Cisco CCNP 350-701 SCOR Practice Questions with Explanations

Correct answer: A

Southbound APIs in SDN architecture enable communication between the SDN controller and network elements (switches, routers, and other forwarding devices). These APIs allow the controller to program and manage the data plane devices. The management console communicates with the controller via northbound APIs, not southbound APIs, making option B incorrect.

Why the other options are wrong:

• B. Management console uses northbound APIs, not southbound APIs, to communicate with the controller.
• C. This describes management console to cloud communication, which does not involve southbound APIs.
• D. SDN controller to cloud communication does not define the purpose of southbound APIs.

Correct answer: D

Northbound APIs enable communication between the SDN controller and management solutions or applications above it. These APIs allow upper-layer management systems and applications to interact with and control the SDN controller. This is the primary purpose of northbound APIs in the SDN stack.

Why the other options are wrong:

• A. Controller to cloud communication is not the primary function of northbound APIs.
• B. This describes the relationship between management console and controller, but the controller is the one exposing northbound APIs, making this phrasing imprecise.
• C. Management console to cloud communication is separate from northbound API functions.

Correct answer: C

Intent-based APIs are a core feature of Cisco DNA Center's open platform capabilities. These APIs allow external systems and applications to programmatically interact with DNA Center using intent-based networking concepts rather than device-level configuration. This enables integration with third-party tools and custom automation.

Why the other options are wrong:

• A. Application adapters are not a standard open platform capability feature of DNA Center.
• B. Domain integration is not the primary feature of DNA Center's open platform capabilities.
• D. Automation adapters are not the correct terminology for DNA Center's open platform features.

Correct answer: D

The code demonstrates an API call to a Cisco AMP endpoint that retrieves computer data, then iterates through the response to extract and display network interface information (MAC addresses, IPv4 addresses, and IPv6 addresses) for each computer. The nested loops access computer['network_addresses'] and then retrieve specific network interface properties like 'mac', 'ip', and 'ipv6', which are then printed. This clearly shows the API is gathering network interface information about the computers that AMP sees.

Why the other options are wrong:

• A. The code uses HTTP GET requests with basic authentication, not SNMP, which is a different protocol used for network management.
• B. The code specifically extracts network interface details (MAC, IP, IPv6) rather than general telemetry information, and does not gather process or performance metrics.
• C. The code accesses network_addresses and interface properties, not process information or PIDs; the API response structure shown contains network data, not process-level details.

Correct answer: B

Botnets are used to launch Distributed Denial of Service (DDoS) attacks. A botnet consists of compromised computers that can be coordinated to send traffic toward a target simultaneously, creating a distributed attack. While botnets can be used in various ways, DDoS is the most characteristic attack leveraging botnet infrastructure.

Why the other options are wrong:

• A. TCP flood is a form of DoS attack but is not specifically leveraged by botnets as their primary attack vector.
• C. DOS (Denial of Service) is singular and refers to attacks from one source, whereas botnets inherently enable distributed attacks.
• D. Virus distribution is a use of botnets, but the primary attack function leveraging botnets is DDoS.

Correct answer: C

Cross-site scripting (XSS) attacks frequently use alternate encoding methods such as hexadecimal, Unicode, or HTML entity encoding to obfuscate malicious scripts and bypass input filters and security controls. Attackers use these encodings to hide the true nature of the injected code from both automated filters and human reviewers.

Why the other options are wrong:

• A. Smurf attacks use ICMP echo requests and do not typically employ alternate encoding techniques.
• B. DDoS attacks rely on traffic volume rather than encoding obfuscation techniques.
• D. Rootkit exploits focus on privilege escalation and system access, not encoding-based evasion.

Correct answer: A

SQL injection vulnerabilities exist when web applications fail to properly validate and sanitize user input before using it in SQL queries. Attackers exploit this lack of input validation by injecting malicious SQL code through input fields, allowing them to manipulate database queries and access unauthorized data.

Why the other options are wrong:

• B. Operating systems are not the flaw exploited in SQL injection attacks.
• C. While the database is affected by SQL injection, the vulnerability stems from improper input validation in the application layer, not from a flaw in the database itself.
• D. Web page images are not related to SQL injection vulnerabilities.

Correct answer: B

Spear phishing is distinguished by targeting a specific individual or small group of people with personalized attacks, whereas deceptive phishing is a broad campaign sent to large groups of recipients. Spear phishing involves reconnaissance to make the attack more convincing to the target, making it more dangerous and targeted than generic deceptive phishing.

Why the other options are wrong:

• A. Spear phishing targets specific individuals but is not limited to C-level roles; it can target any employee with valuable access or information.
• C. This describes spear phishing focused on executives but incorrectly limits the definition; spear phishing can target any specific individual.
• D. This describes DNS hijacking, which is a different attack type entirely, not a characteristic of deceptive phishing.

Correct answer: D

Buffer overflow attacks are the attack type most commonly associated with C and C++ programming languages. These languages lack built-in bounds checking on memory operations, allowing attackers to write data beyond allocated buffer boundaries, overwriting adjacent memory and potentially executing arbitrary code. This vulnerability is fundamental to the memory management model of C and C++.

Why the other options are wrong:

• A. Cross-site scripting (XSS) is a web application vulnerability, primarily affecting JavaScript and interpreted web languages.
• B. Water holing attacks target websites frequented by specific user groups; they are not language-specific.
• C. DDoS attacks are network-based attacks independent of programming language.

Correct answer: B

DNS tunneling exfiltrates data by encoding the payload with random characters, breaking it into short DNS query strings, and sending these queries through the DNS server to an attacker-controlled DNS server. The attacker's DNS server receives these fragments and reassembles them to reconstruct the exfiltrated data. This technique abuses the DNS protocol's legitimate function to covertly tunnel data out of networks that allow DNS queries.

Why the other options are wrong:

• A. Recursive lookup spreading describes DNS amplification DDoS attacks, not data exfiltration.
• C. Redirecting DNS to steal credentials describes DNS hijacking or poisoning, not DNS tunneling for exfiltration.
• D. Corrupting DNS servers with rogue IP addresses describes DNS poisoning attacks, not the DNS tunneling exfiltration method.

Correct answer: C

Phishing is a social engineering attack that manipulates users into divulging sensitive information or performing harmful actions by deceiving them through fraudulent emails, websites, or communications. It exploits human psychology and trust rather than technical vulnerabilities, making it the correct classification among the given options.

Why the other options are wrong:

• A. Trojan is malware that deceives users into installing it, but it is classified as malware, not social engineering per se.
• B. Man-in-the-middle (MITM) is a network-based attack intercepting communications, not a social engineering technique.
• D. Malware is a broad category of malicious software; while phishing can deliver malware, phishing itself is specifically a social engineering attack.

Correct answer: A

A man-in-the-middle (MITM) attack is defined by an attacker positioning themselves between two communicating hosts to intercept, eavesdrop on, or manipulate the communication. This is the textbook definition of the attack type described in the question.

Why the other options are wrong:

• B. LDAP injection is an attack that exploits LDAP query syntax, not an attack involving positioning between two hosts.
• C. Insecure API refers to vulnerabilities in API endpoints, not an attack requiring the attacker to be positioned between communicating parties.
• D. Cross-site scripting (XSS) is a code injection attack that exploits web applications, not an attack involving interception between two hosts.

Correct answer: B

Cisco Advanced Phishing Protection leverages machine learning algorithms and real-time behavior analytics to detect and prevent phishing attacks. This approach analyzes email patterns, user behavior, and content characteristics to identify suspicious phishing attempts before they reach users, making it more effective than static rule-based methods.

Why the other options are wrong:

• A. While sensors are part of security infrastructure, Cisco APP's primary protection mechanism is not about secure message transmission but threat detection.
• C. DKIM is an email authentication protocol for validating sender identity, but it is not the primary mechanism used by Cisco Advanced Phishing Protection.
• D. Determining perceived identities is not the core function of Cisco APP; the focus is on detecting phishing behavior and malicious emails.

Correct answer: A

DNS tunneling exfiltrates data by encoding information within DNS queries and responses. An attacker registers a domain and configures it so that when a compromised client makes DNS queries to resolve subdomains of that attacker-controlled domain, the encoded data travels through DNS traffic, which typically bypasses firewalls. This technique exploits the fact that DNS is usually allowed through network perimeters.

Why the other options are wrong:

• B. A reverse DNS shell is not how DNS tunneling works; DNS tunneling uses DNS queries themselves as the exfiltration channel, not shell access.
• C. Hidden DNS resolvers in emails is not a DNS tunneling technique; DNS tunneling involves encoding data in DNS queries to an attacker-controlled domain.
• D. Using non-standard DNS ports for server access is not DNS tunneling; tunneling specifically encodes data within DNS protocol traffic to exfiltrate information.

Correct answer: A

The question explicitly states that the system has unencrypted VPN links. Unencrypted network traffic means that passwords and other sensitive data transmitted over those links are visible in clear text to anyone who can intercept the traffic. This vulnerability directly allows an attacker to see passwords being transmitted without encryption.

Why the other options are wrong:

• B. While weak passwords are a vulnerability, they don't directly allow an attacker to see passwords in clear text during transmission; this is about password policy, not traffic visibility.
• C. Improper file security relates to access controls on files and systems, not to seeing passwords transmitted over the network.
• D. Software bugs on applications may create various security issues but do not specifically enable viewing passwords in clear text during transmission.

Correct answer: A

A SYN flood attack involves an attacker sending a large number of SYN (synchronization) packets to a target device from multiple spoofed source addresses. The device receives too many connection requests and attempts to process them all, exhausting its resources. This matches the scenario of a device receiving too many connection requests from multiple machines.

Why the other options are wrong:

• B. Slowloris is an attack that sends slow, incomplete HTTP requests to exhaust server resources; it doesn't involve multiple machines sending many connection requests simultaneously.
• C. Phishing is a social engineering attack using deceptive emails or messages, not a network-based attack causing excessive connection requests.
• D. Pharming redirects users to fraudulent websites through DNS poisoning or host file manipulation; it doesn't involve multiple machines sending connection requests to a target.

Correct answer: D

A virus is malicious software designed to gain unauthorized access to a computer system, replicate itself, and potentially cause harm. Viruses are programs that require human action to spread and can compromise system security and user data. This matches the definition of software being used to gain unauthorized access.

Why the other options are wrong:

• A. Ping of death is a network-based denial-of-service attack using malformed ping packets, not software designed to gain unauthorized system access.
• B. HTTP flood is a volume-based DDoS attack that overwhelms servers with HTTP requests, not malware for unauthorized system access.
• C. NTP amplification is a DDoS attack technique using Network Time Protocol, not malware for gaining unauthorized access to systems.

Correct answer: A

AES-GCM (Galois/Counter Mode) is an authenticated encryption algorithm that provides both encryption and authentication for data plane communication in a single operation. It combines the AES cipher in counter mode with the Galois Message Authentication Code (GMAC) to ensure confidentiality and authenticity simultaneously.

Why the other options are wrong:

• B. SHA-96 is a hash algorithm that provides authentication only, not encryption.
• C. AES-256 provides encryption only without built-in authentication; authentication must be handled separately.
• D. SHA-384 is a hash algorithm that provides authentication only, not encryption.

Correct answer: A

STIX (Structured Threat Information eXpression) is a standardized language and serialization format designed specifically for expressing and exchanging cyber threat intelligence. It is the primary format transported over the TAXII protocol to enable structured sharing of threat indicators and intelligence between organizations.

Why the other options are wrong:

• B. XMPP is an instant messaging protocol, not a threat intelligence format.
• C. pxGrid is a Cisco endpoint visibility protocol, not a threat intelligence format.
• D. SMTP is an email transmission protocol, not a threat intelligence format.

Correct answer: C

FlexVPN is a standards-based VPN technology that supports multivendor environments and can securely interconnect multiple sites. It is built on standard protocols like IPsec and IKEv2, making it interoperable across different vendor equipment while maintaining site-to- site secure connectivity.

Why the other options are wrong:

• A. SSL VPN is primarily designed for remote user access, not site-to-site multivendor connectivity.
• B. GET VPN is a Cisco proprietary technology and does not support multivendor environments.
• D. DMVPN is primarily a Cisco technology and requires hub-and-spoke architecture; it is not ideal for true multivendor environments.

Correct answer: D

GET VPN (Group Encrypted Transport) is specifically designed to provide any-to-any scalable secure connectivity among company branches over a private IP cloud. It enables multipoint-to-multipoint communication without the need for a centralized hub, making it ideal for implementing secure VPN connectivity with full mesh scalability among branch offices.

Why the other options are wrong:

• A. DMVPN requires a hub-and-spoke architecture and is not optimized for true any-to- any scalable connectivity.
• B. FlexVPN is multivendor-focused and does not provide the same any-to-any optimization as GET VPN.
• C. IPsec DVTI (Dynamic Virtual Tunnel Interface) is a tunnel configuration method but does not provide the integrated any-to-any scalability that GET VPN offers.

Correct answer: C

Both DMVPN and FlexVPN use NHRP (Next Hop Resolution Protocol) for hub-and-spoke communication and dynamic spoke discovery. The NHRP code implementation in IOS routers is shared between these two VPN technologies, making this a key commonality between them.

Why the other options are wrong:

• A. While both can use IKEv2, DMVPN traditionally uses IKEv1 and does not require IKEv2 as a commonality.
• B. DMVPN and FlexVPN do not use IS-IS routing protocol; they use standard IP routing and NHRP for discovery.
• D. Both technologies can support various hashing algorithms, but they do not exclusively use the same ones as a defining commonality.

Correct answer: A

DTLS (Datagram TLS) provides superior throughput performance compared to TLS variants when using Cisco AnyConnect VPN. DTLS operates over UDP, which has lower overhead than TCP used by TLS, resulting in better throughput performance for VPN connections.

Why the other options are wrong:

• B. TLSv1 operates over TCP, which has higher overhead than DTLS and lower throughput performance.
• C. TLSv1.1 operates over TCP with higher overhead than DTLS, providing lower throughput performance.
• D. TLSv1.2, while more secure, still operates over TCP and provides lower throughput than DTLS.

Correct answer: A

Cisco Talos is the group responsible for publishing weekly threat intelligence newsletters to keep cybersecurity professionals informed about current and prevalent threats. Talos is Cisco's threat intelligence and research organization.

Why the other options are wrong:

• B. PSIRT (Product Security Incident Response Team) handles security vulnerabilities but does not publish weekly newsletters.
• C. SCIRT is not a recognized Cisco security group or newsletter publisher.
• D. DEVNET is Cisco's developer network community and does not focus on cybersecurity threat intelligence newsletters.

Correct answer: B

CVE (Common Vulnerabilities and Exposures) is the standard naming convention used by Cisco and other industry organizations to publish and categorize known security vulnerabilities and exposures. The CVE system provides a unique identifier for each vulnerability.

Why the other options are wrong:

• A. This is not the correct name of the vulnerability disclosure standard; 'Threats' is not part of the official acronym.
• C. This is not the official vulnerability disclosure standard used by the industry.
• D. This is not the correct name of the vulnerability disclosure standard used by Cisco and industry organizations.

Correct answer: C

APIs (Application Programming Interfaces) provide the ability to program and monitor networks from external systems and locations other than the DNA Center GUI. APIs enable programmatic access to DNA Center functionality and data for automation and integration.

Why the other options are wrong:

• A. ASDM is the Adaptive Security Device Manager for ASA devices, not for DNA Center programming.
• B. NetFlow is a traffic monitoring protocol and does not provide programming capabilities for DNA Center.
• D. A desktop client would still interface through DNA Center's core functions, not provide external programming capability like APIs do.

Correct answer: A

3DES (Triple Data Encryption Standard) is a symmetric encryption algorithm that encrypts data by applying the DES algorithm three times. Its primary cryptographic function is to encrypt traffic and data, making it a block cipher used for confidentiality.

Why the other options are wrong:

• B. 3DES does not create one-time use passwords; this is a function of OTP generators or similar mechanisms.
• C. 3DES is an encryption cipher, not a hashing algorithm; hashing is performed by algorithms like MD5 or SHA.
• D. 3DES does not generate private keys; key generation is a separate cryptographic process.

Correct answer: D

The profile enrollment method in PKI allows users to separate authentication and enrollment actions, providing flexibility in the enrollment process. It also supports specifying HTTP/TFTP commands for file retrieval from the server, enabling dynamic certificate and configuration distribution to endpoints.

Why the other options are wrong:

• A. Terminal enrollment is a manual, interactive method that does not separate authentication and enrollment or support automated file retrieval commands.
• B. Self-signed certificates are generated locally without PKI infrastructure involvement and do not involve server-based enrollment.
• C. URL-based enrollment typically involves direct web-based enrollment without the separation of authentication and enrollment phases that profile enrollment provides.

Correct answer: D

The northbound API in SDN architecture connects applications and security services to the controller. When a security application notifies the controller about a threat, this communication flows northbound from the application layer upward to the control plane.

Why the other options are wrong:

• A. Southbound APIs communicate between the controller and network devices, not from security applications to controllers.
• B. Westbound APIs are used for east-west communication between controllers in a multi-controller SDN deployment, not for application-to-controller notifications.
• C. Eastbound APIs are used for controller-to-controller communication in distributed SDN architectures, not for security application notifications.

Correct answer: D

Inserting malicious commands into the database exploits SQL injection vulnerabilities, which directly targets Machine 1's weakness. This attack method would not affect Machine 2, which is vulnerable to buffer overflows rather than SQL injection, as buffer overflow exploits target memory management rather than database input validation.

Why the other options are wrong:

• A. Packet sniffing captures network traffic but does not exploit either SQL injection or buffer overflow vulnerabilities.
• B. Continuous pings test connectivity and may cause denial of service but do not exploit SQL injection or buffer overflow vulnerabilities.
• C. Overflowing the buffer's memory exploits Machine 2's vulnerability, not Machine 1's SQL injection weakness.

Correct answer: C

Southbound API protocols enable the SDN controller to make dynamic changes to the data plane devices. This is their primary function-allowing the controller to push configuration changes and policies to network devices like routers and switches in real time.

Why the other options are wrong:

• A. Southbound APIs enable dynamic, not static, configuration of network devices.
• B. REST is a northbound API protocol used for application-to-controller communication, not a primary function of southbound protocols.
• D. While southbound APIs do configure the data plane, not the control plane, the correct answer focuses on the controller's ability to make changes.

Correct answer: B

Cross-site Scripting (XSS) injects malicious code that executes on the client side in the victim's browser, while SQL Injection injects commands that execute server-side in the database. This distinction in execution location is the fundamental difference between these two attacks.

Why the other options are wrong:

• A. This incorrectly characterizes XSS as targeting executives and conflates attack scope with attack mechanism.
• C. XSS is not a brute force attack, and SQL Injection is not a social engineering attack; both are code injection vulnerabilities.
• D. This reverses the actual mechanisms-SQL Injection targets the database, not the browser, and XSS targets the browser, not the database.

Correct answer: D

Cisco DNA Center provides a centralized management dashboard that offers complete control of the network from a single pane of glass. This centralized approach simplifies network management, visibility, and policy enforcement across the entire organization.

Why the other options are wrong:

• A. Distributed management implies multiple management points, which contradicts DNA Center's centralized architecture.
• B. Service management refers to managing specific services, not the complete network control provided by DNA Center.
• C. Application management is a subset of network management and does not capture DNA Center's comprehensive network control capabilities.

Correct answer: A

The script makes a GET request to the /v1/computers endpoint of the Cisco AMP API with Basic authentication. This specific endpoint is designed to retrieve a list of computers that are managed by Cisco AMP, along with their associated metadata including policies and connector statuses. The endpoint does not provide vulnerability details, malware information, or compromise data-it simply returns the inventory of computers and their management status.

Why the other options are wrong:

• B. The /v1/computers endpoint does not return vulnerability information; that would require a different API endpoint focused on vulnerability data.
• C. Malware trajectory data is not provided by the basic /v1/computers endpoint; this would require endpoints specifically designed for threat intelligence.
• D. While the endpoint may indicate connector status, it does not provide detailed compromise information or malware identification; that requires threat-specific API endpoints.

Correct answer: C

The script makes a GET request to the Cisco AMP API endpoint for computers, converts the response to JSON, then iterates through each computer object in the 'data' array. For each computer in the loop, it extracts the 'hostname' field and prints it. This process repeats for all computers returned by the API, so the script will pull and print all computer hostnames from the response.

Why the other options are wrong:

• A. The script iterates through all computers in the response_json['data'] array, not just the client in the client ID field.
• B. The script simply extracts and prints the hostname string value; it performs no DNS resolution or IP translation.
• D. The script extracts the 'hostname' field directly from the JSON response; it does not perform any reverse DNS lookups or IP-to-FQDN translation.

Correct answer: D

Southbound APIs in SDN communicate between the controller and network infrastructure devices such as routers and switches. These protocols enable the controller to configure and manage the data plane devices that forward network traffic.

Why the other options are wrong:

• A. Applications communicate with controllers via northbound APIs, not southbound APIs.
• B. Controllers communicate with other controllers via eastbound/westbound APIs, not southbound APIs.
• C. Appliances are managed through northbound APIs or management interfaces, not southbound SDN APIs which focus on networking devices.

Correct answer: D

Simple Certificate Enrollment Protocol (SCEP) is specifically designed to automate certificate deployment and configuration on mobile devices and endpoints. It enables supplicants to request and receive certificates along with network configuration, allowing secure network access on mobile devices.

Why the other options are wrong:

• A. BYOD onboarding is a broader process that may incorporate certificate enrollment but is not the specific method for certificate deployment and supplicant configuration.
• B. MAC authentication bypass is a network access control method that does not involve certificate deployment or supplicant provisioning.
• C. Client provisioning is a general term that may involve multiple methods; SCEP is the specific protocol designed for automated certificate and configuration delivery.

Correct answer: C

To ensure a custom file detection policy functions correctly, the file hash must be uploaded into the policy. File hashing allows the security system to identify the specific malicious file by its cryptographic signature, enabling consistent detection regardless of the file's location or the application attempting to execute it. This is the standard method for implementing file-based indicators of compromise in endpoint protection policies.

Why the other options are wrong:

• A. Blocking the download source does not help detect the file if it already exists on endpoints or arrives through other means.
• B. Blocking the application is too broad and doesn't specifically address file detection; multiple applications may try to execute the file.
• D. Sending the file to Cisco Threat Grid provides analysis but does not directly update or fix the detection policy on endpoints.

Correct answer: A

The script establishes an HTTPS connection to a Cisco ISE server (10.10.10.240:9060), constructs Basic Authentication credentials using the username 'ersad' and a password, encodes them in base64, and sends a GET request to the /ers/config/internaluser/ endpoint with the Authorization header containing the encoded credentials. This accomplishes authentication to Cisco ISE using the specified username.

Why the other options are wrong:

• B. The script does not list LDAP users; it sends a request to an internal user endpoint but returns whatever response is received without parsing user data from an external identity store.
• C. The script uses HTTPS (HTTP over SSL/TLS), not SSH; the connection is established on port 9060 with http.client.HTTPSConnection, which is HTTP-based, not SSH.
• D. The script explicitly uses ssl.PROTOCOL_TLSv1_2, which is TLSv1.2, not TLSv1; additionally, allowing authentication with an older protocol version is a security concern, not the script's primary purpose.

Correct answer: D

GETVPN is specifically designed to provide encryption over MPLS networks without requiring a central hub (hub-and-spoke model), which reduces latency and simplifies architecture for service provider environments. Unlike IPsec which requires point-to-point tunnels, GETVPN uses a group-based approach where key servers distribute encryption keys to group members, eliminating the need for a central hub for traffic forwarding while maintaining full encryption.

Why the other options are wrong:

• A. While GETVPN simplifies multi-site deployments, both GETVPN and IPsec can be configured without static device configurations using dynamic discovery mechanisms.
• B. GETVPN is not inherently based on IKEv2 and actually uses a different key management protocol (GDOI) distinct from IPsec's IKE.
• C. Key management and security association management are features of both GETVPN and IPsec, not a distinguishing difference between them.

Correct answer: D

RSA is the primary asymmetric encryption algorithm that uses a public-private key pair, where data encrypted with a public key can only be decrypted with the corresponding private key. This fundamental characteristic of asymmetric cryptography enables secure key exchange and digital signatures. The other options (3DES, RC4, and AES) are all symmetric algorithms that use the same key for both encryption and decryption.

Why the other options are wrong:

• A. 3DES is a symmetric encryption algorithm that uses the same key for encryption and decryption.
• B. RC4 is a symmetric stream cipher that uses the same key for both encryption and decryption.
• C. AES is a symmetric block cipher that uses the same key for both encryption and decryption.

Correct answer: A

SQL injection attacks specifically target SQL databases by exploiting input validation flaws to execute malicious SQL commands, making them database-specific threats. XSS (Cross-Site Scripting) attacks can occur in any web application or system that renders user-supplied input, as they exploit inadequate output encoding to inject malicious scripts that execute in users' browsers. This key difference is that SQL injection is database- focused while XSS is application-agnostic.

Why the other options are wrong:

• B. This reverses the actual purposes: SQL injection targets databases to steal data, while XSS targets users to steal credentials or session data, not redirect for physical theft.
• C. This incorrectly labels XSS as database-specific when it actually affects web applications broadly.
• D. This reverses the actual attack vectors and purposes of both attack types.

Correct answer: D

A Denial of Service (DoS) attack originates from a single computer that floods a server with packets (TCP, UDP, or both) to overwhelm its resources. A Distributed Denial of Service (DDoS) attack coordinates multiple compromised systems to simultaneously launch DoS attacks against a single target, overwhelming it through distributed traffic. The critical distinction is the number of attack sources: one for DoS versus many for DDoS.

Why the other options are wrong:

• A. DoS attacks are not limited to TCP packets; they can use TCP, UDP, or both types of packets.
• B. This incorrectly specifies packet types to attack methods; both DoS and DDoS can use either TCP or UDP packets.
• C. While DoS uses TCP and UDP packets correctly, the DDoS description is incorrect; DDoS targets a single system with coordinated attacks, not multiple servers on a LAN.

Correct answer: A

A vulnerability is a weakness, flaw, or gap in security controls that exists in systems, software, or networks. An exploit is the means by which an attacker takes advantage of a vulnerability to compromise a system. The relationship is direct: vulnerabilities are the target weaknesses, and exploits are the tools or techniques used to leverage those weaknesses. This fundamental distinction is critical to security understanding.

Why the other options are wrong:

• B. A vulnerability is not hypothetical; it is a real, identifiable weakness that currently exists in a system.
• C. An exploit is not hypothetical and does not cause vulnerabilities; instead, it is a technique that takes advantage of existing vulnerabilities.
• D. An exploit is not a weakness itself; it is a method or code that exploits weaknesses.

Correct answer: A

Threat intelligence is defined as information about threats and threat actors that helps organizations mitigate harmful events and protect their networks and systems. This information enables proactive defense and informed security decisions.

Why the other options are wrong:

• B. Indicators of Compromise are artifacts observed on a network or system that suggest a breach, but they are a component of threat intelligence, not the overarching concept.
• C. Trusted Automated Exchange of Intelligence Information (TAXII) is a protocol for sharing threat intelligence, not the term for threat intelligence itself.
• D. The Exploit Database is a repository of known exploits, not a general term for threat intelligence.

Correct answer: B

The configuration 'crypto ikev2 name-mangler MANGLER' with 'dn organization-unit' specifies that the organizational unit (OU) attribute from the DN (distinguished name) of the peer's certificate should be extracted and used as the identity for IKEv2 authorization policy matching. This name mangler extracts the OU certificate attribute and applies it during the identity matching process for authorization policies, allowing the OU to serve as the peer identity rather than using the full DN or other certificate attributes.

Why the other options are wrong:

• A. The configuration does not restrict connections to only peers with OU set to MANGLER; rather, it uses whatever OU value exists in the peer certificate for identity matching.
• C. The configuration does not set or modify the peer certificate's OU to MANGLER; it only uses MANGLER as the name of the policy that extracts the OU attribute.
• D. The configuration does not encrypt the OU attribute; name mangling is a policy for extracting and using certificate attributes for identity purposes, not for encryption.

Correct answer: B

Intent-based APIs in Cisco DNA Center allow engineers to express business intent and automatically provision network services including SSIDs, QoS policies, and software updates on switches without needing to understand underlying device configurations.

Why the other options are wrong:

• A. Event APIs are used for receiving notifications about network events, not for provisioning network services.
• C. Integration APIs are used for connecting external systems to DNA Center, not for provisioning SSID and QoS policies.
• D. Multivendor APIs support non-Cisco devices, but the question specifically asks about DNA Center's primary provisioning capability.

Correct answer: C

FlexVPN supports IKEv2, which provides stringent security with multiple security associations and efficient establishment with minimal bandwidth overhead. DMVPN uses IKEv1 which lacks some of these advanced capabilities, making FlexVPN the superior choice for the stated requirements.

Why the other options are wrong:

• A. DMVPN does support multiple SAs, but FlexVPN also does, and the key differentiator is IKEv2 support which DMVPN lacks.
• B. DMVPN does not support IKEv2; it is limited to IKEv1.
• D. Both FlexVPN and DMVPN support multiple SAs, so this is not an accurate differentiator.

Correct answer: D

The exhibit displays authentication session information including Interface, MAC Address, Method (dot1x or mab), Domain, Status, and Fg Session ID. This output format is characteristic of the 'show authentication sessions' command, which displays detailed information about active authentication sessions on network interfaces, including which authentication methods (dot1x or mab) are being used for each session. The columns and data structure match exactly what this command produces on Cisco switches.

Why the other options are wrong:

• A. show authentication registrations displays registered authentication methods/profiles, not active session details with interface and MAC address information.
• B. show authentication method displays available authentication methods and their configuration, not active session data with interfaces and MAC addresses.
• C. show dot1x all displays only 802.1X protocol-specific information, not a comprehensive table showing both dot1x and mab methods with session IDs.

Correct answer: B

In the command 'snmp-server group SNMP v3 auth access 15', the number 15 refers to an access list number. Access lists in Cisco IOS are identified by numbers, and this particular access list (15) is used to define and filter which SNMP devices or hosts are permitted to access the router using SNMPv3 authentication. The syntax structure is: snmp-server group <group-name> <version> <security-model> access <access-list-number>.

Why the other options are wrong:

• A. Privilege levels are configured separately and are not represented by a single number in this SNMP group command syntax.
• C. SNMP authentication attempt intervals are configured with different commands like 'snmp-server engineID' or timeout parameters, not as part of the group access definition.
• D. Failed attempt lockout thresholds are not a feature of SNMPv3 configuration in standard Cisco IOS and would not be specified in a group access line.