View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.

 

Question 121

Which IPsec protocol is responsible for negotiating authentication, encryption, and integrity parameters before protected traffic is exchanged?

1. ESP
2. IKE
3. ARP
4. GRE

Correct Answer: 2

Explanation

Internet Key Exchange, or IKE, negotiates the security parameters required for an IPsec connection. During the negotiation process, peers authenticate each other and agree on cryptographic algorithms, keying material, and other parameters used to establish security associations. IKEv2 is commonly deployed for modern IPsec VPN implementations. ESP subsequently protects the actual user traffic, while ARP performs local address resolution and GRE provides tunneling without inherently providing encryption. Therefore, IKE is responsible for negotiating the security parameters before protected IPsec traffic is transmitted.

Question 122

A security engineer wants to prevent unauthorized IPv4 DHCP servers from responding to clients on an access-layer switch. Which feature should be configured?

1. DHCP snooping
2. DNSSEC
3. CoPP
4. MACsec

Correct Answer: 1

Explanation

DHCP snooping helps protect an IPv4 network from rogue DHCP servers by distinguishing trusted and untrusted switch interfaces. DHCP server responses received on untrusted interfaces can be blocked, preventing unauthorized devices from assigning misleading network configuration to clients. DHCP snooping can also build binding information that other security features can use for additional protection. DNSSEC protects DNS data, CoPP protects the control plane, and MACsec provides Layer 2 encryption. Therefore, DHCP snooping is the appropriate feature for preventing rogue DHCP server responses.

Question 123

Which security function analyzes network traffic against predefined signatures and generates alerts without directly blocking the detected traffic?

1. IPS
2. DLP
3. IDS
4. NAC

Correct Answer: 3

Explanation

An Intrusion Detection System, or IDS, monitors network traffic and analyzes it for indicators of malicious activity, including known attack signatures and suspicious patterns. When an event matches a detection rule, the IDS generates an alert so security personnel or another security system can investigate it. Unlike an IPS, an IDS is primarily designed for detection and notification rather than direct traffic blocking. DLP focuses on sensitive-data protection, while NAC controls network access. Therefore, IDS is the technology described in this scenario.

Question 124

Which security control helps ensure that only authorized applications can execute on a managed endpoint?

1. Application allowlisting
2. Network Address Translation
3. Route filtering
4. DNS caching

Correct Answer: 1

Explanation

Application allowlisting restricts software execution to applications that have been explicitly approved by an organization. This can prevent unauthorized or malicious executables from running even when they reach an endpoint through phishing, downloads, removable media, or other channels. Depending on the implementation, policies can identify trusted applications using hashes, signatures, paths, publishers, or other attributes. NAT translates addresses, route filtering controls routing information, and DNS caching stores previously resolved names. Therefore, application allowlisting provides the required endpoint execution control.

Question 125

Which security mechanism allows a firewall to inspect encrypted HTTPS traffic by decrypting and then re-encrypting the session?

1. DNS tunneling
2. SSL/TLS inspection
3. Port security
4. DHCP relay

Correct Answer: 2

Explanation

SSL/TLS inspection allows a security device to decrypt protected application traffic, inspect its contents, and then establish or continue an encrypted session toward the destination. This provides security controls with visibility into threats that could otherwise remain hidden inside encrypted HTTPS connections. Proper certificate handling and privacy policies are important because the security device temporarily has access to decrypted content. DNS tunneling abuses DNS for communication, port security restricts Layer 2 access, and DHCP relay forwards DHCP requests. Therefore, SSL/TLS inspection provides the described capability.

Question 126

Which cloud security model requires the cloud provider to protect the underlying physical infrastructure while the customer remains responsible for configured resources and data according to the service model?

1. Shared responsibility model
2. Zero Trust model
3. Bell-LaPadula model
4. Clark-Wilson model

Correct Answer: 1

Explanation

The shared responsibility model divides security responsibilities between the cloud provider and the customer. The provider is generally responsible for security of the underlying cloud infrastructure, while customers remain responsible for aspects such as their data, identities, configurations, and workloads depending on the specific cloud service. The exact division changes between IaaS, PaaS, and SaaS. Zero Trust concerns access decisions, while Bell-LaPadula and Clark-Wilson are information-security models. Therefore, the shared responsibility model describes the division of cloud security obligations.

Question 127

Which cryptographic mechanism uses a private key to create a signature that can be verified with the corresponding public key?

1. Symmetric encryption
2. Digital signature
3. Hash collision
4. Tokenization

Correct Answer: 2

Explanation

A digital signature uses asymmetric cryptography to provide evidence that data was signed by the holder of a particular private key. The corresponding public key can be used to verify the signature. Digital signatures can provide integrity and authentication and may support nonrepudiation depending on the surrounding process and legal context. Symmetric encryption uses a shared secret key, a hash collision concerns two inputs producing the same digest, and tokenization substitutes sensitive data with tokens. Therefore, a digital signature provides the cryptographic mechanism described.

Question 128

Which Cisco firewall policy capability can identify traffic according to the application generating it rather than only using traditional port numbers?

1. Application control
2. Static routing
3. ARP inspection
4. DHCP snooping

Correct Answer: 1

Explanation

Application control allows a security policy to identify and enforce rules based on applications rather than relying solely on IP addresses and transport-layer ports. This provides greater visibility because modern applications may use dynamic ports, shared protocols, or encrypted connections. Application-aware policies can therefore provide more granular control over permitted or denied activity. Static routing determines forwarding paths, ARP inspection protects address-resolution behavior, and DHCP snooping protects against rogue DHCP servers. Therefore, application control is the capability that identifies traffic by application.

Question 129

Which security technique makes it more difficult for attackers to determine whether a username exists by returning similar authentication responses for valid and invalid accounts?

1. Account enumeration prevention
2. Packet filtering
3. VLAN pruning
4. Route redistribution

Correct Answer: 1

Explanation

Account enumeration prevention reduces the amount of information exposed during authentication attempts. If a system clearly distinguishes between an invalid username and an incorrect password, attackers can use those responses to identify valid accounts before attempting password attacks. Applications can reduce this risk by providing similar responses and carefully controlling error messages, while logging and rate-limiting suspicious authentication activity. Packet filtering controls traffic, VLAN pruning restricts VLAN propagation, and route redistribution exchanges routing information. Therefore, account enumeration prevention is the appropriate security technique.

Question 130

Which protocol provides secure remote administration of a network device by encrypting the management session?

1. Telnet
2. FTP
3. SSH
4. TFTP

Correct Answer: 3

Explanation

SSH provides encrypted remote command-line administration for network devices and servers. It protects credentials and interactive management traffic from being transmitted as clear text across the network. Administrators can use SSH to configure routers, switches, firewalls, and other infrastructure securely. Telnet provides remote access without equivalent built-in encryption, while FTP and TFTP are primarily file-transfer protocols. Secure management access should also be restricted to authorized source networks and protected with strong authentication and appropriate logging. Therefore, SSH is the correct protocol for encrypted remote administration.

Question 131

Which security technology can identify whether sensitive information is being transmitted through an organization’s approved or unapproved cloud applications?

1. CASB
2. HSRP
3. OSPF
4. LACP

Correct Answer: 1

Explanation

A Cloud Access Security Broker, or CASB, provides visibility and policy enforcement between users and cloud services. Depending on the implementation, CASB capabilities can help identify cloud applications, apply access policies, monitor data movement, and enforce controls such as DLP. This is useful when employees use numerous cloud applications that may not all be officially approved. HSRP provides gateway redundancy, OSPF is a routing protocol, and LACP negotiates link aggregation. Therefore, CASB is the security technology associated with cloud-application visibility and policy enforcement.

Question 132

Which type of attack attempts to cause a system to execute unauthorized commands by inserting unexpected input into an operating-system command?

1. Command injection
2. MAC flooding
3. DHCP starvation
4. Credential stuffing

Correct Answer: 1

Explanation

Command injection occurs when an application improperly handles user-controlled input and allows an attacker to influence commands executed by the underlying operating system. Successful exploitation can allow unauthorized actions with the privileges of the vulnerable application or process. Secure development practices such as input validation, safe APIs, parameterization where appropriate, and least-privilege execution can reduce the risk. MAC flooding targets switch forwarding tables, DHCP starvation consumes address leases, and credential stuffing uses previously compromised credentials. Therefore, command injection matches the described attack.

Question 133

Which security technology can provide centralized authentication, authorization, and accounting for administrators accessing network devices?

1. RADIUS
2. TACACS+
3. DNS
4. NTP

Correct Answer: 2

Explanation

TACACS+ is commonly used for centralized administrative access control to network devices. It separates authentication, authorization, and accounting functions and can provide detailed authorization of administrative commands. This makes it particularly useful for controlling and auditing administrator access to routers, switches, and security appliances. RADIUS is also widely used for centralized authentication, particularly for network access, but TACACS+ is commonly associated with granular device-administration authorization. DNS resolves names and NTP synchronizes time. Therefore, TACACS+ best matches the described administrative access-control requirement.

Question 134

Which security capability can automatically place a suspicious endpoint into a restricted network segment after detecting a policy violation?

1. Dynamic network access control
2. Static routing
3. DNS forwarding
4. NAT overload

Correct Answer: 1

Explanation

Dynamic network access control can change an endpoint’s authorization or network placement in response to security conditions. For example, an endpoint that fails posture checks or is identified as suspicious can be moved into a restricted VLAN or assigned a limited access policy. This allows organizations to contain potentially compromised devices while preserving controlled connectivity for remediation. Static routing determines packet paths, DNS forwarding handles name-resolution requests, and NAT overload translates multiple addresses through one public address. Therefore, dynamic network access control provides the described response capability.

Question 135

Which security feature helps prevent attackers from using forged ARP messages to associate their MAC address with another device’s IP address?

1. Dynamic ARP Inspection
2. DNSSEC
3. CoPP
4. Port mirroring

Correct Answer: 1

Explanation

Dynamic ARP Inspection, or DAI, validates ARP messages on supported switches to reduce the risk of ARP spoofing and poisoning. It can compare ARP information against trusted IP-to-MAC bindings, commonly obtained through DHCP snooping. Invalid ARP packets can then be discarded. DNSSEC protects DNS information, CoPP protects the control plane, and port mirroring copies traffic for analysis. ARP spoofing can allow an attacker to intercept or redirect local traffic, making DAI an important Layer 2 protection. Therefore, DAI provides the described defense.

Question 136

Which security control helps identify unauthorized changes to critical operating-system files by continuously comparing their state with a trusted baseline?

1. File integrity monitoring
2. Traffic shaping
3. Load balancing
4. Route summarization

Correct Answer: 1

Explanation

File integrity monitoring compares important files against known trusted states and alerts security personnel when unexpected changes occur. It can be used to monitor operating-system files, configuration files, application components, and other critical resources. Unexpected modifications may indicate malware activity, unauthorized administrative actions, or system compromise. File integrity monitoring is particularly useful when combined with centralized logging and incident-response processes. Traffic shaping manages bandwidth, load balancing distributes application requests, and route summarization reduces routing information. Therefore, file integrity monitoring provides the described protection.

Question 137

Which security mechanism can use a cryptographic hash to verify that downloaded software has not been modified after publication?

1. Hash verification
2. VLAN tagging
3. DHCP relay
4. NAT traversal

Correct Answer: 1

Explanation

Hash verification allows a recipient to calculate a cryptographic digest of downloaded software and compare it with a trusted published value. If the calculated digest matches the expected value, the recipient gains evidence that the file contents have not changed since the trusted value was generated. Hashes do not by themselves prove who published the software, so digital signatures may provide stronger authenticity assurance when available. VLAN tagging identifies VLAN membership, DHCP relay forwards requests, and NAT traversal supports certain communications through address translation. Therefore, hash verification provides integrity checking.

Question 138

Which security service is primarily designed to filter malicious or inappropriate web requests and enforce acceptable-use policies for Internet browsing?

1. Secure Web Gateway
2. DHCP server
3. Routing Information Base
4. Network Time Protocol

Correct Answer: 1

Explanation

A Secure Web Gateway, or SWG, provides security controls for web traffic between users and Internet destinations. Depending on the implementation, it can enforce URL policies, inspect web content, identify malware, apply data-protection controls, and block prohibited or risky websites. SWGs are commonly used as part of secure access service architectures and can protect users regardless of where they connect from. DHCP provides IP configuration, the routing information base stores routes, and NTP synchronizes clocks. Therefore, Secure Web Gateway is the appropriate web-security service.

Question 139

Which security control can reduce the risk of unauthorized users gaining access through a stolen password by requiring an additional authentication factor?

1. Password expiration
2. Multifactor authentication
3. Account naming convention
4. Static authorization

Correct Answer: 2

Explanation

Multifactor authentication adds one or more independent authentication factors beyond a password. For example, an organization may require a password plus a hardware token, authenticator application approval, or biometric factor. If an attacker obtains the password alone, the additional factor can prevent or significantly complicate unauthorized access. Password expiration may reduce exposure in some circumstances but does not provide an independent authentication factor. Account naming conventions and static authorization do not provide equivalent authentication protection. Therefore, multifactor authentication is the appropriate control.

Question 140

Which security technology can identify abnormal network communication by establishing a baseline of expected behavior and detecting significant deviations?

1. Behavioral analysis
2. Static NAT
3. VLAN trunking
4. DHCP relay

Correct Answer: 1

Explanation

Behavioral analysis identifies suspicious activity by comparing observed behavior with an established or dynamically learned baseline of normal activity. Significant deviations, such as unusual communication patterns, unexpected destinations, abnormal data volumes, or atypical user behavior, can generate security alerts for investigation. This approach can help detect previously unknown or modified threats that may not match traditional signatures. Static NAT maps addresses, VLAN trunking transports multiple VLANs, and DHCP relay forwards configuration requests. Therefore, behavioral analysis provides the anomaly-detection capability described.