{"id":20918,"date":"2026-09-24T09:09:31","date_gmt":"2026-09-24T09:09:31","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=20918"},"modified":"2026-09-24T09:09:31","modified_gmt":"2026-09-24T09:09:31","slug":"cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part13-q241-260","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part13-q241-260\/","title":{"rendered":"Cisco CCIE Security 350-701 Practice Test Questions and Exam Dumps Part13 Q241-260"},"content":{"rendered":"

View Full <\/b>Cisco 350-701 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 241<\/b><\/h3>\n

Which security mechanism can prevent an unauthorized device from obtaining network configuration information from a rogue DHCP server?<\/b><\/p>\n

    \n
  1. DHCP snooping<\/span><\/li>\n
  2. DNSSEC<\/span><\/li>\n
  3. MACsec<\/span><\/li>\n
  4. CoPP<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    DHCP snooping allows a switch to distinguish trusted DHCP-server-facing interfaces from untrusted access interfaces. DHCP server messages received on an untrusted interface can be blocked, helping prevent rogue DHCP servers from providing malicious gateway, DNS, or addressing information to clients. DHCP snooping can also create trusted IP-to-MAC bindings that support other first-hop security controls. DNSSEC protects DNS data, MACsec secures Ethernet frames, and CoPP protects control-plane resources. Therefore, DHCP snooping provides the required protection against rogue DHCP servers.<\/span><\/p>\n

    Question 242<\/b><\/h3>\n

    Which security feature can prevent unauthorized IPv6 neighbors from claiming an address that belongs to another host?<\/b><\/p>\n

      \n
    1. IPv6 source guard<\/span><\/li>\n
    2. NAT overload<\/span><\/li>\n
    3. BGP prefix filtering<\/span><\/li>\n
    4. SPAN<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      IPv6 source guard is a first-hop security mechanism that can validate IPv6 source information associated with traffic arriving on an interface. By restricting traffic according to known IPv6 address and interface bindings, it can help prevent unauthorized hosts from using another device’s IPv6 address. This reduces opportunities for source-address spoofing and certain local-network attacks. NAT overload translates multiple addresses, BGP prefix filtering controls routing advertisements, and SPAN copies traffic for monitoring. Therefore, IPv6 source guard provides the required protection.<\/span><\/p>\n

      Question 243<\/b><\/h3>\n

      Which security technique can protect a private VLAN environment by restricting communication between isolated endpoints even when they belong to the same primary VLAN?<\/b><\/p>\n

        \n
      1. Private VLANs<\/span><\/li>\n
      2. Route summarization<\/span><\/li>\n
      3. Link aggregation<\/span><\/li>\n
      4. DNS forwarding<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Private VLANs provide Layer 2 isolation between endpoints within the same primary VLAN. Depending on the configured private VLAN type, hosts may be isolated from one another while still communicating with an approved promiscuous port or required gateway. This can be useful in environments such as hosting facilities where systems share infrastructure but should not have unrestricted Layer 2 communication. Route summarization reduces routing information, link aggregation combines interfaces, and DNS forwarding handles name-resolution requests. Therefore, private VLANs provide the described endpoint isolation.<\/span><\/p>\n

        Question 244<\/b><\/h3>\n

        Which security control can limit administrative access to a network device by allowing management connections only through a designated management interface?<\/b><\/p>\n

          \n
        1. Management-plane ACL<\/span><\/li>\n
        2. DNSSEC<\/span><\/li>\n
        3. Storm control<\/span><\/li>\n
        4. DHCP relay<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          A management-plane ACL can restrict which sources are permitted to access administrative services on network infrastructure. Organizations can apply policies that allow management connections only from designated management networks, jump hosts, or other approved sources. This reduces exposure of SSH, HTTPS, SNMP, and similar services to untrusted users or general production networks. DNSSEC protects DNS integrity, storm control limits excessive Layer 2 traffic, and DHCP relay forwards configuration requests. Therefore, a management-plane ACL directly supports restricted administrative access.<\/span><\/p>\n

          Question 245<\/b><\/h3>\n

          Which security capability can identify an attacker attempting to exploit a vulnerable web application by detecting malicious HTTP request patterns?<\/b><\/p>\n

            \n
          1. Web application firewall<\/span><\/li>\n
          2. NTP<\/span><\/li>\n
          3. VRRP<\/span><\/li>\n
          4. LACP<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            A Web Application Firewall, or WAF, monitors and filters HTTP and HTTPS application traffic according to security rules. It can identify patterns associated with attacks such as SQL injection, cross-site scripting, malicious parameter manipulation, and other web-application threats. By applying policies at the application layer, a WAF provides protection that traditional network firewalls may not provide on their own. NTP synchronizes clocks, VRRP provides gateway redundancy, and LACP manages link aggregation. Therefore, WAF provides the application-layer protection described.<\/span><\/p>\n

            Question 246<\/b><\/h3>\n

            Which security control can detect when a user attempts to access a website categorized as malicious or inappropriate according to organizational policy?<\/b><\/p>\n

              \n
            1. Secure Web Gateway<\/span><\/li>\n
            2. MACsec<\/span><\/li>\n
            3. IP Source Guard<\/span><\/li>\n
            4. CoPP<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              A Secure Web Gateway, or SWG, can inspect web requests and enforce organizational policies based on URL categories, reputation, malware indicators, and other security criteria. An organization can configure policies to block known malicious websites or restrict categories that violate acceptable-use requirements. SWG services may also integrate malware inspection and data-protection capabilities. MACsec secures Ethernet traffic, IP Source Guard validates source information, and CoPP protects the control plane. Therefore, Secure Web Gateway provides the web-access control described.<\/span><\/p>\n

              Question 247<\/b><\/h3>\n

              Which security principle requires an organization to identify and prioritize risks based on their likelihood and potential business impact?<\/b><\/p>\n

                \n
              1. Risk assessment<\/span><\/li>\n
              2. Network address translation<\/span><\/li>\n
              3. Traffic mirroring<\/span><\/li>\n
              4. VLAN tagging<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Risk assessment involves identifying threats and vulnerabilities, evaluating their likelihood and potential consequences, and determining which risks require attention. Organizations can use risk assessments to prioritize security investments and select controls according to business requirements. The process helps avoid treating every issue as equally important and supports informed security planning. NAT translates addresses, traffic mirroring copies network packets, and VLAN tagging identifies VLAN membership. Therefore, risk assessment provides the structured approach for evaluating and prioritizing organizational security risks.<\/span><\/p>\n

                Question 248<\/b><\/h3>\n

                Which security technology can inspect application traffic and identify the application being used rather than relying only on destination port numbers?<\/b><\/p>\n

                  \n
                1. Application Visibility and Control<\/span><\/li>\n
                2. DHCP snooping<\/span><\/li>\n
                3. Root Guard<\/span><\/li>\n
                4. RPO<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Application Visibility and Control, or AVC, identifies applications based on traffic characteristics rather than relying solely on traditional port-based classification. This provides security administrators with greater visibility into the applications operating across the network and can support application-aware security policies. Modern applications may use common ports or dynamically select ports, making simple port-based identification less reliable. DHCP snooping protects DHCP operations, Root Guard protects spanning-tree topology, and RPO defines acceptable data loss. Therefore, AVC provides the required application-level visibility.<\/span><\/p>\n

                  Question 249<\/b><\/h3>\n

                  Which security mechanism allows an administrator to securely transfer configuration files between network devices while protecting the data during transit?<\/b><\/p>\n

                    \n
                  1. SFTP<\/span><\/li>\n
                  2. TFTP<\/span><\/li>\n
                  3. FTP<\/span><\/li>\n
                  4. Telnet<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Secure File Transfer Protocol, or SFTP, transfers files through an encrypted SSH-based connection. It provides confidentiality and helps protect credentials and configuration data from interception while files are being transferred. This is particularly important when configuration files contain sensitive information such as authentication settings, network addresses, or security policies. TFTP and traditional FTP do not provide the same built-in protection, while Telnet is designed for remote terminal access rather than secure file transfer. Therefore, SFTP is the appropriate secure file-transfer mechanism.<\/span><\/p>\n

                    Question 250<\/b><\/h3>\n

                    Which security control can prevent unauthorized users from changing the configuration of a network device by requiring appropriate administrative authorization?<\/b><\/p>\n

                      \n
                    1. Role-based access control<\/span><\/li>\n
                    2. DNS caching<\/span><\/li>\n
                    3. SPAN<\/span><\/li>\n
                    4. GRE<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Role-based access control, or RBAC, assigns permissions according to defined administrative roles. Instead of giving every administrator unrestricted privileges, organizations can provide only the commands and functions required for a person’s responsibilities. This supports least privilege and reduces the impact of compromised administrative credentials or accidental configuration changes. DNS caching stores name-resolution information, SPAN copies traffic for monitoring, and GRE provides tunneling. Therefore, RBAC provides the authorization mechanism needed to restrict administrative configuration privileges.<\/span><\/p>\n

                      Question 251<\/b><\/h3>\n

                      Which security capability can analyze endpoint behavior across multiple security products to identify coordinated attacks that may not be obvious from a single alert?<\/b><\/p>\n

                        \n
                      1. XDR<\/span><\/li>\n
                      2. NAT<\/span><\/li>\n
                      3. STP<\/span><\/li>\n
                      4. DHCP<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Extended Detection and Response, or XDR, correlates security telemetry from multiple security domains such as endpoints, networks, email, cloud services, and identity systems. By combining related events, XDR can provide broader visibility into coordinated attacks and reduce the limitations of analyzing individual alerts separately. This can help analysts investigate attack chains and respond more efficiently. NAT translates addresses, STP prevents Layer 2 loops, and DHCP provides network configuration. Therefore, XDR provides the cross-domain detection capability described.<\/span><\/p>\n

                        Question 252<\/b><\/h3>\n

                        Which security mechanism can protect a routing protocol session by requiring authenticated peers before routing updates are accepted?<\/b><\/p>\n

                          \n
                        1. Routing protocol authentication<\/span><\/li>\n
                        2. VLAN pruning<\/span><\/li>\n
                        3. DNS caching<\/span><\/li>\n
                        4. Port mirroring<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Routing protocol authentication allows routers to verify that routing updates originate from an authorized peer. Depending on the routing protocol and implementation, authentication can use cryptographic mechanisms to protect routing exchanges from unauthorized participation or manipulation. This helps prevent attackers from injecting false routes that could redirect traffic or disrupt network connectivity. VLAN pruning limits VLAN propagation, DNS caching stores name-resolution results, and port mirroring copies traffic for monitoring. Therefore, routing protocol authentication provides the required protection for routing exchanges.<\/span><\/p>\n

                          Question 253<\/b><\/h3>\n

                          Which security capability can identify and block a file containing known malware before the file is delivered to an endpoint?<\/b><\/p>\n

                            \n
                          1. Malware inspection<\/span><\/li>\n
                          2. Route summarization<\/span><\/li>\n
                          3. HSRP<\/span><\/li>\n
                          4. NTP<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Malware inspection examines files or other content for indicators associated with malicious software. Depending on the security platform, inspection may use signatures, reputation data, behavioral analysis, sandboxing, or combinations of these methods. Blocking a malicious file before it reaches an endpoint can reduce the opportunity for malware execution and subsequent compromise. Route summarization reduces routing information, HSRP provides gateway redundancy, and NTP synchronizes system clocks. Therefore, malware inspection provides the file-level detection and prevention capability described.<\/span><\/p>\n

                            Question 254<\/b><\/h3>\n

                            Which security mechanism can ensure that an IPsec packet cannot simply be captured and resent later to repeat a previously valid communication?<\/b><\/p>\n

                              \n
                            1. Anti-replay protection<\/span><\/li>\n
                            2. DNSSEC<\/span><\/li>\n
                            3. VLAN tagging<\/span><\/li>\n
                            4. Storm control<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              IPsec anti-replay protection uses sequence information to detect packets that have already been received or that fall outside the acceptable replay window. This helps prevent an attacker from capturing legitimate encrypted packets and retransmitting them later in an attempt to repeat an earlier action. Anti-replay protection is an important part of maintaining the integrity of IPsec-protected communications. DNSSEC protects DNS data, VLAN tagging identifies Layer 2 membership, and storm control limits excessive traffic. Therefore, anti-replay protection addresses the described threat.<\/span><\/p>\n

                              Question 255<\/b><\/h3>\n

                              Which security capability can identify abnormal login behavior, such as a successful authentication from an unusual geographic location or device?<\/b><\/p>\n

                                \n
                              1. UEBA<\/span><\/li>\n
                              2. STP<\/span><\/li>\n
                              3. GRE<\/span><\/li>\n
                              4. LACP<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                User and Entity Behavior Analytics, or UEBA, establishes behavioral patterns for users and entities and identifies significant deviations from those patterns. An unusual login location, unexpected device, abnormal access time, or sudden change in resource usage may indicate compromised credentials or other suspicious activity. UEBA can provide additional context for security investigations and risk-based decisions. STP prevents switching loops, GRE provides tunneling, and LACP manages link aggregation. Therefore, UEBA is the capability designed to identify abnormal behavioral patterns.<\/span><\/p>\n

                                Question 256<\/b><\/h3>\n

                                Which cloud security approach combines capabilities such as workload protection, cloud posture management, and application security into a broader cloud-native security strategy?<\/b><\/p>\n

                                  \n
                                1. CNAPP<\/span><\/li>\n
                                2. VRRP<\/span><\/li>\n
                                3. CoPP<\/span><\/li>\n
                                4. RADIUS<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  A Cloud-Native Application Protection Platform, or CNAPP, combines multiple cloud-security capabilities into an integrated approach for protecting cloud-native applications and infrastructure. Depending on the platform, capabilities can include cloud security posture management, cloud workload protection, application security, identity controls, vulnerability management, and runtime protection. The goal is to provide security visibility across the cloud application lifecycle rather than relying on isolated tools. VRRP provides gateway redundancy, CoPP protects the control plane, and RADIUS supports authentication. Therefore, CNAPP matches the described cloud-security approach.<\/span><\/p>\n

                                  Question 257<\/b><\/h3>\n

                                  Which security control can protect a network device from unauthorized configuration changes by recording administrator commands for later review?<\/b><\/p>\n

                                    \n
                                  1. Command accounting<\/span><\/li>\n
                                  2. DNS forwarding<\/span><\/li>\n
                                  3. NAT traversal<\/span><\/li>\n
                                  4. VLAN pruning<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Command accounting records administrative activity such as commands executed by network-device users. When integrated with centralized AAA infrastructure, command accounting can provide an audit trail showing which administrator performed specific actions. This information can support incident investigation, compliance requirements, change tracking, and accountability. DNS forwarding handles name-resolution requests, NAT traversal supports communication through address translation, and VLAN pruning controls VLAN propagation. Therefore, command accounting provides the administrative activity-recording capability described.<\/span><\/p>\n

                                    Question 258<\/b><\/h3>\n

                                    Which security control can help detect unauthorized software installation by comparing installed applications against an approved endpoint inventory?<\/b><\/p>\n

                                      \n
                                    1. Endpoint application inventory<\/span><\/li>\n
                                    2. BGP TTL security<\/span><\/li>\n
                                    3. DHCP relay<\/span><\/li>\n
                                    4. MACsec<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Endpoint application inventory provides visibility into software installed on managed devices. Security teams can compare observed applications against an approved software baseline to identify unauthorized, outdated, or potentially risky programs. This information can support application allowlisting, vulnerability management, software-removal processes, and compliance activities. BGP TTL security protects routing sessions, DHCP relay forwards DHCP messages, and MACsec secures Ethernet frames. Therefore, endpoint application inventory provides the visibility needed to identify software that should not be present.<\/span><\/p>\n

                                      Question 259<\/b><\/h3>\n

                                      Which security control can limit the ability of an attacker to move from a compromised user workstation toward sensitive server networks?<\/b><\/p>\n

                                        \n
                                      1. Network segmentation<\/span><\/li>\n
                                      2. DNS caching<\/span><\/li>\n
                                      3. NTP synchronization<\/span><\/li>\n
                                      4. Link aggregation<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Network segmentation separates systems or services into distinct security zones and controls communication between those zones. If a user workstation becomes compromised, segmentation can prevent unrestricted access to sensitive servers, administrative networks, databases, or other critical resources. Firewall policies, VLANs, VRFs, security groups, and other controls can be used to implement segmentation. DNS caching stores name-resolution information, NTP synchronizes time, and link aggregation combines network links. Therefore, network segmentation can reduce opportunities for lateral movement after endpoint compromise.<\/span><\/p>\n

                                        Question 260<\/b><\/h3>\n

                                        Which security mechanism can verify that a certificate is intended for a particular cryptographic purpose, such as server authentication, before allowing it to be trusted for that purpose?<\/b><\/p>\n

                                          \n
                                        1. Extended Key Usage<\/span><\/li>\n
                                        2. DHCP snooping<\/span><\/li>\n
                                        3. SPAN<\/span><\/li>\n
                                        4. MAC learning<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Extended Key Usage, or EKU, specifies the purposes for which a certificate’s public key may be used. During certificate validation, applications can evaluate EKU values to determine whether a certificate is appropriate for a particular purpose, such as server authentication, client authentication, or code signing. This helps prevent a valid certificate from being incorrectly accepted for an unrelated security function. DHCP snooping protects DHCP operations, SPAN copies traffic for monitoring, and MAC learning supports Ethernet forwarding. Therefore, EKU provides the required certificate-purpose validation.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.   Question 241 Which security mechanism can prevent an unauthorized device from obtaining network configuration information from a rogue DHCP server? DHCP snooping DNSSEC MACsec CoPP Correct Answer: 1 Explanation DHCP snooping allows a switch to distinguish trusted DHCP-server-facing interfaces from untrusted access interfaces. DHCP […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20918"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=20918"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20918\/revisions"}],"predecessor-version":[{"id":20919,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20918\/revisions\/20919"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=20918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=20918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=20918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}