View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 141

What security technology uses machine learning to detect behavioral anomalies in enterprise event logs?

1. Layer 2 unmanaged Ethernet switch
2. Security Information and Event Management (SIEM)
3. Basic passive network signal repeater
4. Unshielded twisted-pair patch cable

Correct Answer: 2

Explanation:

A Security Information and Event Management (SIEM) solution is a comprehensive enterprise security technology that aggregates, normalizes, and correlates log data collected from various hardware devices, operating systems, applications, and network infrastructure components. By centralizing log telemetry, SIEM platforms enable security operations centers to monitor real-time security events, detect advanced persistent threats, and identify behavioral anomalies that deviate from established baselines. They utilize pre-configured correlation rules, automated threat intelligence feeds, and machine learning algorithms to generate actionable alerts, facilitating rapid incident response and regulatory compliance auditing.

Question 142

Which cryptographic mode provides both data confidentiality and authentication simultaneously within symmetric block ciphers?

1. Electronic Codebook mode encryption
2. Cipher Block Chaining mode standard
3. Galois/Counter Mode authenticated encryption
4. Counter Mode cipher implementation

Correct Answer: 3

Explanation:

Galois/Counter Mode (GCM) is an authenticated encryption mode of operation designed to provide both data confidentiality and data integrity simultaneously within symmetric block ciphers like AES. Traditional encryption modes required separate mechanisms to verify integrity, leaving systems vulnerable to tampering if message authentication codes were omitted or misconfigured. GCM combines counter mode encryption with universal hashing over a Galois field, ensuring that any unauthorized modification to ciphertext or associated authentication data is detected instantly. Because of its high performance and robust security guarantees, GCM is heavily utilized in modern TLS 1.3 protocols and secure enterprise VPN deployments.

Question 143

What networking mechanism prevents IP spoofing by checking if packets arrive on the optimal interface back to the source IP?

1. Dynamic Host Configuration Protocol snooping
2. Address Resolution Protocol dynamic inspection
3. Unicast Reverse Path Forwarding (uRPF)
4. Port security MAC address limiting

Correct Answer: 3

Explanation:

Unicast Reverse Path Forwarding (uRPF) is a security and routing feature implemented on Cisco network devices to mitigate problems caused by malicious or accidental IP address spoofing. When uRPF is enabled on an interface, the router examines incoming packets and checks its routing table to determine if the packet arrived on the optimal interface back to the source IP address. If the packet arrives on an unexpected interface or if no valid routing entry exists for that source IP, the router drops the packet. This prevents attackers from launching spoofed DoS attacks or bypassing perimeter access controls.

Question 144

Which security assessment technique involves an ethical hacker simulating real-world cyber attacks against an organization?

1. Static application source code review
2. Penetration testing assessment engagement
3. Passive network traffic log sniffing
4. Automated vulnerability port scanning

Correct Answer: 2

Explanation:

Penetration testing is an authorized, simulated cyber attack launched against a computer system, network, or web application to evaluate security posture and identify exploitable vulnerabilities. Performed by ethical hackers, penetration testing mimics the tactics, techniques, and procedures utilized by real-world threat actors to bypass defenses. The assessment uncovers weak configurations, unpatched software flaws, and architectural security gaps before malicious attackers can exploit them. Comprehensive reporting from penetration tests allows security teams to prioritize remediation efforts and strengthen overall organizational defense mechanisms.

Question 145

What enterprise network design divides infrastructure into micro-zones to limit lateral movement after a security breach?

1. Flat unsegmented network topology
2. Micro-segmentation firewall policy
3. Passive signal repeating hub architecture
4. Unencrypted remote administration Telnet

Correct Answer: 2

Explanation:

Enterprise network micro-segmentation is an advanced security architecture that divides a data center or cloud environment into distinct, highly secure zones down to the workload or container level. By enforcing granular, perimeter-less firewall policies between individual servers and application tiers, micro-segmentation restricts lateral movement for attackers who manage to breach the initial network perimeter. Even if a single endpoint or server is compromised, the containment policies prevent malware from spreading laterally across adjacent internal systems, significantly reducing the overall blast radius of security incidents within enterprise networks.

Question 146

Which automated tool injects malformed inputs into programs to discover memory exceptions and crashes?

1. Static code review analysis tool
2. Passive network traffic logging agent
3. Application fuzz testing (Fuzzing)
4. Active network port scanning utility

Correct Answer: 3

Explanation:

Fuzz testing—or fuzzing—is an automated software testing technique that involves injecting massive amounts of invalid, malformed, or random data inputs into a computer program to monitor for software exceptions, memory leaks, assertion failures, and application crashes. Software developers and security engineers utilize fuzz testing during the development lifecycle to uncover unhandled edge cases, buffer overflow vulnerabilities, and input validation flaws that traditional unit tests might overlook. By identifying and patching these hidden software bugs prior to production release, organizations significantly enhance application robustness and reduce vulnerability risks.

Question 147

What endpoint security technology provides behavioral telemetry recording and automated process containment?

1. Basic static antivirus software
2. Passive network packet sniffer
3. Unshielded twisted-pair patch cable
4. Endpoint Detection and Response (EDR)

Correct Answer: 4

Explanation:

Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors end-user devices and hosts to collect telemetry, detect suspicious behaviors, and provide automated containment and remediation capabilities. Unlike traditional antivirus software that relied primarily on static file signatures to block known malware, EDR tools record process executions, file modifications, registry changes, and network connections in real time. This behavioral visibility enables security analysts to identify zero-day exploits, fileless malware attacks, and advanced persistent threats executing on enterprise endpoints.

Question 148

Which threat intelligence schema standardizes the sharing of cyber threat information in JSON or XML format?

1. Structured Threat Information Expression (STIX)
2. Common Vulnerability Scoring System (CVSS)
3. Open Web Application Security Project (OWASP)
4. National Institute of Standards (NIST) framework

Correct Answer: 1

Explanation:

Structured Threat Information Expression (STIX) is a standardized, structured XML/JSON language and serialization format developed to describe cyber threat information so it can be shared, stored, and analyzed in a consistent manner. STIX covers a comprehensive range of threat data, including threat actor profiles, campaign details, malware signatures, indicators of compromise, and recommended mitigation actions. When paired with trusted automated exchange protocols like TAXII, STIX enables security operations centers and automated defenses to share real-time threat intelligence seamlessly across disparate organizational boundaries.

Question 149

What cryptographic mechanism generates unique session keys for every communication session to ensure past ciphertexts remain secure if long-term keys are compromised?

1. Static RSA public key encryption
2. Forward secrecy (Perfect Forward Secrecy)
3. Plaintext symmetric session key sharing
4. Electronic Codebook mode cipher encryption

Correct Answer: 2

Explanation:

Forward secrecy—often referred to as Perfect Forward Secrecy (PFS)—is a security feature of specific key agreement protocols that ensures session keys derived from public key cryptography are not compromised even if the private key of the server is compromised at a later date. PFS achieves this by generating a unique, temporary session key for every individual communication session using ephemeral Diffie-Hellman key exchanges. Because the long-term private key is never used directly to encrypt the session data, past recorded ciphertexts remain completely secure against retrospective decryption.

Question 150

Which cloud deployment model provides computing resources exclusively managed and hosted for a single organization?

1. Public cloud shared multi-tenant environment
2. Hybrid cloud federated infrastructure
3. Community cloud collaborative platform
4. Private cloud dedicated hardware environment

Correct Answer: 4

Explanation:

A private cloud deployment model provides cloud computing resources dedicated exclusively to a single business organization, hosted either on-premises or managed externally by a third-party vendor. Unlike public cloud environments that pool virtualized infrastructure across multiple tenants, a private cloud maintains dedicated physical hardware, storage arrays, and network fabrics. This architecture delivers superior control, customization, and data privacy, making it an ideal choice for enterprises operating under strict regulatory compliance mandates, financial constraints, or specialized security requirements that prohibit sharing physical infrastructure with external tenants.

Question 151

What security protocol synchronizes network clocks securely using cryptographic keys and TLS protection?

1. Simple Network Management Protocol v1
2. Dynamic Host Configuration Protocol
3. Network Time Security (NTS) protocol
4. Trivial File Transfer Protocol utility

Correct Answer: 3

Explanation:

Network Time Security (NTS) is a cryptographic extension of the Network Time Protocol designed to provide secure, authenticated time synchronization across computer networks. Traditional time synchronization protocols were highly vulnerable to spoofing, tampering, and man-in-the-middle attacks, allowing malicious actors to manipulate system clocks and disrupt time-sensitive security logs, Kerberos authentication tickets, and cryptographic certificates. NTS addresses this by utilizing Transport Layer Security and authenticated encryption to secure time packets between clients and time servers, ensuring absolute time integrity across enterprise infrastructure and distributed systems.

Question 152

Which targeted phishing attack focuses specifically on high-profile corporate executives and decision-makers?

1. Low-volume automated credential stuffing
2. General broadcast spam email campaign
3. Whaling executive phishing attack
4. Standard network port scanning script

Correct Answer: 3

Explanation:

Whaling is a specialized form of spear phishing that specifically targets high-profile senior executives, chief executive officers, or individuals with privileged administrative access within an organization. Because these targets possess access to highly sensitive corporate data and financial authorization controls, attackers craft highly sophisticated, personalized social engineering messages—often masquerading as legal subpoenas, executive directives, or urgent board communications—to trick victims into transferring funds or divulging critical credentials. Defending against whaling requires executive security awareness training and strict dual-authorization workflows.

Question 153

What specialized network appliance decrypts and inspects HTTPS traffic inline to detect hidden malware payloads?

1. Layer 2 unmanaged Ethernet switch
2. Basic passive network signal repeater hub
3. Unshielded twisted-pair patch cable
4. SSL/TLS decryption proxy appliance

Correct Answer: 4

Explanation:

An SSL/TLS decryption proxy is a specialized network security appliance placed inline to intercept, decrypt, inspect, and re-encrypt HTTPS web traffic passing between internal clients and external web servers. Because modern cyber threats frequently utilize encryption to evade traditional perimeter defenses, security teams deploy SSL decryption to allow next-generation firewalls and intrusion prevention systems to analyze underlying application payloads, detect embedded malware, and enforce organizational data loss prevention policies without breaking end-to-end cryptographic integrity.

Question 154

Which discipline encompasses the collection, preservation, and analysis of digital evidence for legal investigations?

1. Network traffic packet sniffing
2. Computer digital forensics investigation
3. Static application source code review
4. Vulnerability assessment scanning

Correct Answer: 2

Explanation:

Computer digital forensics is a specialized branch of forensic science encompassing the recovery, investigation, examination, and analysis of material found in digital devices, often in relation to computer crime and security breaches. Digital forensics professionals follow strict chain-of-custody protocols to ensure that digital evidence—such as hard disk images, memory dumps, and log files—is collected, preserved, and analyzed without altering or contaminating the original data. This rigorous methodology ensures that findings remain legally admissible in court and provides actionable intelligence regarding root causes during enterprise incident response investigations.

Question 155

What security control calculates and compares cryptographic file hashes to detect unauthorized system file tampering?

1. Passive network traffic log analyzer
2. File integrity monitoring (FIM) software
3. Dynamic IP address leasing daemon
4. Unshielded twisted-pair cabling link

Correct Answer: 2

Explanation:

File integrity monitoring (FIM) is an automated security control and software mechanism that examines operating system files, application binaries, and configuration files to detect unauthorized modifications, tampering, or corruption. FIM tools typically calculate cryptographic hash baselines of critical system files during known-good states and continuously compare current file hashes against these baseline references. If an attacker modifies a system binary, installs a rootkit, or alters configuration settings, the FIM engine instantly flags the discrepancy, generating real-time security alerts for incident response teams to investigate potential system compromises.

Question 156

Which framework defines organizational security guidelines structured around Identify, Protect, Detect, Respond, and Recover?

1. National Institute of Standards and Technology framework
2. Layer 2 Ethernet switching standard specification
3. Dynamic Host Configuration Protocol server protocol
4. Structured cabling patch panel wiring guide

Correct Answer: 1

Explanation:

The National Institute of Standards and Technology (NIST) Cybersecurity Framework provides a comprehensive, policy-based standard of guidelines, standards, and best practices designed to help organizations manage and reduce cybersecurity risk. Structured around five core functions—Identify, Protect, Detect, Respond, and Recover—the framework enables organizations of all sizes to assess their current security posture, establish target maturity levels, and communicate security requirements across business units. By adopting NIST guidelines, enterprises can build resilient security programs, align technical defenses with business objectives, and streamline regulatory compliance audits effectively.

Question 157

What centralized identity service provides Single Sign-On and federation across multiple enterprise cloud applications?

1. Active Directory federation and SSO
2. Passive packet analyzer diagnostic tool
3. Unshielded twisted-pair patch cable link
4. Layer 2 unmanaged Ethernet switch device

Correct Answer: 1

Explanation:

Active Directory federation and Single Sign-On (SSO) services provide centralized identity management and authentication validation across multiple disparate security domains, cloud platforms, and enterprise applications. Instead of requiring users to maintain separate credentials for every service, federation utilizes standardized protocols like Security Assertion Markup Language and OpenID Connect to securely pass authenticated identity tokens between trusted identity providers and service providers. This centralized approach simplifies administrative overhead, enhances user experience, and strengthens enterprise security by reducing password fatigue and centralizing multi-factor authentication enforcement.

Question 158

Which protocol provides centralized AAA services using UDP and encrypts only the password field within access-request packets?

1. TACACS+ protocol secure daemon
2. Secure Shell remote console service
3. Remote Authentication Dial-In User Service (RADIUS)
4. Lightweight Directory Access Protocol Secure

Correct Answer: 3

Explanation:

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect and use a network service. Operating primarily over UDP ports 1812 and 1813, traditional RADIUS encrypts only the user’s password within the access-request packet, while leaving the rest of the packet payload unencrypted. RADIUS combines authentication and authorization into a single process, making it widely deployed for network access control, VPN connections, and wireless 802.1X enterprise environments.

Question 159

What cryptographic exploit attempts to find two distinct inputs that generate identical hash digests under a hash function?

1. Brute-force password decryption
2. Dictionary key recovery attack
3. Man-in-the-middle interception
4. Hash collision attack

Correct Answer: 4

Explanation:

A hash collision attack is a cryptographic exploit where an attacker attempts to find two distinct plaintext inputs that produce identical cryptographic hash values under a specific hash function (such as MD5 or SHA-1). Because cryptographic hash functions map arbitrarily large data sets to fixed-size outputs, collisions are mathematically possible, but a secure hash function makes finding them computationally infeasible. When a hashing algorithm suffers from collision vulnerabilities, it undermines digital signatures and certificate integrity, forcing organizations to transition to stronger algorithms like SHA-256 or SHA-3.

Question 160

Which routing security framework uses cryptographic Route Origin Authorizations to prevent BGP prefix hijacking?

1. Resource Public Key Infrastructure (RPKI)
2. Simple Network Management Protocol v3
3. Dynamic ARP Inspection mechanism
4. Port-based 802.1X network access control

Correct Answer: 1

Explanation:

Resource Public Key Infrastructure (RPKI) is a specialized cryptographic framework designed to secure the routing infrastructure of the internet by validating the ownership of Internet Number Resources. BGP routing table exchanges historically lacked built-in authentication, leaving global routing vulnerable to malicious prefix hijacking. RPKI utilizes cryptographic Route Origin Authorizations to bind specific IP address prefixes to authorized autonomous system numbers. Routers implementing RPKI validate these digital signatures before accepting routing updates, ensuring reliable path selection and global routing security.