350-701 Security Concepts Practice Test 4 — 15 Questions

Question 1

An attacker uses Shodan to discover internet-facing ICS devices and then performs banner grabbing. This is an example of which type of attack?

Accepted Answer

Passive OSINT. Passive OSINT involves collecting publicly available information without directly interacting with the target. Banner grabbing is active scanning, but the question emphasizes the initial passive phase. However, Shodan is a passive OSINT tool.

Answer

Social engineering

Answer

Active reconnaissance

Answer

Exploitation

Question 2

A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?

Accepted Answer

Remote Access Trojan (RAT). Port 4444 is commonly associated with Blaster worm and remote access tools. A Remote Access Trojan (RAT) allows remote control and often communicates on such ports.

Answer

Ransomware

Answer

Keylogger

Answer

Botnet C2 client

Question 3

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Accepted Answer

Zero Trust. Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Answer

CIA triad

Answer

AAA model

Answer

Defense in depth

Question 4

Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-based DNS security solution that blocks requests to malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 5

An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle (MITM). ARP spoofing allows an attacker to intercept traffic, a classic man-in-the-middle (MITM) technique.

Answer

Reconnaissance

Answer

DNS cache poisoning

Answer

DDoS attack

Question 6

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

Accepted Answer

SQL injection. SQL injection occurs when user input is not sanitized and alters SQL query structure.

Answer

Cross-site scripting (XSS)

Answer

Buffer overflow

Answer

CSRF

Question 7

A security engineer needs to choose a hashing algorithm for storing passwords. Which of the following should be avoided due to known collision vulnerabilities?

Accepted Answer

MD5. MD5 has known collision attacks and should not be used. SHA-256 and SHA-3 are secure. SHA-1 is also deprecated but not an option.

Answer

RIPEMD-160

Answer

SHA-3

Answer

SHA-256

Question 8

Which authentication factor does a fingerprint scanner represent?

Accepted Answer

Inherence factor (something you are). Inherence factors are based on biological traits like fingerprints.

Answer

Knowledge factor (something you know)

Answer

Possession factor (something you have)

Answer

Location factor (somewhere you are)

Question 9

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP (Online Certificate Status Protocol). OCSP (Online Certificate Status Protocol) provides real-time revocation status without the overhead of CRLs.

Answer

CRL (Certificate Revocation List)

Answer

PKI certificate chain

Answer

SSL/TLS handshake

Question 10

Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?

Accepted Answer

Cisco Advanced Malware Protection (AMP). Cisco AMP for Endpoints provides endpoint protection with advanced malware analysis.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Web Security Appliance (WSA)

Answer

Cisco Email Security Appliance (ESA)

Question 11

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 12

Which symmetric encryption algorithm is considered the current standard and is often used in VPNs and SSL/TLS?

Accepted Answer

AES. AES (Advanced Encryption Standard) is widely used and recommended.

Answer

MD5

Answer

3DES

Answer

RSA

Question 13

A security analyst observes a sustained increase in traffic from many different IP addresses to a single web application, causing CPU spikes. The traffic consists of legitimate-looking HTTP GET requests for the same resource. Which TWO types of attack could this be? (Choose two.)

Accepted Answer

Distributed denial-of-service (DDoS) attack. Application layer DDoS (Layer 7) uses legitimate-looking requests. A DDoS attack involves many sources. Volumetric DDoS is about bandwidth, not CPU. DNS amplification uses UDP reflection.

Answer

Volumetric DDoS

Answer

DNS amplification attack

Answer

Man-in-the-middle attack

Question 14

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

Accepted Answer

Least privilege access. Zero Trust core principles: never trust, always verify; least privilege; microsegmentation. Defense in depth is a separate concept.

Answer

Single sign-on (SSO)

Answer

Defense in depth

Question 15

A network administrator wants to deploy security products that provide network-based intrusion prevention and advanced threat detection. Which TWO Cisco products are most suitable? (Choose two.)

Accepted Answer

Cisco Stealthwatch. Cisco Firepower is an NGFW/IPS. Cisco Stealthwatch provides network detection and analysis. ISE is for identity, not IPS. ESA is email, AMP is endpoint.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Advanced Malware Protection (AMP) for Endpoints

Answer

Cisco Email Security Appliance (ESA)