100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 610
A SOC must detect meaningful repeated login failures and suspicious configuration changes with fewer false positives. Which security monitoring and alert-tuning activity supports that outcome?
- Use appropriately tuned monitoring and alerts
- Turn on all debug events permanently without severity or threshold filtering
- Disable logging on repeated authentication failures to reduce alert noise
- Allow only manually inspected local console logs with no centralized alerts
Explanation
Correct Answer
A:Monitoring creates visibility into suspicious events rather than relying only on prevention.
Incorrect Answers
B:Untuned high-volume debugging can overwhelm responders and increase false positives rather than highlight meaningful patterns.
C:Removing those records hides precisely the suspicious login activity that SOC needs to detect.
D:Exclusive manual checking is not the responsive tuned detection/alerting specified.
Question 611
Employees are repeatedly fooled by forged sign-in notices asking for their Microsoft 365 or VPN passwords. Which training topic directly targets credential-harvesting email and fake-login recognition?
- Train users to trust any sign-in page reached from a message bearing a familiar company logo
- Deliver phishing recognition and independent sign-in verification exercises
- Train users to forward suspicious messages to colleagues for informal voting before reporting
- Teach that a padlock icon alone guarantees the sender of a sign-in link is an approved employer
Explanation
Correct Answer
B:Phishing-focused training teaches recognizing forged senders, suspicious links, unexpected urgency, and verifying sign-in through known channels.
Incorrect Answers
A:Branding can be copied by attackers; visual familiarity alone is not proof that a credential request is legitimate.
C:Forwarding phishing content widely can amplify risky links and delays proper reporting through the approved security channel.
D:TLS secures a connection to a named endpoint but does not guarantee that endpoint is the legitimate employer service.
Question 612
A small branch wiring closet contains routers and switches but is accessible to visitors. Which controlled physical-access measure should limit who can enter and handle the equipment?
- Leave the network room open during office hours but add a stronger device password
- Use controlled locks or badge access and explicitly authorize room entry
- Enable syslog alerts without restricting visitor access to the equipment room
- Allow unsupervised visitors if every router has a protected configuration backup
Explanation
Correct Answer
B:Controlled physical entry restricts equipment access to authorized staff and provides a stronger boundary for a visitors-accessible wiring closet.
Incorrect Answers
A:Device credentials cannot stop a visitor physically handling, unplugging or stealing equipment in an unlocked closet.
C:Syslog can help detect a device event afterward, but it is not a physical access-control mechanism at the closet door.
D:A configuration backup aids recovery but cannot prevent unauthorized hardware access, tampering or theft.
Question 613
A data-center team must investigate who entered a restricted equipment room during a suspicious overnight event. Which access-recording and camera controls preserve useful physical evidence under policy?
- Record only the final network outage ticket but preserve no entrance event history
- Require password resets for router users without checking physical room entry
- Disable every physical access badge log once the affected room is secured
- Preserve authorized access logs and policy-compliant camera recordings for the incident window
Explanation
Correct Answer
D:Timestamped access events and retained camera recordings can correlate entry to the overnight event when collected and managed under policy.
Incorrect Answers
A:An outage ticket lacks the chronological physical entry evidence needed to reconstruct who accessed the restricted room overnight.
B:Credential rotation can be a separate incident response measure, but it does not identify people entering the equipment area.
C:Deleting logs destroys the historical badge and visitor trail that the investigation specifically requires.
Question 614
Employees leave unlocked laptops and escort visitors through secure office zones. Which staff procedures directly reduce unattended-screen and unsupervised-visitor exposure?
- Require automatic screen locks and authorized escort of visitors in restricted zones
- Instruct workers to hide Wi-Fi network names instead of locking their sessions
- Keep unlocked laptops near surveillance cameras and treat the camera as sufficient access control
- Issue visitor passes without requiring an employee escort in sensitive areas
Explanation
Correct Answer
A:Screen locking reduces opportunistic console or data access, while escort requirements reduce unauthorized visitor movement in restricted spaces.
Incorrect Answers
B:SSID visibility does not change whether a person can access a logged-in local workstation or follow an employee through a door.
C:Camera footage is detective evidence; it does not replace session locking or active supervision against immediate misuse.
D:Visitor identification is useful but without escort enforcement still permits unsupervised movement into sensitive work areas.
Question 615
A help-desk worker sees signs of a possible account compromise but does not know the reporting channel or escalation order. Which practice exercise prepares staff to notify the right incident responders?
- Ask staff to delay reporting until three similar suspected compromises are observed
- Teach staff to erase local evidence before contacting the security response team
- Run incident reporting and escalation drills with the approved notification path
- Treat an email to all employees as a substitute for the incident response escalation channel
Explanation
Correct Answer
C:Drills teach workers whom to contact, what evidence to preserve, and which escalation order applies when a compromise indicator appears.
Incorrect Answers
A:Waiting for additional incidents can increase exposure and conflicts with the requirement for timely escalation of suspected account compromise.
B:Deleting potential evidence can hinder incident analysis and should not precede the prescribed security reporting procedure.
D:A mass email may spread sensitive details and does not follow defined incident-response ownership or escalation procedures.
Question 616
New starters will receive sensitive credentials and badge access. Which initial security training should be completed before giving staff normal production access?
- Grant production credentials immediately and postpone security education until the next annual refresher
- Give only a badge orientation while omitting phishing and credential handling before access
- Skip initial training if the employee signs a non-disclosure agreement
- Complete onboarding security awareness before granting normal sensitive access
Explanation
Correct Answer
D:Onboarding security awareness prepares access holders for credential handling, social engineering, reporting procedures and physical security obligations.
Incorrect Answers
A:Delaying initial training leaves new access holders unprepared for phishing and credential handling risks during their first use of the environment.
B:Badge instruction addresses physical entry but omits credential requests, account security and escalation needed for initial privileged exposure.
C:An NDA is a legal confidentiality obligation, not practical training in authentication, reporting or safe behavior.
Question 617
An outdoor cabinet contains network gear and exposed physical ports. Which locks and tamper-resistant site protections reduce opportunistic physical access?
- Leave service ports exposed and rely exclusively on console login passwords for physical protection
- Use tamper-resistant locks, controlled cabinet access and protected exposed ports
- Rely on a remotely configured firewall ACL to prevent theft or physical port tampering
- Keep cabinet doors open for ventilation while disabling physical access records
Explanation
Correct Answer
B:Protective enclosures and controlled site entry reduce the opportunity for opportunistic tampering with outdoor network hardware.
Incorrect Answers
A:A console password helps authenticate administrative sessions but cannot physically protect cables, switch ports or removable equipment.
C:A Layer 3 traffic ACL cannot stop someone accessing or removing hardware and patching into its exposed physical ports.
D:Leaving equipment exposed undermines the requested tamper-resistance and prevents reliable physical access accountability.
Question 618
A facility uses one public entrance to a restricted server area and must stop tailgating. Which staffed or monitored access checkpoint controls physical entry?
- Rely only on posted signs asking visitors not to enter the restricted room
- Use an unlocked open doorway with downstream router security settings
- Send periodic awareness email reminders without controlling who crosses the door
- Use a staffed, monitored, controlled entry checkpoint to validate each person entering
Explanation
Correct Answer
D:An individually verified staffed or monitored access point can challenge unauthorized entry and reduce tailgating into the restricted area.
Incorrect Answers
A:Signs announce policy but cannot physically check an identity or stop someone following an authorized employee through an entry.
B:Network-device settings do not prevent unauthorized people from entering a room through an uncontrolled physical doorway.
C:Awareness emails reinforce expectations but do not provide the requested actively supervised anti-tailgating access control.
Question 619
An attacker impersonates IT support and asks a user to read out a one-time MFA code. Which awareness principle tells the employee to verify independently and never share authentication codes?
- Verify claimed IT support using a known independent channel and never disclose a one-time authentication code
- Read the code aloud if the caller already knows the employee’s name and department
- Share the one-time code but change the primary password after the support call
- Post the requested code into the official team chat to establish a record of the support request
Explanation
Correct Answer
A:An unsolicited request for a verification code can be an impersonation attack; users should independently verify the contact and refuse to disclose factors.
Incorrect Answers
B:Employee information is easily collected and does not prove the caller is authorized to receive authentication secrets.
C:Password changes do not undo the fact that a stolen live one-time code can enable immediate unauthorized sign-in.
D:Publishing an MFA code in chat exposes a usable authentication secret and is not a legitimate support verification method.
Question 620
A small branch stores spare routers and laptop backups in an open storeroom. Which physical anchoring and locked storage controls limit equipment theft or tampering?
- Store spare routers on open floor shelving and depend on MAC address filtering to prevent their removal
- Use a fire-resistant container with no lock and a publicly accessible key
- Keep spare equipment in locked storage and anchor or physically secure exposed devices
- Record serial numbers only, without any access or removal restrictions for open storeroom shelves
Explanation
Correct Answer
C:Locked controlled storage and appropriately secured physical mounting reduce opportunistic removal of equipment and sensitive backups.
Incorrect Answers
A:MAC filtering can limit some network attachment but cannot stop physical removal or tampering with devices in an unsecured storeroom.
B:Fire resistance protects against one hazard, but an unlocked cabinet and accessible key do not provide physical theft prevention.
D:Inventory records improve accountability after an event but are not a preventive substitute for lockable, controlled physical storage.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
