350-701 Security Concepts Practice Test 4 — 15 Questions

Question 1

Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?

Accepted Answer

Ransomware. Ransomware encrypts data and demands ransom.

Answer

RAT

Answer

Keylogger

Answer

Botnet

Question 2

Which three components are part of the CIA triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability, so options B, C, and E are correct. Integrity (B) is a core goal because it ensures data is accurate, complete, and protected from unauthorized modification, whether in storage or in transit. Confidentiality (C) is correct because it ensures information is accessible only to authorized parties, typically enforced through encryption, access controls, and classification. Availability (E) is correct because it ensures systems, networks, and data remain accessible to authorized users when needed, supported by redundancy, backups, and resilience controls. Authentication (A) and Authorization (D) are important security functions, but they are access-control mechanisms rather than the three foundational properties of the CIA triad.

Answer

Authentication

Answer

Authorization

Question 3

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Accepted Answer

Never trust, always verify. Option C ('Never trust, always verify') is correct because Zero Trust's core tenet is that no user, device, or workload is trusted by default regardless of network location, so every access request must be explicitly authenticated and authorized using signals like identity, device health, and context. Option D ('Least privilege access') is correct because Zero Trust enforces just-enough-access (JEA) and just-in-time (JIT) permissions, granting users and workloads only the minimum rights needed for a specific task, which limits lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: single-factor authentication (A) contradicts Zero Trust's requirement for strong, often phishing-resistant multi-factor authentication; perimeter-based security (B) reflects the traditional castle-and-moat model that Zero Trust explicitly replaces; and implicit trust for internal networks (E) is the exact assumption Zero Trust eliminates by treating the internal network as hostile.

Answer

Single-factor authentication

Answer

Perimeter-based security

Answer

Implicit trust for internal networks

Question 4

Which component of the CIA triad ensures that data is not altered by unauthorized entities during transmission?

Accepted Answer

Integrity. Integrity ensures that data remains accurate and unaltered during storage or transmission, preventing unauthorized modifications.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 5

An attacker uses a tool to scan a target network for open ports and running services. Which type of reconnaissance does this represent?

Accepted Answer

Active scanning. Active scanning involves directly interacting with the target network to discover open ports and running services, such as using tools like Nmap. This type of reconnaissance sends packets to the target and analyzes responses, which is exactly what the attacker is doing. It is considered active because it generates traffic that could be detected.

Answer

DNS cache poisoning

Answer

Social engineering

Answer

Passive OSINT

Question 6

A security administrator is evaluating symmetric encryption algorithms for a new VPN deployment. Which algorithm uses a 128-bit block size and supports key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits.

Answer

3DES

Answer

RSA

Answer

MD5

Question 7

Which of the following is a characteristic of a zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every request must be verified regardless of source.

Answer

Implicit trust for internal users

Answer

Trust but verify

Answer

Trust based on network location

Question 8

A security engineer is configuring a Cisco Firepower NGFW to detect a buffer overflow attack. Which attack vector is this?

Accepted Answer

Exploitation. Buffer overflow is an exploitation technique where an attacker writes beyond the allocated buffer to execute arbitrary code.

Answer

Malware delivery

Answer

Reconnaissance

Answer

Denial of Service

Question 9

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Accepted Answer

List revoked certificates. CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.

Answer

Store private keys

Answer

Validate certificate signatures

Answer

Generate new certificates

Question 10

Which Cisco security product provides DNS-layer security to block malicious domains and cloud-based threats?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security service that provides DNS-layer filtering to block malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Answer

Cisco AMP

Question 11

An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?

Accepted Answer

Knowledge and inherence. Password is a knowledge factor, fingerprint is an inherence (biometric) factor.

Answer

Knowledge and possession

Answer

Inherence and location

Answer

Possession and inherence

Question 12

An attacker intercepts traffic between a client and server using ARP spoofing. Which type of attack is this?

Accepted Answer

Man-in-the-middle. ARP spoofing allows an attacker to intercept traffic, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

DNS poisoning

Answer

Denial of Service

Question 13

Which Cisco security product is primarily used for endpoint threat detection and retrospective security?

Accepted Answer

Cisco AMP for Endpoints. Cisco AMP (Advanced Malware Protection) provides endpoint protection with retrospective analysis and threat detection.

Answer

Cisco ESA

Answer

Cisco Firepower

Answer

Cisco WSA

Question 14

An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)

Accepted Answer

Never trust, always verify. Option B, 'Never trust, always verify,' is foundational to zero trust because it requires every access request to be authenticated and authorized based on identity, device posture, and context regardless of network location, eliminating implicit trust. Option E, 'Least privilege access,' is also foundational because zero trust enforces just-enough-access (JEA) and just-in-time (JIT) permissions, granting users and workloads only the minimum rights needed for a specific task to limit lateral movement. Option A is incorrect because single factor authentication relies on only one credential and does not provide the continuous, strong verification zero trust requires. Option C is incorrect because implicit trust for internal networks is the traditional perimeter model that zero trust explicitly rejects. Option D is incorrect because 'trust but verify' still starts from a position of trust, whereas zero trust starts from no trust and verifies every request.

Answer

Single factor authentication

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 15

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Accepted Answer

DNS query flood. DNS query flood (A) is an application-layer attack because it overwhelms a DNS server with a high volume of valid-looking recursive queries, exhausting its ability to resolve names at Layer 7. Slowloris (B) is an application-layer attack that opens many partial HTTP connections and sends incomplete headers to keep sockets open, exhausting the web server's connection pool without high bandwidth. HTTP flood (E) is an application-layer attack that sends massive numbers of seemingly legitimate HTTP GET or POST requests to consume web server and application resources. DNS amplification (C) is a volumetric reflection/amplification attack typically classified at the network/infrastructure layer, not an application-layer attack. SYN flood (D) is a transport-layer (Layer 4) attack that exploits the TCP three-way handshake by sending many SYN packets without completing the connection.

Answer

DNS amplification

Answer

SYN flood