350-701 Security Concepts Practice Test 6 — 15 Questions

Question 1

A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?

Accepted Answer

Ransomware. Ransomware is a type of malware that encrypts files on a victim's system and demands payment (usually cryptocurrency) for the decryption key. The scenario describes exactly this behavior: malware encrypts files and demands payment for decryption, which is the defining characteristic of ransomware.

Answer

Remote Access Trojan (RAT)

Answer

Botnet C2

Answer

Keylogger

Question 2

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) that operates on 128-bit blocks with key sizes of 128, 192, or 256 bits. It is widely used in modern VPNs (e.g., IPsec, OpenVPN, WireGuard) because it is fast, secure, and resistant to known cryptanalytic attacks. AES is the de facto standard for symmetric encryption in network security.

Answer

ECC

Answer

RSA

Answer

3DES

Question 3

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

Answer

EST

Answer

SCEP

Answer

CRL

Question 4

Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?

Accepted Answer

Zero Trust. Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 5

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 6

A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.

Answer

Cisco ISE

Answer

Cisco Firepower

Answer

Cisco ASA

Question 7

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

Accepted Answer

Inherence. Inherence is the authentication factor based on something the user is, such as biometric characteristics like fingerprints, retina scans, or facial recognition. This is a fundamental category in multi-factor authentication.

Answer

Knowledge

Answer

Possession

Answer

Location

Question 8

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security solution that blocks malicious domains and provides secure internet gateway.

Answer

Cisco AMP

Answer

Cisco ESA

Answer

Cisco WSA

Question 9

During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?

Accepted Answer

Man-in-the-middle. Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.

Answer

Pass-the-hash

Answer

Replay attack

Answer

DNS tunneling

Question 10

Which Cisco product provides next-generation firewall (NGFW) capabilities, including application visibility and intrusion prevention?

Accepted Answer

Cisco Firepower. Cisco Firepower (now part of Cisco Secure Firewall) is the NGFW that includes IPS and application control.

Answer

Cisco ASA

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Question 11

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Option C, 'Never trust, always verify,' is a foundational zero-trust principle because zero-trust treats every access request as untrusted regardless of source, requiring continuous authentication and authorization of users, devices, and sessions before granting access to resources. Option E, 'Least privilege access,' is also core to zero-trust because it enforces just-enough-access (JEA) and just-in-time (JIT) permissions so identities receive only the minimum rights needed, limiting lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: A, 'Single perimeter defense,' reflects the traditional castle-and-moat model that zero-trust explicitly replaces with microsegmentation and identity-centric controls; B, 'Implicit trust for internal networks,' is the opposite of zero-trust, which assumes no implicit trust based on network location; and D, 'Trust but verify,' is a legacy governance phrase, not a zero-trust principle, since zero-trust starts from 'never trust' rather than granting trust first.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 12

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

Accepted Answer

UDP flood. UDP flood (A) is volumetric because it blasts the target with massive numbers of User Datagram Protocol packets, consuming bandwidth and processing resources without needing a handshake. DNS amplification (B) is volumetric because small spoofed DNS queries trigger large responses from open resolvers, multiplying traffic volume and saturating the victim's link. ICMP flood (D) is volumetric because it sends enormous volumes of ICMP Echo Request packets (e.g., ping floods) that fill the bandwidth pipe. HTTP GET flood (C) is an application-layer (Layer 7) attack that exhausts web server resources with seemingly legitimate requests rather than raw bandwidth. SYN flood (E) is a protocol/state-exhaustion attack that depletes TCP connection tables via half-open connections, not primarily a volumetric bandwidth flood.

Answer

HTTP GET flood

Answer

SYN flood

Question 13

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation (A) is correct because it enforces granular, identity- and workload-based policies between internal segments, so stolen credentials alone cannot freely reach other servers and lateral movement paths are blocked or alerted. Network behavioral analytics such as Stealthwatch (D) is correct because it baselines normal east-west traffic and uses flow telemetry to detect anomalous internal connections, beaconing, and unusual data transfers indicative of lateral movement and exfiltration. Endpoint detection and response (EDR) (E) is correct because it monitors process, credential, and command activity on hosts, detecting techniques like pass-the-hash, remote service creation, and suspicious lateral tooling, and can isolate the endpoint. A stateful firewall at the perimeter (B) only inspects traffic crossing the network edge and does not see or stop internal east-west lateral movement. SSL inspection (C) decrypts TLS traffic for content inspection but by itself neither segments the internal network nor correlates host/network behavior to detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 14

A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)

Accepted Answer

Least privilege access. Option D (Least privilege access) is correct because zero trust grants users and workloads only the minimum permissions needed for their specific tasks, limiting lateral movement if credentials are compromised. Option E (Never trust, always verify) is correct because zero trust explicitly authenticates and authorizes every request regardless of network location, using continuous verification of identity, device health, and context rather than assuming trust from being inside the corporate network. Option A (Implicit trust for internal users) is wrong because it directly contradicts the zero trust model, which eliminates implicit trust based on network location. Option B (Single perimeter defense) is wrong because zero trust abandons the castle-and-moat single-perimeter model in favor of microsegmentation and identity-centric controls. Option C (All traffic must be inspected by a firewall) is wrong because while inspection may be part of an implementation, it is not a foundational zero trust principle; zero trust is defined by identity-based verification and least privilege, not by mandating firewall inspection of all traffic.

Answer

Implicit trust for internal users

Answer

Single perimeter defense

Answer

All traffic must be inspected by a firewall

Question 15

An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)

Accepted Answer

Use prepared statements with parameterized queries. Option A is correct because prepared statements with parameterized queries separate SQL code from user-supplied data, so input is treated strictly as data and cannot alter query structure, which is the most fundamental defense against SQL injection. Option C is correct because a WAF can inspect HTTP requests and block known SQL injection patterns (e.g., tautologies like ' OR 1=1--, UNION SELECT, or stacked queries), providing a valuable compensating/detection layer especially for legacy code that cannot be immediately fixed. Option D is correct because strict input validation (allowlisting expected formats, types, lengths, and character sets) rejects malformed or malicious input before it reaches the database, reducing the attack surface for injection payloads. Option B is not among the chosen answers because suppressing detailed database error messages is only a defense-in-depth measure that prevents information disclosure; it does not stop SQL injection itself. Option E is also not chosen because strong password policies for database accounts mitigate credential brute-force and unauthorized access, but they do nothing to prevent injection through application input paths.

Answer

Disable detailed database error messages in production

Answer

Enforce strong password policies for database accounts