CiscoProfessional level350-201Page 2 of 3

350-201 exam dumps: questions 101 to 200 of 288

Page 2 of the free 350-201 question bank for the Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies exam. Questions 101 to 200 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated February 2025

Start timed practice exam Questions 101 to 200

Free 350-201 practice questions

Questions 101 to 105 of 288

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

350-201 Question 101

Select 3

A financial institution wants to implement a data loss prevention (DLP) strategy to secure sensitive customer data such as personally identifiable information (PII) and financial records. Which mechanisms should be employed to detect and enforce DLP policies effectively?

A
Content-based inspection to identify sensitive data patterns such as Social Security Numbers or credit card numbers
B
Endpoint device monitoring to prevent unauthorized file transfers or printing of sensitive information
C
Network behavior analysis to identify anomalies in traffic unrelated to data exfiltration
D
Email filtering to block outgoing messages containing unencrypted sensitive data
E
File integrity monitoring to detect unauthorized changes to sensitive files

Show answer and explanation

Correct answers: A, B, D

Explanation

Data loss prevention (DLP) strategies rely on mechanisms that can detect sensitive data and enforce policies to prevent its unauthorized access or exfiltration. Content-based inspection, endpoint device monitoring, and email filtering are all critical for identifying and controlling the flow of sensitive data. While network behavior analysis and file integrity monitoring are useful in broader security strategies, they are not directly designed for DLP enforcement.

A. Correct.
Content-based inspection is a core mechanism in DLP strategies to detect patterns of sensitive data (e.g., PII, credit card numbers) as they traverse the network or are accessed on endpoints.
B. Correct.
Endpoint device monitoring is critical for enforcing DLP policies, as it prevents sensitive data from being transferred to unauthorized devices or printed.
C. Incorrect.
Network behavior analysis is more focused on detecting general traffic anomalies, such as unusual bandwidth usage, and is not directly used for DLP enforcement.
D. Correct.
Email filtering is an essential DLP technique to prevent sensitive information from being sent outside the organization without encryption or approval.
E. Incorrect.
File integrity monitoring is useful for detecting changes to files but does not enforce DLP policies or prevent data exfiltration.

350-201 Question 102

Select 4

A company is implementing a Data Loss Prevention (DLP) strategy to protect sensitive information transmitted via email and cloud storage. As a security engineer, you are tasked with configuring mechanisms to detect and enforce DLP policies. Which of the following mechanisms should you configure to ensure effective DLP enforcement?

A
Content-based inspection to identify sensitive data within email attachments
B
SSL decryption to analyze encrypted traffic for policy violations
C
Role-based access control (RBAC) to restrict user access to sensitive files
D
Keyword matching to detect specific patterns in data transmissions
E
Anomaly detection to identify unusual patterns of sensitive data movement

Show answer and explanation

Correct answers: A, B, D, E

Explanation

Effective DLP enforcement relies on multiple mechanisms to ensure sensitive data is protected. Content-based inspection, SSL decryption, keyword matching, and anomaly detection work together to identify and control the movement of sensitive information, whether through email, cloud services, or encrypted channels. While RBAC is critical for access management, it does not directly address DLP enforcement mechanisms.

A. Correct.
Content-based inspection is a core technique in DLP solutions, used to analyze and identify sensitive information such as PII, credit card numbers, or intellectual property inside attachments or text.
B. Correct.
SSL decryption is necessary to inspect encrypted traffic for sensitive data and enforce DLP policies, as encrypted communication can bypass traditional DLP mechanisms.
C. Incorrect.
While RBAC is important for access control, it does not directly detect or enforce DLP policies, as it focuses on permissions rather than data movement or content analysis.
D. Correct.
Keyword matching is a fundamental DLP mechanism that helps detect sensitive data by identifying predefined patterns, such as keywords or regular expressions.
E. Correct.
Anomaly detection is an advanced DLP approach to identify deviations from normal data usage patterns, such as unusual file transfers, which could indicate a potential data breach.

350-201 Question 103

Select 2

A company is experiencing frequent accidental data leaks due to employees sharing sensitive customer information in emails. The security team wants to implement a solution that can detect and prevent such incidents by analyzing email content and enforcing appropriate policies. Which mechanisms can be used to address this issue?

A
Content-based inspection to analyze email body and attachments for sensitive data
B
Endpoint containment to block all email traffic from user devices
C
Regex pattern matching for identifying personally identifiable information (PII)
D
Encryption of all outgoing emails to protect sensitive data
E
Integration with a cloud access security broker (CASB) for monitoring email activities

Show answer and explanation

Correct answers: A, C

Explanation

Data loss prevention (DLP) mechanisms such as content-based inspection and regex pattern matching are effective in detecting and enforcing policies to prevent accidental data leaks through emails. Content-based inspection analyzes the body and attachments for sensitive information, while regex pattern matching detects specific patterns like PII. These techniques directly address the issue of accidental data leakage in emails.

A. Correct.
Content-based inspection is a core mechanism used in data loss prevention (DLP) solutions to identify sensitive information, such as customer data, within email content and attachments. This helps in detecting and mitigating accidental data leakage.
B. Incorrect.
Endpoint containment is not relevant in this scenario as it would block all email traffic, which is not a feasible or practical solution for regular business operations.
C. Correct.
Regex pattern matching is a common technique in DLP solutions to identify specific patterns, such as credit card numbers, Social Security numbers, or other PII, in email content or attachments.
D. Incorrect.
Encryption protects data in transit but does not address the detection or prevention of accidental data leaks caused by employees sharing sensitive information inappropriately.
E. Incorrect.
While CASB can enhance cloud-based security, it is not specifically designed for the detection and prevention of sensitive data leakage through emails.

350-201 Question 104

Select 3

An organization wants to prevent sensitive customer data from being shared outside its corporate network. As a cybersecurity specialist, you are tasked with implementing data loss prevention (DLP) solutions. Which of the following mechanisms can be used to detect and enforce DLP policies effectively?

A
Content-based inspection to analyze files and emails for sensitive information.
B
User behavior monitoring to identify anomalous activity related to data access.
C
Encrypting all outbound traffic to prevent unauthorized access.
D
Endpoint agents to block unauthorized data transfers from workstations.
E
Using firewalls to restrict access to specific external IP addresses.

Show answer and explanation

Correct answers: A, B, D

Explanation

Effective data loss prevention (DLP) requires a combination of detection and enforcement mechanisms. Content-based inspection and user behavior monitoring are critical for detecting sensitive data or risky actions. Endpoint agents enforce policies directly on devices to prevent data leaks. While encryption and firewalls enhance security, they do not specifically address DLP detection or enforcement tasks.

A. Correct.
Content-based inspection is a key DLP mechanism that analyzes the content of files, emails, or other data streams to identify and enforce policies on sensitive information. This is a valid detection and enforcement method.
B. Correct.
User behavior monitoring is relevant in DLP as it helps identify unusual or risky activity, such as unexpected data exfiltration attempts, which can then trigger enforcement actions.
C. Incorrect.
Encrypting outbound traffic is a security best practice but does not directly contribute to detecting or enforcing DLP policies, as it primarily protects data in transit rather than identifying or blocking sensitive data leaks.
D. Correct.
Endpoint agents are integral to DLP enforcement as they monitor and control data transfers directly from user devices, such as blocking USB file transfers or unauthorized uploads.
E. Incorrect.
Firewalls are network security tools designed to manage traffic access, but by themselves, they do not provide content-level inspection or enforcement of DLP policies.

350-201 Question 105

Select 3

A security analyst is tasked with deploying endpoint protection on all hosts within their organization to detect and mitigate malware threats. The analyst decides to use Cisco AMP for Endpoints. Which of the following capabilities provided by Cisco AMP for Endpoints are most relevant to ensuring host security?

A
Real-time malware detection and blocking using global threat intelligence
B
Network traffic segmentation to prevent lateral movement
C
File trajectory tracking to analyze the lifecycle of malicious files
D
Sandboxing capabilities to detonate suspicious files in a controlled environment
E
DDoS attack mitigation using global scrubbing centers

Show answer and explanation

Correct answers: A, C, D

Explanation

Cisco AMP for Endpoints provides robust host security by focusing on malware detection, file trajectory tracking, and sandboxing capabilities. These features ensure that threats are identified, analyzed, and mitigated effectively at the host level. Other options like network segmentation or DDoS mitigation are not part of AMP's scope and are handled by different security solutions.

A. Correct.
Real-time malware detection and blocking is a core feature of Cisco AMP for Endpoints, leveraging global threat intelligence to identify and stop threats on hosts.
B. Incorrect.
Network traffic segmentation is not a feature of Cisco AMP for Endpoints. It is more relevant to network-based solutions like Cisco TrustSec.
C. Correct.
File trajectory tracking allows Cisco AMP for Endpoints to provide visibility into the lifecycle and behavior of files on a host, helping analysts understand how threats propagate.
D. Correct.
Sandboxing is a key feature of Cisco AMP for Endpoints, as it allows suspicious files to be analyzed in a controlled environment before they can harm the host.
E. Incorrect.
DDoS attack mitigation is not a capability of Cisco AMP for Endpoints. This type of protection is typically handled by network-level solutions like Cisco Umbrella or Cisco Secure DDoS Protection.

Timed practice exam

Take a 350-201 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

350-201 practice questions 101 to 200 of 288

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.