350-701 Security Concepts Practice Test 5 — 15 Questions

Question 1

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

Accepted Answer

Active scanning. ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.

Answer

Passive OSINT

Answer

ARP spoofing

Answer

DNS cache poisoning

Question 2

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

Accepted Answer

SQL injection. SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Answer

Cross-site scripting (XSS)

Question 3

A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?

Accepted Answer

Ransomware. Ransomware encrypts files and demands a ransom for the decryption key.

Answer

Remote Access Trojan (RAT)

Answer

Botnet C2

Answer

Keylogger

Question 4

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a widely used symmetric block cipher with key sizes of 128, 192, or 256 bits.

Answer

ECC

Answer

RSA

Answer

3DES

Question 5

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

Answer

EST

Answer

SCEP

Answer

CRL

Question 6

Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?

Accepted Answer

Zero Trust. Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 7

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 8

A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.

Answer

Cisco ISE

Answer

Cisco Firepower

Answer

Cisco ASA

Question 9

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

Accepted Answer

Inherence. Inherence factors are biometric characteristics unique to the user.

Answer

Knowledge

Answer

Possession

Answer

Location

Question 10

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security solution that blocks malicious domains and provides secure internet gateway.

Answer

Cisco AMP

Answer

Cisco ESA

Answer

Cisco WSA

Question 11

During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?

Accepted Answer

Man-in-the-middle. Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.

Answer

Pass-the-hash

Answer

Replay attack

Answer

DNS tunneling

Question 12

Which Cisco product provides next-generation firewall (NGFW) capabilities, including application visibility and intrusion prevention?

Accepted Answer

Cisco Firepower. Cisco Firepower (now part of Cisco Secure Firewall) is the NGFW that includes IPS and application control.

Answer

Cisco ASA

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Question 13

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Zero trust is based on 'never trust, always verify' and least privilege access.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 14

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

Accepted Answer

UDP flood. Volumetric attacks aim to consume bandwidth. UDP floods, ICMP floods, and DNS amplification are common examples.

Answer

HTTP GET flood

Answer

SYN flood

Question 15

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation, network behavioral analytics, and endpoint detection help limit and detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection