View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 321

Which DNS security technique redirects requests for known malicious domains to a controlled destination so infected systems can be identified or prevented from reaching command-and-control infrastructure?

1. DNS recursion
2. DNS sinkholing
3. DNS caching
4. DNS delegation

Correct Answer: 2

Explanation

DNS sinkholing redirects DNS requests for identified malicious domains to a controlled destination instead of allowing the endpoint to connect to the original infrastructure. Security teams can use this technique to prevent communication with known malicious destinations while also identifying potentially compromised systems that continue attempting such connections. DNS recursion resolves queries on behalf of clients, caching stores previous responses, and delegation distributes authority between DNS servers. Therefore, DNS sinkholing provides both disruption and visibility for malicious domain activity.

Question 322

Which attack technique uses rapidly changing domain names or algorithms to make command-and-control infrastructure difficult for defenders to block using static domain lists?

1. DNSSEC
2. DNS tunneling
3. Domain Generation Algorithm
4. ARP spoofing

Correct Answer: 3

Explanation

A Domain Generation Algorithm, or DGA, can generate large numbers of pseudo-random domain names that malware may use to locate command-and-control infrastructure. Because the domains can change frequently, defenders cannot rely exclusively on manually maintained blocklists. Security systems can analyze domain characteristics, request patterns, reputation, and other indicators to identify DGA-related activity. DNSSEC protects DNS authenticity, DNS tunneling abuses DNS queries for data transfer, and ARP spoofing targets local address resolution. Therefore, DGA best describes the technique.

Question 323

Which security control can identify unusually large or frequent DNS queries that may indicate an attempt to use DNS as a covert data-transfer channel?

1. DNS traffic analysis
2. VLAN pruning
3. MACsec
4. Route summarization

Correct Answer: 1

Explanation

DNS traffic analysis examines DNS requests and responses for suspicious characteristics such as unusually long queries, excessive request rates, abnormal subdomain patterns, or encoded data. Attackers can abuse DNS to transfer information through queries and responses while attempting to blend activity with normal name resolution. Analyzing DNS behavior can therefore help identify potential tunneling. VLAN pruning controls VLAN propagation, MACsec protects Ethernet frames, and route summarization reduces routing-table size. Therefore, DNS traffic analysis is the appropriate detection capability.

Question 324

Which endpoint security capability can prevent known exploitation techniques by monitoring application behavior rather than relying only on malware signatures?

1. Exploit prevention
2. DHCP snooping
3. NAT
4. NTP

Correct Answer: 1

Explanation

Exploit prevention protects endpoints by detecting and blocking behaviors associated with attempts to exploit software vulnerabilities. Instead of depending exclusively on known malware signatures, exploit-prevention mechanisms can monitor suspicious memory, process, or application behavior and stop techniques used to gain unauthorized execution. This can provide protection against certain attacks even when a specific malicious file has not previously been identified. DHCP snooping protects DHCP operations, NAT translates addresses, and NTP synchronizes clocks. Therefore, exploit prevention provides the described endpoint defense.

Question 325

Which endpoint security function records processes, network connections, files, and other activity over time to support investigation of a suspected compromise?

1. Endpoint telemetry
2. VLAN tagging
3. Traffic shaping
4. NAT traversal

Correct Answer: 1

Explanation

Endpoint telemetry collects information about activity occurring on a device, such as process execution, file changes, network connections, user activity, and other security-relevant events. Security analysts can use this information to reconstruct activity, identify suspicious behavior, determine the scope of a compromise, and support incident response. VLAN tagging identifies Layer 2 network membership, traffic shaping controls bandwidth, and NAT traversal helps certain protocols operate through address translation. Therefore, endpoint telemetry provides the investigative visibility described.

Question 326

Which incident-response activity focuses on removing malicious files, persistence mechanisms, compromised accounts, and other components of an identified threat?

1. Preparation
2. Containment
3. Eradication
4. Recovery

Correct Answer: 3

Explanation

Eradication is the incident-response phase in which the underlying malicious components are removed from affected systems. Activities can include deleting malware, removing persistence mechanisms, disabling compromised credentials, closing exploited weaknesses, and eliminating unauthorized configurations. Containment focuses on limiting the spread or impact of the incident, while recovery restores systems to normal operation. Preparation occurs before incidents and establishes procedures, tools, and resources. Therefore, eradication specifically addresses removal of the threat from affected environments.

Question 327

During a security investigation, which process ensures that collected evidence can be traced from acquisition through storage, transfer, analysis, and presentation?

1. Chain of custody
2. Data compression
3. Route filtering
4. Session timeout

Correct Answer: 1

Explanation

Chain of custody documents how evidence is collected, handled, stored, transferred, and analyzed throughout an investigation. Maintaining this record helps demonstrate that evidence was properly controlled and that unauthorized changes or unexplained handling did not occur. Investigators may document who collected the evidence, when it was transferred, where it was stored, and what actions were performed. Data compression changes storage representation, route filtering controls routing information, and session timeout limits connection duration. Therefore, chain of custody provides the required evidence-tracking process.

Question 328

Which incident-response phase restores affected systems to normal operation after malicious activity has been removed and security controls have been verified?

1. Detection
2. Recovery
3. Containment
4. Analysis

Correct Answer: 2

Explanation

Recovery focuses on returning affected systems and services to normal operation after containment and eradication activities have been completed. Security teams may restore systems from trusted backups, rebuild compromised hosts, validate configurations, monitor restored services, and confirm that security controls are functioning correctly. Detection identifies potential incidents, containment limits their impact, and analysis determines what happened and how the threat operated. Therefore, recovery is the incident-response phase responsible for safely returning services to operational status.

Question 329

Which business continuity metric defines the maximum acceptable amount of time that a service can remain unavailable after a disruption?

1. RPO
2. MTTR
3. RTO
4. MTTD

Correct Answer: 3

Explanation

Recovery Time Objective, or RTO, defines the maximum targeted duration within which a system or service should be restored following a disruption. Organizations use RTO values to design recovery procedures, infrastructure redundancy, staffing requirements, and disaster-recovery capabilities. Recovery Point Objective, or RPO, focuses on the acceptable amount of data loss measured in time. MTTR measures average repair or recovery time, while MTTD measures how long it takes to detect an issue. Therefore, RTO represents the required recovery-time target.

Question 330

Which backup strategy stores only the changes made since the most recent full backup?

1. Incremental backup
2. Differential backup
3. Mirror backup
4. Synthetic backup

Correct Answer: 2

Explanation

A differential backup stores changes made since the most recent full backup. As time passes, each differential backup generally becomes larger because it includes all changes made since that last full backup. During restoration, a full backup and the latest differential backup are typically required. An incremental backup stores changes since the most recent backup of any type, which can reduce backup size but may require multiple backup sets during restoration. Therefore, differential backup matches the described strategy.

Question 331

Which vulnerability-management factor helps determine whether a vulnerability affecting an Internet-facing production server should receive greater attention than the same vulnerability on an isolated test system?

1. Asset criticality
2. Screen resolution
3. VLAN number
4. Interface speed

Correct Answer: 1

Explanation

Asset criticality considers the business importance and operational role of an affected system. An Internet-facing production server supporting an important business service may require faster remediation than an isolated test system even when both have the same vulnerability severity. Vulnerability-management programs can combine technical severity with exposure, exploitability, asset importance, and business impact to establish remediation priorities. Screen resolution, VLAN numbering, and interface speed do not determine the business significance of a vulnerable asset. Therefore, asset criticality is the relevant factor.

Question 332

Which vulnerability-management activity confirms that a previously reported security weakness has actually been corrected?

1. Threat modeling
2. Remediation verification
3. Asset discovery
4. Security awareness

Correct Answer: 2

Explanation

Remediation verification confirms that a vulnerability or configuration weakness has been successfully corrected. Security teams may perform another vulnerability scan, configuration review, authenticated assessment, or targeted validation after remediation. Simply changing the status of a vulnerability in a tracking system does not prove that the technical issue has been resolved. Threat modeling identifies potential threats, asset discovery identifies systems, and security awareness addresses user behavior. Therefore, remediation verification provides evidence that the reported weakness has been addressed.

Question 333

Which security testing approach attempts to identify vulnerabilities by analyzing application source code without executing the application?

1. DAST
2. SAST
3. Fuzz testing
4. Penetration testing

Correct Answer: 2

Explanation

Static Application Security Testing, or SAST, analyzes application source code or compiled representations without requiring the application to execute. It can identify coding weaknesses such as insecure functions, injection risks, improper input handling, and certain authentication or authorization problems. Dynamic Application Security Testing evaluates a running application, fuzz testing supplies unexpected inputs to discover weaknesses, and penetration testing attempts controlled exploitation of security weaknesses. Therefore, SAST provides the source-code analysis capability described.

Question 334

Which application-security testing method evaluates a running application from the outside by sending requests and analyzing its responses?

1. SCA
2. SAST
3. DAST
4. IaC scanning

Correct Answer: 3

Explanation

Dynamic Application Security Testing, or DAST, evaluates an application while it is running. The testing system interacts with the application through its available interfaces and analyzes responses for vulnerabilities such as injection flaws, authentication weaknesses, insecure configurations, and other application-layer problems. SAST examines source or compiled code, Software Composition Analysis identifies risks in third-party dependencies, and Infrastructure as Code scanning evaluates deployment definitions. Therefore, DAST provides the external testing approach described.

Question 335

Which software-security technique identifies known vulnerabilities and licensing concerns in third-party libraries used by an application?

1. SCA
2. DAST
3. SPAN
4. CoPP

Correct Answer: 1

Explanation

Software Composition Analysis, or SCA, examines third-party and open-source components used by an application. It can identify known vulnerabilities, outdated dependencies, software versions, and licensing information. This helps development and security teams understand risks introduced through external packages and determine whether updates or replacements are required. DAST tests running applications, SPAN mirrors network traffic, and CoPP protects the control plane of network devices. Therefore, SCA provides the dependency-analysis capability described.

Question 336

Which application-development security practice checks infrastructure configuration files for insecure settings before cloud resources are deployed?

1. Secrets rotation
2. IaC security scanning
3. Email filtering
4. Network address translation

Correct Answer: 2

Explanation

Infrastructure as Code security scanning analyzes configuration files used to provision infrastructure and identifies potentially insecure settings before deployment. Examples include overly permissive access rules, publicly exposed services, weak encryption settings, and insecure storage configurations. Detecting these issues during development helps prevent insecure infrastructure from reaching production and supports security integration within CI/CD processes. Secrets rotation manages credentials, email filtering protects messaging systems, and NAT translates addresses. Therefore, IaC security scanning provides the required pre-deployment configuration assessment.

Question 337

Which cloud security control is specifically designed to identify publicly exposed cloud storage resources that violate an organization’s security policy?

1. CSPM
2. CIEM
3. WAF
4. DLP

Correct Answer: 1

Explanation

Cloud Security Posture Management, or CSPM, continuously evaluates cloud environments for configuration weaknesses and policy violations. It can identify issues such as publicly accessible storage, insecure network configurations, missing encryption, and other posture problems. CSPM helps organizations compare cloud resources against defined security policies and compliance requirements. CIEM focuses on cloud permissions and entitlements, WAF protects web applications, and DLP focuses on controlling sensitive information. Therefore, CSPM is the appropriate control for identifying insecure cloud-storage exposure.

Question 338

Which cloud identity security capability helps identify accounts that possess permissions greater than those required for their assigned responsibilities?

1. SWG
2. CIEM
3. Secure Email Gateway
4. DNS security

Correct Answer: 2

Explanation

Cloud Infrastructure Entitlement Management helps organizations identify excessive or unnecessary permissions assigned to cloud identities. CIEM can analyze entitlements, discover unused privileges, identify over-permissioned accounts, and support least-privilege access decisions. This reduces the risk that compromised or misused identities can access more cloud resources than necessary. SWG protects web access, Secure Email Gateway protects email communications, and DNS security controls domain-related threats. Therefore, CIEM directly addresses excessive cloud permissions.

Question 339

Which secure access architecture provides users with application-specific access without requiring broad network-level access to the internal network?

1. Traditional site-to-site VPN
2. ZTNA
3. Static NAT
4. GRE

Correct Answer: 2

Explanation

Zero Trust Network Access, or ZTNA, provides application-specific access based on identity, device context, policy, and other security conditions rather than automatically granting broad network access after authentication. This approach reduces the attack surface by limiting users to resources they are explicitly authorized to access. A traditional site-to-site VPN connects networks, static NAT translates addresses, and GRE provides tunneling without providing the same access-control model. Therefore, ZTNA provides the application-specific access architecture described.

Question 340

Which security architecture combines networking and security functions delivered through cloud-based services to protect users regardless of their physical network location?

1. SASE
2. STP
3. VRRP
4. LACP

Correct Answer: 1

Explanation

Secure Access Service Edge, or SASE, combines networking capabilities with cloud-delivered security services to provide secure connectivity for users, devices, and applications regardless of location. SASE can incorporate capabilities such as secure web access, Zero Trust access, cloud access controls, and other security functions alongside networking services. This architecture supports distributed users and applications without depending entirely on traditional centralized network boundaries. STP prevents Layer 2 loops, VRRP provides gateway redundancy, and LACP combines links. Therefore, SASE matches the described architecture.