350-701 Practice Test 16 — 15 Questions

Question 1

A security engineer needs to prevent secrets (e.g., API keys) from being stored in code repositories. Which DevSecOps practice should be implemented?

Accepted Answer

Implement secrets management using a tool like Vault. Secrets management tools like HashiCorp Vault securely store and manage secrets, avoiding hardcoding in code.

Answer

Use a SAST scanner to find secrets in code

Answer

Encrypt the code repository

Answer

Use a DAST tool to test for secrets

Question 2

Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?

Accepted Answer

Ransomware. Ransomware encrypts data and demands ransom.

Answer

RAT

Answer

Keylogger

Answer

Botnet

Question 3

What is the primary purpose of a digital signature?

Accepted Answer

Verify the sender's identity and ensure message integrity. A digital signature provides authentication, integrity, and non-repudiation.

Answer

Compress the data

Answer

Prevent replay attacks

Answer

Encrypt the message

Question 4

An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?

Accepted Answer

Redirection of traffic to malicious servers. DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.

Answer

Encryption of DNS queries

Answer

Exposure of DNS server credentials

Answer

Denial of service to the DNS server

Question 5

Which of the following is an example of a passive reconnaissance technique?

Accepted Answer

OSINT gathering from public websites. Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.

Answer

Port scanning

Answer

Social engineering

Answer

Vulnerability scanning

Question 6

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 7

An attacker intercepts traffic between a client and server using ARP spoofing. Which type of attack is this?

Accepted Answer

Man-in-the-middle. ARP spoofing allows an attacker to intercept traffic, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

DNS poisoning

Answer

Denial of Service

Question 8

Which authentication factor does a fingerprint scanner represent?

Accepted Answer

Inherence factor (something you are). Inherence factors are based on biological traits like fingerprints.

Answer

Knowledge factor (something you know)

Answer

Possession factor (something you have)

Answer

Location factor (somewhere you are)

Question 9

Which Cisco security product provides DNS-layer security to block malicious domains and cloud-based threats?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security service that provides DNS-layer filtering to block malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Answer

Cisco AMP

Question 10

A security analyst is investigating a potential ARP spoofing attack. Which two symptoms would indicate this type of attack?

Accepted Answer

Duplicate IP addresses in the ARP table. ARP spoofing involves sending fake ARP messages to associate the attacker's MAC with the IP of another host, causing traffic to be misdirected.

Answer

High CPU usage on the switch

Answer

Increased broadcast traffic

Answer

Unusual outbound DNS queries

Question 11

An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?

Accepted Answer

Knowledge and inherence. Password is a knowledge factor, fingerprint is an inherence (biometric) factor.

Answer

Knowledge and possession

Answer

Inherence and location

Answer

Possession and inherence

Question 12

A security engineer is configuring a Cisco Firepower NGFW to detect a buffer overflow attack. Which attack vector is this?

Accepted Answer

Exploitation. Buffer overflow is an exploitation technique where an attacker writes beyond the allocated buffer to execute arbitrary code.

Answer

Malware delivery

Answer

Reconnaissance

Answer

Denial of Service

Question 13

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation, network behavioral analytics, and endpoint detection help limit and detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 14

A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)

Accepted Answer

Least privilege access. Zero trust is based on 'never trust, always verify' and least privilege. Microsegmentation is a technique to enforce least privilege, but the core principles are never trust/always verify and least privilege.

Answer

Implicit trust for internal users

Answer

Single perimeter defense

Answer

All traffic must be inspected by a firewall

Question 15

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

Accepted Answer

SQL injection. SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Answer

Cross-site scripting (XSS)