Which statement best describes the primary purpose of network segmentation in a security context?

To simplify IP address management by using a single subnet

To isolate critical assets and limit the ability of an attacker to move laterally

To increase the speed of the network by reducing broadcast domains

To replace the need for firewalls and other security devices

A network administrator is hardening a router that is managed via SSH. The router also has an out-of-band management interface. The security policy requires that management access be restricted to a specific management subnet and that all management traffic be encrypted. The administrator wants to minimize the attack surface. Which set of actions should be taken?

Apply an ACL to the management interface allowing only SSH from the management subnet, disable HTTP and Telnet, and use SSHv2

Use HTTP for management and restrict it to the management subnet

Enable Telnet on the management interface and restrict it to the management subnet

Apply an ACL allowing all traffic from the management subnet and disable SSH

A network engineer is hardening a router that is experiencing high CPU utilization due to excessive traffic destined to the router's own IP address. The engineer wants to protect the control plane without impacting legitimate routing protocol traffic. Which configuration should be applied?

Apply an ACL on all interfaces that denies traffic destined to the router's IP address.

Enable IP Source Guard on all interfaces.

Disable all unused services and enable SSH for management.

Apply a Control Plane Policing (CoPP) policy that classifies and rate-limits traffic destined to the control plane.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 9

2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 2)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

10concepts

30%of the exam

Questions 6–10

6application · easy
A company wants to prevent an attacker from spoofing IP addresses on its access network. The switch has DHCP snooping enabled for the relevant VLANs. Which additional control should be enabled on the access ports to enforce that traffic matches the DHCP snooping binding table?
Select an answer first
7foundation · easy
Which encryption protocol is commonly used to secure remote management sessions to network devices?
Select an answer first
8foundation · easy
Which statement best describes the primary purpose of network segmentation in a security context?
Select an answer first
9expert · hard
A network administrator is hardening a router that is managed via SSH. The router also has an out-of-band management interface. The security policy requires that management access be restricted to a specific management subnet and that all management traffic be encrypted. The administrator wants to minimize the attack surface. Which set of actions should be taken?
Select an answer first
10application · medium
A network engineer is hardening a router that is experiencing high CPU utilization due to excessive traffic destined to the router's own IP address. The engineer wants to protect the control plane without impacting legitimate routing protocol traffic. Which configuration should be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 2)

Questions 6–10

A company wants to prevent an attacker from spoofing IP addresses on its access network. The switch has DHCP snooping enabled for the relevant VLANs. Which additional control should be enabled on the access ports to enforce that traffic matches the DHCP snooping binding table?

Which encryption protocol is commonly used to secure remote management sessions to network devices?

Which statement best describes the primary purpose of network segmentation in a security context?

A network engineer is hardening a router that is experiencing high CPU utilization due to excessive traffic destined to the router's own IP address. The engineer wants to protect the control plane without impacting legitimate routing protocol traffic. Which configuration should be applied?

Keep studying — Techniques