View Full Cisco CCNP Security 300-730 Exam Dumps and Practice Test Dumps.

 

Question 81

Which Cisco technology provides centralized identity-based access control for wired and wireless networks?

1. Cisco Umbrella
2. Cisco Secure Firewall
3. Cisco ISE
4. Cisco Secure Client

Correct Answer: 3

Explanation

Cisco Identity Services Engine, commonly known as Cisco ISE, provides centralized identity-based access control for enterprise networks. It can authenticate users and devices and then apply authorization policies based on identity, device type, location, security posture, and other contextual information. ISE commonly integrates with 802.1X to control access to wired and wireless infrastructure. It can also support guest access, profiling, and posture-related functions. Cisco Umbrella focuses primarily on cloud-delivered security, Secure Firewall provides network security enforcement, and Secure Client operates on endpoints. ISE is therefore well suited for organizations requiring centralized identity-aware network access policies.

Question 82

Which protocol is commonly used by Cisco ISE to authenticate network users through 802.1X?

1. RADIUS
2. FTP
3. SNMP
4. TFTP

Correct Answer: 1

Explanation

RADIUS is commonly used between Cisco ISE and network access devices when implementing 802.1X authentication. The switch or wireless controller acts as the authenticator and communicates with ISE as the RADIUS server. ISE validates the user’s or device’s credentials and returns authorization information to the network access device. FTP and TFTP are file-transfer protocols, while SNMP is primarily used for network monitoring and management. RADIUS is widely used for network access authentication because it supports centralized authentication and authorization and integrates well with enterprise identity systems and 802.1X deployments.

Question 83

Which IPsec mode encrypts the original IP header along with the payload?

1. Transport mode
2. Tunnel mode
3. Authentication mode
4. Proxy mode

Correct Answer: 2

Explanation

IPsec tunnel mode encapsulates the original IP packet inside a new IP packet. The original IP header and payload are protected, while a new outer IP header is added for routing between VPN peers. Tunnel mode is commonly used for site-to-site VPNs where security gateways connect separate networks across an untrusted network. Transport mode protects the payload while retaining the original IP header and is commonly associated with host-to-host communication. Authentication mode and proxy mode are not IPsec operating modes. Tunnel mode therefore provides the encapsulation required for typical gateway-to-gateway VPN deployments.

Question 84

Which security mechanism helps prevent rogue DHCP servers from providing unauthorized IP configuration?

1. Dynamic ARP Inspection
2. IP Source Guard
3. DHCP Snooping
4. Port Security

Correct Answer: 3

Explanation

DHCP Snooping helps protect a switched network from unauthorized or rogue DHCP servers. The switch can classify interfaces as trusted or untrusted. DHCP responses from untrusted interfaces can be blocked, while legitimate DHCP server traffic is allowed through trusted interfaces. DHCP Snooping can also build a binding database containing information such as client MAC addresses, assigned IP addresses, VLANs, and interfaces. Other Layer 2 security features can use this information. Dynamic ARP Inspection validates ARP traffic, IP Source Guard controls source addresses, and Port Security limits MAC addresses. DHCP Snooping is specifically designed to control DHCP behavior.

Question 85

Which Cisco Secure Firewall feature allows administrators to control access based on URL categories?

1. URL Filtering
2. DHCP Snooping
3. MACsec
4. IP Source Guard

Correct Answer: 1

Explanation

URL Filtering allows Cisco Secure Firewall deployments to control web access based on URL categories and reputation information. Administrators can create policies that permit or block websites according to organizational requirements. For example, categories associated with malicious or inappropriate content can be restricted while business-related categories remain accessible. DHCP Snooping and IP Source Guard are Layer 2 security features, while MACsec protects Ethernet traffic using encryption and integrity mechanisms. URL filtering provides an additional level of web security because policies can consider the destination website or category rather than relying only on IP addresses and ports.

Question 86

Which protocol is designed to provide secure remote command-line access to network devices?

1. Telnet
2. FTP
3. SSH
4. HTTP

Correct Answer: 3

Explanation

SSH, or Secure Shell, provides encrypted remote command-line access to network devices. It protects administrator credentials and session data from being transmitted in clear text. SSH is commonly used for securely managing routers, switches, firewalls, and other infrastructure. Telnet also provides remote CLI access but does not encrypt the session, making it unsuitable for secure administrative access over untrusted networks. FTP is primarily used for file transfers, while HTTP is used for web-based communication. Organizations generally prefer SSH for remote CLI management because it provides confidentiality and authentication for administrative sessions.

Question 87

Which security technology uses digital certificates to establish trusted identities?

1. PKI
2. NAT
3. DHCP
4. ARP

Correct Answer: 1

Explanation

Public Key Infrastructure, or PKI, provides the framework for managing digital certificates and public-key cryptography. A certificate authority issues certificates that bind an identity to a public key. Devices and users can then use these certificates for authentication, encryption, and establishing trust. PKI is commonly used with technologies such as TLS, IPsec VPNs, and secure email. NAT translates network addresses, DHCP provides IP configuration, and ARP resolves IPv4 addresses to MAC addresses. PKI is particularly useful in large environments because certificate-based authentication can scale more effectively than manually managing shared secrets between many systems.

Question 88

Which Cisco security feature can identify and control applications regardless of the TCP or UDP port they use?

1. Application Control
2. Port Security
3. DHCP Snooping
4. MACsec

Correct Answer: 1

Explanation

Application Control allows Cisco security platforms to identify applications and enforce policies based on application identity rather than relying only on TCP or UDP port numbers. Modern applications may use dynamic ports, common protocols, or encrypted connections, making simple port-based filtering less effective. Application-aware policies can allow, block, or further inspect identified applications according to organizational requirements. Port Security controls MAC addresses on switch interfaces, DHCP Snooping protects DHCP operations, and MACsec secures Layer 2 traffic. Application Control therefore provides more granular visibility and policy enforcement for modern enterprise network traffic.

Question 89

Which component of a PKI environment is responsible for issuing and signing digital certificates?

1. Registration Authority
2. Certificate Authority
3. Authentication Server
4. DNS Server

Correct Answer: 2

Explanation

The Certificate Authority, or CA, is responsible for issuing and digitally signing certificates in a PKI environment. The CA verifies identity according to the organization’s certificate policies and then creates certificates containing information such as the subject identity and public key. A Registration Authority may assist with identity verification and certificate requests, but the CA performs the certificate issuance and signing function. DNS servers provide name resolution, while authentication servers handle other forms of identity verification. A trusted CA hierarchy allows devices and applications to validate certificates and establish cryptographic trust with other systems.

Question 90

Which security control is primarily responsible for determining what an authenticated user is allowed to do?

1. Authentication
2. Accounting
3. Authorization
4. Encryption

Correct Answer: 3

Explanation

Authorization determines what actions or resources an authenticated user is permitted to access. Authentication first verifies the identity of a user or device, while authorization applies permissions after that identity has been established. Accounting records activity such as login events and administrative actions. Encryption protects information from unauthorized disclosure during transmission or storage. In an AAA framework, authentication answers who the user is, authorization determines what the user can do, and accounting records what the user did. Understanding these distinctions is important when designing centralized access-control policies for enterprise security systems.

Question 91

Which Cisco solution provides DNS-based security enforcement using cloud-delivered threat intelligence?

1. Cisco ISE
2. Cisco Secure Firewall
3. Cisco Umbrella
4. Cisco Secure Client

Correct Answer: 3

Explanation

Cisco Umbrella provides cloud-delivered security services that can enforce policies at the DNS layer. When a user attempts to access a domain, Umbrella can evaluate the DNS request against security intelligence and configured policies. Requests associated with malicious, phishing, or otherwise blocked destinations can be prevented before the connection is established. Cisco ISE is focused on identity and network access control, Secure Firewall provides network security enforcement, and Secure Client provides endpoint-based capabilities. DNS-layer security is useful because it can protect users even when they are outside the traditional corporate network perimeter.

Question 92

Which IPsec protocol provides confidentiality by encrypting network traffic?

1. AH
2. ESP
3. IKE
4. ARP

Correct Answer: 2

Explanation

Encapsulating Security Payload, or ESP, is the primary IPsec protocol used to provide confidentiality through encryption. ESP can also provide integrity, authentication, and anti-replay protection depending on the configured algorithms and security association. AH can provide integrity and authentication but does not encrypt the payload. IKE is responsible for negotiating security associations and cryptographic parameters rather than directly protecting user traffic. ARP is a local network protocol used for IPv4 address-to-MAC resolution. ESP is therefore the protocol most commonly associated with encrypted IPsec VPN traffic.

Question 93

Which Layer 2 security feature validates ARP packets against trusted IP-to-MAC bindings?

1. Dynamic ARP Inspection
2. Port Security
3. IP Source Guard
4. DHCP Relay

Correct Answer: 1

Explanation

Dynamic ARP Inspection, or DAI, validates ARP packets to help prevent ARP spoofing attacks. On many Cisco switch deployments, DAI uses the DHCP Snooping binding database as a source of trusted IP-to-MAC information. When an ARP packet arrives, the switch can compare the claimed IP and MAC information with the trusted binding. Invalid packets can then be dropped. Port Security controls MAC addresses on interfaces, IP Source Guard validates source addressing, and DHCP Relay forwards DHCP messages between network segments. DAI is especially effective when deployed together with DHCP Snooping in access-layer security designs.

Question 94

Which Cisco security management platform is used to centrally configure and monitor Secure Firewall policies?

1. Cisco ISE
2. Cisco Umbrella
3. Cisco Secure Client
4. Cisco Secure Firewall Management Center

Correct Answer: 4

Explanation

Cisco Secure Firewall Management Center, or FMC, provides centralized management and monitoring for supported Cisco Secure Firewall deployments. Administrators can configure access-control policies, network objects, NAT, VPN settings, intrusion policies, and other security functions through the management platform. FMC also provides visibility into security events and traffic activity from managed devices. Cisco ISE focuses on identity-based network access, Umbrella provides cloud security services, and Secure Client provides endpoint capabilities. Centralized management is particularly useful when organizations operate multiple firewalls and need consistent security policies and centralized operational visibility.

Question 95

Which VPN type connects two or more complete networks through an encrypted tunnel?

1. Remote-access VPN
2. Site-to-site VPN
3. Clientless VPN
4. Host-only VPN

Correct Answer: 2

Explanation

A site-to-site VPN creates an encrypted connection between networks, commonly using security gateways at each location. Users inside the connected networks can communicate through the VPN without individually establishing a VPN session on every endpoint. IPsec is frequently used to provide encryption and authentication for site-to-site VPNs. A remote-access VPN is designed for individual users connecting from external locations. Clientless VPNs typically provide browser-based access to selected resources rather than connecting entire networks. Site-to-site VPNs are therefore commonly used to securely connect branch offices, data centers, headquarters, and other organizational locations.

Question 96

Which security technology provides encryption and integrity protection for Ethernet frames at Layer 2?

1. MACsec
2. RADIUS
3. IKE
4. TACACS+

Correct Answer: 1

Explanation

MACsec, defined by IEEE 802.1AE, provides Layer 2 security for Ethernet frames. It can provide confidentiality, integrity, data-origin authentication, and protection against certain replay attacks depending on the implementation and configuration. MACsec is useful when organizations need to protect traffic on Ethernet links, including connections between switches or supported endpoint devices. RADIUS and TACACS+ are AAA protocols, while IKE is used for negotiating IPsec security associations. MACsec operates at a different layer from IPsec and is particularly useful when Layer 2 traffic itself needs cryptographic protection across a trusted or semi-trusted network infrastructure.

Question 97

Which security function records user or administrator activities for later review?

1. Authentication
2. Authorization
3. Accounting
4. Encryption

Correct Answer: 3

Explanation

Accounting records activities performed by authenticated users or administrators. In AAA systems, accounting information can include login times, session durations, commands executed, or other activity depending on the protocol and device configuration. This information can be useful for auditing, troubleshooting, compliance, and security investigations. Authentication verifies identity, authorization determines permitted actions, and encryption protects data from unauthorized disclosure. Accounting therefore completes the AAA model by providing visibility into what authenticated users actually did. Centralized accounting can also help security teams correlate administrative activity across multiple network devices and identify unusual or unauthorized behavior.

Question 98

Which technology can restrict a switch port to a specific number of authorized MAC addresses?

1. IPsec
2. Port Security
3. Cisco Umbrella
4. URL Filtering

Correct Answer: 2

Explanation

Port Security allows a Cisco switch interface to be configured with a maximum number of secure MAC addresses. This limits the number of devices that can successfully use the port and can help prevent unauthorized endpoint connections. Secure MAC addresses can be configured manually or learned dynamically depending on the deployment. If the configured limit is exceeded or an unauthorized MAC address is detected, the switch can apply a configured violation action. IPsec protects IP traffic, Cisco Umbrella provides cloud-delivered security, and URL Filtering controls web destinations. Port Security is therefore a direct Layer 2 access-control mechanism.

Question 99

Which protocol is responsible for negotiating IPsec security parameters between VPN peers?

1. ESP
2. AH
3. IKE
4. MACsec

Correct Answer: 3

Explanation

Internet Key Exchange, or IKE, negotiates security parameters between IPsec VPN peers. During the negotiation process, the peers establish trust, agree on cryptographic algorithms, authenticate each other, and establish the information needed to create IPsec security associations. IKEv2 is the modern version commonly used in current VPN deployments. ESP protects the actual user traffic, while AH can provide integrity and authentication without encryption. MACsec protects Ethernet frames at Layer 2 and does not perform IPsec VPN negotiation. IKE is therefore a critical control-plane protocol for establishing secure IPsec communications between VPN endpoints.

Question 100

Which security principle uses multiple independent security controls to reduce the impact of a single control failure?

1. Least privilege
2. Defense in depth
3. Network Address Translation
4. Single sign-on

Correct Answer: 2

Explanation

Defense in depth is a security principle that uses multiple layers of protection so that the failure or bypass of one security control does not automatically expose the entire environment. Organizations may combine firewalls, intrusion prevention, endpoint protection, identity controls, network segmentation, encryption, monitoring, and security policies to create several defensive layers. Least privilege focuses on limiting permissions to only what users or systems require. NAT translates network addresses, while single sign-on allows users to authenticate once and access multiple authorized applications. Defense in depth improves resilience because different controls can address different attack paths and security weaknesses.