Security Concepts

Which security model requires that all subjects and devices are untrusted by default, and access is granted only after verification, regardless of the network location?

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

A security administrator is configuring a Cisco Firepower NGFW to detect and block application-layer DDoS attacks. Which type of DDoS attack is characterized by overwhelming a server with incomplete HTTP requests, causing resource exhaustion?

Which cryptographic algorithm is considered deprecated and should be avoided due to known vulnerabilities, especially when used in digital signatures and certificate signing?

An attacker uses ARP spoofing to intercept traffic between two devices on the same subnet. After successfully becoming a man-in-the-middle, the attacker can then perform which further attack to downgrade HTTPS connections to HTTP?

In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?

A network administrator is configuring an ASA to enforce that traffic between two internal zones must be inspected by the firewall. Which security principle is being applied?

An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?

A security analyst is investigating a potential insider threat. Which TWO indicators are most commonly associated with malicious insider activity? (Choose two.)

A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)

A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)

A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

A security engineer is configuring a Cisco Firepower NGFW to detect and block a new malware variant that communicates with a command-and-control server using encrypted DNS queries. Which Cisco security product is best suited to provide visibility into this malicious DNS traffic?

Which of the following is an example of a passive reconnaissance technique?

A company deploys a solution that uses a root certificate authority (CA) and intermediate CAs to issue certificates. What is the term for the hierarchical structure of certificates from the root CA to the end entity?

Which Cisco security product provides identity-based access control and policy enforcement for wired and wireless networks?

An attacker intercepts traffic between a client and a server and modifies the communication without either party knowing. Which type of attack is being performed?

Which encryption algorithm is classified as symmetric?

A security team implements a policy where users must provide a password and a one-time code from a mobile app. Which authentication factors are being used?

A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?

What is the primary purpose of a digital signature?

Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?

A security analyst is investigating a potential ARP spoofing attack. Which two symptoms would indicate this type of attack?

Which three components are part of the CIA triad?

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Which component of the CIA triad ensures that data is not altered by unauthorized entities during transmission?

An attacker uses a tool to scan a target network for open ports and running services. Which type of reconnaissance does this represent?

A security administrator is evaluating symmetric encryption algorithms for a new VPN deployment. Which algorithm uses a 128-bit block size and supports key sizes of 128, 192, and 256 bits?

Which of the following is a characteristic of a zero trust security model?

An employee receives an email that appears to be from the company's IT department requesting their login credentials. This is an example of which type of attack?

A security engineer is configuring a Cisco Firepower NGFW to detect a buffer overflow attack. Which attack vector is this?

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Which Cisco security product provides DNS-layer security to block malicious domains and cloud-based threats?

An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?

An attacker intercepts traffic between a client and server using ARP spoofing. Which type of attack is this?

Which Cisco security product is primarily used for endpoint threat detection and retrospective security?

What is the primary purpose of a digital signature?

An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Which three cryptographic algorithms are considered secure for use in modern systems? (Choose three.)

An attacker uses Shodan to discover internet-facing ICS devices and then performs banner grabbing. This is an example of which type of attack?

A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?

An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

A security engineer needs to choose a hashing algorithm for storing passwords. Which of the following should be avoided due to known collision vulnerabilities?

Which authentication factor does a fingerprint scanner represent?

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Which symmetric encryption algorithm is considered the current standard and is often used in VPNs and SSL/TLS?

A security analyst observes a sustained increase in traffic from many different IP addresses to a single web application, causing CPU spikes. The traffic consists of legitimate-looking HTTP GET requests for the same resource. Which TWO types of attack could this be? (Choose two.)

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

A network administrator wants to deploy security products that provide network-based intrusion prevention and advanced threat detection. Which TWO Cisco products are most suitable? (Choose two.)

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?

Which Cisco product provides next-generation firewall (NGFW) capabilities, including application visibility and intrusion prevention?

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)

An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)

A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)

A security analyst is investigating a malware outbreak. Analysis reveals a remote access trojan (RAT) that communicates with a command-and-control (C2) server. Which TWO behaviors are typical of a RAT? (Choose two.)

An organization is adopting Cisco's security portfolio. Which THREE products are correctly paired with their primary function? (Choose three.)