View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 21

What protocol secures email transmission using cryptographic public keys?

1. Pretty Good Privacy
2. Telnet remote administration
3. File Transfer Protocol
4. Trivial File Transfer Protocol

Correct Answer: 1

Explanation:

Pretty Good Privacy (PGP) is a widely used cryptographic software system that provides cryptographic privacy and authentication for data communication. PGP is frequently utilized for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions to increase the security of email communications. It combines symmetric encryption algorithms and public-key cryptography to ensure robust confidentiality and integrity. By utilizing a web of trust model, PGP allows users to verify digital signatures and establish trust in public keys without relying exclusively on centralized certificate authorities, making it a powerful tool for secure peer-to-peer messaging.

Question 22

Which wireless security standard mandates CCMP and AES encryption?

1. Wired Equivalent Privacy
2. Wi-Fi Protected Access
3. Wi-Fi Protected Access 2
4. Open unencrypted wireless

Correct Answer: 3

Explanation:

Wi-Fi Protected Access 2 (WPA2) was introduced by the Wi-Fi Alliance to provide robust enterprise-grade security for wireless local area networks, addressing critical cryptographic vulnerabilities found in original WEP and transitional WPA-TKIP protocols. WPA2 mandates the use of the Advanced Encryption Standard (AES) algorithm combined with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) to ensure strict data confidentiality, integrity, and authentication over the air. By utilizing strong cryptographic keys and secure cipher wrappers, WPA2 effectively protects enterprise wireless communications against unauthorized eavesdropping, packet injection, and cryptographic cracking attacks.

Question 23

What attack floods target servers to disrupt operational availability?

1. Structured Query Language injection
2. Denial of Service attack
3. Cross-site scripting attack
4. Address Resolution Protocol spoofing

Correct Answer: 2

Explanation:

A Denial of Service (DoS) attack is a malicious cyber threat designed to render a target system, network, or application unavailable to its intended users. Attackers achieve this by flooding the victim resource with an overwhelming volume of illegitimate traffic or exploiting software vulnerabilities to exhaust critical system resources, such as processing power, memory, bandwidth, or connection tables. Distributed Denial of Service (DDoS) attacks scale this concept by utilizing coordinated networks of compromised machines, known as botnets, to launch synchronized floods from multiple geographic sources. Mitigating these attacks requires robust traffic monitoring, rate-limiting, and cloud-based scrubbing centers.

Question 24

Which security tool captures and analyzes network traffic packets?

1. Packet sniffer network analyzer
2. Layer 2 Ethernet switch
3. Basic network repeater hub
4. Unshielded twisted-pair patch cable

Correct Answer: 1

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software or hardware tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications, detect anomalies, identify malicious payloads, and audit security policies.

Question 25

What vulnerability allows malicious input into database queries?

1. Cross-site scripting vulnerability
2. Buffer overflow flaw
3. Structured Query Language injection
4. Man-in-the-middle interception

Correct Answer: 3

Explanation:

SQL injection (SQLi) is a dangerous code injection vulnerability that occurs when malicious user input is improperly sanitized and concatenated directly into database query statements. If an application fails to validate input properly, an attacker can input specially crafted SQL commands into web forms or uniform resource locators, tricking the underlying database management system into executing unauthorized commands. This can lead to severe security breaches, including unauthorized access to sensitive user data, table modification, credential theft, and complete database server compromise. Preventing SQLi requires parameterized queries, input validation, and stored procedures.

Question 26

Which cryptographic hash function produces a 256-bit digest?

1. Message Digest 5
2. Secure Hash Algorithm 256
3. Secure Hash Algorithm 1
4. Data Encryption Standard

Correct Answer: 2

Explanation:

Secure Hash Algorithm 256 (SHA-256) is a member of the SHA-2 cryptographic hash function family designed by the National Security Agency. SHA-256 takes an input of arbitrary length and produces a fixed 256-bit (32-byte) hash value, typically represented as a 64-character hexadecimal string. Because of its cryptographic strength and collision resistance, SHA-256 is widely utilized across modern security protocols, including digital certificates, blockchain transactions, secure firmware updates, and TLS encryption handshakes. It ensures data integrity by making it computationally infeasible for attackers to alter data without changing the resulting hash digest.

Question 27

What protocol manages network device configurations securely via SSH?

1. Telnet protocol
2. Hypertext Transfer Protocol
3. Trivial File Transfer Protocol
4. Network Configuration Protocol

Correct Answer: 4

Explanation:

Network Configuration Protocol (NETCONF) is a network management protocol developed by the Internet Engineering Task Force to address the limitations of legacy management interfaces like SNMP and CLI scripting. NETCONF provides mechanisms to install, manipulate, and delete the configurations of network devices programmatically. It operates over secure transport protocols like Secure Shell (SSH), ensuring that management sessions and configuration data payloads are fully encrypted and authenticated. By utilizing XML-based data encodings and supporting structured data models like YANG, NETCONF enables automated network orchestration and software-defined networking workflows.

Question 28

Which security device monitors and blocks unauthorized network traffic?

1. Enterprise network firewall
2. Passive repeater hub
3. Structured cabling patch panel
4. Layer 2 Ethernet bridge

Correct Answer: 1

Explanation:

A network firewall is a dedicated security system designed to monitor, filter, and control incoming and outgoing network traffic based on a pre-configured set of organizational security rules. Operating at various layers of the OSI model depending on architecture, firewalls establish a trusted boundary between internal corporate networks and untrusted external environments like the internet. Modern next-generation firewalls integrate deep packet inspection, intrusion prevention, and application awareness to block malicious traffic, prevent unauthorized access, and protect enterprise assets against sophisticated cyber threats while permitting legitimate business communications.

Question 29

What mechanism prevents unauthorized access via wireless network pre-shared keys?

1. Wired Equivalent Privacy encryption
2. Open unencrypted network authentication
3. WPA3-Personal Simultaneous Authentication of Equals
4. Passive hub signal repeating

Correct Answer: 3

Explanation:

Wi-Fi Protected Access 3 Personal introduced advanced cryptographic enhancements to secure wireless networks against offline dictionary attacks. Traditional WPA2-Personal networks relied on static pre-shared keys, allowing attackers to capture handshake packets over the air and execute brute-force decryption offline if the passphrase was weak. WPA3-Personal replaces this exchange with Simultaneous Authentication of Equals (SAE), a secure key establishment protocol based on elliptic-curve cryptography. SAE ensures that even if users choose weak passwords, attackers cannot recover the password through offline dictionary attacks, while also providing robust forward secrecy for wireless sessions.

Question 30

Which attack intercepts communications between two unsuspecting network endpoints?

1. Denial of service attack
2. Man-in-the-middle attack
3. Structured Query Language injection
4. Buffer overflow execution

Correct Answer: 2

Explanation:

A man-in-the-middle (MitM) attack occurs when a malicious actor secretly intercepts and relays communications between two parties who believe they are communicating directly with each other. The attacker positions themselves along the communication path, enabling them to eavesdrop on sensitive conversations, harvest credentials, or modify data payloads in transit without the victims’ knowledge. MitM attacks frequently occur on unsecured public Wi-Fi networks or through ARP spoofing and DNS poisoning techniques. Implementing robust cryptographic protocols such as HTTPS, TLS encryption, and digital certificate validation effectively neutralizes eavesdropping threats.

Question 31

What malware encrypts user files demanding financial ransom payment?

1. Adware marketing program
2. Spyware tracking software
3. Ransomware malware software
4. Bootkit loader module

Correct Answer: 3

Explanation:

Ransomware is a particularly destructive form of malicious software designed to deny access to a computer system or encrypt critical files until a financial ransom is paid to the cybercriminals. Once deployed on a victim machine, ransomware utilizes robust asymmetric and symmetric encryption algorithms to lock local files and connected network shares. Attackers typically leave digital drop notes demanding cryptocurrency payments in exchange for the decryption keys. Mitigating ransomware requires comprehensive multi-layered security strategies, including regular offline backups, advanced endpoint protection, employee security awareness training, and robust network segmentation.

Question 32

Which protocol provides secure file transfers over SSH transport?

1. File Transfer Protocol
2. Secure File Transfer Protocol
3. Trivial File Transfer Protocol
4. Hypertext Transfer Protocol

Correct Answer: 2

Explanation:

Secure File Transfer Protocol (SFTP) is a secure network protocol designed to provide file access, file transfer, and file management functionalities over any reliable data stream. Unlike legacy File Transfer Protocol (FTP) which transmits credentials and data payloads in clear text across separate control and data channels, SFTP operates entirely over a secure Secure Shell (SSH) session utilizing TCP port 22. This integration ensures that all transmitted passwords, file metadata, and data streams are fully encrypted from end to end, protecting sensitive enterprise data against eavesdropping and tampering during transit across public networks.

Question 33

What security testing method involves examining application source code?

1. Dynamic application analysis
2. Black-box penetration testing
3. Static code security analysis
4. Active port scanning

Correct Answer: 3

Explanation:

Static code analysis—often referred to as static application security testing (SAST)—is a software debugging and security methodology that analyzes source code or compiled binaries for security vulnerabilities without executing the program. Performed during early phases of the software development lifecycle, static analysis tools inspect code syntax, control flows, and architectural logic against known vulnerability patterns and secure coding standards. By identifying security flaws early in development, organizations can remediate coding defects before applications are deployed into production environments, significantly reducing software risk and remediation costs.

Question 34

Which cloud service model provides fully managed application platforms?

1. Platform as a Service
2. Infrastructure as a Service
3. Software as a Service
4. Desktop as a Service

Correct Answer: 1

Explanation:

Platform as a Service (PaaS) is a cloud computing service model that supplies an on-demand environment for developing, testing, delivering, and managing software applications. PaaS provides developers with a complete hardware and software platform—including operating systems, databases, web servers, and development frameworks—hosted on remote cloud infrastructure, freeing them from managing underlying physical servers or storage arrays. This allows development teams to focus entirely on writing code and building applications, accelerating time-to-market while maintaining scalability and administrative efficiency across cloud environments.

Question 35

What security device detects malicious network intrusions via signatures?

1. Ethernet Layer 2 switch
2. Network signal repeater
3. Intrusion Detection System
4. Structured cabling patch panel

Correct Answer: 3

Explanation:

An Intrusion Detection System (IDS) is a specialized security appliance or software solution designed to monitor network traffic for suspicious activity, policy violations, and known attack signatures. Operating primarily in passive monitoring modes by tapping into SPAN ports or optical splitters, an IDS analyzes packet streams and compares them against signature databases or behavioral anomaly baselines. When a potential security threat or intrusion attempt is identified, the IDS generates real-time security alerts for administrative review, allowing security operations teams to investigate and respond to cyber threats without interrupting live network traffic flows.

Question 36

Which protocol provides secure directory service authentication over networks?

1. Lightweight Directory Access Protocol
2. Lightweight Directory Access Protocol Secure
3. Unencrypted Telnet protocol
4. Hypertext Transfer Protocol

Correct Answer: 2

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of the standard Lightweight Directory Access Protocol, designed to provide directory service querying and user authentication across IP networks. While standard LDAP transmits directory queries, user accounts, and credentials in clear text, LDAPS wraps the communication session inside Transport Layer Security (TLS) or Secure Sockets Layer (SSL) encryption wrappers, typically operating over TCP port 636. This encryption ensures that sensitive user credentials and enterprise directory schemas are protected against packet sniffing and credential harvesting attacks.

Question 37

What security principle restricts user account permissions to minimum necessary?

1. Defense in depth strategy
2. Principle of least privilege
3. Zero Trust network architecture
4. Separation of duties policy

Correct Answer: 2

Explanation:

The principle of least privilege is a fundamental information security concept that dictates that a user, process, or system component must be given only the minimum levels of access permissions—or privileges—necessary to perform its specific, authorized job functions. By restricting privileges strictly to operational requirements, organizations significantly limit the potential blast radius of credential compromise, insider threats, and malware propagation. For example, standard network users should never possess administrative privileges, and software applications should execute under restricted service accounts rather than root-level permissions.

Question 38

Which malware type replicates automatically across networks without user action?

1. Computer virus infection
2. Trojan horse program
3. Computer worm malware
4. Adware spyware program

Correct Answer: 3

Explanation:

A computer worm is a standalone malicious software program that replicates itself in order to spread to other computers across network connections. Unlike traditional computer viruses that require user intervention—such as opening an infected document or running an executable file—worms operate autonomously, exploiting operating system vulnerabilities or misconfigurations to scan and propagate across local networks and the internet. Once a worm infects a system, it consumes valuable bandwidth, exhausts CPU resources, and frequently installs secondary payloads like backdoors or ransomware, posing a severe threat to network availability.

Question 39

What security framework implements continuous verification of all identities?

1. Traditional perimeter defense
2. Demilitarized zone architecture
3. Static VLAN segmentation model
4. Zero Trust Architecture

Correct Answer: 4

Explanation:

Zero Trust Architecture (ZTA) is a modern cybersecurity paradigm based on the core philosophy of “never trust, always verify.” Traditional enterprise security models relied heavily on perimeter defenses, assuming that everything inside the corporate network was inherently trustworthy. Zero Trust eliminates this assumption, mandating continuous, strict identity verification, device health validation, and least-access authorization for every user and device attempting to access resources, regardless of whether they originate from inside or outside the traditional network perimeter.

Question 40

Which protocol secures domain name resolution records using cryptography?

1. Domain Name System Security Extensions
2. Dynamic Host Configuration Protocol
3. Simple Network Management Protocol
4. Network Time Protocol

Correct Answer: 1

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the Internet Engineering Task Force to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in security, making them highly vulnerable to cache poisoning and spoofing attacks where malicious actors redirected traffic to fraudulent servers. DNSSEC addresses this by signing DNS records cryptographically using digital signatures based on public key cryptography. This allows client resolvers to verify the authenticity and integrity of DNS responses, ensuring users connect to legitimate destinations.