100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 600
A configuration archive contains sensitive credentials and the transfer network is not fully trusted. Which encrypted alternative avoids sending the payload via plaintext FTP or TFTP?
- Use plain FTP with a strong password but no encrypted transport
- Use a protected alternative such as SFTP or an approved encrypted channel
- Use TFTP only on the same public network
- Encrypt only the destination filename while transferring the file unencrypted
Explanation
Correct Answer
B:Conventional TFTP and FTP do not encrypt sensitive configuration contents.
Incorrect Answers
A:Traditional FTP sends payload data without confidentiality; a strong login password alone does not encrypt the archived file.
C:TFTP includes no intrinsic encryption/authentication and does not protect sensitive configuration content.
D:A hidden filename does not encrypt transferred configuration bytes or embedded secrets.
Question 601
A newly discovered unpatched remote-code-execution flaw exists in a router's management service. Before any attack is observed, what security term names the weakness itself rather than the method of exploiting it?
- A vulnerability
- An exploit, the attacker’s actual use of a bug to achieve unintended behavior
- A threat, a plausible source or actor capable of causing harm
- A security control, a preventative or detective countermeasure
Explanation
Correct Answer
A:A vulnerability is the exploitable weakness in software, hardware or configuration—for example, an unpatched remote-code-execution flaw. A threat is a potential cause of harm, while an exploit is the method used against the weakness.
Incorrect Answers
B:An exploit uses a weakness; the situation calls for the defect that exists before any attack.
C:A threat may take advantage of the weakness, but is not the underlying unpatched flaw.
D:A countermeasure reduces exposure; it is not the defect present in the service.
Question 602
An attacker sends a crafted packet sequence that deliberately triggers a known unpatched memory corruption flaw on an exposed service. Which security term describes this active use of the vulnerability?
- A vulnerability, the unpatched defect existing before any malicious use
- A security mitigation, a control that reduces attack exposure
- An exploit
- A threat, merely the capability or intent of an actor
Explanation
Correct Answer
C:An exploit is code or a technique that exercises a vulnerability to make a system behave outside its intended controls. The bug itself is the vulnerability; the exploit is the means of taking advantage of it.
Incorrect Answers
A:The attack actively triggers a known flaw; the exploit is the method/act, not the preexisting weakness alone.
B:A crafted malicious payload is an attack, whereas mitigation is defensive.
D:The question describes the concrete exploitation of the defect, not a hypothetical threat source.
Question 603
A hostile actor with the capability and intent to disrupt the network is identified in incident intelligence. Which term describes the possible source of harm, distinct from a specific software defect?
- The vulnerability in router management software
- A threat
- The security control protecting the management network
- The numerical risk score estimated for the service
Explanation
Correct Answer
B:A threat is a potential source or event of harm rather than the weakness itself.
Incorrect Answers
A:A vulnerability is a weakness of technology; it is not the malicious actor and capability described.
C:A control defends the network and is not the agent or condition capable of causing harm.
D:Risk is likelihood and impact of harm; the scenario asks for the harmful actor/source itself.
Question 604
A firewall blocks an exposed management service, and a patch closes the underlying bug. Which security term describes the protective action that reduces the likelihood or impact of exploitation?
- An exploit that triggers memory corruption to execute arbitrary code
- A mitigation
- A vulnerability introduced by the configuration change
- A threat actor with intent to compromise network management
Explanation
Correct Answer
B:A mitigation limits the probability or impact of a threat exploiting a weakness.
Incorrect Answers
A:An exploit is an offensive use of a weakness, not the patch/firewall action that protects the service.
C:The patch and exposure block reduce, rather than create, the specified vulnerable behavior.
D:An attacker is a threat source, not a remedial change that reduces exposure.
Question 605
A vulnerable network service is exposed to credible attackers and could cause financial loss if exploited. Which term combines potential likelihood and consequence rather than naming only the weakness?
- A vulnerability: the existence of the software bug alone
- An exploit: the crafted method for triggering a defect
- Security risk
- A threat: a possible hostile actor without considering consequences
Explanation
Correct Answer
C:Risk combines the chance of a harmful event with its consequences.
Incorrect Answers
A:A weakness alone does not combine likelihood of use and the resulting loss magnitude.
B:The method of attack is not the overall likelihood-and-impact assessment.
D:Threat describes a potential source of harm, while risk incorporates consequences and probability.
Question 606
A vendor has published an IOS XE security update for an exploitable management-plane vulnerability. Which proactive remediation directly addresses that known software flaw after change testing?
- Apply supported security patches promptly
- Only change the operator username but keep the vulnerable IOS XE release
- Disable syslog messages for the affected service
- Increase interface MTU to prevent malicious management packets
Explanation
Correct Answer
A:Patching removes or reduces known exploitable software weaknesses.
Incorrect Answers
B:Identity changes do not remove the known security flaw in the unpatched management process.
C:Suppressing logs masks evidence but does not fix or contain the exploitable vulnerability.
D:MTU changes are not a substitute for applying tested vendor patches for a known RCE flaw.
Question 607
A user account used for read-only NOC monitoring currently holds full configuration privileges. Which authorization design limits that account to the access necessary for its job?
- Keep full configuration privileges but change the monitoring account password monthly
- Give the monitoring account shared enable credentials for convenience
- Remove all authorization controls while leaving audit logs enabled
- Apply least-privilege authorization
Explanation
Correct Answer
D:Least privilege limits what a stolen or misused account can access.
Incorrect Answers
A:Password rotation does not change excessive authorization if the account is compromised or misused.
B:Shared privileged credentials enlarge access and undermine separate read-only identities.
C:Audit logs can record misuse but do not prevent a read-only operator from executing dangerous commands.
Question 608
A Cisco ISE administrator reports that their ISE admin-console password was exposed to an attacker. Cisco ISE still shows that administrator logged in through an active GUI session. Which response directly reduces continued use of that compromised identity?
- Keep the already-exposed password but add a longer security banner to the admin login page
- Terminate affected active ISE administrative sessions and reset or disable the compromised credentials under incident procedures
- Change a switch access VLAN number without touching the ISE administrative identity
- Increase the DHCP lease interval on the administrator workstation so fewer logins are required
Explanation
Correct Answer
B:ISE supports invalidation of active administrative sessions; containing the disclosed account and rotating the credential address both existing sessions and future reuse.
Incorrect Answers
A:A login banner informs users but neither invalidates the known secret nor removes an attacker-controlled active administration session.
C:Changing Ethernet VLAN membership is unrelated to control over the compromised identity and cannot revoke its existing administrative sessions.
D:DHCP address lease duration affects IP assignment, not validity of ISE administrator authentication credentials or active sessions.
Question 609
Guest clients should not reach management interfaces even though both networks pass through the same edge. Which combination of segmentation and packet policy restricts that path?
- Place guest and management IPs in the same permitted subnet and rely on device login prompts
- Require MFA only on management devices while leaving the guest-to-management path open
- Use a shared VLAN and DNS names to distinguish guest from admin clients
- Segment networks and apply firewall or ACL policy
Explanation
Correct Answer
D:Segmentation confines allowed traffic paths and reduces lateral movement.
Incorrect Answers
A:Co-location may permit unwanted management traffic and does not enforce the requested network-level restriction.
B:MFA strengthens login but does not fulfill the independent network segmentation and filtering objective.
C:Logical names do not block packet reachability; VLAN/VRF and ACL/firewall enforcement must isolate policy paths.
Question 610
A SOC must detect meaningful repeated login failures and suspicious configuration changes with fewer false positives. Which security monitoring and alert-tuning activity supports that outcome?
- Use appropriately tuned monitoring and alerts
- Turn on all debug events permanently without severity or threshold filtering
- Disable logging on repeated authentication failures to reduce alert noise
- Allow only manually inspected local console logs with no centralized alerts
Explanation
Correct Answer
A:Monitoring creates visibility into suspicious events rather than relying only on prevention.
Incorrect Answers
B:Untuned high-volume debugging can overwhelm responders and increase false positives rather than highlight meaningful patterns.
C:Removing those records hides precisely the suspicious login activity that SOC needs to detect.
D:Exclusive manual checking is not the responsive tuned detection/alerting specified.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
