View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 101

What protocol provides AAA services using UDP and encrypts only the password field during transmission?

1. TACACS+ protocol daemon
2. Secure Shell remote service
3. Remote Authentication Dial-In User Service (RADIUS)
4. Lightweight Directory Access Protocol Secure

Correct Answer: 3

Explanation:

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service. Operating primarily over UDP ports 1812 and 1813, traditional RADIUS encrypts only the user’s password within the access-request packet, while leaving the rest of the packet payload unencrypted. RADIUS combines authentication and authorization into a single process, making it widely deployed for network access control, VPN connections, and wireless 802.1X enterprise environments.

Question 102

Which security feature verifies packet source IP addresses against routing table entries to prevent IP spoofing?

1. Unicast Reverse Path Forwarding (uRPF)
2. Dynamic Host Configuration Protocol snooping
3. Address Resolution Protocol dynamic inspection
4. Port security MAC address limiting

Correct Answer: 1

Explanation:

Unicast Reverse Path Forwarding (uRPF) is a security and routing feature implemented on Cisco network devices to mitigate problems caused by malicious or accidental IP address spoofing. When uRPF is enabled on an interface, the router examines incoming packets and checks its routing table to determine if the packet arrived on the optimal interface back to the source IP address. If the packet arrives on an unexpected interface or if no valid routing entry exists for that source IP, the router drops the packet. This prevents attackers from launching spoofed DoS attacks or bypassing perimeter access controls.

Question 103

What cryptographic attack attempts to find two different inputs that produce the exact same hash digest?

1. Brute-force decryption attack
2. Dictionary key recovery attack
3. Man-in-the-middle interception
4. Hash collision attack

Correct Answer: 4

Explanation:

A hash collision attack is a cryptographic exploit where an attacker attempts to find two distinct plaintext inputs that produce identical cryptographic hash values under a specific hash function (such as MD5 or SHA-1). Because cryptographic hash functions map arbitrarily large data sets to fixed-size outputs, collisions are mathematically possible, but a secure hash function makes finding them computationally infeasible. When a hashing algorithm suffers from collision vulnerabilities, it undermines digital signatures and certificate integrity, forcing organizations to transition to stronger algorithms like SHA-256 or SHA-3.

Question 104

Which security control isolates critical enterprise workloads into granular virtual boundaries to restrict lateral movement?

1. Flat network perimeter design
2. Micro-segmentation policy
3. Passive hub signal sniffing
4. Unmanaged Layer 2 switching

Correct Answer: 2

Explanation:

Enterprise network micro-segmentation is an advanced security architecture that divides a data center or cloud environment into distinct, highly secure zones down to the workload or container level. By enforcing granular, perimeter-less firewall policies between individual servers and application tiers, micro-segmentation restricts lateral movement for attackers who manage to breach the initial network perimeter. Even if a single endpoint or server is compromised, the containment policies prevent malware from spreading laterally across adjacent internal systems, significantly reducing the overall blast radius of security incidents within enterprise networks.

Question 105

What protocol is used by security systems to query digital certificate revocation status in real-time?

1. Simple Network Management Protocol
2. Dynamic Host Configuration Protocol
3. Online Certificate Status Protocol (OCSP)
4. Network Time Security protocol

Correct Answer: 3

Explanation:

The Online Certificate Status Protocol (OCSP) is an internet protocol used for obtaining the revocation status of an X.509 digital certificate in real time. Traditional public key infrastructure implementations relied heavily on Certificate Revocation Lists, which required clients to download large, periodically updated files containing lists of all revoked certificates. This approach introduced significant network overhead and latency. OCSP addresses this inefficiency by allowing client applications to query a designated OCSP responder directly for the revocation status of a specific certificate during the TLS handshake, ensuring immediate validation.

Question 106

Which threat intelligence format is designed as a standardized XML or JSON schema for sharing cyber threat information?

1. Structured Threat Information Expression (STIX)
2. Common Vulnerability Scoring System
3. Open Web Application Security standard
4. National Institute of Standards framework

Correct Answer: 1

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed in a consistent manner. STIX covers a comprehensive range of threat data, including threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions. When paired with trusted automated exchange protocols like TAXII, STIX enables security operations centers and automated defenses to share real-time threat intelligence seamlessly across disparate organizational boundaries.

Question 107

What security appliance intercepts and inspects Secure Sockets Layer/Transport Layer Security encrypted web traffic to detect hidden malware?

1. Layer 2 unmanaged Ethernet switch
2. Basic network signal repeater hub
3. Unshielded twisted-pair patch cable
4. SSL/TLS decryption proxy appliance

Correct Answer: 4

Explanation:

An SSL/TLS decryption proxy is a specialized network security appliance placed inline to intercept, decrypt, inspect, and re-encrypt HTTPS web traffic passing between internal clients and external web servers. Because modern cyber threats frequently utilize encryption to evade traditional perimeter defenses, security teams deploy SSL decryption to allow next-generation firewalls and intrusion prevention systems to analyze underlying application payloads, detect embedded malware, and enforce organizational data loss prevention policies without breaking end-to-end cryptographic integrity.

Question 108

Which cloud security model places the responsibility of physical hardware security, facility cooling, and hypervisor management entirely on the cloud provider?

1. On-premises physical data center
2. Infrastructure as a Service (IaaS)
3. Desktop as a Service local client
4. Traditional enterprise perimeter model

Correct Answer: 2

Explanation:

Infrastructure as a Service (IaaS) is a cloud computing service model that provides fundamental computing resources over the internet, such as virtual machines, storage, networks, and operating systems, hosted on remote data center infrastructure. In an IaaS model, cloud providers manage the underlying physical hardware, virtualization layers, and facility security, while customers retain complete administrative control over installed operating systems, middleware, applications, and security configurations. This model offers high scalability, flexibility, and cost-efficiency for enterprise IT workloads.

Question 109

What type of cyber attack specifically targets high-profile executives or individuals with high-level access privileges?

1. General spam email campaign
2. Automated credential stuffing
3. Whaling phishing attack
4. Low-level port scanning

Correct Answer: 3

Explanation:

Whaling is a specialized form of spear phishing that specifically targets high-profile senior executives, chief executive officers, or individuals with privileged administrative access within an organization. Because these targets possess access to highly sensitive corporate data and financial authorization controls, attackers craft highly sophisticated, personalized social engineering messages—often masquerading as legal subpoenas, executive directives, or urgent board communications—to trick victims into transferring funds or divulging critical credentials. Defending against whaling requires executive security awareness training and strict dual-authorization workflows.

Question 110

Which protocol provides secure, encrypted network management and monitoring operations over SNMP version 3?

1. Simple Network Management Protocol version 3 (SNMPv3)
2. Unencrypted Telnet remote console
3. Trivial File Transfer Protocol daemon
4. Legacy File Transfer Protocol utility

Correct Answer: 1

Explanation:

Simple Network Management Protocol version 3 (SNMPv3) is a secure network monitoring protocol that introduces robust cryptographic security features to address the inherent vulnerabilities of legacy SNMPv1 and v2c implementations, which transmitted community strings and management data in clear text. SNMPv3 provides critical security capabilities including message integrity checking to ensure packets were not altered in transit, authentication to verify the identity of management entities, and data confidentiality through cryptographic encryption of management payloads across enterprise networks.

Question 111

What advanced endpoint protection technology goes beyond traditional signature detection by monitoring process behaviors and execution anomalies?

1. Basic static antivirus scanner
2. Passive network traffic sniffer
3. Unshielded twisted-pair cabling
4. Endpoint Detection and Response (EDR)

Correct Answer: 4

Explanation:

Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors end-user devices and hosts to collect telemetry, detect suspicious behaviors, and provide automated containment and remediation capabilities. Unlike traditional antivirus software that relied primarily on static file signatures to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This behavioral visibility enables security analysts to identify zero-day exploits, fileless malware attacks, and advanced persistent threats executing on enterprise endpoints.

Question 112

Which cryptographic mechanism ensures that intercepted encrypted messages cannot be decrypted later even if the long-term private key is eventually compromised?

1. Static RSA public key encryption
2. Forward secrecy (Perfect Forward Secrecy)
3. Plaintext session key transmission
4. Electronic Codebook mode cipher

Correct Answer: 2

Explanation:

Forward secrecy—often referred to as Perfect Forward Secrecy (PFS)—is a security feature of specific key agreement protocols that ensures session keys derived from public key cryptography are not compromised even if the private key of the server is compromised at a later date. PFS achieves this by generating a unique, temporary session key for every individual communication session using ephemeral Diffie-Hellman key exchanges. Because the long-term private key is never used directly to encrypt the session data, past recorded ciphertexts remain completely secure against retrospective decryption.

Question 113

What protocol secures email transmissions by providing cryptographic privacy and authentication through a web-of-trust model?

1. Hypertext Transfer Protocol Secure
2. Secure File Transfer Protocol
3. Pretty Good Privacy (PGP)
4. Lightweight Directory Access Protocol

Correct Answer: 3

Explanation:

Pretty Good Privacy (PGP) is a widely used cryptographic software system that provides cryptographic privacy and authentication for data communication. PGP is frequently utilized for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions to increase the security of email communications. It combines symmetric encryption algorithms and public-key cryptography to ensure robust confidentiality and integrity. By utilizing a web of trust model, PGP allows users to verify digital signatures and establish trust in public keys without relying exclusively on centralized certificate authorities.

Question 114

Which security concept requires multiple layers of distinct defensive controls to protect enterprise assets so that the failure of a single control does not compromise the entire system?

1. Defense in depth strategy
2. Single perimeter reliance model
3. Flat network segmentation
4. Unencrypted remote administration

Correct Answer: 1

Explanation:

Defense in depth is a foundational information security strategy that relies on deploying multiple layers of distinct, complementary security controls throughout an IT infrastructure. By stacking physical security, perimeter firewalls, network segmentation, host-based intrusion detection, multi-factor authentication, and robust encryption, organizations ensure that if a single defensive layer fails or is breached by an attacker, subsequent layers remain active to contain the threat, delay the attacker, and protect critical enterprise assets.

Question 115

What malicious software payload establishes a hidden, persistent backdoor access channel into a compromised computer system?

1. Adware marketing program
2. Spyware telemetry agent
3. Ransomware file encryptor
4. Trojan horse backdoor payload

Correct Answer: 4

Explanation:

A Trojan horse is a type of malicious software that is disguised as legitimate, desirable software but conceals harmful instructions designed to compromise system security, steal data, or establish unauthorized remote access. Unlike viruses and worms that replicate independently, Trojans require user interaction to be downloaded and executed. Once active, advanced Trojans frequently install backdoor payloads, keyloggers, or command-and-control communication channels, allowing external cybercriminals to maintain persistent, covert control over the victim’s host operating system.

Question 116

Which network security mechanism dynamically inspects and filters ARP packets to prevent man-in-the-middle poisoning attacks on local segments?

1. Dynamic Host Configuration Protocol snooping
2. Dynamic ARP Inspection (DAI)
3. Spanning Tree Protocol root guard
4. Basic port security MAC limiting

Correct Answer: 2

Explanation:

Dynamic ARP Inspection (DAI) is a Layer 2 security feature on Cisco switches that uses information gathered from DHCP snooping to validate Address Resolution Protocol packets and protect enterprise networks against ARP spoofing and poisoning attacks. DAI intercepts all ARP requests and responses on untrusted ports, comparing the packet bindings against valid entries in the DHCP snooping database. If an ARP packet contains forged IP-to-MAC address mappings, DAI immediately drops the packet, preventing attackers from redirecting local traffic streams.

Question 117

What security assessment technique involves automated testing of web applications by injecting invalid or random data inputs to trigger software exceptions?

1. Static code review analysis
2. Passive log file inspection
3. Application fuzz testing (Fuzzing)
4. Active port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing—or fuzzing—is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook. By identifying these hidden software bugs prior to production release, organizations enhance application robustness.

Question 118

Which routing security framework utilizes cryptographic Route Origin Authorizations to prevent BGP prefix hijacking?

1. Resource Public Key Infrastructure (RPKI)
2. Simple Network Management Protocol v3
3. Dynamic ARP Inspection mechanism
4. Port-based 802.1X authentication

Correct Answer: 1

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers. Routers implementing RPKI validate these digital signatures before accepting routing updates, ensuring reliable path selection and global routing security.

Question 119

What cryptographic hash function produces a fixed 128-bit hash digest and is considered cryptographically broken due to vulnerability to collision attacks?

1. Secure Hash Algorithm 256
2. Secure Hash Algorithm 1
3. Secure Hash Algorithm 512
4. Message Digest 5 (MD5)

Correct Answer: 4

Explanation:

Message Digest 5 (MD5) is a widely used cryptographic hash function that produces a fixed 128-bit hash digest, typically expressed as a 32-character hexadecimal number. While historically utilized for checksum validation and data integrity verification, MD5 has been proven cryptographically broken due to severe vulnerabilities that allow researchers to generate hash collisions efficiently. Because attackers can forge digital signatures and manipulate files without altering the resulting MD5 hash, modern security standards strictly prohibit its use in secure applications, recommending SHA-256 or SHA-3 instead.

Question 120

Which centralized AAA protocol encrypts the entire packet payload and separates authentication from authorization?

1. RADIUS authentication protocol
2. TACACS+ protocol
3. Unencrypted LDAP directory service
4. Dynamic Host Configuration Protocol

Correct Answer: 2

Explanation:

Terminal Access Controller Access Control System Plus (TACACS+) is a protocol developed by Cisco that provides comprehensive, centralized validation for users attempting to gain administrative access to network devices. Unlike RADIUS which combines authentication and authorization into a single process and encrypts only the password field, TACACS+ separates authentication, authorization, and accounting functions entirely and encrypts the entire packet payload of every management communication session. TACACS+ records granular accounting telemetry for every command executed by an administrator.