View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 221

Which Cisco security solution can enforce identity-based access policies for users and devices connecting to enterprise networks?

1. Cisco ISE
2. Cisco HSRP
3. Cisco IP SLA
4. Cisco NTP

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or ISE, provides centralized identity-based access control for enterprise networks. It can authenticate users and devices, evaluate endpoint information, assign authorization policies, and integrate with technologies such as 802.1X and Security Group Tags. This allows organizations to make access decisions based on identity, device context, and security policy rather than relying only on network location. HSRP provides gateway redundancy, IP SLA monitors network performance, and NTP synchronizes time. Therefore, Cisco ISE provides the required identity-based access functionality.

Question 222

Which security technique can reduce the risk of attackers learning sensitive information from discarded storage devices?

1. Data masking
2. Secure media sanitization
3. Network segmentation
4. Traffic shaping

Correct Answer: 2

Explanation

Secure media sanitization removes or destroys information from storage devices before they are reused, transferred, or disposed of. Depending on the medium and security requirements, sanitization can involve secure erasure, cryptographic erasure, or physical destruction. This prevents unauthorized individuals from recovering sensitive information from discarded drives or other storage media. Data masking changes how information is displayed, network segmentation separates communication domains, and traffic shaping controls bandwidth usage. Therefore, secure media sanitization directly addresses the risk associated with discarded storage devices.

Question 223

Which authentication method allows a user to prove possession of a private cryptographic key without transmitting the private key to the authentication server?

1. Password authentication
2. Certificate-based authentication
3. PAP
4. CHAP

Correct Answer: 2

Explanation

Certificate-based authentication uses a digital certificate and its associated private key to establish an identity. During authentication, the user or device can prove possession of the private key through a cryptographic exchange without sending the private key to the authentication server. This provides stronger protection than simply transmitting reusable passwords. PAP relies on password-based authentication, while CHAP uses a challenge-response mechanism. Certificate-based authentication is especially useful for device identity, VPN access, and enterprise authentication where strong cryptographic credentials are required.

Question 224

Which security feature can detect when a switch’s MAC address table is being exhausted by a large number of dynamically learned addresses?

1. DHCP snooping
2. CAM table monitoring
3. DNSSEC
4. IPsec

Correct Answer: 2

Explanation

CAM table monitoring can help identify abnormal growth in dynamically learned MAC addresses, which may indicate a MAC flooding or CAM table exhaustion attempt. Attackers can send numerous frames with different source MAC addresses in an effort to consume available switch-table entries and disrupt normal forwarding behavior. Administrators can reduce this risk with port security, MAC limits, and monitoring. DHCP snooping protects DHCP operations, DNSSEC protects DNS information, and IPsec secures IP communications. Therefore, CAM table monitoring is the appropriate detection mechanism.

Question 225

Which security control provides a cryptographic method for confirming that a downloaded file has not been altered?

1. Hash verification
2. VLAN tagging
3. Route filtering
4. Port mirroring

Correct Answer: 1

Explanation

Hash verification calculates a cryptographic digest of a file and compares it with a trusted reference value. If the values match, the file is considered consistent with the expected content, assuming the reference hash itself is trustworthy. A changed file normally produces a different digest, making hashes useful for integrity verification and software validation. VLAN tagging identifies traffic belonging to specific VLANs, route filtering controls routing information, and port mirroring copies traffic for analysis. Therefore, hash verification provides the described integrity check.

Question 226

Which security mechanism can require an additional authentication factor after a username and password have been successfully entered?

1. Single sign-on
2. Multifactor authentication
3. Network segmentation
4. Data compression

Correct Answer: 2

Explanation

Multifactor authentication, or MFA, requires users to provide two or more independent authentication factors. These factors can include something the user knows, something the user has, or something the user is. For example, a password may be combined with a hardware token or an approved authentication application. This reduces the impact of stolen passwords because possession of the password alone is insufficient for successful authentication. Single sign-on simplifies access across applications, while segmentation and compression address network and data-handling functions.

Question 227

Which security capability can identify sensitive information stored in cloud repositories and apply policies to prevent unauthorized sharing?

1. Cloud DLP
2. Route redistribution
3. MACsec
4. STP

Correct Answer: 1

Explanation

Cloud Data Loss Prevention, or cloud DLP, identifies sensitive information in cloud services and applies policies designed to prevent unauthorized disclosure. Policies can inspect content for organizationally defined sensitive information and may generate alerts, restrict sharing, or block transfers depending on the implementation. This is particularly important when cloud collaboration services allow users to share files externally. Route redistribution manages routing information, MACsec protects Ethernet traffic, and STP prevents Layer 2 loops. Therefore, cloud DLP provides the described data-protection capability.

Question 228

A security analyst needs to observe packets traversing a switch without interrupting the original traffic flow. Which feature is appropriate?

1. CoPP
2. SPAN
3. NAT
4. 802.1X

Correct Answer: 2

Explanation

Switched Port Analyzer, or SPAN, copies selected network traffic from one or more source interfaces or VLANs to a destination monitoring interface. Security analysts can connect monitoring or packet-analysis tools to the destination interface to inspect traffic without changing the original forwarding path. CoPP protects the control plane, NAT translates addresses, and 802.1X controls network access through authentication. Therefore, SPAN is the appropriate feature for obtaining a copy of switch traffic for security monitoring and analysis.

Question 229

Which security control can identify whether a network device is running outdated software that contains known vulnerabilities?

1. Vulnerability assessment
2. DNS caching
3. Traffic shaping
4. VLAN pruning

Correct Answer: 1

Explanation

Vulnerability assessment evaluates systems, applications, and devices for known weaknesses and insecure configurations. A network-device assessment can identify outdated operating-system versions, vulnerable software components, missing security updates, weak configurations, or exposed services. Organizations can use the results to prioritize remediation according to factors such as severity, exposure, and business impact. DNS caching stores name-resolution information, traffic shaping controls bandwidth, and VLAN pruning limits VLAN propagation. Therefore, vulnerability assessment provides the capability required to identify vulnerable software versions.

Question 230

Which security control can prevent a user from connecting an unauthorized device to a protected switch access port by limiting the number of allowed MAC addresses?

1. DNSSEC
2. Port security
3. IPsec
4. Syslog

Correct Answer: 2

Explanation

Switch port security can limit the number of MAC addresses permitted on an access port and can specify how the switch responds when a violation occurs. This can prevent unauthorized devices from gaining network access through ports intended for specific endpoints. Administrators may use dynamically learned secure addresses or explicitly configured addresses depending on operational requirements. DNSSEC protects DNS integrity, IPsec secures IP traffic, and Syslog transports event messages. Therefore, port security directly provides the required device-connection restriction.

Question 231

Which cloud security model places application deployment and application security largely under the customer’s responsibility while the provider manages the underlying platform?

1. PaaS
2. SaaS
3. IaaS
4. Colocation

Correct Answer: 1

Explanation

Platform as a Service, or PaaS, provides customers with a managed application platform while the cloud provider manages much of the underlying infrastructure and platform components. Customers generally remain responsible for the applications they deploy, including application code, configurations, identities, and data security. SaaS shifts more operational responsibility to the provider, while IaaS gives customers control over a larger portion of the infrastructure stack. Colocation involves physical hosting rather than the same managed cloud-platform model. Therefore, PaaS matches the described responsibility model.

Question 232

Which security capability can detect suspicious DNS requests that attempt to communicate with command-and-control infrastructure using domain names?

1. DNS traffic analysis
2. Link aggregation
3. DHCP relay
4. STP

Correct Answer: 1

Explanation

DNS traffic analysis can identify suspicious domain queries and unusual resolution patterns that may indicate malware communicating with command-and-control infrastructure. Analysts can examine factors such as query frequency, unusual domain characteristics, newly observed domains, and connections to known malicious destinations. DNS security controls can also block or redirect requests according to policy. Link aggregation combines interfaces, DHCP relay forwards configuration requests, and STP prevents switching loops. Therefore, DNS traffic analysis provides the visibility needed to detect suspicious domain-based communications.

Question 233

Which security protocol can protect administrative access to a network device by providing encrypted remote command-line communication?

1. Telnet
2. FTP
3. SSH
4. TFTP

Correct Answer: 3

Explanation

Secure Shell, or SSH, provides encrypted remote administrative access to network devices and servers. It protects credentials and command-line traffic from being transmitted as readable plaintext across the network. SSH can also support stronger authentication mechanisms and secure file-transfer capabilities through related protocols. Telnet does not provide comparable encryption, while FTP and TFTP are primarily file-transfer protocols. Therefore, SSH is the appropriate protocol for securely administering network infrastructure through a remote command-line session.

Question 234

Which security control helps detect unauthorized changes to important operating-system files by comparing their current state with an approved baseline?

1. File Integrity Monitoring
2. Network Address Translation
3. VLAN trunking
4. Route summarization

Correct Answer: 1

Explanation

File Integrity Monitoring, or FIM, tracks important files and compares their current characteristics against a trusted baseline. Depending on the implementation, it can monitor hashes, permissions, ownership, timestamps, or other attributes. Unexpected modifications can generate alerts for investigation because unauthorized changes may indicate malware activity, privilege abuse, or system compromise. NAT translates addresses, VLAN trunking carries multiple VLANs across links, and route summarization reduces routing information. Therefore, FIM provides the required detection of unauthorized file modifications.

Question 235

Which security capability can automatically assign different network-access permissions based on the authenticated user’s role or device classification?

1. Identity-based authorization
2. DNS recursion
3. Traffic mirroring
4. NAT overload

Correct Answer: 1

Explanation

Identity-based authorization allows access decisions to be determined by information about the authenticated user, device, role, or other contextual attributes. Instead of applying the same permissions to every endpoint, the security system can provide different access based on organizational policy. For example, an administrator’s device may receive different access from a contractor’s endpoint. DNS recursion handles name resolution, traffic mirroring copies packets, and NAT overload translates multiple addresses. Therefore, identity-based authorization provides the required role-aware access control.

Question 236

Which security technique makes stolen password databases more difficult to use by storing passwords as salted cryptographic hashes rather than plaintext?

1. Password hashing
2. VLAN tagging
3. Port mirroring
4. Route filtering

Correct Answer: 1

Explanation

Password hashing converts passwords into cryptographic representations rather than storing the original plaintext values. Adding a unique salt to each password before hashing helps prevent attackers from efficiently using precomputed lookup tables against many accounts. Modern password-storage systems should use appropriate password-hashing algorithms designed for this purpose rather than fast general-purpose hashes. VLAN tagging identifies VLAN membership, port mirroring copies traffic, and route filtering controls routing information. Therefore, salted password hashing provides the protection described for stored credentials.

Question 237

Which security mechanism can restrict traffic between virtual networks by applying policy at the routing or security boundary between them?

1. VRF segmentation
2. DNS caching
3. NTP
4. SFTP

Correct Answer: 1

Explanation

Virtual Routing and Forwarding, or VRF, creates separate routing tables on the same physical infrastructure. By maintaining distinct routing contexts, organizations can isolate traffic between different tenants, departments, environments, or security zones. Additional security policies can be applied where controlled communication between VRFs is required. DNS caching stores name-resolution results, NTP synchronizes time, and SFTP provides secure file transfer. Therefore, VRF segmentation can provide logical separation between network environments and help enforce controlled connectivity.

Question 238

Which incident-response action is intended to limit the spread of a compromise before the underlying threat has been completely removed?

1. Containment
2. Eradication
3. Recovery
4. Lessons learned

Correct Answer: 1

Explanation

Containment focuses on limiting the scope and impact of an active security incident. Security teams may isolate affected endpoints, block malicious communications, disable compromised accounts, or segment portions of the network while investigation and eradication continue. The purpose is to prevent the attacker or malware from spreading further. Eradication removes the underlying threat, recovery restores normal operations, and lessons learned evaluates the incident afterward. Therefore, containment is the incident-response activity specifically intended to restrict further damage while the investigation continues.

Question 239

Which cloud security capability provides visibility into cloud applications and helps enforce policies governing their use by employees?

1. CASB
2. CoPP
3. BPDU Guard
4. IP Source Guard

Correct Answer: 1

Explanation

A Cloud Access Security Broker, or CASB, provides visibility and security controls for cloud-service usage. It can help organizations discover applications, monitor cloud activity, enforce access policies, and apply data-protection or compliance controls. CASB capabilities can be particularly useful when users access cloud services from multiple locations and devices outside traditional enterprise boundaries. CoPP protects the control plane, BPDU Guard protects switch edge ports from unexpected spanning-tree messages, and IP Source Guard helps prevent source-address spoofing. Therefore, CASB matches the cloud-application requirement.

Question 240

Which security control can validate the source IP address of packets entering a switch port by using information learned through DHCP snooping?

1. IP Source Guard
2. DNSSEC
3. MACsec
4. Secure Web Gateway

Correct Answer: 1

Explanation

IP Source Guard uses trusted IP-to-MAC binding information, commonly learned through DHCP snooping, to validate traffic entering a switch interface. Packets with source information that does not match the expected binding can be blocked. This helps reduce source-address spoofing and unauthorized use of assigned addresses on Layer 2 networks. DNSSEC protects DNS data, MACsec provides Ethernet-frame confidentiality and integrity, and Secure Web Gateway protects web traffic. Therefore, IP Source Guard provides the described source-address validation.