A network engineer is hardening a Cisco router that provides BGP peering with an ISP. The router also has an SSH management interface. The engineer wants to reduce the attack surface without breaking BGP connectivity. Which action is most appropriate?

Enable SNMP with a strong community string for monitoring

Apply an access control list (ACL) to the SSH interface that permits only management IP addresses

Change the BGP password to a longer value

Disable BGP and use static routes instead

What is a fundamental hardening recommendation for a firewall's administrative access?

Disable logging of administrative actions to save storage

Use HTTP for the management interface to simplify access

Allow management access from any IP address for flexibility

Restrict management access to specific trusted IP addresses

A company is migrating a production workload to AWS. The security team must ensure that the cloud environment is hardened according to industry best practices. Which combination of controls should be implemented first?

Apply the latest security patches to all EC2 instances

Enable multi-factor authentication for all IAM users and enforce least-privilege permissions

Enable CloudTrail and VPC Flow Logs

Encrypt all data at rest using AWS KMS

Which application hardening practice is most directly aimed at preventing injection attacks?

Running the application with administrator privileges

Disabling error messages to users

Using a web application firewall (WAF)

Implementing input validation and parameterized queries

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 5

2.5 Determine Resources for Industry Standards and Recommendations for Hardening of Systems 350-201 Practice Questions (Page 4)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

30%of the exam

Questions 16–20

16expert · hard
A network engineer is hardening a Cisco router that provides BGP peering with an ISP. The router also has an SSH management interface. The engineer wants to reduce the attack surface without breaking BGP connectivity. Which action is most appropriate?
Select an answer first
17foundation · easy
Which principle is a cornerstone of application hardening that limits the potential damage from a compromised application process?
Select an answer first
18foundation · easy
What is a fundamental hardening recommendation for a firewall's administrative access?
Select an answer first
19application · medium
A company is migrating a production workload to AWS. The security team must ensure that the cloud environment is hardened according to industry best practices. Which combination of controls should be implemented first?
Select an answer first
20foundation · easy
Which application hardening practice is most directly aimed at preventing injection attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.