View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 61

What network protocol secures remote device management sessions?

1. Unencrypted Telnet remote administration protocol
2. File Transfer Protocol management utility
3. Secure Shell cryptographic remote access
4. Trivial File Transfer Protocol daemon

Correct Answer: 3

Explanation:

Secure Shell (SSH) is a cryptographic network protocol designed specifically to provide secure, encrypted command-line administration and remote login capabilities across unsecured IP networks. It serves as a modern, secure replacement for legacy unencrypted protocols like Telnet. When an administrator connects to a network device via SSH, all transmitted keystrokes, passwords, and management commands are encapsulated in robust cryptographic wrappers. This prevents malicious actors from capturing sensitive credentials through packet sniffing or executing man-in-the-middle attacks on enterprise infrastructure. SSH operates by default over Transmission Control Protocol port 22 and requires cryptographic key exchanges prior to establishing an authenticated session.

Question 62

Which attack alters packet headers to impersonate hosts?

1. IP spoofing header manipulation attack
2. Cross-site scripting script injection flaw
3. Structured Query Language injection exploit vector
4. Distributed denial of service flood campaign

Correct Answer: 1

Explanation:

IP spoofing is a malicious technique where an attacker alters source IP address headers within transmitted network packets to disguise their true identity or impersonate another trusted host on the network. This deceptive practice is frequently utilized to bypass IP-based access control lists, launch SYN flood denial-of-service attacks, or facilitate man-in-the-middle operations by tricking victim nodes into accepting forged communication streams. Defending against IP spoofing requires implementing strict ingress and egress filtering on network routers, deploying cryptographic authentication mechanisms, and utilizing modern routing security frameworks to verify packet origins across enterprise networks.

Question 63

What security model verifies every access request continuously?

1. Traditional perimeter defense model
2. Zero Trust security architecture framework
3. Demilitarized zone network perimeter design
4. Static Virtual Local Area Network segmentation

Correct Answer: 2

Explanation:

Zero Trust Architecture (ZTA) is a modern cybersecurity paradigm based on the core philosophy of “never trust, always verify.” Traditional enterprise security models relied heavily on perimeter defenses, assuming that everything inside the corporate network was inherently trustworthy. Zero Trust eliminates this assumption, mandating continuous, strict identity verification, device health validation, and least-access authorization for every user and device attempting to access resources, regardless of whether they originate from inside or outside the traditional network perimeter. By micro-segmenting resources and inspecting all traffic flows, organizations significantly reduce lateral movement and improve overall resilience.

Question 64

Which encryption mode combines block cipher with authentication?

1. Electronic Codebook mode encryption
2. Cipher Block Chaining mode standard
3. Counter Mode cipher implementation
4. Galois/Counter Mode authenticated encryption

Correct Answer: 4

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly. Because of its high performance and robust security guarantees, GCM is heavily utilized in modern TLS 1.3 protocols and secure enterprise VPN deployments.

Question 65

What protocol dynamically assigns IP addresses to hosts?

1. Address Resolution Protocol stack
2. Network Address Translation protocol
3. Dynamic Host Configuration Protocol
4. Internet Control Message Protocol

Correct Answer: 3

Explanation:

Dynamic Host Configuration Protocol (DHCP) is a standardized network management protocol used to automate the assignment of Internet Protocol addresses and other network configuration parameters—such as subnet masks, default gateways, and DNS server addresses—to client devices on an IP network. DHCP eliminates the administrative burden and potential configuration errors associated with manual static IP address provisioning. By utilizing a dynamic lease mechanism, DHCP servers manage address pools efficiently, reclaiming and reallocating IP addresses as client devices connect and disconnect from the enterprise network infrastructure over time.

Question 66

Which security device inspects traffic at network perimeter?

1. Enterprise network security firewall
2. Basic passive network repeater hub
3. Structured copper patch panel block
4. Layer 2 unmanaged Ethernet switch

Correct Answer: 1

Explanation:

A network firewall is a dedicated security system designed to monitor, filter, and control incoming and outgoing network traffic based on a pre-configured set of organizational security rules. Operating at various layers of the OSI model depending on architecture, firewalls establish a trusted boundary between internal corporate networks and untrusted external environments like the internet. Modern next-generation firewalls integrate deep packet inspection, intrusion prevention, and application awareness to block malicious traffic, prevent unauthorized access, and protect enterprise assets against sophisticated cyber threats while permitting legitimate business communications.

Question 67

What service provides centralized authentication authorization and accounting?

1. Radius remote authentication service
2. Terminal Access Controller Access Control System
3. Lightweight Directory Access Protocol server
4. Active Directory domain controller host

Correct Answer: 2

Explanation:

Terminal Access Controller Access Control System Plus (TACACS+) is a protocol developed by Cisco that provides comprehensive, centralized validation for users attempting to gain administrative access to network routers, switches, and security appliances. Unlike RADIUS which combines authentication and authorization into a single process, TACACS+ separates these functions entirely and encrypts the entire packet payload of every management communication session. TACACS+ records granular accounting telemetry for every command executed by an administrator, providing robust audit trails and accountability across enterprise network operations centers.

Question 68

Which network attack floods a switch address table?

1. Address Resolution Protocol poisoning attack
2. Dynamic Host Configuration server exhaustion
3. Spanning Tree Root bridge hijacking
4. Content Addressable Memory table flooding

Correct Answer: 4

Explanation:

A Content Addressable Memory (CAM) table flooding attack—commonly referred to as a MAC flooding attack—is a Layer 2 exploit where a malicious actor overwhelms an enterprise switch by transmitting a high volume of Ethernet frames with randomized source MAC addresses. Because switches maintain limited physical memory capacity within their CAM tables to track valid interface associations, exhausting this table forces the switch into an insecure hub-like broadcast mode. In this degraded state, subsequent traffic destined for any port is broadcast across all ports, allowing the attacker to capture sensitive data using packet sniffers.

Question 69

What protocol secures file transfers over secure shell?

1. File Transfer Protocol daemon
2. Trivial File Transfer Protocol service
3. Secure File Transfer Protocol
4. Hypertext Transfer Protocol utility

Correct Answer: 3

Explanation:

Secure File Transfer Protocol (SFTP) is a secure network protocol designed to provide file access, file transfer, and file management functionalities over any reliable data stream. Unlike legacy File Transfer Protocol (FTP) which transmits credentials and data payloads in clear text across separate control and data channels, SFTP operates entirely over a secure Secure Shell (SSH) session utilizing TCP port 22. This integration ensures that all transmitted passwords, file metadata, and data streams are fully encrypted from end to end, protecting sensitive enterprise data against eavesdropping and tampering during transit across public networks.

Question 70

Which cryptographic algorithm is a symmetric block cipher?

1. Advanced Encryption Standard cipher
2. Rivest-Shamir-Adleman public key system
3. Secure Hash Algorithm 256 digest
4. Message Digest 5 hash function

Correct Answer: 1

Explanation:

The Advanced Encryption Standard (AES) is a widely adopted, highly secure symmetric encryption algorithm established by the National Institute of Standards and Technology. Symmetric encryption utilizes the exact same cryptographic key for both encrypting plaintext into ciphertext and decrypting ciphertext back into readable data. AES supports key lengths of 128, 192, and 256 bits, providing exceptionally robust security that makes brute-force attacks computationally infeasible with modern computing power. It is heavily utilized across modern enterprise security protocols, including IPsec VPNs, Wi-Fi WPA2/WPA3 encryption, and TLS web security, ensuring data confidentiality across networks.

Question 71

What mechanism stops rogue dynamic host configuration servers?

1. Dynamic ARP Inspection mechanism
2. Dynamic Host Configuration Protocol snooping
3. Spanning Tree Protocol root guard
4. Port security MAC limit enforcement

Correct Answer: 2

Explanation:

Dynamic Host Configuration Protocol (DHCP) snooping is a robust Layer 2 security feature built into enterprise switches that acts as a firewall between untrusted host connection ports and trusted DHCP servers. In a compromised network environment, an attacker could plug an unauthorized rogue DHCP server into a user access port and flood the local segment with malicious IP configuration parameters to launch man-in-the-middle attacks. DHCP snooping inspects incoming DHCP traffic on a per-port basis, dividing ports into trusted and untrusted states, and immediately dropping unauthorized server reply messages.

Question 72

Which standard defines port-based local network access?

1. IEEE 802.1Q trunking standard specification
2. IEEE 802.11ac wireless networking protocol
3. IEEE 802.3af Power over Ethernet
4. IEEE 802.1X port-based access control

Correct Answer: 4

Explanation:

The IEEE 802.1X standard defines port-based network access control, providing an authentication mechanism for devices wishing to attach to a LAN or WLAN. 802.1X uses the Extensible Authentication Protocol to pass authentication messages between the supplicant client, the network access device (authenticator), and a centralized authentication server (such as RADIUS). Until the client successfully authenticates, the switch port blocks all traffic except EAPOL frames. This ensures that unauthorized endpoints, rogue devices, or unverified computers cannot access enterprise network resources.

Question 73

What protocol resolves numerical internet addresses to hardware?

1. Domain Name System resolution protocol
2. Dynamic Host Configuration Protocol engine
3. Address Resolution Protocol mapping
4. Internet Control Message Protocol utility

Correct Answer: 3

Explanation:

Address Resolution Protocol (ARP) is a fundamental networking protocol used to map a network layer IP address to a physical hardware MAC address recognized by the local area network data link layer. When a host needs to communicate with another device on the same local subnet, it broadcasts an ARP request packet asking, “Who has this IP address?” The target device responds with its unique hardware MAC address, allowing the sender to encapsulate data frames correctly for physical transmission. While essential for local delivery, standard ARP lacks authentication, making it vulnerable to spoofing and poisoning attacks.

Question 74

Which firewall inspects active communication connection states dynamically?

1. Stateful inspection firewall appliance
2. Stateless packet filtering router
3. Layer 2 Ethernet switching bridge
4. Basic passive network signal hub

Correct Answer: 1

Explanation:

A stateful inspection firewall—often referred to as a stateful firewall—is a network security device that monitors active connection states and evaluates incoming packets against a dynamic state table. Unlike stateless packet filters that examine each packet in complete isolation, stateful firewalls track the full context of a TCP or UDP communication session. They maintain records of established connections, handshake states, and sequence numbers, allowing the firewall to make intelligent forwarding decisions based on whether a packet belongs to an active, authorized communication session or represents an unsolicited external connection attempt.

Question 75

What malicious software hides deep inside operating systems?

1. Adware marketing program package
2. Rootkit system concealment software
3. Spyware tracking telemetry agent
4. Ransomware file encryption utility

Correct Answer: 2

Explanation:

A rootkit is a stealthy type of malicious software designed to conceal the existence of certain processes or programs from normal methods of detection while maintaining privileged administrative access to a computer system. Rootkits frequently compromise core operating system kernels or system binaries, intercepting operating system application programming interface calls to hide files, network connections, and active malicious processes from antivirus scanners and system administrators. Because they operate at deep privilege levels, detecting and removing rootkits often requires specialized offline scanning tools or complete operating system reinstallation.

Question 76

Which cloud service model manages physical hardware infrastructure?

1. Software as a Service product
2. Platform as a Service environment
3. Desktop as a Service offering
4. Infrastructure as a Service model

Correct Answer: 4

Explanation:

Infrastructure as a Service (IaaS) is a cloud computing service model that provides fundamental computing resources over the internet, such as virtual machines, storage, networks, and operating systems, hosted on remote data center infrastructure. In an IaaS model, cloud providers manage the underlying physical hardware, virtualization layers, and facility cooling, while customers retain complete administrative control over installed operating systems, middleware, applications, and security configurations. This model offers high scalability, flexibility, and cost-efficiency for enterprise IT workloads without requiring heavy capital expenditure on physical data center hardware.

Question 77

What protocol provides encrypted directory service user authentication?

1. Lightweight Directory Access Protocol
2. Unencrypted Telnet remote management
3. Lightweight Directory Access Protocol Secure
4. Hypertext Transfer Protocol service

Correct Answer: 3

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of the standard Lightweight Directory Access Protocol, designed to provide directory service querying and user authentication across IP networks. While standard LDAP transmits directory queries, user accounts, and credentials in clear text, LDAPS wraps the communication session inside Transport Layer Security (TLS) or Secure Sockets Layer (SSL) encryption wrappers, typically operating over TCP port 636. This encryption ensures that sensitive user credentials and enterprise directory schemas are protected against packet sniffing and credential harvesting attacks.

Question 78

Which metric system measures software vulnerability severity scores?

1. Common Vulnerability Scoring System
2. Open Web Application Security Project
3. National Institute of Standards framework
4. Information Technology Infrastructure Library

Correct Answer: 1

Explanation:

The Common Vulnerability Scoring System (CVSS) is an open, standardized framework used to assess and measure the severity of computer system security vulnerabilities. CVSS produces numerical score ratings ranging from 0.0 to 10.0 based on various metric groups, including exploitability metrics (how easily a flaw can be accessed), impact metrics (consequences to confidentiality, integrity, and availability), and temporal characteristics that change over time. Security operations teams utilize CVSS scores to prioritize vulnerability remediation efforts, allocate resources effectively, and evaluate operational risk across enterprise software and hardware inventories.

Question 79

What diagnostic tool captures raw binary network frames?

1. Layer 2 Ethernet hardware switch
2. Packet sniffer network analyzer tool
3. Basic network signal repeater hub
4. Structured cabling patch cord cable

Correct Answer: 2

Explanation:

A packet analyzer—commonly referred to as a packet sniffer or network protocol analyzer—is a specialized software or hardware tool designed to intercept, log, and analyze network traffic traversing a wired or wireless medium. When packets pass through a network interface card configured in promiscuous mode, the analyzer captures raw binary frames, decodes encapsulation layers, and displays detailed protocol metrics, payloads, and header fields. Security analysts and network engineers rely heavily on packet sniffers like Wireshark during troubleshooting and forensic investigations to examine network communications, detect anomalies, identify malicious payloads, and audit security policies.

Question 80

Which security assessment simulates real-world cyber threat actors?

1. Static application source code review
2. Passive network traffic log analysis
3. Automated vulnerability port scanning
4. Penetration testing assessment engagement

Correct Answer: 4

Explanation:

Penetration testing is an authorized, simulated cyber attack launched against a computer system, network, or web application to evaluate security posture and identify exploitable vulnerabilities. Performed by ethical hackers, penetration testing mimics the tactics, techniques, and procedures utilized by real-world threat actors to bypass defenses. The assessment uncovers weak configurations, unpatched software flaws, and architectural security gaps before malicious attackers can exploit them. Comprehensive reporting from penetration tests allows security teams to prioritize remediation efforts and strengthen overall organizational defense mechanisms.