Cisco CCNP Enterprise 350-401 ENCOR Threat Endpoint and Segmentation Security Design Practice Test

 

Topic 18 covers threat, endpoint and segmentation security design for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

An internet-facing application is allowed through a perimeter firewall. The security requirement is to inspect permitted application traffic for exploit signatures and actively stop matching malicious payloads before they reach the server. Which control best addresses the requirement?

1. Collect NetFlow records only.
2. Place intrusion-prevention inspection on the permitted traffic path.
3. Assign the server a security-group tag only.
4. Increase the server interface speed.
5. Enable MACsec on the server access link only.

Correct Answer: B

 

Correct Answer

Answer B is correct because IPS inspection can analyze allowed traffic for malicious patterns and take a blocking action.

Incorrect Answers

Answer A is incorrect because flow metadata improves visibility but does not inspect payloads or block exploit signatures.

Answer C is incorrect because identity tagging supports segmentation decisions but does not itself inspect exploit content.

Answer D is incorrect because capacity does not provide threat inspection. It does not satisfy the stem’s governing point: Use prevention inspection on the relevant traffic path when the requirement is to detect and stop malicious application content.

Answer E is incorrect because link encryption protects that Ethernet hop but does not identify exploit payloads.

 

Question 2

A SOC receives high-fidelity alerts from a passive sensor when exploit traffic crosses a tap, but management now requires the control to stop the exploit automatically in-line. What has to change?

1. Encrypt the tap feed with MACsec.
2. Replace all endpoint telemetry with syslog.
3. Tag the attacker with an SGT but leave all policy permit.
4. Place a prevention-capable control inline on the traffic path.
5. Increase alert retention.

Correct Answer: D

 

Correct Answer

Answer D is correct because automatic blocking requires an enforcement point in the path, not detection-only visibility.

Incorrect Answers

Answer A is incorrect because protecting the monitoring link does not create enforcement.

Answer B is incorrect because logging changes do not turn a passive observation point into an enforcement path.

Answer C is incorrect because classification without an enforcement policy does not stop traffic.

Answer E is incorrect because retention supports investigation, not prevention. It does not satisfy the stem’s governing point: Detection visibility and prevention enforcement are different outcomes; blocking requires an enforcement-capable control on the path.

 

Question 3

A company deploys an IPS at the internet edge. An internal user laterally attacks a database across an east-west path that never traverses the edge. The IPS reports nothing. Which design correction addresses the stated gap?

1. Put inspection on the east-west traffic path.
2. Disable endpoint protection so the IPS has sole responsibility.
3. Force the database to use a public IP.
4. Tune the edge IPS for more signatures.
5. Enable NTP on the database.

Correct Answer: A

 

Correct Answer

Answer A is correct because the control must see the traffic it is expected to inspect.

Incorrect Answers

Answer B is incorrect because removing a layer weakens defense and does not fix path visibility.

Answer C is incorrect because changing addressing does not establish the intended internal inspection architecture.

Answer D is incorrect because a better signature set still cannot inspect traffic that never crosses the sensor.

Answer E is incorrect because time synchronization does not provide threat inspection. It does not satisfy the stem’s governing point: A network inspection control only sees traffic that traverses it; placement must match the threat path.

 

Question 4

A ransomware campaign may arrive through email, execute on a laptop, and then scan internal servers. Which TWO controls most directly create layered coverage across the host-execution and network-propagation stages? Choose TWO.

1. Disabling security logs to reduce noise.
2. A larger DHCP lease pool.
3. Endpoint protection with host telemetry/containment on laptops.
4. MACsec on one uplink only.
5. A longer DNS TTL.
6. An in-path network security control that can inspect/enforce on relevant internal traffic.

Correct Answers: C, F

 

Correct Answers

Answer C is correct because host control can observe and contain execution even when the device is away from a network inspection point.

Answer F is correct because network inspection adds a separate control over propagation paths.

Incorrect Answers

Answer A is incorrect because removing evidence weakens detection and response. It does not satisfy the stem’s governing point: Layered defense uses controls at different failure stages, such as endpoint execution and network propagation.

Answer B is incorrect because address capacity is not a threat-defense layer. It does not satisfy the stem’s governing point: Layered defense uses controls at different failure stages, such as endpoint execution and network propagation.

Answer D is incorrect because link encryption does not identify ransomware execution or malicious lateral behavior.

Answer E is incorrect because DNS caching does not provide the required security controls.

 

Question 5

A firewall with IPS inspects all north-south traffic, but a backup VLAN has direct Layer 3 reachability to production and is intentionally excluded from the firewall path. Which statement is the most accurate security assessment?

1. MACsec would make payload inspection unnecessary.
2. TrustSec tagging automatically decrypts and inspects the bypass.
3. A default route guarantees IPS coverage.
4. The bypass creates an inspection blind spot requiring another control or explicit acceptance.
5. The firewall protects the excluded path because both networks use the same core.

Correct Answer: D

 

Correct Answer

Answer D is correct because traffic outside the enforcement path is not inspected by that firewall.

Incorrect Answers

Answer A is incorrect because encryption protects links but does not replace threat inspection.

Answer B is incorrect because SGT propagation is classification context, not payload inspection.

Answer C is incorrect because routing reachability alone does not prove the path crosses the firewall.

Answer E is incorrect because sharing infrastructure does not make bypass traffic traverse inspection.

 

Question 6

Sales laptops regularly work from home and public networks, outside the corporate firewall. The company needs malware telemetry and the ability to contain a compromised laptop wherever the endpoint agent can reach its cloud service. Which control is most directly aligned?

1. Endpoint security/EDR capability installed on the laptops.
2. A perimeter-only IPS at headquarters.
3. MACsec between two campus switches.
4. An SGACL on the headquarters campus only.
5. A larger Internet circuit.

Correct Answer: A

 

Correct Answer

Answer A is correct because host-based telemetry and isolation remain available even when traffic is not behind the enterprise gateway.

Incorrect Answers

Answer B is incorrect because off-network devices can bypass that inspection point. It does not satisfy the stem’s governing point: Endpoint protection follows the device and can provide host telemetry/containment outside enterprise network inspection points.

Answer C is incorrect because a campus link control does not provide host telemetry off-network.

Answer D is incorrect because campus group policy cannot protect an endpoint while it is off that network.

Answer E is incorrect because bandwidth is not endpoint protection. It does not satisfy the stem’s governing point: Endpoint protection follows the device and can provide host telemetry/containment outside enterprise network inspection points.

 

Question 7

A SOC investigates suspicious PowerShell activity. NetFlow shows the laptop contacted an external IP over TCP/443, but analysts need the process command line and host execution context. Which evidence source is more appropriate?

1. An SGT assignment alone.
2. Only interface utilization counters.
3. MACsec counters.
4. Only the switch MAC address table.
5. Endpoint telemetry from the affected host.

Correct Answer: E

 

Correct Answer

Answer E is correct because endpoint security can expose process and command-line behavior that network flow metadata cannot.

Incorrect Answers

Answer A is incorrect because identity classification does not provide execution details. It does not satisfy the stem’s governing point: Network flow evidence describes communications; endpoint telemetry can expose process-level execution context.

Answer B is incorrect because utilization has no process context. It does not satisfy the stem’s governing point: Network flow evidence describes communications; endpoint telemetry can expose process-level execution context.

Answer C is incorrect because link-security counters do not identify the host process.

Answer D is incorrect because Layer 2 forwarding state does not show host process command lines.

 

Question 8

A workstation is confirmed compromised and actively contacting command-and-control infrastructure. Analysts still need controlled access from approved recovery systems. What is the most appropriate immediate host-boundary response?

1. Change the user desktop background.
2. Increase the workstation DNS cache.
3. Isolate the endpoint with recovery-only access.
4. Move the firewall inspection policy to monitor-only.
5. Disable all SOC telemetry first.

Correct Answer: C

 

Correct Answer

Answer C is correct because isolation limits malicious communications while preserving approved remediation access.

Incorrect Answers

Answer A is incorrect because cosmetic changes do not contain the host. It does not satisfy the stem’s governing point: Contain a confirmed compromised endpoint at the host boundary while preserving only trusted remediation access when supported.

Answer B is incorrect because caching does not contain a compromised host. It does not satisfy the stem’s governing point: Contain a confirmed compromised endpoint at the host boundary while preserving only trusted remediation access when supported.

Answer D is incorrect because that weakens enforcement during an active compromise. It does not satisfy the stem’s governing point: Contain a confirmed compromised endpoint at the host boundary while preserving only trusted remediation access when supported.

Answer E is incorrect because removing visibility impairs response. It does not satisfy the stem’s governing point: Contain a confirmed compromised endpoint at the host boundary while preserving only trusted remediation access when supported.

 

Question 9

A contractor connects an unmanaged personal laptop to a guest segment. The organization has no endpoint agent, management profile, or host telemetry on that device. Which limitation should the architect document?

1. Network controls lack endpoint process and file telemetry.
2. The laptop cannot obtain an IP address.
3. The firewall can reconstruct every local process solely from packet headers.
4. TrustSec automatically installs an endpoint agent.
5. MACsec creates endpoint EDR telemetry.

Correct Answer: A

 

Correct Answer

Answer A is correct because unmanaged endpoints can be governed at network boundaries without providing managed host visibility.

Incorrect Answers

Answer B is incorrect because endpoint management status does not inherently prevent addressing.

Answer C is incorrect because network evidence does not provide complete host execution telemetry.

Answer D is incorrect because identity segmentation and endpoint software are separate mechanisms.

Answer E is incorrect because link encryption does not instrument host processes. It does not satisfy the stem’s governing point: Unmanaged endpoints may still be subject to network policy, but they lack the host-level telemetry and control of a managed endpoint agent.

 

Question 10

A branch firewall blocks known malicious destinations, but a laptop executes malware from a USB drive while disconnected from the branch network. Which statement best explains why endpoint protection is still needed?

1. Gateway filtering and endpoint protection cover different security boundaries.
2. The firewall will inspect the USB bus remotely.
3. An SGT converts malware into allowed traffic.
4. MACsec on the branch uplink prevents local malware execution.
5. Endpoint protection is unnecessary whenever the branch has Internet access.

Correct Answer: A

 

Correct Answer

Answer A is correct because local execution can occur without crossing a network enforcement point.

Incorrect Answers

Answer B is incorrect because network firewalls do not inspect local removable-media execution that does not traverse them.

Answer C is incorrect because SGTs classify identity and do not remove malware.

Answer D is incorrect because link protection does not inspect endpoint files/processes. It does not satisfy the stem’s governing point: Use endpoint security for host-local threats and gateway/network controls for traffic-path threats; neither boundary fully replaces the other.

Answer E is incorrect because connectivity does not eliminate host-local threats. It does not satisfy the stem’s governing point: Use endpoint security for host-local threats and gateway/network controls for traffic-path threats; neither boundary fully replaces the other.

 

Question 11

A policy must block a specific file-sharing application even when the application can use TCP/443, while permitting other approved HTTPS applications. Why is application-aware firewalling preferable to a port-only rule?

1. It changes every application to a unique TCP port.
2. It guarantees visibility into every encrypted payload without limits.
3. It makes TLS encryption mathematically unnecessary.
4. It automatically installs endpoint agents.
5. Classify the application and apply policy to it.

Correct Answer: E

 

Correct Answer

Answer E is correct because port 443 can carry many applications, so application identity provides finer policy context.

Incorrect Answers

Answer A is incorrect because modern applications may share or shift ports; that is why application identification matters.

Answer B is incorrect because encrypted traffic can restrict inspection and may require decryption or other visibility methods.

Answer C is incorrect because application awareness does not remove the need for transport encryption.

Answer D is incorrect because firewall application control and endpoint software are separate.

 

Question 12

A security policy says members of the Finance identity group may reach a reporting application, regardless of which managed workstation they use. Which additional context is decisive beyond destination IP/port?

1. The Ethernet cable color.
2. Use mapped user identity context.
3. The current NTP stratum alone.
4. The interface speed.
5. The packet TTL alone.

Correct Answer: B

 

Correct Answer

Answer B is correct because user-based policy needs a reliable identity-to-session mapping rather than only network coordinates.

Incorrect Answers

Answer A is incorrect because physical appearance does not establish user authorization. It does not satisfy the stem’s governing point: Identity-aware firewall rules require trustworthy identity context associated with the traffic/session.

Answer C is incorrect because time quality can support logs/authentication but does not identify the user group by itself.

Answer D is incorrect because link speed is unrelated to user-based authorization. It does not satisfy the stem’s governing point: Identity-aware firewall rules require trustworthy identity context associated with the traffic/session.

Answer E is incorrect because TTL does not identify the authenticated user. It does not satisfy the stem’s governing point: Identity-aware firewall rules require trustworthy identity context associated with the traffic/session.

 

Question 13

An NGFW allows outbound TLS. Administrators want full inspection of file contents inside HTTPS, but certificate pinning prevents decryption for one application. Which assessment is most accurate?

1. Changing the destination port to 8443 automatically decrypts the application.
2. TrustSec SGTs decrypt TLS payloads.
3. The firewall can always read full encrypted payloads because it sees TCP/443.
4. MACsec on the inside link decrypts Internet TLS.
5. Encrypted metadata may provide visibility, but full payload inspection requires decryption.

Correct Answer: E

 

Correct Answer

Answer E is correct because Cisco documents visibility methods that reduce blind spots while acknowledging payload inspection limitations.

Incorrect Answers

Answer A is incorrect because port changes do not bypass cryptography. It does not satisfy the stem’s governing point: Encrypted traffic can preserve application/process metadata visibility, but full payload inspection generally depends on decryption and its operational constraints.

Answer B is incorrect because SGTs carry identity context, not TLS keys. It does not satisfy the stem’s governing point: Encrypted traffic can preserve application/process metadata visibility, but full payload inspection generally depends on decryption and its operational constraints.

Answer C is incorrect because transport ports do not defeat TLS encryption. It does not satisfy the stem’s governing point: Encrypted traffic can preserve application/process metadata visibility, but full payload inspection generally depends on decryption and its operational constraints.

Answer D is incorrect because MACsec protects a local Ethernet hop and does not terminate application TLS.

 

Question 14

Two internal security zones are permitted to communicate, but policy requires session-aware enforcement so return traffic is associated with approved connections and application controls can be applied. Which boundary is most appropriate?

1. A passive SPAN destination only.
2. MACsec alone between access switches.
3. A larger route table.
4. Only an endpoint antivirus signature update.
5. Use stateful firewalling between zones.

Correct Answer: E

 

Correct Answer

Answer E is correct because stateful inspection is designed to track permitted sessions and enforce policy at the segmentation boundary.

Incorrect Answers

Answer A is incorrect because passive monitoring does not enforce connection state. It does not satisfy the stem’s governing point: Use a stateful firewall boundary when permitted segments still require session-aware application/security enforcement.

Answer B is incorrect because link encryption does not make inter-zone authorization stateful.

Answer C is incorrect because routing scale does not provide stateful inspection. It does not satisfy the stem’s governing point: Use a stateful firewall boundary when permitted segments still require session-aware application/security enforcement.

Answer D is incorrect because host malware prevention does not enforce network session policy between zones.

 

Question 15

A compromised endpoint is isolated by the EDR platform, but the network firewall continues allowing the user identity to other applications after the endpoint is restored. Which statement best separates the responsibilities?

1. Remediate the host; control later sessions with firewall policy.
2. Restoring the endpoint automatically rewrites every firewall rule.
3. MACsec replaces both controls.
4. The two controls are identical because both can block traffic.
5. Firewall rules disinfect local files.

Correct Answer: A

 

Correct Answer

Answer A is correct because host recovery and network authorization are distinct controls that must both be correct.

Incorrect Answers

Answer B is incorrect because endpoint recovery does not inherently define firewall authorization.

Answer C is incorrect because link encryption neither remediates endpoints nor defines application authorization.

Answer D is incorrect because their enforcement boundaries and evidence differ. It does not satisfy the stem’s governing point: Endpoint remediation and network firewall authorization are complementary but distinct security responsibilities.

Answer E is incorrect because network policy does not remediate host files/processes. It does not satisfy the stem’s governing point: Endpoint remediation and network firewall authorization are complementary but distinct security responsibilities.

 

Question 16

A user moves from one campus access switch to another and receives a different IP address. Policy should still treat the user as the same security role. Which TrustSec concept supports this design?

1. Use a security group tag for the source role or identity.
2. Use the switchport number as the permanent user identity.
3. Require the user to keep the same IP forever.
4. Use MACsec keys as the authorization group.
5. Use only the packet TTL.

Correct Answer: A

 

Correct Answer

Answer A is correct because SGT policy context can remain tied to security-group membership as location/address changes.

Incorrect Answers

Answer B is incorrect because physical ports change when users move. It does not satisfy the stem’s governing point: TrustSec can express policy using security-group identity independent of a specific source IP location.

Answer C is incorrect because that defeats the mobility requirement and is unnecessary for group-based policy.

Answer D is incorrect because link-encryption keys are not the same as TrustSec security-group identity.

Answer E is incorrect because TTL has no role identity semantics. It does not satisfy the stem’s governing point: TrustSec can express policy using security-group identity independent of a specific source IP location.

 

Question 17

An access edge authenticates a device and assigns it an SGT. No SGACL or other policy consumes that tag anywhere downstream. Which statement is correct?

1. The tag automatically encrypts all Ethernet frames.
2. The tag automatically removes malware from the endpoint.
3. The tag turns every firewall into stateless routing.
4. Classification alone does not enforce a permit or deny relationship.
5. The device is denied by definition.

Correct Answer: D

 

Correct Answer

Answer D is correct because SGT assignment provides identity context; enforcement requires a policy decision using that context.

Incorrect Answers

Answer A is incorrect because SGT propagation can be clear text and is not MACsec.

Answer B is incorrect because classification is not endpoint remediation. It does not satisfy the stem’s governing point: Separate identity classification (assigning an SGT) from policy enforcement (for example, applying an SGACL matrix decision).

Answer C is incorrect because TrustSec does not remove firewall state behavior. It does not satisfy the stem’s governing point: Separate identity classification (assigning an SGT) from policy enforcement (for example, applying an SGACL matrix decision).

Answer E is incorrect because the effect depends on configured enforcement policy. It does not satisfy the stem’s governing point: Separate identity classification (assigning an SGT) from policy enforcement (for example, applying an SGACL matrix decision).

 

Question 18

A TrustSec policy matrix specifies that source group Contractors may use HTTPS to destination group Payroll-Servers but must not use SSH. A contractor packet is tagged correctly and reaches an enforcing device. Which information drives the group policy decision?

1. Only the destination TCP port without any identity context.
2. The MACsec cipher suite.
3. Only the contractor source IP subnet.
4. The endpoint antivirus signature version.
5. The source SGT together with the destination security group and the configured SGACL relationship.

Correct Answer: E

 

Correct Answer

Answer E is correct because TrustSec enforcement uses source/destination group context to select policy.

Incorrect Answers

Answer A is incorrect because the permitted service is evaluated within a source/destination group relationship.

Answer B is incorrect because link cryptography does not define the SGACL relationship.

Answer C is incorrect because the design explicitly uses security-group identity rather than subnet-only policy.

Answer D is incorrect because host protection state is not the stated TrustSec matrix key.

 

Question 19

A nurse moves between wired and wireless access locations during a shift. The hospital wants the same role-based segmentation outcome without rewriting IP ACLs for each subnet. Which design best fits?

1. Create one permanent static IP for every location the nurse may visit.
2. Use consistent identity-to-security-group classification and enforce group-based policy wherever the traffic reaches the relevant TrustSec enforcement points.
3. Use only MACsec so every encrypted frame is automatically authorized.
4. Use a unique VLAN for each individual user.
5. Disable segmentation while the user moves.

Correct Answer: B

 

Correct Answer

Answer B is correct because identity-based segmentation avoids tying the role solely to changing network location.

Incorrect Answers

Answer A is incorrect because this does not scale and still ties policy to addressing.

Answer C is incorrect because link confidentiality does not define role permissions. It does not satisfy the stem’s governing point: Identity-based segmentation can preserve policy across mobility when classification and enforcement remain consistent.

Answer D is incorrect because per-user VLAN proliferation is not the stated identity-policy model.

Answer E is incorrect because that violates the requirement. It does not satisfy the stem’s governing point: Identity-based segmentation can preserve policy across mobility when classification and enforcement remain consistent.

 

Question 20

Two switches propagate SGTs using inline tagging. A security review assumes this also encrypts the Ethernet payload between the switches. What correction is required?

1. An SGACL automatically performs TLS decryption.
2. Inline SGT propagation carries identity metadata and can be clear text; use an encryption mechanism such as MACsec separately when link confidentiality is required.
3. Changing the SGT value enables encryption.
4. TrustSec tagging encrypts only TCP but not UDP.
5. SGTs are 256-bit encryption keys.

Correct Answer: B

 

Correct Answer

Answer B is correct because Cisco documents SGT-over-Ethernet as clear-text propagation; it is not a confidentiality service.

Incorrect Answers

Answer A is incorrect because group policy and application TLS are unrelated mechanisms.

Answer C is incorrect because the label value does not turn tagging into MACsec.

Answer D is incorrect because SGT tagging does not provide payload encryption for either protocol.

Answer E is incorrect because an SGT is a group identifier, not a payload-encryption key.

 

Question 21

A company owns a dark-fiber Ethernet link between two buildings. The principal risk is passive tapping of that physical link, and the requirement is confidentiality/integrity on the Ethernet hop without changing application protocols. Which control most directly fits?

1. MACsec on the participating Ethernet interfaces, with appropriate key agreement/trust.
2. A passive IPS sensor.
3. A NetFlow exporter.
4. An SGT only.
5. A longer OSPF dead timer.

Correct Answer: A

 

Correct Answer

Answer A is correct because MACsec protects Ethernet frames on the secured link and is designed for link-layer confidentiality/integrity.

Incorrect Answers

Answer B is incorrect because detection does not encrypt the wire. It does not satisfy the stem’s governing point: MACsec addresses confidentiality/integrity exposure on an Ethernet link; it does not require changing every application.

Answer C is incorrect because flow telemetry does not encrypt the link. It does not satisfy the stem’s governing point: MACsec addresses confidentiality/integrity exposure on an Ethernet link; it does not require changing every application.

Answer D is incorrect because a group tag provides identity context and can be carried in clear text.

Answer E is incorrect because routing timers do not protect frame confidentiality. It does not satisfy the stem’s governing point: MACsec addresses confidentiality/integrity exposure on an Ethernet link; it does not require changing every application.

 

Question 22

Traffic crosses three routed provider hops between sites. MACsec is enabled only on the customer Ethernet handoff from each site router to its local provider device. The requirement is end-to-end confidentiality across the entire provider path. Which assessment is correct?

1. SGTs make MACsec end-to-end.
2. MACsec automatically extends through every provider router.
3. The local MACsec links protect only their secured Ethernet segments; an end-to-end mechanism such as IPsec is needed if the entire routed path must remain cryptographically protected.
4. Changing the BGP metric extends the cryptographic boundary.
5. A firewall state table encrypts the provider core.

Correct Answer: C

 

Correct Answer

Answer C is correct because MACsec is link/hop scoped rather than an end-to-end routed tunnel by itself.

Incorrect Answers

Answer A is incorrect because identity tags do not extend encryption scope. It does not satisfy the stem’s governing point: Distinguish link-layer MACsec protection from end-to-end routed encryption such as IPsec.

Answer B is incorrect because intermediate hops are separate links unless they also participate in protection.

Answer D is incorrect because routing preference does not alter encryption scope. It does not satisfy the stem’s governing point: Distinguish link-layer MACsec protection from end-to-end routed encryption such as IPsec.

Answer E is incorrect because stateful inspection is not a path encryption mechanism.

 

Question 23

Two switches are configured for MACsec, but they do not share a valid keying/trust relationship for MKA. What prerequisite is missing?

1. A public DNS record for each switch.
2. A matching SGT for every user.
3. An IPS signature for Ethernet encryption.
4. A larger MTU alone.
5. Mutually usable keying/trust material and compatible MACsec/MKA configuration between the peers.

Correct Answer: E

 

Correct Answer

Answer E is correct because the peers need a valid security association/key agreement basis before protected traffic can be established.

Incorrect Answers

Answer A is incorrect because DNS publication is not required for the local MKA relationship described.

Answer B is incorrect because TrustSec identity groups are not the MACsec keying prerequisite.

Answer C is incorrect because IPS signatures do not establish MACsec keys. It does not satisfy the stem’s governing point: MACsec requires participating peers to establish compatible security associations through an approved keying/trust method.

Answer D is incorrect because frame overhead may affect design, but it does not supply trust/keying material.

 

Question 24

A path is Host—Switch A—Switch B—Switch C—Server. MACsec protects A–B and B–C, but Host–A and C–Server are unprotected Ethernet links. Which TWO statements are true? Choose TWO.

1. The application payload is end-to-end encrypted solely because two middle links use MACsec.
2. The unprotected links inherit confidentiality from routing.
3. Frames are cryptographically protected on the A–B and B–C secured links.
4. The SGT must disappear whenever MACsec is used.
5. The firewall automatically decrypts both secured links even if it is not a MACsec peer.
6. The Host–A and C–Server segments remain outside the stated MACsec coverage.

Correct Answers: C, F

 

Correct Answers

Answer C is correct because those are the links with MACsec enabled. This directly matches the stem’s governing point: Evaluate MACsec coverage link by link; intermediate protection does not automatically secure adjacent unprotected Ethernet segments.

Answer F is correct because link-layer protection does not magically extend to unconfigured adjacent links.

Incorrect Answers

Answer A is incorrect because the endpoints and edge links are outside the stated protection.

Answer B is incorrect because forwarding does not extend link cryptography. It does not satisfy the stem’s governing point: Evaluate MACsec coverage link by link; intermediate protection does not automatically secure adjacent unprotected Ethernet segments.

Answer D is incorrect because identity tagging and link encryption can be separate mechanisms.

Answer E is incorrect because decryption requires participation in the relevant protection context.

 

Question 25

A MACsec-protected switch interconnect carries traffic from many applications. Which risk remains outside the direct purpose of MACsec on that link?

1. Passive observation of plaintext Ethernet frames on that protected wire.
2. Loss of confidentiality from simply tapping the protected link.
3. Peer authentication/key agreement for the protected relationship.
4. Unauthorized modification of protected frames in transit on that hop.
5. A malicious but authorized endpoint sending an application-layer exploit through the encrypted link.

Correct Answer: E

 

Correct Answer

Answer E is correct because link confidentiality/integrity does not determine whether the protected payload itself is benign.

Incorrect Answers

Answer A is incorrect because preventing that exposure is a direct MACsec purpose when correctly configured.

Answer B is incorrect because confidentiality protection addresses this risk. It does not satisfy the stem’s governing point: Link encryption protects frames in transit, but it does not determine whether an authorized endpoint is sending malicious application content.

Answer C is incorrect because that is part of establishing link security, not an application-content control.

Answer D is incorrect because integrity protection addresses in-transit tampering on the secured link.

 

Question 26

EDR confirms a laptop is compromised and isolates it. The user identity is also known to the network. Which TWO actions best combine host containment with network enforcement while the incident is investigated? Choose TWO.

1. Increase link speed to the laptop.
2. Remove authentication so the host cannot be identified.
3. Keep the endpoint isolation/containment in place according to the response workflow.
4. Apply/restrict the user or device network security-group/firewall policy so the identity cannot reach sensitive segments.
5. Disable every security log.
6. Turn off all firewalls because EDR is already active.

Correct Answers: C, D

 

Correct Answers

Answer C is correct because this limits host communications at the endpoint boundary.

Answer D is correct because network enforcement supplies an independent containment boundary. This directly matches the stem’s governing point: A serious incident can use complementary endpoint containment and identity/network enforcement rather than relying on one boundary.

Incorrect Answers

Answer A is incorrect because capacity does not contain the incident. It does not satisfy the stem’s governing point: A serious incident can use complementary endpoint containment and identity/network enforcement rather than relying on one boundary.

Answer B is incorrect because losing identity weakens policy and investigation. It does not satisfy the stem’s governing point: A serious incident can use complementary endpoint containment and identity/network enforcement rather than relying on one boundary.

Answer E is incorrect because that removes evidence. It does not satisfy the stem’s governing point: A serious incident can use complementary endpoint containment and identity/network enforcement rather than relying on one boundary.

Answer F is incorrect because layered controls should not be removed during compromise.

 

Question 27

A university wants students to keep the same access permissions as they roam among campus buildings and subnets. The decisive requirement is role-based segmentation independent of IP address, not link encryption. Which technology is the better architectural fit?

1. NAT overload.
2. TrustSec security-group classification and group-based policy enforcement.
3. An IPS signature for every student.
4. MACsec alone.
5. A single static ACL tied to one student subnet.

Correct Answer: B

 

Correct Answer

Answer B is correct because SGT-based policy is intended to decouple role identity from changing network location/address.

Incorrect Answers

Answer A is incorrect because address translation does not express role permissions. It does not satisfy the stem’s governing point: Choose TrustSec when the decisive problem is identity-based segmentation that should persist across changing addresses/locations.

Answer C is incorrect because threat signatures are not an identity-segmentation model. It does not satisfy the stem’s governing point: Choose TrustSec when the decisive problem is identity-based segmentation that should persist across changing addresses/locations.

Answer D is incorrect because MACsec protects links but does not define student-versus-staff authorization policy.

Answer E is incorrect because that conflicts with mobility and address independence. It does not satisfy the stem’s governing point: Choose TrustSec when the decisive problem is identity-based segmentation that should persist across changing addresses/locations.

 

Question 28

Two switches connect through a physically exposed Ethernet run in a shared utility space. Existing role-based segmentation is correct, but the security requirement newly calls for confidentiality against tapping on that one link. Which control addresses the new requirement?

1. Disable the firewall.
2. Move users between VLANs every hour.
3. Add a syslog server only.
4. Enable an appropriate MACsec design on the exposed Ethernet link.
5. Create more SGT values.

Correct Answer: D

 

Correct Answer

Answer D is correct because the decisive gap is local link confidentiality/integrity, which MACsec addresses.

Incorrect Answers

Answer A is incorrect because removing inspection does not protect the wire. It does not satisfy the stem’s governing point: Choose MACsec when the decisive security gap is exposure of a specific Ethernet link, while keeping authorization controls separate.

Answer B is incorrect because VLAN changes do not provide cryptographic confidentiality. It does not satisfy the stem’s governing point: Choose MACsec when the decisive security gap is exposure of a specific Ethernet link, while keeping authorization controls separate.

Answer C is incorrect because logging can show events but does not encrypt traffic.

Answer E is incorrect because additional role labels do not encrypt the physical link.

 

Question 29

Two application tiers are allowed to communicate. TrustSec permits the source group to the destination group, but policy still requires malware/exploit inspection of the permitted sessions. What should the design retain?

1. Only static routes.
2. Only endpoint naming conventions.
3. Only the SGT because permitted traffic is automatically safe.
4. Only MACsec because encryption detects exploits.
5. A firewall/IPS inspection boundary for the permitted inter-tier traffic in addition to the group authorization.

Correct Answer: E

 

Correct Answer

Answer E is correct because segmentation decides who may communicate; inspection evaluates the allowed traffic for threats.

Incorrect Answers

Answer A is incorrect because reachability is not threat inspection. It does not satisfy the stem’s governing point: Authorization/segmentation and threat inspection solve different problems; permitted flows may still need stateful/IPS inspection.

Answer B is incorrect because names do not enforce or inspect traffic. It does not satisfy the stem’s governing point: Authorization/segmentation and threat inspection solve different problems; permitted flows may still need stateful/IPS inspection.

Answer C is incorrect because authorization does not guarantee benign content. It does not satisfy the stem’s governing point: Authorization/segmentation and threat inspection solve different problems; permitted flows may still need stateful/IPS inspection.

Answer D is incorrect because link encryption does not classify malicious application payloads.

 

Question 30

A branch encrypts every WAN packet end-to-end with IPsec and uses MACsec on the local uplinks. A compromised administrator account is still able to authenticate to an internal application and exfiltrate permitted data. Which security gap remains?

1. A faster WAN circuit would block exfiltration.
2. Disabling logs would hide the security gap.
3. Encryption protects data in transit but does not by itself prevent misuse by an authenticated/authorized-but-compromised identity; identity, least-privilege, endpoint and application controls are still required.
4. The packets were not encrypted enough because two encryption layers always prevent account compromise.
5. TrustSec tagging would decrypt the IPsec traffic.

Correct Answer: C

 

Correct Answer

Answer C is correct because confidentiality of transport does not establish that the communicating principal is trustworthy or acting legitimately.

Incorrect Answers

Answer A is incorrect because bandwidth does not correct identity misuse. It does not satisfy the stem’s governing point: Encrypted transport can coexist with compromised identities or malicious endpoints; confidentiality is only one security property.

Answer B is incorrect because removing evidence worsens detection and accountability. It does not satisfy the stem’s governing point: Encrypted transport can coexist with compromised identities or malicious endpoints; confidentiality is only one security property.

Answer D is incorrect because more transport encryption does not remediate stolen credentials or excessive authorization.

Answer E is incorrect because identity tagging is unrelated to tunnel decryption. It does not satisfy the stem’s governing point: Encrypted transport can coexist with compromised identities or malicious endpoints; confidentiality is only one security property.