View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 61

Which Cisco security technology provides network access control based on user and device identity?

1. Cisco Umbrella
2. Cisco ISE
3. Cisco Secure Client
4. Cisco Secure Firewall

Correct Answer: 2

Explanation

Cisco Identity Services Engine, or ISE, provides identity-based network access control. It can authenticate users and devices and apply authorization policies based on identity, device type, location, posture, and other contextual information. ISE commonly works with 802.1X to control access to wired and wireless networks. This allows organizations to apply different policies to employees, guests, contractors, and managed devices. Cisco Umbrella focuses on cloud-delivered security, Secure Client provides endpoint connectivity and security functions, and Secure Firewall provides network traffic inspection and policy enforcement. ISE is therefore a central component for identity-aware network access control.

Question 62

Which IPsec protocol provides integrity and authentication without encrypting the packet payload?

1. ESP
2. IKE
3. AH
4. TLS

Correct Answer: 3

Explanation

Authentication Header, or AH, provides integrity and authentication for IP packets but does not provide confidentiality through encryption. It allows the receiving device to verify that protected packet information has not been modified and that the packet originated from an authenticated peer. ESP can provide encryption in addition to integrity and authentication and is therefore more commonly used in modern IPsec VPN deployments. IKE is responsible for negotiating IPsec security associations and cryptographic parameters. TLS is a separate security protocol generally associated with application-layer communications. Understanding AH and ESP helps administrators select appropriate IPsec security services.

Question 63

Which Cisco security feature can block traffic based on known malicious IP addresses and domains?

1. Security intelligence
2. HSRP
3. DHCP Snooping
4. Port Security

Correct Answer: 1

Explanation

Security intelligence capabilities can use reputation information about IP addresses, domains, and other indicators to identify known malicious destinations or sources. Cisco security platforms can use threat intelligence to block or otherwise control connections associated with known malicious infrastructure. This provides an additional layer of protection before deeper inspection or application-level analysis occurs. HSRP provides gateway redundancy, DHCP Snooping protects against rogue DHCP servers, and Port Security controls MAC addresses on switch interfaces. Security intelligence is particularly useful because threat information can be updated as new malicious infrastructure is identified and added to reputation databases.

Question 64

Which protocol is used to authenticate and authorize administrators accessing Cisco network devices?

1. TACACS+
2. ARP
3. ICMP
4. DHCP

Correct Answer: 1

Explanation

TACACS+ is commonly used for centralized authentication and authorization of administrators accessing Cisco network infrastructure. It can verify administrator credentials and determine which commands or services the authenticated user is allowed to use. TACACS+ also supports accounting, allowing organizations to record administrative activity. ARP resolves IPv4 addresses to MAC addresses, ICMP provides network control and diagnostic messaging, and DHCP provides IP configuration. Centralized TACACS+ authentication improves administrative security by reducing dependence on locally configured credentials and allowing organizations to enforce consistent authorization policies across multiple routers, switches, firewalls, and other network devices.

Question 65

Which VPN technology is designed specifically for individual remote users?

1. Site-to-site IPsec
2. Remote-access VPN
3. GRE
4. DMVPN

Correct Answer: 2

Explanation

A remote-access VPN is designed to provide secure connectivity for individual users connecting from remote locations. A user typically runs a supported VPN client, such as Cisco Secure Client, to establish an encrypted connection to the organization’s VPN gateway. The organization can then authenticate the user and apply authorization policies before granting access to permitted resources. Site-to-site IPsec VPNs connect entire networks rather than individual users. GRE provides tunneling without inherent encryption, while DMVPN is designed for scalable dynamic site-to-site connectivity. Remote-access VPNs are especially useful for employees working from home, traveling, or connecting from other external locations.

Question 66

Which Cisco security feature can inspect traffic at the application layer and enforce application-specific policies?

1. Application Control
2. DHCP Snooping
3. IP Source Guard
4. MACsec

Correct Answer: 1

Explanation

Application Control allows supported Cisco security platforms to identify applications and enforce policies based on application traffic. This provides greater visibility than relying solely on IP addresses and port numbers. Administrators can create policies to allow, block, or inspect particular applications or application categories according to organizational requirements. DHCP Snooping protects against rogue DHCP servers, IP Source Guard validates source information, and MACsec provides Layer 2 cryptographic protection. Application-aware policies are useful because modern applications may use dynamic ports or share common protocols. Identifying applications allows security administrators to create more precise and meaningful access-control rules.

Question 67

Which IPsec component provides protection against replay attacks?

1. Sequence number
2. DNS
3. DHCP
4. NAT

Correct Answer: 1

Explanation

IPsec uses sequence numbers together with anti-replay mechanisms to help detect and reject duplicated or replayed packets. Each protected packet can contain a sequence number, and the receiving device maintains a replay window to determine whether packets have already been received or fall outside the acceptable sequence range. This helps prevent an attacker from capturing legitimate encrypted traffic and retransmitting it later. DNS provides name resolution, DHCP provides network configuration, and NAT translates addresses. Anti-replay protection is an important part of IPsec security because confidentiality and integrity alone do not necessarily prevent an attacker from retransmitting valid previously captured packets.

Question 68

Which Cisco product provides endpoint-based VPN connectivity and security capabilities?

1. Cisco ISE
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco Secure Firewall Management Center

Correct Answer: 3

Explanation

Cisco Secure Client provides endpoint connectivity and security capabilities, including supported remote-access VPN functionality. It is installed on user devices and can establish secure connections to organizational VPN gateways. Depending on the deployment and licensing, Secure Client can also provide additional endpoint security functions. Cisco ISE focuses on identity-based network access control, Cisco Umbrella provides cloud-delivered security services, and Secure Firewall Management Center centrally manages supported firewall infrastructure. Endpoint VPN software is important for remote users because it provides a controlled and encrypted connection from the user’s device to the organization’s security infrastructure.

Question 69

Which Layer 2 security feature limits the number of MAC addresses that can be learned on a switch port?

1. Port Security
2. DHCP Snooping
3. Dynamic ARP Inspection
4. IP Source Guard

Correct Answer: 1

Explanation

Port Security allows administrators to limit the number of MAC addresses permitted on a switch interface. It can also specify secure MAC addresses manually or allow them to be learned dynamically or through sticky learning, depending on the configuration. When a violation occurs, the switch can take an action such as restricting or dropping unauthorized traffic. DHCP Snooping protects DHCP operations, Dynamic ARP Inspection validates ARP information, and IP Source Guard restricts source addressing. Port Security is therefore directly associated with controlling which Layer 2 devices can use an access port and can help reduce unauthorized device connections.

Question 70

Which authentication method is commonly used with IKE when a VPN peer is authenticated using a shared secret?

1. Digital certificate
2. Pre-shared key
3. Kerberos ticket
4. PAP

Correct Answer: 2

Explanation

A pre-shared key is a shared secret configured on both VPN peers and used during IKE authentication. Each peer must possess the correct secret for authentication to succeed. PSK authentication is relatively simple and can work well for smaller VPN deployments. However, managing many different shared keys can become difficult in large environments, which is one reason certificate-based authentication may be preferred for larger deployments. Digital certificates provide identity verification through PKI, while Kerberos and PAP are different authentication mechanisms. The security of a PSK deployment depends heavily on using strong secrets and protecting them from unauthorized disclosure.

Question 71

Which Cisco security technology can identify users associated with network traffic for policy enforcement?

1. User identity services
2. HSRP
3. DHCP Relay
4. NTP

Correct Answer: 1

Explanation

User identity services allow supported Cisco security platforms to associate network activity with authenticated users. This enables administrators to create policies based on user identity rather than relying exclusively on IP addresses. User-aware policies can be useful when different groups require different access to applications, websites, or network resources. Identity information can be obtained through integration with authentication systems and other identity sources. HSRP provides gateway redundancy, DHCP Relay forwards DHCP requests between networks, and NTP synchronizes clocks. Identity-aware security is particularly useful in enterprise environments where user roles and permissions are more meaningful than individual IP addresses.

Question 72

Which security technology can inspect encrypted VPN traffic after it has been decrypted by a security appliance?

1. Access Control Policy
2. Traffic inspection
3. Application inspection
4. Security inspection policy

Correct Answer: 4

Explanation

A security inspection policy can apply security controls to traffic after it has been decrypted by a security appliance. VPN encryption protects traffic while it crosses an untrusted network, but the traffic may need to be inspected once it reaches a security gateway. Depending on the platform and configuration, the appliance can apply access control, intrusion prevention, application identification, malware inspection, or other security services. Simply establishing an encrypted VPN tunnel does not automatically guarantee that the content of the decrypted traffic is safe. Layered inspection is therefore important when organizations want VPN users or remote networks to remain subject to normal security policies.

Question 73

Which Cisco security feature can detect unauthorized ARP replies on a Layer 2 network?

1. Port Security
2. Dynamic ARP Inspection
3. IP Source Guard
4. MACsec

Correct Answer: 2

Explanation

Dynamic ARP Inspection, or DAI, helps detect and block invalid or unauthorized ARP messages on supported Cisco switches. It can compare ARP information against trusted DHCP Snooping bindings and reject packets whose IP-to-MAC information does not match expected values. This helps protect against ARP spoofing and certain man-in-the-middle attacks. Port Security focuses on MAC addresses, IP Source Guard validates source addressing, and MACsec provides cryptographic protection for Ethernet frames. DAI is commonly deployed alongside DHCP Snooping because the DHCP binding database provides the trusted information needed for effective ARP validation.

Question 74

Which IPsec security association defines the algorithms and keys used to protect traffic?

1. IPsec Security Association
2. DNS record
3. DHCP lease
4. ARP entry

Correct Answer: 1

Explanation

An IPsec Security Association, or SA, defines the security parameters used to protect traffic between VPN peers. These parameters can include encryption and integrity algorithms, keys, security protocol information, and other details required for protected communication. IKE is commonly responsible for negotiating and establishing the security associations. DNS records provide name-resolution information, DHCP leases provide IP configuration, and ARP entries map IPv4 addresses to MAC addresses. Security associations are fundamental to IPsec operation because they provide the context that tells the devices how traffic should be encrypted, authenticated, and processed.

Question 75

Which Cisco technology provides centralized management of firewall policies and security events?

1. Cisco Secure Client
2. Cisco Secure Firewall Management Center
3. Cisco Umbrella
4. Cisco ISE

Correct Answer: 2

Explanation

Cisco Secure Firewall Management Center provides centralized management and monitoring for supported Cisco Secure Firewall deployments. Administrators can use it to configure access-control policies, NAT rules, intrusion policies, network objects, VPN settings, and other security controls. It also provides visibility into events and security activity from managed firewalls. Cisco Secure Client is an endpoint application, Cisco Umbrella provides cloud-delivered security services, and Cisco ISE focuses on identity-based network access control. Centralized firewall management simplifies administration in environments with multiple security devices and helps maintain consistent policies while providing a consolidated view of security events.

Question 76

Which protocol protects web traffic using encryption and authentication between a client and server?

1. HTTP
2. HTTPS
3. FTP
4. TFTP

Correct Answer: 2

Explanation

HTTPS uses HTTP over TLS to protect web communications between clients and servers. TLS provides encryption, integrity, and server authentication through digital certificates. This prevents unauthorized parties from easily reading or modifying protected web traffic while it travels across an untrusted network. Plain HTTP does not provide these cryptographic protections. FTP and TFTP are file-transfer protocols and do not inherently provide the same security as HTTPS. Certificate validation is an important part of HTTPS security because it allows clients to verify that the server certificate chains to a trusted certificate authority and matches the intended destination.

Question 77

Which security control can prevent unauthorized devices from using an access switch port based on their MAC addresses?

1. Port Security
2. IKE
3. URL Filtering
4. IPS

Correct Answer: 1

Explanation

Port Security can restrict which MAC addresses are permitted to use a switch interface. Administrators can define secure MAC addresses or configure the switch to dynamically learn them. A maximum number of allowed MAC addresses can also be specified. If an unauthorized MAC address appears, the configured violation action determines how the switch responds. This feature is commonly used on access ports where only specific endpoints should be connected. IKE handles VPN negotiation, URL Filtering controls web destinations, and IPS detects and prevents malicious network activity. Port Security is therefore a direct Layer 2 access-control mechanism.

Question 78

Which Cisco security solution provides DNS-layer protection against phishing and malware destinations?

1. Cisco Secure Client
2. Cisco ISE
3. Cisco Umbrella
4. Cisco TACACS+

Correct Answer: 3

Explanation

Cisco Umbrella provides DNS-layer security that can block access to malicious, phishing, and other unwanted destinations based on security intelligence and configured policies. DNS-layer enforcement can stop a connection before the user reaches the destination because the DNS request itself can be blocked or redirected. Cisco ISE provides identity and network access control, Secure Client provides endpoint connectivity and security functions, and TACACS+ provides centralized AAA for administrative access. Umbrella can complement firewalls, endpoint security, and other controls by providing protection that is not limited to the organization’s physical network perimeter.

Question 79

Which AAA protocol separates authentication and authorization functions and supports command-level authorization?

1. RADIUS
2. TACACS+
3. SNMP
4. LDAP

Correct Answer: 2

Explanation

TACACS+ separates authentication and authorization and supports detailed command-level authorization for network administrators. This allows an organization to authenticate an administrator and then determine exactly which commands that administrator is permitted to execute. TACACS+ also supports accounting for administrative activity. RADIUS is commonly used for network access authentication and has a different protocol design. SNMP is used for network monitoring and management, while LDAP is primarily a directory-access protocol. Command-level authorization is particularly valuable in enterprise environments where administrators have different responsibilities and should not automatically receive unrestricted access to every network-device command.

Question 80

Which IPsec feature ensures that a received packet was not modified while traveling through the VPN?

1. Confidentiality
2. Integrity
3. Compression
4. Address translation

Correct Answer: 2

Explanation

Integrity ensures that protected IPsec data has not been modified during transmission. Cryptographic integrity mechanisms calculate and verify authentication information associated with protected packets. If the received information does not match the expected integrity value, the packet can be rejected. Confidentiality is provided by encryption and protects data from being read by unauthorized parties. Compression and address translation are separate networking functions and do not provide cryptographic integrity. Integrity protection is especially important because encrypted data could still potentially be modified if no mechanism existed to detect tampering. IPsec commonly combines confidentiality and integrity for comprehensive VPN protection.