350-701 Security Concepts — 30 Questions

Question 1

Which security model requires that all subjects and devices are untrusted by default, and access is granted only after verification, regardless of the network location?

Accepted Answer

Zero Trust. Zero Trust is a security model based on the principle of 'never trust, always verify', requiring continuous authentication and authorization.

Answer

Least Privilege

Answer

Defense in Depth

Answer

CIA Triad

Question 2

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

Accepted Answer

Remote Access Trojan (RAT). A RAT (Remote Access Trojan) often uses a command-and-control (C2) channel on high-numbered ports like 4444, allowing attackers to control the host remotely.

Answer

Ransomware

Answer

Botnet C2 client

Answer

Keylogger

Question 3

An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) enables real-time checking of a certificate's revocation status by querying the CA's responder, avoiding the need to download the entire CRL.

Answer

SCEP

Answer

EST

Answer

CRL

Question 4

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

Accepted Answer

SQL Injection. SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Buffer Overflow

Answer

Cross-Site Scripting (XSS)

Question 5

A security administrator is configuring a Cisco Firepower NGFW to detect and block application-layer DDoS attacks. Which type of DDoS attack is characterized by overwhelming a server with incomplete HTTP requests, causing resource exhaustion?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.

Answer

UDP Flood

Answer

ICMP Flood

Answer

SYN Flood

Question 6

Which cryptographic algorithm is considered deprecated and should be avoided due to known vulnerabilities, especially when used in digital signatures and certificate signing?

Accepted Answer

MD5. MD5 is a hashing algorithm with known collision vulnerabilities, making it unsuitable for security-sensitive applications like digital signatures.

Answer

SHA-256

Answer

SHA-3

Answer

AES-256

Question 7

An attacker uses ARP spoofing to intercept traffic between two devices on the same subnet. After successfully becoming a man-in-the-middle, the attacker can then perform which further attack to downgrade HTTPS connections to HTTP?

Accepted Answer

SSL stripping. SSL stripping is a MITM attack that downgrades HTTPS connections to HTTP by intercepting the initial HTTPS request and maintaining a plaintext connection with the client.

Answer

Session hijacking

Answer

DNS cache poisoning

Answer

Typosquatting

Question 8

In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?

Accepted Answer

Intermediate CA. An intermediate CA (subordinate CA) is a CA that is signed by the root CA and issues certificates to end entities, forming a chain of trust.

Answer

Registration Authority (RA)

Answer

Root CA

Answer

Certificate Revocation List (CRL)

Question 9

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Accepted Answer

Inherence. Fingerprints are inherent characteristics of a person, placing them in the 'inherence' category (something you are).

Answer

Possession

Answer

Knowledge

Answer

Location

Question 10

Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-based security solution that provides DNS-layer protection to block malicious domains before a connection is established.

Answer

AMP for Endpoints

Answer

Firepower NGFW

Answer

Stealthwatch

Question 11

A network administrator is configuring an ASA to enforce that traffic between two internal zones must be inspected by the firewall. Which security principle is being applied?

Accepted Answer

Microsegmentation. Microsegmentation is a zero trust principle that divides the network into small zones and enforces granular access controls between them.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense in Depth

Question 12

An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?

Accepted Answer

Redirection of traffic to malicious servers. DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.

Answer

Encryption of DNS queries

Answer

Exposure of DNS server credentials

Answer

Denial of service to the DNS server

Question 13

A security analyst is investigating a potential insider threat. Which TWO indicators are most commonly associated with malicious insider activity? (Choose two.)

Accepted Answer

Accessing files outside normal working hours without justification. Insider threats often involve unusual access patterns (e.g., accessing sensitive data not needed for the role) and attempts to bypass security controls (e.g., disabling logging).

Answer

Frequent password changes as required by policy

Answer

Receiving a promotion to a higher security clearance

Answer

Using a company-approved VPN for remote access

Question 14

A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)

Accepted Answer

Never trust, always verify. Zero Trust is built on the principles of never trust, always verify; least privilege; and microsegmentation to enforce granular access controls.

Answer

Trust but verify

Answer

Defense in depth

Question 15

A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)

Accepted Answer

Cisco ESA (Email Security Appliance). Cisco Email Security Appliance (ESA) and Cisco Secure Email (formerly Cloud Email Security) are dedicated email security solutions.

Answer

Cisco Stealthwatch

Answer

Cisco ISE (Identity Services Engine)

Answer

Cisco WSA (Web Security Appliance)

Question 16

A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated attempts to guess credentials, often automated, until successful.

Answer

SQL injection

Answer

Man-in-the-middle attack

Answer

Phishing

Question 17

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

Accepted Answer

Zero Trust. Zero Trust assumes no implicit trust and verifies every access request.

Answer

Defense in depth

Answer

Least privilege

Answer

Network segmentation

Question 18

A security engineer is configuring a Cisco Firepower NGFW to detect and block a new malware variant that communicates with a command-and-control server using encrypted DNS queries. Which Cisco security product is best suited to provide visibility into this malicious DNS traffic?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security service that can block malicious domains and provide visibility into DNS queries.

Answer

Cisco ASA

Answer

Cisco AMP

Answer

Cisco Stealthwatch

Question 19

Which of the following is an example of a passive reconnaissance technique?

Accepted Answer

OSINT gathering from public websites. Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.

Answer

Port scanning

Answer

Social engineering

Answer

Vulnerability scanning

Question 20

A company deploys a solution that uses a root certificate authority (CA) and intermediate CAs to issue certificates. What is the term for the hierarchical structure of certificates from the root CA to the end entity?

Accepted Answer

Certificate chaining. Certificate chaining refers to the path from the root CA through intermediates to the end-entity certificate.

Answer

Certificate signing request

Answer

Certificate revocation list

Answer

Public key infrastructure