350-701 Security Concepts Practice Test 5 — 15 Questions

Question 1

Which three cryptographic algorithms are considered secure for use in modern systems? (Choose three.)

Accepted Answer

ECDSA. ECDSA (A) is correct because it is an elliptic-curve digital signature algorithm that provides strong security with smaller key sizes (e.g., a 256-bit ECDSA key offers roughly 128-bit security), making it a modern, secure choice for signing and authentication. RSA (C) is correct because, when used with sufficiently large keys (typically 2048 bits or more) and proper padding such as OAEP or PSS, it remains a secure public-key algorithm for encryption and digital signatures. AES (E) is correct because it is a modern symmetric block cipher standardized by NIST that, with 128-, 192-, or 256-bit keys, is considered secure and is the current standard for symmetric encryption. MD5 (B) is not acceptable because it is a broken hash function with practical collision attacks, and 3DES (D) is not acceptable because its 64-bit block size enables Sweet32-style attacks and its effective key strength is reduced, so both are deprecated for modern secure systems.

Answer

MD5

Answer

3DES

Question 2

A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?

Accepted Answer

Remote Access Trojan (RAT). A Remote Access Trojan (RAT) establishes a covert command-and-control channel back to an attacker, commonly using high ports like 4444 (the default Metasploit/Meterpreter listener port). The combination of outbound traffic to an external IP on 4444, high CPU from unknown processes, and interactive remote control behavior is the classic RAT signature. RATs give the attacker hands-on-keyboard access, which explains the anomalous process activity and resource consumption.

Answer

Ransomware

Answer

Keylogger

Answer

Botnet C2 client

Question 3

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Accepted Answer

Zero Trust. Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Answer

CIA triad

Answer

AAA model

Answer

Defense in depth

Question 4

Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer security, blocking malicious domains and preventing connections to command-and-control servers before a connection is established. It uses DNS resolution to enforce security policies across all devices, both on and off the corporate network. This is the product specifically designed for DNS-layer protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 5

An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle (MITM). ARP spoofing — sending forged ARP replies to associate the attacker's MAC address with a legitimate IP (such as the server's) — positions the attacker between the client and server, allowing interception and possibly modification of traffic. This is the classic definition of a man-in-the-middle (MITM) attack, where the attacker transparently relays and captures communications between two parties.

Answer

Reconnaissance

Answer

DNS cache poisoning

Answer

DDoS attack

Question 6

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

Accepted Answer

SQL injection. SQL injection occurs when user input is not sanitized and alters SQL query structure.

Answer

Cross-site scripting (XSS)

Answer

Buffer overflow

Answer

CSRF

Question 7

A security engineer needs to choose a hashing algorithm for storing passwords. Which of the following should be avoided due to known collision vulnerabilities?

Accepted Answer

MD5. MD5 produces a 128-bit hash and has well-documented collision vulnerabilities — practical chosen-prefix collisions were demonstrated as early as 2004 (Wang et al.) and weaponized in attacks like Flame and the rogue CA certificate incident. Because collisions allow two different inputs to produce the same hash, MD5 is unsuitable for password storage or any integrity/security use. It should be avoided.

Answer

RIPEMD-160

Answer

SHA-3

Answer

SHA-256

Question 8

Which authentication factor does a fingerprint scanner represent?

Accepted Answer

Inherence factor (something you are). Inherence factors are based on biological traits like fingerprints.

Answer

Knowledge factor (something you know)

Answer

Possession factor (something you have)

Answer

Location factor (somewhere you are)

Question 9

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP (Online Certificate Status Protocol). OCSP (Online Certificate Status Protocol, RFC 6960) lets a client query a responder in real time for the revocation status of a specific certificate, returning 'good', 'revoked', or 'unknown' without downloading the entire CRL. This avoids the latency and bandwidth cost of full CRL downloads and provides fresher status. It is the standard real-time revocation check used in TLS handshakes via the OCSP stapling extension.

Answer

CRL (Certificate Revocation List)

Answer

PKI certificate chain

Answer

SSL/TLS handshake

Question 10

Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?

Accepted Answer

Cisco Advanced Malware Protection (AMP). Cisco Advanced Malware Protection (AMP) is Cisco's endpoint and network malware protection product that provides file reputation, file analysis (via AMP Threat Grid), and retrospective security — the ability to look back at file behavior and retroactively alert on files that were previously deemed benign. This matches the question's requirements exactly.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Web Security Appliance (WSA)

Answer

Cisco Email Security Appliance (ESA)

Question 11

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 12

Which symmetric encryption algorithm is considered the current standard and is often used in VPNs and SSL/TLS?

Accepted Answer

AES. AES (Advanced Encryption Standard) is widely used and recommended.

Answer

MD5

Answer

3DES

Answer

RSA

Question 13

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

Accepted Answer

Least privilege access. Least privilege access (A) is a core Zero Trust principle because users and workloads are granted only the minimum permissions needed for their tasks, limiting lateral movement if an account is compromised. 'Never trust, always verify' (C) is the foundational Zero Trust tenet: every access request is authenticated and authorized based on identity, device health, and context regardless of network location. Microsegmentation (D) supports Zero Trust by dividing the network into granular zones with policy controls between them, preventing unrestricted east-west traffic. Single sign-on (B) is an authentication convenience/identity-federation mechanism, not a Zero Trust principle itself, and defense in depth (E) is a broader layered-security strategy that predates and is distinct from Zero Trust's explicit trust-verification model.

Answer

Single sign-on (SSO)

Answer

Defense in depth

Question 14

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

Accepted Answer

Active scanning. ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.

Answer

Passive OSINT

Answer

ARP spoofing

Answer

DNS cache poisoning

Question 15

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

Accepted Answer

SQL injection. SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Answer

Cross-site scripting (XSS)