. DNS caching stores previously resolved information, DHCP provides host configuration, and NAT translates network addresses. Therefore, DNSSEC is the technology that provides cryptographic protection for DNS records.

Question 212

Which cloud security capability evaluates infrastructure-as-code templates for insecure configurations before cloud resources are deployed?

1. IaC security scanning
2. NAT traversal
3. MAC address filtering
4. Port mirroring

Correct Answer: 1

Explanation

Infrastructure-as-Code security scanning examines configuration templates before they are used to deploy cloud infrastructure. Security tools can identify issues such as overly permissive access rules, publicly exposed resources, weak encryption settings, or insecure identity permissions during the development and deployment process. Finding these problems early helps prevent insecure configurations from reaching production. NAT traversal supports VPN connectivity through address translation, MAC filtering controls Layer 2 access, and port mirroring copies traffic for analysis. Therefore, IaC security scanning provides the required preventive control.

Question 213

Which security feature can prevent a switch port from accepting frames with unexpected source MAC addresses?

1. Port security
2. DNSSEC
3. IPsec
4. CoPP

Correct Answer: 1

Explanation

Switch port security can restrict which source MAC addresses are permitted on an interface. Administrators can configure static or dynamically learned secure MAC addresses and define an appropriate violation action when an unauthorized address appears. This can help reduce risks such as unauthorized device connections and certain forms of CAM-table abuse. DNSSEC protects DNS information, IPsec secures IP traffic, and CoPP protects the control plane. Therefore, port security provides the Layer 2 source-address enforcement described.

Question 214

Which incident-response phase focuses on removing malware, malicious persistence mechanisms, and unauthorized access from affected systems?

1. Identification
2. Containment
3. Eradication
4. Preparation

Correct Answer: 3

Explanation

Eradication is the incident-response phase focused on removing the underlying cause and malicious artifacts of a security incident. Activities can include deleting malware, removing persistence mechanisms, disabling compromised accounts, closing exploited vulnerabilities, and eliminating unauthorized configurations. Containment focuses on limiting the incident’s spread, identification determines what happened and what is affected, and preparation establishes capabilities before incidents occur. Therefore, eradication is the phase most directly associated with removing malicious components from affected systems.

Question 215

Which security control helps ensure that network-device logs from different systems can be accurately correlated by maintaining consistent system time?

1. NTP
2. FTP
3. ARP
4. GRE

Correct Answer: 1

Explanation

Network Time Protocol, or NTP, synchronizes system clocks so that security devices and other infrastructure maintain consistent timestamps. Accurate time is particularly important for incident investigation, SIEM correlation, authentication analysis, and forensic timeline reconstruction. If different systems have significantly different clocks, analysts may struggle to determine the actual order of events. FTP provides file transfer, ARP resolves IPv4 addresses to MAC addresses, and GRE provides tunneling. Therefore, NTP supports reliable time correlation across security infrastructure.

Question 216

Which security mechanism can protect routing information by rejecting BGP routes that do not match approved prefixes?

1. Prefix filtering
2. DNS forwarding
3. VLAN pruning
4. NAT overload

Correct Answer: 1

Explanation

BGP prefix filtering allows administrators to define which network prefixes are permitted to be received from or advertised to a particular peer. Filtering helps prevent accidental or malicious route announcements from introducing unauthorized destinations or causing routing instability. Organizations can establish explicit prefix policies based on their expected routing relationships. DNS forwarding handles name-resolution requests, VLAN pruning limits VLAN propagation, and NAT overload translates multiple private addresses through a shared public address. Therefore, prefix filtering provides the required BGP security control.

Question 217

Which endpoint-security capability can prevent exploitation of certain vulnerable applications by monitoring and blocking suspicious exploit behavior?

1. Exploit prevention
2. DNS forwarding
3. Link aggregation
4. Route summarization

Correct Answer: 1

Explanation

Exploit prevention is an endpoint-security capability designed to detect and block techniques used to exploit software vulnerabilities. Rather than relying only on malware signatures, exploit-prevention controls can monitor suspicious behaviors associated with memory corruption, unauthorized code execution, or other exploitation techniques. This provides an additional defensive layer for applications that may contain known or unknown weaknesses. DNS forwarding handles name resolution, link aggregation combines physical interfaces, and route summarization reduces routing information. Therefore, exploit prevention directly addresses endpoint exploitation attempts.

Question 218

Which security capability provides a centralized method for collecting, storing, and analyzing logs from multiple network and security devices?

1. Syslog
2. RADIUS
3. TACACS+
4. SFTP

Correct Answer: 1

Explanation

Syslog provides a standardized mechanism for sending event and log messages from network devices, servers, applications, and security systems to centralized logging infrastructure. Centralized collection makes it easier to retain records, investigate incidents, correlate events, and monitor device activity. RADIUS and TACACS+ are primarily authentication, authorization, and accounting protocols, while SFTP provides secure file transfer. Syslog therefore matches the requirement for centralized security-event collection, although a SIEM may provide additional correlation and analytical capabilities on top of collected logs.

Question 219

Which security control is intended to ensure that administrators can access network infrastructure only from explicitly authorized management hosts or networks?

1. Infrastructure ACL
2. DNSSEC
3. DHCP relay
4. GRE

Correct Answer: 1

Explanation

An infrastructure ACL can restrict management-plane access to network devices by allowing administrative connections only from approved source addresses or management networks. Such controls can be combined with AAA, secure management protocols, multifactor authentication, and dedicated management networks to strengthen infrastructure protection. DNSSEC protects DNS integrity, DHCP relay forwards DHCP requests between network segments, and GRE provides tunneling. Therefore, an infrastructure ACL is the control that directly limits administrative access based on authorized management sources.

Question 220

Which security technology can provide encrypted remote access for an individual user to resources inside an organization?

1. Remote-access VPN
2. VLAN trunking
3. SPAN
4. STP

Correct Answer: 1

Explanation

A remote-access VPN provides secure connectivity for individual users connecting to organizational resources over an untrusted network such as the Internet. Depending on the implementation, the VPN can use technologies such as IPsec or TLS to protect communications and can integrate with identity and multifactor authentication controls. VLAN trunking transports multiple VLANs, SPAN copies network traffic for monitoring, and STP prevents Layer 2 switching loops. Therefore, remote-access VPN provides the encrypted user-to-network connectivity described.