{"id":20932,"date":"2026-09-24T09:12:04","date_gmt":"2026-09-24T09:12:04","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=20932"},"modified":"2026-09-24T09:12:04","modified_gmt":"2026-09-24T09:12:04","slug":"cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/cisco-ccie-security-350-701-practice-test-questions-and-exam-dumps-part20-q381-400\/","title":{"rendered":"Cisco CCIE Security 350-701 Practice Test Questions and Exam Dumps Part20 Q381-400"},"content":{"rendered":"

View Full <\/b>Cisco 350-701 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 381<\/b><\/h3>\n

Which control can prevent unauthorized devices from using a switch port by limiting the MAC addresses permitted on that interface?<\/b><\/p>\n

    \n
  1. DHCP snooping<\/span><\/li>\n
  2. Port security<\/span><\/li>\n
  3. DNSSEC<\/span><\/li>\n
  4. NetFlow<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Port security can restrict which MAC addresses are permitted to use a switch interface. Administrators can configure limits on the number of learned or statically defined MAC addresses and specify actions when unauthorized addresses appear. This helps reduce risks such as unauthorized device connections and certain MAC-based attacks. DHCP snooping protects DHCP operations, DNSSEC protects DNS integrity, and NetFlow provides traffic telemetry. Therefore, port security provides the Layer 2 access-control mechanism described.<\/span><\/p>\n

    Question 382<\/b><\/h3>\n

    Which protocol security feature protects BGP sessions by limiting the acceptable IP time-to-live value of incoming packets from a directly connected neighbor?<\/b><\/p>\n

      \n
    1. Prefix filtering<\/span><\/li>\n
    2. Route dampening<\/span><\/li>\n
    3. BGP TTL Security<\/span><\/li>\n
    4. RPKI<\/span><\/li>\n<\/ol>\n

      Correct Answer: 3<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      BGP TTL Security uses the IP TTL field to help protect BGP sessions from spoofed packets originating beyond the expected network distance. A router can require incoming BGP packets to have a sufficiently high TTL, which implies that they originated within a limited hop count. This makes certain remote spoofing attacks against BGP sessions more difficult. Prefix filtering controls advertised routes, route dampening addresses route instability, and RPKI validates route origins. Therefore, BGP TTL Security provides the described protection.<\/span><\/p>\n

      Question 383<\/b><\/h3>\n

      Which security feature can automatically disable or restrict a switch port when the configured MAC-address violation condition occurs?<\/b><\/p>\n

        \n
      1. Port-security violation action<\/span><\/li>\n
      2. DNS filtering<\/span><\/li>\n
      3. RPKI<\/span><\/li>\n
      4. TLS inspection<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        A port-security violation action defines how a switch should respond when traffic violates configured MAC-address restrictions. Depending on the selected mode, the switch can drop violating traffic, generate notifications, restrict the interface, or place the port into an error-disabled state. This provides a direct response to unauthorized devices attempting to use a protected interface. DNS filtering controls domain access, RPKI validates BGP route origins, and TLS inspection examines encrypted application traffic. Therefore, the port-security violation action provides the required response.<\/span><\/p>\n

        Question 384<\/b><\/h3>\n

        Which technology can validate whether a DNS response was generated from an authenticated DNS zone and has not been modified in transit?<\/b><\/p>\n

          \n
        1. SPF<\/span><\/li>\n
        2. DKIM<\/span><\/li>\n
        3. DNSSEC<\/span><\/li>\n
        4. SFTP<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          DNS Security Extensions, or DNSSEC, uses digital signatures to provide authenticity and integrity for DNS data. A validating resolver can verify the cryptographic chain of trust and determine whether the received DNS information can be trusted. This helps protect against attacks in which DNS responses are modified or forged. SPF and DKIM are email-security mechanisms, while SFTP provides secure file transfer. Therefore, DNSSEC provides the authentication and integrity protection required for DNS responses.<\/span><\/p>\n

          Question 385<\/b><\/h3>\n

          Which security mechanism can prevent an attacker from sending forged DHCP server responses from an unauthorized switch port?<\/b><\/p>\n

            \n
          1. DHCP snooping<\/span><\/li>\n
          2. MACsec<\/span><\/li>\n
          3. RADIUS<\/span><\/li>\n
          4. SNI<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            DHCP snooping distinguishes trusted and untrusted switch interfaces and can block unauthorized DHCP server messages arriving from untrusted ports. This helps prevent rogue DHCP servers from assigning malicious gateway, DNS, or address information to clients. DHCP snooping can also build trusted bindings that other Layer 2 security features can use. MACsec protects Ethernet traffic, RADIUS provides centralized authentication, and SNI identifies a requested hostname during TLS negotiation. Therefore, DHCP snooping provides the described rogue-DHCP protection.<\/span><\/p>\n

            Question 386<\/b><\/h3>\n

            Which control allows security administrators to identify which users are associated with network traffic instead of relying only on source IP addresses?<\/b><\/p>\n

              \n
            1. User identity mapping<\/span><\/li>\n
            2. Route summarization<\/span><\/li>\n
            3. Storm control<\/span><\/li>\n
            4. NAT overload<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              User identity mapping associates authenticated users with network addresses or traffic flows so that security policies can be based on identity rather than only on IP addresses. This can improve visibility and allow administrators to create policies that follow users even when their network addresses change. Route summarization reduces routing information, storm control limits excessive Layer 2 traffic, and NAT overload translates multiple addresses through a shared public address. Therefore, user identity mapping provides the identity-aware visibility described.<\/span><\/p>\n

              Question 387<\/b><\/h3>\n

              Which security control can limit excessive broadcast, multicast, or unknown-unicast traffic on a switch interface to reduce the impact of a traffic storm?<\/b><\/p>\n

                \n
              1. Storm control<\/span><\/li>\n
              2. Root Guard<\/span><\/li>\n
              3. DHCP relay<\/span><\/li>\n
              4. SFTP<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Storm control monitors specific types of Layer 2 traffic and can restrict traffic when configured thresholds are exceeded. This helps protect switching infrastructure from excessive broadcast, multicast, or unknown-unicast traffic that could consume bandwidth and processing resources. Depending on configuration, the switch may drop excess traffic or take another defined protective action. Root Guard protects spanning-tree topology, DHCP relay forwards DHCP messages, and SFTP provides secure file transfer. Therefore, storm control provides the required traffic-storm mitigation.<\/span><\/p>\n

                Question 388<\/b><\/h3>\n

                Which spanning-tree security feature prevents an unauthorized switch from becoming the root bridge on a protected interface?<\/b><\/p>\n

                  \n
                1. BPDU Filter<\/span><\/li>\n
                2. Root Guard<\/span><\/li>\n
                3. PortFast<\/span><\/li>\n
                4. DHCP snooping<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Root Guard protects the intended spanning-tree topology by preventing a protected interface from accepting superior Bridge Protocol Data Units that could cause an unauthorized switch to become the root bridge. If an unexpected superior BPDU is received, the affected interface can enter a restricted state until the condition is resolved. BPDU Filter suppresses or filters BPDUs, PortFast accelerates edge-port transition, and DHCP snooping protects DHCP exchanges. Therefore, Root Guard provides the required protection against unauthorized root-bridge influence.<\/span><\/p>\n

                  Question 389<\/b><\/h3>\n

                  Which secure file-transfer protocol provides encrypted authentication and data transfer by operating through SSH?<\/b><\/p>\n

                    \n
                  1. FTP<\/span><\/li>\n
                  2. TFTP<\/span><\/li>\n
                  3. SFTP<\/span><\/li>\n
                  4. HTTP<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 3<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Secure File Transfer Protocol, or SFTP, provides file-transfer capabilities through the SSH framework. It protects authentication and file data using the cryptographic protections provided by SSH. This makes it appropriate for securely transferring configuration files, logs, and other sensitive information across untrusted networks. Traditional FTP and TFTP do not provide equivalent built-in encryption, while HTTP is primarily designed for web communication. Therefore, SFTP provides the secure file-transfer mechanism described.<\/span><\/p>\n

                    Question 390<\/b><\/h3>\n

                    Which authentication protocol commonly uses TCP and provides centralized authentication, authorization, and accounting for network-device administrators?<\/b><\/p>\n

                      \n
                    1. TACACS+<\/span><\/li>\n
                    2. RADIUS<\/span><\/li>\n
                    3. SNMPv3<\/span><\/li>\n
                    4. LDAP<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      TACACS+ is commonly used for centralized administrative access to network devices. It uses TCP and separates authentication, authorization, and accounting functions, allowing organizations to control administrator access and record administrative activity. This is particularly useful when different administrators require different command permissions. RADIUS commonly uses UDP and is widely used for network access authentication, SNMPv3 provides secure network management, and LDAP provides directory services. Therefore, TACACS+ provides the described administrative AAA capability.<\/span><\/p>\n

                      Question 391<\/b><\/h3>\n

                      Which network-access mechanism can dynamically change a user’s authorization or network policy after authentication has already occurred?<\/b><\/p>\n

                        \n
                      1. DHCP snooping<\/span><\/li>\n
                      2. Change of Authorization<\/span><\/li>\n
                      3. DNSSEC<\/span><\/li>\n
                      4. MACsec<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 2<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Change of Authorization, or CoA, allows an authentication or access-control system to modify an existing session’s authorization after the initial authentication process. For example, a user’s access level can be changed when a posture assessment changes, an account is disabled, or a security policy requires immediate restriction. DHCP snooping protects DHCP behavior, DNSSEC protects DNS integrity, and MACsec protects Ethernet frames. Therefore, CoA provides the dynamic authorization mechanism described.<\/span><\/p>\n

                        Question 392<\/b><\/h3>\n

                        Which security capability can quarantine a device when its security posture no longer meets the organization’s access requirements?<\/b><\/p>\n

                          \n
                        1. Network Access Control<\/span><\/li>\n
                        2. DNS caching<\/span><\/li>\n
                        3. Route redistribution<\/span><\/li>\n
                        4. NAT traversal<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Network Access Control can evaluate device identity and posture before or during network access and apply appropriate authorization policies. If an endpoint fails required security checks, the NAC system can restrict access, place the device into a remediation network, or otherwise quarantine it according to policy. This helps prevent noncompliant devices from obtaining unrestricted access to sensitive resources. DNS caching stores query results, route redistribution exchanges routing information, and NAT traversal supports IPsec through NAT. Therefore, NAC provides the described access-enforcement capability.<\/span><\/p>\n

                          Question 393<\/b><\/h3>\n

                          Which security mechanism can detect an attempt to overwhelm a server with a large number of incomplete TCP connection requests?<\/b><\/p>\n

                            \n
                          1. SYN flood detection<\/span><\/li>\n
                          2. DNSSEC<\/span><\/li>\n
                          3. File integrity monitoring<\/span><\/li>\n
                          4. SFTP<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            A SYN flood attempts to exhaust server resources by sending large numbers of TCP connection requests without completing the connection establishment process. Security devices can identify abnormal SYN behavior and apply controls such as rate limiting, connection thresholds, or other mitigation techniques. DNSSEC protects DNS data, file integrity monitoring detects changes to files, and SFTP provides secure file transfer. Therefore, SYN flood detection provides the capability needed to identify this type of denial-of-service activity.<\/span><\/p>\n

                            Question 394<\/b><\/h3>\n

                            Which security technology monitors critical files and alerts administrators when unauthorized modifications occur?<\/b><\/p>\n

                              \n
                            1. DLP<\/span><\/li>\n
                            2. File Integrity Monitoring<\/span><\/li>\n
                            3. CASB<\/span><\/li>\n
                            4. SWG<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              File Integrity Monitoring, or FIM, tracks important files and detects changes to their contents, attributes, permissions, or other monitored properties. Unexpected modifications can indicate malware activity, unauthorized administrative actions, configuration tampering, or compromise. FIM can generate alerts that help security teams investigate potentially suspicious changes. DLP focuses on sensitive-data movement, CASB manages cloud-service security, and SWG secures web access. Therefore, FIM provides the required file-change detection capability.<\/span><\/p>\n

                              Question 395<\/b><\/h3>\n

                              Which security control can identify unauthorized changes to a software package or configuration file by comparing its current cryptographic digest with a trusted value?<\/b><\/p>\n

                                \n
                              1. Hash verification<\/span><\/li>\n
                              2. VLAN pruning<\/span><\/li>\n
                              3. NAT<\/span><\/li>\n
                              4. SPAN<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Hash verification can identify unauthorized changes by calculating a cryptographic digest of a file and comparing it with a previously trusted digest. If the values differ, the file contents have changed, although the comparison alone does not necessarily establish whether the change was malicious or authorized. This technique is useful for software integrity, configuration validation, and forensic analysis. VLAN pruning controls VLAN propagation, NAT translates addresses, and SPAN mirrors traffic. Therefore, hash verification provides the described integrity check.<\/span><\/p>\n

                                Question 396<\/b><\/h3>\n

                                Which security capability helps identify whether a user account is being accessed from an unusual geographic location or device compared with its normal behavior?<\/b><\/p>\n

                                  \n
                                1. SIEM<\/span><\/li>\n
                                2. UEBA<\/span><\/li>\n
                                3. DHCP relay<\/span><\/li>\n
                                4. Port security<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 2<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  User and Entity Behavior Analytics can establish normal behavioral patterns for users and entities and identify significant deviations. An unexpected geographic location, unfamiliar device, unusual access time, or abnormal resource usage can indicate compromised credentials or suspicious activity. UEBA can generate risk indicators that security teams can investigate alongside other security events. SIEM aggregates and correlates events, DHCP relay forwards DHCP messages, and port security restricts switch-port access. Therefore, UEBA provides the behavioral-anomaly capability described.<\/span><\/p>\n

                                  Question 397<\/b><\/h3>\n

                                  Which security technology can inspect outbound web requests and block access based on website category, reputation, or organizational policy?<\/b><\/p>\n

                                    \n
                                  1. Secure Web Gateway<\/span><\/li>\n
                                  2. MACsec<\/span><\/li>\n
                                  3. RPKI<\/span><\/li>\n
                                  4. SNMPv3<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    A Secure Web Gateway provides centralized security controls for users’ web traffic. It can enforce policies based on URL categories, destination reputation, user identity, application characteristics, and other conditions. Depending on configuration, it can also integrate malware inspection and other security functions. MACsec protects Ethernet frames, RPKI validates BGP route origins, and SNMPv3 provides secure network management. Therefore, Secure Web Gateway provides the web-access filtering capability described.<\/span><\/p>\n

                                    Question 398<\/b><\/h3>\n

                                    Which security architecture verifies identity, device context, and authorization policy before granting access to a specific application rather than trusting a user’s network location?<\/b><\/p>\n

                                      \n
                                    1. Traditional perimeter security<\/span><\/li>\n
                                    2. Zero Trust<\/span><\/li>\n
                                    3. Static routing<\/span><\/li>\n
                                    4. VLAN trunking<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Zero Trust treats access as a policy decision that should be continuously evaluated rather than assuming that a user is trustworthy because the user is located inside a particular network. Identity, device posture, resource sensitivity, and other contextual information can be considered before access is granted. This approach supports least privilege and reduces reliance on broad network-level trust. Traditional perimeter security relies more heavily on network boundaries, while static routing and VLAN trunking provide network functions rather than identity-based access decisions. Therefore, Zero Trust matches the requirement.<\/span><\/p>\n

                                      Question 399<\/b><\/h3>\n

                                      Which security capability can identify and block malicious files by analyzing their behavior in an isolated environment before allowing them to reach an endpoint?<\/b><\/p>\n

                                        \n
                                      1. Sandboxing<\/span><\/li>\n
                                      2. Route filtering<\/span><\/li>\n
                                      3. NTP authentication<\/span><\/li>\n
                                      4. VLAN tagging<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Sandboxing executes suspicious files or objects in an isolated environment so their behavior can be observed without exposing production systems directly. Security systems can analyze activities such as process creation, file modifications, network connections, and other indicators to determine whether a sample behaves maliciously. This approach can detect threats that may not yet have reliable static signatures. Route filtering controls routing information, NTP authentication protects time synchronization, and VLAN tagging identifies VLAN membership. Therefore, sandboxing provides the described behavioral-analysis capability.<\/span><\/p>\n

                                        Question 400<\/b><\/h3>\n

                                        Which security process compares identified vulnerabilities with available threat intelligence and asset information to determine which issues should be addressed first?<\/b><\/p>\n

                                          \n
                                        1. Vulnerability prioritization<\/span><\/li>\n
                                        2. Packet capture<\/span><\/li>\n
                                        3. Network address translation<\/span><\/li>\n
                                        4. Certificate enrollment<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Vulnerability prioritization determines which identified weaknesses require attention first by considering factors beyond technical severity alone. Security teams can combine vulnerability information with asset criticality, exposure, exploit availability, threat intelligence, business impact, and other contextual factors. This helps organizations direct limited remediation resources toward the issues that present the most significant operational risk. Packet capture records network traffic, NAT translates addresses, and certificate enrollment obtains digital certificates. Therefore, vulnerability prioritization provides the required risk-based remediation process.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Cisco 350-701 Exam Dumps and Practice Test Dumps.   Question 381 Which control can prevent unauthorized devices from using a switch port by limiting the MAC addresses permitted on that interface? DHCP snooping Port security DNSSEC NetFlow Correct Answer: 2 Explanation Port security can restrict which MAC addresses are permitted to use a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20932"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=20932"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20932\/revisions"}],"predecessor-version":[{"id":20933,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20932\/revisions\/20933"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=20932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=20932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=20932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}