View Full Cisco CCNP Cybersecurity 350-201 Exam Dumps and Practice Test Dumps.

 

Question 161

What Cisco security architecture utilizes Security Group Tags (SGTs) and MACsec to enforce role-based access control across enterprise networks?

1. Cisco TrustSec technology architecture
2. Basic unmanaged Layer 2 switching model
3. Traditional perimeter firewall topology
4. Passive network monitoring architecture

Correct Answer: 1

Explanation:

Cisco TrustSec is an advanced software-defined segmentation architecture that uses Security Group Tags (SGTs) to classify traffic based on user roles, device types, or application categories rather than traditional IP addresses. By embedding metadata tags into Ethernet frames, TrustSec allows network infrastructure to enforce granular, role-based access control policies dynamically across the entire enterprise fabric. Combined with MACsec (Media Access Control Security) for line-rate encryption at Layer 2, Cisco TrustSec simplifies network security management and stops lateral movement across campus and data center environments.

Question 162

Which protocol provides secure digital certificate enrollment over HTTPS using Elliptic Curve Cryptography?

1. Simple Network Management Protocol v3
2. Enrollment over Secure Transport (EST)
3. Dynamic Host Configuration Protocol service
4. Trivial File Transfer Protocol utility

Correct Answer: 2

Explanation:

Enrollment over Secure Transport (EST) is a modern certificate enrollment protocol defined in RFC 7030 that enables clients to securely obtain and update digital certificates within a Public Key Infrastructure. Unlike legacy enrollment protocols that relied on weaker cryptographic wrappers or HTTP, EST operates entirely over HTTPS and leverages Transport Layer Security (TLS) for mutual authentication and session encryption. It natively supports modern cryptographic standards, including Elliptic Curve Cryptography (ECC), making it the preferred protocol for automated device provisioning and certificate management in enterprise IoT and campus networks.

Question 163

What security technology provides cloud-delivered DNS-layer protection by blocking requests to malicious domains before connections are established?

1. Local unshielded patch cable link
2. Cisco Umbrella cloud security platform
3. Passive network signal sniffer tool
4. Layer 2 unmanaged Ethernet switch

Correct Answer: 2

Explanation:

Cisco Umbrella is a cloud-delivered enterprise security platform that provides the first line of defense against threats by inspecting and filtering Domain Name System (DNS) requests. When an endpoint attempts to resolve a domain name, Cisco Umbrella evaluates the request against real-time global threat intelligence feeds. If the destination domain is associated with malware, ransomware, phishing campaigns, or command-and-control servers, Umbrella blocks the connection instantly before any IP traffic reaches the infrastructure. Because it operates at the DNS layer, it provides robust protection for remote workers and roaming laptops without requiring heavy client software.

Question 164

Which protocol is used for secure syslog message forwarding over encrypted TLS connections?

1. Unencrypted UDP syslog transmission
2. Syslog over TLS (RFC 5425 protocol)
3. Trivial File Transfer Protocol service
4. Legacy Telnet remote administration

Correct Answer: 2

Explanation:

Syslog over TLS—standardized in RFC 5425—is a secure network management protocol designed to encrypt system log messages transmitted between network devices, servers, and centralized Security Information and Event Management (SIEM) collectors. Traditional syslog messages were transmitted in clear text over UDP, making them highly vulnerable to eavesdropping, tampering, and log injection attacks by malicious actors. Syslog over TLS wraps log streams in cryptographic transport layers, ensuring message confidentiality, peer authentication, and absolute log integrity across enterprise audit pipelines.

Question 165

What type of malicious software encrypts user files and demands ransom payment for the decryption key?

1. Adware marketing software package
2. Spyware telemetry tracking agent
3. Ransomware payload encryption tool
4. Rootkit operating system kernel mod

Correct Answer: 3

Explanation:

Ransomware is a destructive form of malware that encrypts files, directories, or entire hard disk drives on a victim’s computer system using robust symmetric and asymmetric encryption algorithms. Once the files are locked, the malicious actors demand a financial ransom payment—typically in cryptocurrency—in exchange for the private decryption key. Modern ransomware operations frequently employ double-extortion tactics, exfiltrating sensitive corporate data prior to encryption and threatening public leaks if demands are unmet. Defense requires rigorous backup strategies, endpoint detection, and email filtering.

Question 166

What security component executes suspicious files in an isolated virtual environment to observe their behavior safely?

1. Static application source code scanner
2. Sandbox security analysis environment
3. Active network port scanning utility
4. Passive network packet sniffer tool

Correct Answer: 2

Explanation:

A security sandbox is an isolated, virtualized execution environment designed to run untrusted software, attachments, or scripts safely without risking damage to the host operating system or production network infrastructure. Security analysts and automated threat intelligence platforms use sandboxing to observe the runtime behavior of suspicious files—such as API calls, registry modifications, process injections, and network connections—to identify zero-day malware and advanced threats that evade traditional static signature detection.

Question 167

Which metric measures the average time required by an organization to detect a security incident or breach?

1. Mean Time to Detect (MTTD)
2. Mean Time to Repair (MTTR)
3. Common Vulnerability Scoring System (CVSS)
4. Network bandwidth throughput rate

Correct Answer: 1

Explanation:

Mean Time to Detect (MTTD) is a critical operational security metric that quantifies the average duration elapsed between the initial moment a cyber threat or security breach occurs within an environment and the moment security operations personnel or automated monitoring systems successfully identify it. Reducing MTTD is a primary goal for Security Operations Centers (SOCs), achieved by deploying advanced Security Information and Event Management (SIEM) tools, Endpoint Detection and Response (EDR) platforms, and continuous behavioral anomaly monitoring.

Question 168

What cloud service model shifts infrastructure, storage, and server management to the provider while giving the customer control over applications and data?

1. On-premises physical data center
2. Infrastructure as a Service (IaaS)
3. Desktop as a Service local client
4. Traditional enterprise perimeter model

Correct Answer: 2

Explanation:

Infrastructure as a Service (IaaS) is a cloud computing service model that provides fundamental computing resources over the internet, such as virtual machines, storage, networks, and operating systems, hosted on remote data center infrastructure. In an IaaS model, cloud providers manage the underlying physical hardware, virtualization layers, and facility security, while customers retain complete administrative control over installed operating systems, middleware, applications, and security configurations. This model offers high scalability, flexibility, and cost-efficiency for enterprise IT workloads.

Question 169

Which cryptographic primitive ensures that a data message has not been altered or tampered with during transmission?

1. Message Authentication Code (MAC) or Hash
2. Static public key encryption wrapper
3. Unencrypted session identifier token
4. Electronic Codebook cipher mode

Correct Answer: 1

Explanation:

A Message Authentication Code (MAC) or cryptographic hash function provides data integrity verification by generating a fixed-size checksum or digital signature derived from the message contents and a shared secret key. If even a single bit of the data payload is altered or manipulated during transit across a network, the resulting hash digest changes drastically, immediately alerting the receiving system to tampering. Cryptographic MACs are essential for verifying message integrity in secure protocols like TLS, IPsec, and SSH.

Question 170

What network attack involves an attacker positioning themselves between two communicating hosts to intercept and relay traffic transparently?

1. Address Resolution Protocol cache poisoning
2. Man-in-the-Middle (MitM) attack
3. Content Addressable Memory table flood
4. Dynamic Host Configuration server exhaustion

Correct Answer: 2

Explanation:

A Man-in-the-Middle (MitM) attack is a cyber threat where an adversary secretly intercepts, routes, and relays communications between two parties who believe they are communicating directly with each other. The attacker can eavesdrop on sensitive conversations, capture credentials, or alter data payloads in transit. Common vectors include rogue Wi-Fi access points, ARP poisoning, and SSL stripping. Defending against MitM attacks requires mutual authentication, robust certificate validation, encrypted protocols like HTTPS and SSH, and secure session management.

Question 171

Which protocol provides secure file transfer capabilities over a Secure Shell connection?

1. Unencrypted File Transfer Protocol daemon
2. Trivial File Transfer Protocol utility
3. Secure File Transfer Protocol (SFTP)
4. Legacy Telnet remote administration

Correct Answer: 3

Explanation:

Secure File Transfer Protocol (SFTP) is a network protocol that provides secure file access, file transfer, and file management functionalities over any reliable data stream, typically running over Secure Shell (SSH) protocol on TCP port 22. Unlike legacy FTP which transmits credentials and data payloads in clear text or requires complex auxiliary channels, SFTP encapsulates all communication within robust cryptographic encryption wrappers. This prevents packet sniffing, credential theft, and data tampering during file transmissions across untrusted networks.

Question 172

What Cisco security solution provides extended detection and response (XDR) capabilities across endpoints, network, email, and cloud?

1. Cisco Secure Endpoint and XDR
2. Basic unmanaged Layer 2 switch
3. Unshielded twisted-pair patch cable
4. Passive network signal repeater hub

Correct Answer: 1

Explanation:

Cisco XDR (Extended Detection and Response) is an advanced cloud-native security platform that correlates telemetry and threat intelligence across multiple security vectors—including endpoints, network traffic, email gateways, cloud environments, and firewalls. By unifying visibility and automating incident response workflows, Cisco XDR enables security operations teams to detect sophisticated, multi-vector attacks rapidly, isolate compromised assets across the entire IT infrastructure, and reduce dwell times compared to siloed, point-product security architectures.

Question 173

Which database security control prevents SQL injection by strictly separating executable query syntax from user-supplied input data?

1. Parameterized query input validation
2. Unencrypted Telnet administration access
3. Passive packet sniffer network inspection
4. MAC address port security enforcement

Correct Answer: 1

Explanation:

Parameterized queries—also known as prepared statements—provide the most effective defense mechanism against SQL injection vulnerabilities by strictly separating user-supplied input data from executable database query structures. When applications utilize parameterized queries, the database management system treats user input strictly as literal values rather than executable SQL command syntax, even if the input contains malicious query fragments. Combined with rigorous input validation and robust error handling, parameterized queries prevent attackers from manipulating database logic, ensuring that sensitive enterprise data remains secure against unauthorized extraction and manipulation.

Question 174

What type of cloud service model shifts database management, middleware, and development frameworks entirely to the cloud provider while the customer manages applications?

1. Infrastructure as a Service (IaaS)
2. Platform as a Service (PaaS)
3. Software as a Service (SaaS)
4. Traditional on-premises server room

Correct Answer: 2

Explanation:

Platform as a Service (PaaS) is a cloud computing model that supplies an on-demand environment for developing, testing, delivering, and managing software applications. In a PaaS model, the cloud provider delivers and manages underlying hardware, operating systems, storage, and relational database middleware, while the customer retains control exclusively over the deployed software applications and business logic configurations. This allows development teams to build applications rapidly without worrying about underlying infrastructure maintenance or operating system patching.

Question 175

Which network security feature inspects and filters Address Resolution Protocol packets to protect local segments against ARP spoofing?

1. Dynamic Host Configuration Protocol snooping
2. Dynamic ARP Inspection (DAI) mechanism
3. Spanning Tree Protocol root guard feature
4. Basic port security MAC address limiting

Correct Answer: 2

Explanation:

Dynamic ARP Inspection (DAI) is a Layer 2 security feature on Cisco switches that uses information gathered from DHCP snooping to validate Address Resolution Protocol packets and protect enterprise networks against ARP spoofing and poisoning attacks. DAI intercepts all ARP requests and responses on untrusted ports, comparing the packet bindings against valid entries in the DHCP snooping database. If an ARP packet contains forged IP-to-MAC address mappings, DAI immediately drops the packet, preventing attackers from redirecting local traffic streams.

Question 176

What security concept mandates that critical business transactions require separate individuals to execute different stages to prevent fraud?

1. Principle of least privilege access
2. Separation of duties governance policy
3. Defense in depth architectural strategy
4. Single sign-on authentication model

Correct Answer: 2

Explanation:

Separation of duties is a foundational internal control and governance principle designed to prevent fraud, errors, and malicious activities by ensuring that no single individual maintains end-to-end control over a critical operational or financial transaction. By dividing sensitive workflows—such as financial authorizations, code deployments, or cryptographic key management—across multiple distinct roles, organizations enforce accountability and require collusion for malicious actions to succeed, significantly enhancing enterprise security posture and compliance alignment.

Question 177

What type of threat actor is typically sponsored by a nation-state to conduct long-term cyber espionage and data exfiltration against critical infrastructure?

1. Script kiddie testing basic malware tools
2. Insider threat disgruntled employee worker
3. Advanced Persistent Threat (APT) group

Correct Answer: 4

Explanation:

An Advanced Persistent Threat (APT) is a prolonged, highly targeted cyber attack or campaign conducted by sophisticated threat actors—frequently nation-state sponsors or organized cybercrime syndicates—who gain unauthorized access to a network and remain undetected for an extended period. The primary objective of an APT is typically long-term espionage, intellectual property theft, or strategic disruption of critical national infrastructure rather than immediate financial gain. Detecting APTs requires advanced behavioral analytics, threat intelligence feeds, and continuous hunting across enterprise environments.

Question 178

Which protocol is used to query directory services securely over encrypted Transport Layer Security connections?

1. Unencrypted Lightweight Directory Access Protocol (LDAP)
2. Lightweight Directory Access Protocol Secure (LDAPS)
3. Trivial File Transfer Protocol directory service
4. Simple Network Management Protocol daemon

Correct Answer: 2

Explanation:

Lightweight Directory Access Protocol Secure (LDAPS) is the secure implementation of LDAP that encrypts all communications between client applications and directory service servers using Transport Layer Security (TLS) or Secure Sockets Layer (SSL). Standard LDAP transmits directory queries, user attributes, and passwords in clear text over TCP port 389, leaving them vulnerable to packet sniffing and credential harvesting. LDAPS operates by default over TCP port 636, wrapping directory transactions in cryptographic privacy to protect enterprise authentication data.

Question 179

What automated tool scans IP networks to identify active hosts, open ports, and running operating system services?

1. Packet sniffer binary analyzer utility
2. Active network port scanner (e.g., Nmap)
3. Static application source code inspector
4. File integrity monitoring hash tool

Correct Answer: 2

Explanation:

An active network port scanner is a specialized reconnaissance tool used by network administrators and security professionals—as well as malicious attackers—to probe target systems and discover active hosts, open communication ports, and running operating system services. By transmitting crafted packets and analyzing response behaviors, tools like Nmap map out network topologies and identify potential attack surface vulnerabilities. Security teams use port scanners during authorized vulnerability assessments to audit network perimeters, while attackers use them to locate vulnerable entry points.

Question 180

What security control restricts user permissions to the absolute minimum necessary to perform assigned job functions?

1. Principle of least privilege
2. Defense in depth network strategy
3. Flat unsegmented topology design
4. Unencrypted remote administration

Correct Answer: 1

Explanation:

The principle of least privilege is a fundamental information security concept that dictates that a user, process, or system component must be given only the minimum levels of access permissions—or privileges—necessary to perform its specific, authorized job functions. By restricting privileges strictly to operational requirements, organizations significantly limit the potential blast radius of credential compromise, insider threats, and malware propagation. For example, standard network users should never possess administrative privileges, and software applications should execute under restricted service accounts rather than root-level permissions.