View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 21

Which protocol is used by IPsec to negotiate security associations between VPN peers?

1. SNMP
2. IKE
3. FTP
4. DNS

Correct Answer: 2

Explanation

Internet Key Exchange, or IKE, is used to negotiate security associations between IPsec peers. It handles peer authentication and negotiation of security parameters such as encryption algorithms, integrity algorithms, Diffie-Hellman groups, and authentication methods. IKEv2 is widely used in modern Cisco VPN deployments because it provides an efficient and secure negotiation process. IKE does not directly carry normal application traffic. Instead, it establishes the security parameters that allow IPsec to protect the actual data. SNMP is used for network management, FTP transfers files, and DNS resolves domain names. Proper IKE configuration is essential for successful IPsec tunnel establishment.

Question 22

Which Cisco technology provides centralized identity-based access control for wired and wireless networks?

1. Cisco ISE
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco Secure Firewall

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or ISE, provides centralized identity-based access control for network environments. It can authenticate users and devices and apply authorization policies based on identity, device type, location, security posture, and other contextual information. Cisco ISE commonly integrates with 802.1X authentication for wired and wireless network access. It can also work with network infrastructure to enforce authorization decisions. Cisco Umbrella focuses on cloud-based security services, Secure Client provides endpoint connectivity and security capabilities, and Secure Firewall provides traffic inspection and enforcement. ISE is particularly useful when organizations need centralized control over who and what can access network resources.

Question 23

Which IPsec protocol provides confidentiality by encrypting the protected payload?

1. AH
2. ESP
3. ARP
4. ICMP

Correct Answer: 2

Explanation

Encapsulating Security Payload, or ESP, provides confidentiality by encrypting protected IPsec traffic. ESP can also provide integrity, authentication, and anti-replay protection depending on the configured security algorithms and parameters. It is commonly used for both site-to-site and remote-access VPN deployments. Authentication Header, or AH, provides integrity and authentication but does not provide encryption. ARP is used for address resolution on local networks, while ICMP is used for control and diagnostic messaging. In modern IPsec VPN deployments, ESP is generally preferred because it can provide confidentiality along with other important security services.

Question 24

Which AAA function records information about user activity and resource usage?

1. Authentication
2. Authorization
3. Accounting
4. Encryption

Correct Answer: 3

Explanation

Accounting is the AAA function responsible for recording information about user activity and resource usage. In a network environment, accounting can record events such as login sessions, command execution, connection duration, or other administrative activities depending on the configured AAA system. Authentication verifies a user’s identity, while authorization determines what the authenticated user is permitted to access or perform. Accounting provides an audit trail that can support security investigations, compliance requirements, and troubleshooting. Cisco environments can use protocols such as TACACS+ or RADIUS to provide centralized AAA services. Proper accounting configuration improves visibility into administrative and user activity.

Question 25

Which Cisco security feature uses a trusted DHCP binding database to validate ARP messages?

1. Port Security
2. Dynamic ARP Inspection
3. IPsec
4. NAT

Correct Answer: 2

Explanation

Dynamic ARP Inspection, or DAI, can use the DHCP Snooping binding database to validate ARP messages on a switch. It compares information in ARP packets with trusted IP-to-MAC bindings and can drop packets that do not match expected information. This helps defend against ARP spoofing attacks. DHCP Snooping creates and maintains the binding information, while DAI uses that information for ARP validation. Port Security focuses on MAC addresses permitted on switch ports, IPsec protects IP traffic cryptographically, and NAT translates addresses. DAI is therefore an important Layer 2 security feature when combined with DHCP Snooping.

Question 26

Which authentication method uses digital certificates to verify the identity of VPN peers?

1. Pre-shared key
2. Username and password
3. Certificate-based authentication
4. PAP

Correct Answer: 3

Explanation

Certificate-based authentication uses digital certificates to verify the identities of communicating VPN peers. Certificates are normally issued and validated through a Public Key Infrastructure, or PKI. This method can provide scalable authentication because organizations do not need to manually configure a unique shared secret between every pair of VPN devices. During the authentication process, the peers validate certificates and establish trust based on the configured certificate authority. Pre-shared keys are simpler for smaller deployments but can become difficult to manage at scale. Certificate-based authentication is therefore commonly considered for larger enterprise VPN environments requiring strong and scalable peer authentication.

Question 27

Which Cisco technology can identify and control applications passing through a security appliance?

1. Application visibility and control
2. DHCP Snooping
3. HSRP
4. NTP

Correct Answer: 1

Explanation

Application visibility and control capabilities allow Cisco security platforms to identify applications and apply security policies based on application characteristics. Instead of relying only on IP addresses and TCP or UDP ports, administrators can create policies that distinguish specific applications or application categories. This provides more granular control over network traffic. DHCP Snooping protects against rogue DHCP servers, HSRP provides gateway redundancy, and NTP synchronizes device clocks. Application-aware security can be particularly useful when multiple applications share common ports or when administrators need to restrict specific applications while allowing other traffic through the same network infrastructure.

Question 28

Which VPN architecture connects remote individual users to an organization’s network?

1. Site-to-site VPN
2. Remote-access VPN
3. GRE tunnel
4. Layer 2 trunk

Correct Answer: 2

Explanation

A remote-access VPN provides secure connectivity for individual users connecting from remote locations to an organization’s network. Users can establish encrypted VPN sessions from laptops or other supported endpoints and access authorized corporate resources. Cisco Secure Client can be used in supported remote-access VPN deployments to establish secure connections. A site-to-site VPN instead connects entire networks through VPN gateways and is commonly used between branch offices or data centers. GRE provides tunneling but does not inherently provide encryption, while a Layer 2 trunk is used to transport VLAN traffic between network devices. Remote-access VPNs are therefore designed specifically for individual remote users.

Question 29

Which Cisco security feature can restrict the source IP address and MAC address of traffic using DHCP Snooping bindings?

1. IP Source Guard
2. Dynamic ARP Inspection
3. Port Security
4. MACsec

Correct Answer: 1

Explanation

IP Source Guard helps prevent IP address spoofing by restricting traffic on an interface according to trusted IP-to-MAC binding information. These bindings can be learned through DHCP Snooping. If a device sends traffic using a source IP address that does not match the expected binding, the switch can block the traffic. Dynamic ARP Inspection focuses specifically on validating ARP messages, while Port Security controls allowed MAC addresses on switch ports. MACsec provides Layer 2 encryption and integrity protection between supported devices. IP Source Guard is therefore useful for enforcing source-address validation at the access layer.

Question 30

Which protocol is commonly used by Cisco ISE for centralized authentication of network access users?

1. RADIUS
2. FTP
3. SMTP
4. TFTP

Correct Answer: 1

Explanation

RADIUS is commonly used by Cisco ISE to provide centralized authentication and authorization for network access. It is widely deployed with technologies such as 802.1X for wired and wireless access control. A network device can forward authentication requests to ISE, which evaluates the user’s credentials and configured policies before returning an authorization decision. FTP and TFTP are file-transfer protocols, while SMTP is used for email transmission. RADIUS is particularly suited to network access scenarios because it can integrate authentication with authorization information and support centralized policy enforcement. Cisco ISE can also integrate with external identity sources for more comprehensive access control.

Question 31

Which IPsec mode is generally used to protect communication between two individual hosts?

1. Tunnel mode
2. Transport mode
3. Broadcast mode
4. Proxy mode

Correct Answer: 2

Explanation

IPsec transport mode generally protects communication between two individual hosts while preserving the original IP header. The IPsec protection is applied to the payload of the IP packet. Transport mode can be appropriate when both endpoints themselves participate in IPsec and are responsible for protecting the communication. Tunnel mode encapsulates the entire original IP packet inside a new IP packet and is commonly used for gateway-to-gateway VPNs. The choice between transport and tunnel mode depends on the VPN architecture and security requirements. Understanding this distinction is important when configuring or troubleshooting IPsec deployments.

Question 32

Which security protocol provides secure remote CLI access to Cisco network devices?

1. Telnet
2. SSH
3. FTP
4. HTTP

Correct Answer: 2

Explanation

Secure Shell, or SSH, provides encrypted remote CLI access to Cisco network devices. SSH protects authentication credentials and management traffic from being transmitted in clear text. Telnet does not provide encryption and therefore exposes administrative information to interception when used across an untrusted network. FTP is designed for file transfers, while HTTP is an application protocol commonly used for web services. Cisco administrators commonly configure SSH with local or centralized AAA authentication and restrict access through management interfaces or access control policies. Secure management is an important part of protecting the network infrastructure itself.

Question 33

Which security technology can identify malicious traffic and automatically take action to block it?

1. IPS
2. Syslog
3. NetFlow
4. NTP

Correct Answer: 1

Explanation

An Intrusion Prevention System, or IPS, can inspect traffic for malicious activity and take automated action according to configured security policies. It can use signatures, reputation information, protocol analysis, and behavioral techniques to identify suspicious or malicious traffic. Depending on the configuration, the IPS can drop packets, reset connections, or otherwise prevent the identified traffic from continuing. Syslog primarily records events, NetFlow provides traffic-flow information, and NTP synchronizes device clocks. IPS capabilities can be integrated into Cisco security platforms to provide deeper inspection than basic network access-control rules and help defend against known and emerging network threats.

Question 34

Which component of PKI issues digital certificates to authenticated entities?

1. Certificate Authority
2. DNS Server
3. DHCP Server
4. RADIUS Server

Correct Answer: 1

Explanation

A Certificate Authority, or CA, is responsible for issuing and managing digital certificates within a Public Key Infrastructure. The CA verifies the identity of an entity according to the organization’s certificate policies and then signs the certificate so that other participants can establish trust. Certificates can be used for VPN authentication, secure web services, device authentication, and other security applications. DNS resolves names, DHCP provides IP configuration, and RADIUS commonly provides centralized authentication and authorization. A properly designed PKI also includes mechanisms for certificate renewal, revocation, and trust-chain validation to maintain secure certificate-based authentication.

Question 35

Which Cisco firewall feature allows administrators to control traffic according to source, destination, application, and other characteristics?

1. Access Control Policy
2. NTP
3. DHCP Snooping
4. HSRP

Correct Answer: 1

Explanation

An Access Control Policy on Cisco Secure Firewall platforms allows administrators to define how network traffic should be handled. Policies can use characteristics such as source and destination networks, ports, applications, users, URLs, and other security criteria depending on the platform and configuration. Rules can permit, block, or further inspect traffic. This provides centralized policy-based control over network communications. NTP is used for time synchronization, DHCP Snooping is a Layer 2 protection mechanism, and HSRP provides gateway redundancy. Proper access-control policy design is essential for enforcing an organization’s security requirements while allowing legitimate business traffic.

Question 36

Which protocol provides confidentiality and integrity for management traffic when accessing a device remotely?

1. Telnet
2. SSH
3. TFTP
4. SNMPv1

Correct Answer: 2

Explanation

SSH provides confidentiality and integrity for remote management sessions. It encrypts the communication between the administrator and the network device, protecting credentials and command information from interception or unauthorized modification. Telnet sends management information without encryption, while TFTP is primarily used for simple file transfers. SNMPv1 does not provide modern cryptographic protection for management communications. Secure management should also include strong authentication, appropriate authorization, restricted management access, and secure device configurations. SSH is therefore the standard choice for encrypted command-line administration of Cisco network infrastructure.

Question 37

Which Cisco technology can provide cloud-delivered security enforcement based on DNS requests?

1. Cisco ISE
2. Cisco Secure Firewall
3. Cisco Umbrella
4. Cisco IPS

Correct Answer: 3

Explanation

Cisco Umbrella provides cloud-delivered security services that can enforce security policies at the DNS layer. When a user attempts to resolve a domain, Umbrella can evaluate the request against security intelligence and configured policies. Requests associated with malicious or unwanted destinations can be blocked before the user establishes a connection to the destination. This approach provides an additional security layer outside traditional perimeter firewalls. Cisco ISE focuses on identity-based access control, Secure Firewall provides network security inspection, and IPS focuses on detecting and preventing malicious traffic. Umbrella can therefore complement these technologies as part of a layered security architecture.

Question 38

Which security feature prevents unauthorized DHCP server responses from untrusted switch ports?

1. Port Security
2. DHCP Snooping
3. IP Source Guard
4. Dynamic ARP Inspection

Correct Answer: 2

Explanation

DHCP Snooping prevents unauthorized DHCP server responses from untrusted switch interfaces. Administrators configure interfaces connected to legitimate DHCP servers or trusted infrastructure as trusted, while access ports are normally left untrusted. DHCP server messages received from untrusted interfaces can then be blocked. DHCP Snooping also builds a binding database that records relationships between IP addresses, MAC addresses, VLANs, and switch interfaces. That database can subsequently support security features such as Dynamic ARP Inspection and IP Source Guard. DHCP Snooping is therefore a foundational protection against rogue DHCP servers and incorrect address assignment on Layer 2 networks.

Question 39

Which IPsec security service protects data from being modified while in transit?

1. Integrity
2. Availability
3. Address translation
4. Compression

Correct Answer: 1

Explanation

Integrity protection ensures that data has not been modified or tampered with while traveling across the network. IPsec can provide integrity using cryptographic authentication mechanisms, allowing the receiving device to verify that the protected packet has not been altered. Confidentiality, provided through encryption, protects the contents from unauthorized disclosure, while integrity protects against unauthorized modification. These are separate but complementary security services. Authentication mechanisms can also help verify the source of the traffic. Proper IPsec configuration combines the required security services according to the organization’s VPN requirements and the capabilities of the selected algorithms and protocols.

Question 40

Which Cisco security solution is primarily designed to manage and enforce identity-based access policies?

1. Cisco Umbrella
2. Cisco Secure Client
3. Cisco ISE
4. Cisco Secure Firewall Management Center

Correct Answer: 3

Explanation

Cisco Identity Services Engine, or ISE, is designed to manage and enforce identity-based access policies. It can authenticate users and devices and make authorization decisions based on identity and contextual information. ISE commonly supports 802.1X, guest access, device profiling, and other network access-control capabilities. Cisco Umbrella provides cloud-delivered security services, Secure Client provides endpoint connectivity and security capabilities, and Secure Firewall Management Center centrally manages supported firewall infrastructure. Identity-based access control allows organizations to apply different network policies to different users and devices instead of relying solely on IP addresses or physical switch ports.