View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 41

Which protocol secures web traffic utilizing cryptographic certificates?

1. Unencrypted Telnet remote administration protocol
2. File Transfer Protocol utility
3. Hypertext Transfer Protocol Secure service
4. Trivial File Transfer Protocol daemon

Correct Answer: 3

Explanation:

Hypertext Transfer Protocol Secure (HTTPS) is the secure extension of standard HTTP, designed to protect web communications between client browsers and enterprise web servers against eavesdropping, tampering, and man-in-the-middle attacks. HTTPS wraps standard HTTP data payloads inside Transport Layer Security (TLS) or Secure Sockets Layer (SSL) cryptographic encryption wrappers backed by digital certificates issued by trusted certificate authorities. Network administrators configure HTTPS to operate over TCP port 443, ensuring robust data confidentiality, integrity, and authentication for modern web applications and cloud services. This cryptographic wrapping protects sensitive user data during transit across untrusted public networks.

Question 42

What security architecture assumes zero implicit network trust?

1. Traditional perimeter defense model
2. Zero Trust network architecture
3. Demilitarized zone network design
4. Static VLAN segmentation model

Correct Answer: 2

Explanation:

Zero Trust Architecture (ZTA) is a modern cybersecurity paradigm based on the core philosophy of “never trust, always verify.” Traditional enterprise security models relied heavily on perimeter defenses, assuming that everything inside the corporate network was inherently trustworthy. Zero Trust eliminates this assumption, mandating continuous, strict identity verification, device health validation, and least-access authorization for every user and device attempting to access resources, regardless of whether they originate from inside or outside the traditional network perimeter. By micro-segmenting resources and inspecting all traffic flows, organizations significantly reduce lateral movement and improve overall resilience.

Question 43

Which cryptographic algorithm provides secure asymmetric public key encryption?

1. Advanced Encryption Standard
2. Message Digest 5 algorithm
3. Secure Hash Algorithm 256
4. Rivest-Shamir-Adleman cryptographic system

Correct Answer: 4

Explanation:

The Rivest-Shamir-Adleman (RSA) cryptosystem is one of the foundational public-key cryptography algorithms widely used for secure data transmission and digital signatures. Unlike symmetric encryption that utilizes a single shared key, asymmetric cryptography utilizes a mathematically linked key pair: a public key used for encrypting data or verifying signatures, and a private key kept secret for decryption and signing. RSA relies on the mathematical difficulty of factoring the product of two large prime numbers. It plays a critical role in establishing secure TLS sessions, exchanging symmetric session keys safely, and issuing digital certificates across enterprise security architectures.

Question 44

What security device inspects deep application layer payloads?

1. Next-Generation Firewall appliance
2. Layer 2 Ethernet switch
3. Basic network repeater hub
4. Passive copper signal regenerator

Correct Answer: 1

Explanation:

A Next-Generation Firewall (NGFW) is an advanced security appliance that goes far beyond traditional packet-filtering firewalls by performing deep packet inspection up to Layer 7 of the OSI model. While legacy firewalls evaluated only IP addresses and port numbers, NGFWs inspect application-layer traffic payloads to identify specific applications, detect sophisticated malware signatures, prevent intrusion attempts, and enforce granular security policies. They integrate traditional firewall capabilities with intrusion prevention systems, URL filtering, and advanced threat intelligence feeds, providing comprehensive security visibility and enforcement across modern corporate networks and data centers.

Question 45

Which protocol translates internal private addresses to public?

1. Address Resolution Protocol stack
2. Dynamic Host Configuration Protocol
3. Network Address Translation protocol
4. Internet Control Message Protocol

Correct Answer: 3

Explanation:

Network Address Translation (NAT) is a core networking mechanism used to map internal private IP addresses to external public IP addresses, thereby conserving scarce IPv4 address space. NAT operates on border routers or enterprise firewalls, modifying source or destination IP headers as packets transition between internal local networks and the public internet. This process ensures that internal host infrastructure remains hidden from direct external inspection while retaining full outbound internet connectivity. Variants like Port Address Translation allow thousands of internal client devices to share a single routable public IP address using unique port identifiers.

Question 46

What attack floods target servers to exhaust resources?

1. Structured Query Language injection
2. Denial of Service attack
3. Cross-site scripting attack vector
4. Address Resolution Protocol spoofing

Correct Answer: 2

Explanation:

A Denial of Service (DoS) attack is a malicious cyber threat designed to render a target system, network, or application unavailable to its intended users. Attackers achieve this by flooding the victim resource with an overwhelming volume of illegitimate traffic or exploiting software vulnerabilities to exhaust critical system resources, such as processing power, memory, bandwidth, or connection tables. Distributed Denial of Service (DDoS) attacks scale this concept by utilizing coordinated networks of compromised machines, known as botnets, to launch synchronized floods from multiple geographic sources. Mitigating these attacks requires robust traffic monitoring, rate-limiting, and cloud-based scrubbing centers.

Question 47

Which security tool captures and analyzes network traffic packets?

1. Layer 2 Ethernet switch
2. Basic network repeater hub
3. Unshielded twisted-pair patch cable
4. Packet sniffer network analyzer

Correct Answer: 4

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software or hardware tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications, detect anomalies, identify malicious payloads, and audit security policies.

Question 48

What vulnerability allows malicious input into database queries?

1. Structured Query Language injection
2. Buffer overflow execution flaw
3. Cross-site scripting vulnerability
4. Man-in-the-middle interception vector

Correct Answer: 1

Explanation:

SQL injection (SQLi) is a dangerous code injection vulnerability that occurs when malicious user input is improperly sanitized and concatenated directly into database query statements. If an application fails to validate input properly, an attacker can input specially crafted SQL commands into web forms or uniform resource locators, tricking the underlying database management system into executing unauthorized commands. This can lead to severe security breaches, including unauthorized access to sensitive user data, table modification, credential theft, and complete database server compromise. Preventing SQLi requires parameterized queries, input validation, and stored procedures.

Question 49

Which protocol manages network device configurations securely via SSH?

1. Telnet remote administration protocol
2. Hypertext Transfer Protocol service
3. Network Configuration Protocol daemon
4. Trivial File Transfer Protocol

Correct Answer: 3

Explanation:

Network Configuration Protocol (NETCONF) is a network management protocol developed by the Internet Engineering Task Force to address the limitations of legacy management interfaces like SNMP and CLI scripting. NETCONF provides mechanisms to install, manipulate, and delete the configurations of network devices programmatically. It operates over secure transport protocols like Secure Shell (SSH), ensuring that management sessions and configuration data payloads are fully encrypted and authenticated. By utilizing XML-based data encodings and supporting structured data models like YANG, NETCONF enables automated network orchestration and software-defined networking workflows across enterprise infrastructures.

Question 50

What security device monitors and blocks unauthorized network traffic?

1. Passive repeater hub device
2. Enterprise network firewall
3. Structured cabling patch panel
4. Layer 2 Ethernet bridge

Correct Answer: 2

Explanation:

A network firewall is a dedicated security system designed to monitor, filter, and control incoming and outgoing network traffic based on a pre-configured set of organizational security rules. Operating at various layers of the OSI model depending on architecture, firewalls establish a trusted boundary between internal corporate networks and untrusted external environments like the internet. Modern next-generation firewalls integrate deep packet inspection, intrusion prevention, and application awareness to block malicious traffic, prevent unauthorized access, and protect enterprise assets against sophisticated cyber threats while permitting legitimate business communications.

Question 51

Which malware encrypts user files demanding financial ransom payment?

1. Adware marketing program module
2. Spyware tracking software agent
3. Network propagation worm utility
4. Ransomware malware software

Correct Answer: 4

Explanation:

Ransomware is a particularly destructive form of malicious software designed to deny access to a computer system or encrypt critical files until a financial ransom is paid to the cybercriminals. Once deployed on a victim machine, ransomware utilizes robust asymmetric and symmetric encryption algorithms to lock local files and connected network shares. Attackers typically leave digital drop notes demanding cryptocurrency payments in exchange for the decryption keys. Mitigating ransomware requires comprehensive multi-layered security strategies, including regular offline backups, advanced endpoint protection, employee security awareness training, and robust network segmentation.

Question 52

What protocol provides secure file transfers over SSH transport?

1. Secure File Transfer Protocol
2. Legacy File Transfer Protocol
3. Trivial File Transfer Protocol
4. Hypertext Transfer Protocol service

Correct Answer: 1

Explanation:

Secure File Transfer Protocol (SFTP) is a secure network protocol designed to provide file access, file transfer, and file management functionalities over any reliable data stream. Unlike legacy File Transfer Protocol (FTP) which transmits credentials and data payloads in clear text across separate control and data channels, SFTP operates entirely over a secure Secure Shell (SSH) session utilizing TCP port 22. This integration ensures that all transmitted passwords, file metadata, and data streams are fully encrypted from end to end, protecting sensitive enterprise data against eavesdropping and tampering during transit across public networks.

Question 53

Which cloud service model provides fully managed application platforms?

1. Infrastructure as a Service model
2. Software as a Service product
3. Platform as a Service solution
4. Desktop as a Service offering

Correct Answer: 3

Explanation:

Platform as a Service (PaaS) is a cloud computing service model that supplies an on-demand environment for developing, testing, delivering, and managing software applications. PaaS provides developers with a complete hardware and software platform—including operating systems, databases, web servers, and development frameworks—hosted on remote cloud infrastructure, freeing them from managing underlying physical servers or storage arrays. This allows development teams to focus entirely on writing code and building applications, accelerating time-to-market while maintaining scalability and administrative efficiency across cloud environments.

Question 54

What security device detects malicious network intrusions via signatures?

1. Ethernet Layer 2 switch
2. Intrusion Detection System appliance
3. Network signal repeater device
4. Structured cabling patch panel

Correct Answer: 2

Explanation:

An Intrusion Detection System (IDS) is a specialized security appliance or software solution designed to monitor network traffic for suspicious activity, policy violations, and known attack signatures. Operating primarily in passive monitoring modes by tapping into SPAN ports or optical splitters, an IDS analyzes packet streams and compares them against signature databases or behavioral anomaly baselines. When a potential security threat or intrusion attempt is identified, the IDS generates real-time security alerts for administrative review, allowing security operations teams to investigate and respond to cyber threats without interrupting live network traffic flows.

Question 55

Which protocol provides secure directory service authentication over networks?

1. Lightweight Directory Access Protocol
2. Unencrypted Telnet protocol daemon
3. Hypertext Transfer Protocol service
4. Lightweight Directory Access Protocol Secure

Correct Answer: 4

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of the standard Lightweight Directory Access Protocol, designed to provide directory service querying and user authentication across IP networks. While standard LDAP transmits directory queries, user accounts, and credentials in clear text, LDAPS wraps the communication session inside Transport Layer Security (TLS) or Secure Sockets Layer (SSL) encryption wrappers, typically operating over TCP port 636. This encryption ensures that sensitive user credentials and enterprise directory schemas are protected against packet sniffing and credential harvesting attacks.

Question 56

What security principle restricts user account permissions to minimum?

1. Principle of least privilege
2. Defense in depth strategy
3. Zero Trust network architecture
4. Separation of duties policy

Correct Answer: 1

Explanation:

The principle of least privilege is a fundamental information security concept that dictates that a user, process, or system component must be given only the minimum levels of access permissions—or privileges—necessary to perform its specific, authorized job functions. By restricting privileges strictly to operational requirements, organizations significantly limit the potential blast radius of credential compromise, insider threats, and malware propagation. For example, standard network users should never possess administrative privileges, and software applications should execute under restricted service accounts rather than root-level permissions.

Question 57

Which malware type replicates automatically across networks without user?

1. Computer virus infection file
2. Trojan horse program file
3. Computer worm malware utility
4. Adware spyware tracking program

Correct Answer: 3

Explanation:

A computer worm is a standalone malicious software program that replicates itself in order to spread to other computers across network connections. Unlike traditional computer viruses that require user intervention—such as opening an infected document or running an executable file—worms operate autonomously, exploiting operating system vulnerabilities or misconfigurations to scan and propagate across local networks and the internet. Once a worm infects a system, it consumes valuable bandwidth, exhausts CPU resources, and frequently installs secondary payloads like backdoors or ransomware, posing a severe threat to network availability.

Question 58

What protocol secures domain name resolution records using cryptography?

1. Dynamic Host Configuration Protocol
2. Domain Name System Security Extensions
3. Simple Network Management Protocol
4. Network Time Protocol daemon

Correct Answer: 2

Explanation:

Domain Name System Security Extensions (DNSSEC) is a suite of cryptographic specifications developed by the Internet Engineering Task Force to secure information provided by the Domain Name System. Traditional DNS implementations lacked built-in security, making them highly vulnerable to cache poisoning and spoofing attacks where malicious actors redirected traffic to fraudulent servers. DNSSEC addresses this by signing DNS records cryptographically using digital signatures based on public key cryptography. This allows client resolvers to verify the authenticity and integrity of DNS responses, ensuring users connect to legitimate destinations.

Question 59

Which wireless security standard mandates CCMP and AES encryption?

1. Wired Equivalent Privacy protocol
2. Wi-Fi Protected Access protocol
3. Open unencrypted wireless network
4. Wi-Fi Protected Access 2

Correct Answer: 4

Explanation:

Wi-Fi Protected Access 2 (WPA2) was introduced by the Wi-Fi Alliance to provide robust enterprise-grade security for wireless local area networks, addressing critical cryptographic vulnerabilities found in original WEP and transitional WPA-TKIP protocols. WPA2 mandates the use of the Advanced Encryption Standard (AES) algorithm combined with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) to ensure strict data confidentiality, integrity, and authentication over the air. By utilizing strong cryptographic keys and secure cipher wrappers, WPA2 effectively protects enterprise wireless communications against unauthorized eavesdropping and cracking attacks.

Question 60

What cryptographic hash function produces a 256-bit digest?

1. Secure Hash Algorithm 256
2. Message Digest 5 algorithm
3. Secure Hash Algorithm 1
4. Data Encryption Standard cipher

Correct Answer: 1

Explanation:

Secure Hash Algorithm 256 (SHA-256) is a member of the SHA-2 cryptographic hash function family designed by the National Security Agency. SHA-256 takes an input of arbitrary length and produces a fixed 256-bit (32-byte) hash value, typically represented as a 64-character hexadecimal string. Because of its cryptographic strength and collision resistance, SHA-256 is widely utilized across modern security protocols, including digital certificates, blockchain transactions, secure firmware updates, and TLS encryption handshakes. It ensures data integrity by making it computationally infeasible for attackers to alter data without changing the resulting hash digest.