Attempt 2021 Free CCNP Security 350-701 Practice Questions to Test Yourself

test2021-10-20T06:18:26+00:00

By test 350-701, 350-701 dumps, 350-701 free dumps, 350-701 SCOR, 350-701 SCOR dumps, 350-701 SCOR free questions, 350-701 SCOR pdf, CCIE Security, CCNP Security 0 Comments

CCNP Security (SCOR 350-701) focuses on your knowledge of security infrastructure including network security, cloud security, content security, endpoint protection and detection, secure network access, visibility, and enforcements. The core exam is also the qualifying exam for CCIE Security Certification.

When you are planning to sit for the 350-701 Implementing and Operating Cisco Security Core Technologies (SCOR) exam, We have updated CCNP Security 350-701 Practice Questions to assist you in preparing for the 350-701 SCOR exam and get your desired certification. This free practice exam validates your understanding of CCNP 350-701 exam and can help you pass the 350-701 SCOR Exam.

Try Latest Free CCNP Security 350-701 Practice Questions

Page 1 of 9

1. Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

It allows the endpoint to authenticate with 802.1x or MA

It verifies that the endpoint has the latest Microsoft security patches installed.

It adds endpoints to identity groups dynamically.

It allows CoA to be applied if the endpoint status is compliant.

2. In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint Protection Platform?

when there is a need for traditional anti-malware detection

when there is no need to have the solution centrally managed

when there is no firewall on the network

when there is a need to have more advanced detection capabilities

3. What is a characteristic of traffic storm control behavior?

Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.

Traffic storm control cannot determine if the packet is unicast or broadcast.

Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.

Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.

4. What is a capability of Cisco ASA Netflow?

It filters NSEL events based on traffic

It generates NSEL events even if the MPF is not configured

It logs all event types only to the same collector

It sends NetFlow data records from active and standby ASAs in an active standby failover pair

5. What are two benefits of Flexible NetFlow records? (Choose two)

They allow the user to configure flow information to perform customized traffic identification

They provide attack prevention by dropping the traffic

They provide accounting and billing enhancements

They converge multiple accounting technologies into one accounting mechanism

They provide monitoring of a wider range of IP packet information from Layer 2 to 4

6. What is the purpose of a Netflow version 9 template record?

It specifies the data format of NetFlow processes.

It provides a standardized set of information about an IP flow.

It defines the format of data records.

It serves as a unique identification number to distinguish individual data records

7. An administrator is configuring a DHCP server to better secure their environment. They need to be able to rate-limit the traffic and ensure that legitimate requests are not dropped .

How would this be accomplished?

Set a trusted interface for the DHCP server

Set the DHCP snooping bit to 1

Add entries in the DHCP snooping database

Enable ARP inspection for the required VLAN

8. Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the deployment?

NGFW

AMP

WSA

ESA

9. Which SNMPv3 configuration must be used to support the strongest security possible?

asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmp-server group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmpserver group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv 3des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

10. A user has a device in the network that is receiving too many connection requests from multiple machines .

Which type of attack is the device undergoing?

phishing

slowloris

pharming

SYN flood

Page 2 of 9

11. Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?

BYOD on boarding

Simple Certificate Enrollment Protocol

Client provisioning

MAC authentication bypass

12. What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two)

flexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications

single sign-on access to on-premises and cloud applications

integration with 802.1x security using native Microsoft Windows supplicant

secure access to on-premises and cloud applications

identification and correction of application vulnerabilities before allowing access to resources

13. Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?

Security Intelligence

Impact Flags

Health Monitoring

URL Filtering

14. Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)

virtualization

middleware

operating systems

applications

data

15. Which category includes DoS Attacks?

Virus attacks

Trojan attacks

Flood attacks

Phishing attacks

16. Refer to the exhibit.

What is the result of this Python script of the Cisco DNA Center API?

adds authentication to a switch

adds a switch to Cisco DNA Center

receives information about a switch

17. What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?

It tracks flow-create, flow-teardown, and flow-denied events.

It provides stateless IP flow tracking that exports all records of a specific flow.

It tracks the flow continuously and provides updates every 10 seconds.

Its events match all traffic classes in parallel.

18. What is a difference between FlexVPN and DMVPN?

DMVPN uses IKEv1 or IKEv2, FlexVPN only uses IKEv1

DMVPN uses only IKEv1 FlexVPN uses only IKEv2

FlexVPN uses IKEv2, DMVPN uses IKEv1 or IKEv2

FlexVPN uses IKEv1 or IKEv2, DMVPN uses only IKEv2

19. Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?

Cisco WiSM

Cisco ESA

Cisco ISE

Cisco Prime Infrastructure

20. When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key establishment?

RSA is an asymmetric key establishment algorithm intended to output symmetric keys

RSA is a symmetric key establishment algorithm intended to output asymmetric keys

DH is a symmetric key establishment algorithm intended to output asymmetric keys

DH is on asymmetric key establishment algorithm intended to output symmetric keys

Page 3 of 9

21. An administrator configures new authorization policies within Cisco ISE and has difficulty profiling the devices. Attributes for the new Cisco IP phones that are profiled based on the RADIUS authentication are seen however the attributes for CDP or DHCP are not .

What should the administrator do to address this issue?

Configure the ip dhcp snooping trust command on the DHCP interfaces to get the information to Cisco ISE

Configure the authentication port-control auto feature within Cisco ISE to identify the devices that are trying to connect

Configure a service template within the switch to standardize the port configurations so that the correct information is sent to Cisco ISE

Configure the device sensor feature within the switch to send the appropriate protocol information

22. Which two endpoint measures are used to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two)

Patch for cross-site scripting.

Perform backups to the private cloud.

Protect against input validation and character escapes in the endpoint.

Install a spam and virus email filter.

Protect systems with an up-to-date antimalware program.

23. Which posture assessment requirement provides options to the client for remediation and requires the remediation within a certain timeframe?

Audit

Mandatory

Optional

Visibility

24. An organization wants to provide visibility and to identify active threats in its network using a VM. The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network .

Which solution meets these requirements?

Cisco Umbrella Cloud

Cisco Stealthwatch Cloud PNM

Cisco Stealthwatch Cloud PCM

Cisco Umbrella On-Premises

25. How is ICMP used an exfiltration technique?

by flooding the destination host with unreachable packets

by sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address

by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host

by overwhelming a targeted host with ICMP echo-request packets

26. Which two key and block sizes are valid for AES? (Choose two)

64-bit block size, 112-bit key length

64-bit block size, 168-bit key length

128-bit block size, 192-bit key length

128-bit block size, 256-bit key length

192-bit block size, 256-bit key length

27. A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available .

What must be done in order to securely connect this device to the network?

Use MAB with profiling

Use MAB with posture assessment.

Use 802.1X with posture assessment.

Use 802.1X with profiling.

28. In a PaaS model, which layer is the tenant responsible for maintaining and patching?

hypervisor

virtual machine

network

application

29. Which benefit does endpoint security provide the overall security posture of an organization?

It streamlines the incident response process to automatically perform digital forensics on the endpoint.

It allows the organization to mitigate web-based attacks as long as the user is active in the domain.

It allows the organization to detect and respond to threats at the edge of the network.

It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.

30. Which two services must remain as on-premises equipment when a hybrid email solution is deployed? (Choose two)

DDoS

antispam

antivirus

encryption

DLP

Page 4 of 9

31. An engineer has been tasked with implementing a solution that can be leveraged for securing the cloud users, data, and applications. There is a requirement to use the Cisco cloud native CASB and cloud cybersecurity platform .

What should be used to meet these requirements?

Cisco Umbrella

Cisco Cloud Email Security

Cisco NGFW

Cisco Cloudlock

32. Refer to the exhibit.

Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance .

What is causing this issue?

No split-tunnel policy is defined on the Firepower Threat Defense appliance.

The access control policy is not allowing VPN traffic in.

Site-to-site VPN peers are using different encryption algorithms.

Site-to-site VPN preshared keys are mismatched.

33. Which two statements about a Cisco WSA configured in Transparent mode are true? (Choose two)

It can handle explicit HTTP requests.

It requires a PAC file for the client web browser.

It requires a proxy for the client web browser.

WCCP v2-enabled devices can automatically redirect traffic destined to port 80.

Layer 4 switches can automatically redirect traffic destined to port 80.

34. Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?

It allows traffic if it does not meet the profile.

It defines a traffic baseline for traffic anomaly deduction.

It inspects hosts that meet the profile with more intrusion rules.

It blocks traffic if it does not meet the profile.

35. Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

DMVPN

FlexVPN

IPsec DVTI

GET VPN

36. An organization has a Cisco Stealthwatch Cloud deployment in their environment.

Cloud logging is working as expected, but logs are not being received from the on-premise network, what action will resolve this issue?

Configure security appliances to send syslogs to Cisco Stealthwatch Cloud

Configure security appliances to send NetFlow to Cisco Stealthwatch Cloud

Deploy a Cisco FTD sensor to send events to Cisco Stealthwatch Cloud

Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud

37. An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE .

Which CoA type achieves this goal?

Port Bounce

CoA Terminate

CoA Reauth

CoA Session Query

38. An organization wants to secure users, data, and applications in the cloud. The solution must be API-based and operate as a cloud-native CASB .

Which solution must be used for this implementation?

Cisco Cloudlock

Cisco Cloud Email Security

Cisco Firepower Next-Generation Firewall

Cisco Umbrella

39. What must be configured in Cisco ISE to enforce reauthentication of an endpoint session when an endpoint is deleted from an identity group?

posture assessment

CoA

external identity source

SNMP probe

40. When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?

Spero analysis

dynamic analysis

sandbox analysis

malware analysis

Page 5 of 9

41. Which two tasks allow NetFlow on a Cisco ASA 5500 Series firewall? (Choose two)

Enable NetFlow Version 9.

Create an ACL to allow UDP traffic on port 9996.

Apply NetFlow Exporter to the outside interface in the inbound direction.

Create a class map to match interesting traffic.

Define a NetFlow collector by using the flow-export command.

42. On Cisco Firepower Management Center, which policy is used to collect health modules alerts from managed devices?

health policy

system policy

correlation policy

access control policy

health awareness policy

43. Drag and drop the descriptions from the left onto the encryption algorithms on the right.

44. What is a characteristic of a bridge group in ASA Firewall transparent mode?

It includes multiple interfaces and access rules between interfaces are customizable

It is a Layer 3 segment and includes one port and customizable access rules

It allows ARP traffic with a single access rule

It has an IP address on its BVI interface and is used for management traffic

45. Which capability is exclusive to a Cisco AMP public cloud instance as compared to a private cloud instance?

RBAC

ETHOS detection engine

SPERO detection engine

TETRA detection engine

46. In which cloud services model is the tenant responsible for virtual machine OS patching?

IaaS

UCaaS

PaaS

SaaS

47. What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?

Enable IP Layer enforcement.

Activate the Advanced Malware Protection license

Activate SSL decryption.

Enable Intelligent Proxy.

48. What is an attribute of the DevSecOps process?

mandated security controls and check lists

security scanning and theoretical vulnerabilities

development security

isolated security team

49. Which two cryptographic algorithms are used with IPsec? (Choose two)

AES-BAC

AES-ABC

HMAC-SHA1/SHA2

Triple AMC-CBC

AES-CBC

50. What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?

Telemetry uses a pull mehod, which makes it more reliable than SNMP

Telemetry uses push and pull, which makes it more scalable than SNMP

Telemetry uses push and pull which makes it more secure than SNMP

Telemetry uses a push method which makes it faster than SNMP

Page 6 of 9

51. Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat? (Choose two)

westbound AP

southbound API

northbound API

eastbound API

52. Which feature is supported when deploying Cisco ASAv within AWS public cloud?

multiple context mode

user deployment of Layer 3 networks

IPv6

clustering

53. Which type of encryption uses a public key and private key?

Asymmetric

Symmetric

Linear

Nonlinear

54. When planning a VPN deployment, for which reason does an engineer opt for an active/active FlexVPN configuration as opposed to DMVPN?

Multiple routers or VRFs are required.

Traffic is distributed statically by default.

Floating static routes are required.

HSRP is used for fallover.

55. Refer to the exhibit.

When configuring a remote access VPN solution terminating on the Cisco ASA, an administrator would like to utilize an external token authentication mechanism in conjunction with AAA authentication using machine certificates .

Which configuration item must be modified to allow this?

Group Policy

Method

SAML Server

DHCP Servers

56. A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication .

How will the Cisco ESA handle any files which need analysis?

AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.

The file is queued for upload when connectivity is restored.

The file upload is abandoned.

The ESA immediately makes another attempt to upload the file.

57. An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group .

Which probe must be enabled for this type of profiling to work?

NetFlow

NMAP

SNMP

DHCP

58. Drag and drop the solutions from the left onto the solution’s benefits on the right.

59. A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports at the same time .

What two catalyst switch security features will prevent further violations? (Choose two)

DHCP Snooping

802.1AE MacSec

Port security

IP Device track

Dynamic ARP inspection

Private VLANs

60. Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

AMP

AnyConnect

DynDNS

Talos

Page 7 of 9

61. What provides the ability to program and monitor networks from somewhere other than the DNAC GUI?

NetFlow

desktop client

ASDM

API

62. Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?

Encrypted Traffic Analytics

Threat Intelligence Director

Cognitive Threat Analytics

Cisco Talos Intelligence

63. What is a language format designed to exchange threat intelligence that can be transported over the TAXII protocol?

STIX

XMPP

pxGrid

SMTP

64. Drag and drop the Firepower Next Generation Intrusion Prevention System detectors from the left onto the correct definitions on the right.

65. What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two)

When the Cisco WSA is running in transparent mode, it uses the WSA’s own IP address as the HTTP request destination.

The Cisco WSA responds with its own IP address only if it is running in explicit mode.

The Cisco WSA is configured in a web browser only if it is running in transparent mode.

The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.

The Cisco WSA responds with its own IP address only if it is running in transparent mode.

66. What is a benefit of using Cisco FMC over Cisco ASDM?

Cisco FMC uses Java while Cisco ASDM uses HTML5.

Cisco FMC provides centralized management while Cisco ASDM does not.

Cisco FMC supports pushing configurations to devices while Cisco ASDM does not.

Cisco FMC supports all firewall products whereas Cisco ASDM only supports Cisco ASA devices

67. What is a difference between GETVPN and IPsec?

GETVPN reduces latency and provides encryption over MPLS without the use of a central hub

GETVPN provides key management and security association management

GETVPN is based on IKEv2 and does not support IKEv1

GETVPN is used to build a VPN network with multiple sites without having to statically configure all devices

68. Which CLI command is used to register a Cisco FirePower sensor to Firepower Management Center?

configure system add <host><key>

configure manager <key> add host

configure manager delete

configure manager add <host><key>

69. A network engineer is deciding whether to use stateful or stateless failover when configuring two ASAs for high availability .

What is the connection status in both cases?

need to be reestablished with stateful failover and preserved with stateless failover

preserved with stateful failover and need to be reestablished with stateless failover

preserved with both stateful and stateless failover

need to be reestablished with both stateful and stateless failover

70. Which information is required when adding a device to Firepower Management Center?

username and password

encryption method

device serial number

registration key

Page 8 of 9

71. Which attack is commonly associated with C and C++ programming languages?

cross-site scripting

water holing

DDoS

buffer overflow

72. Which DevSecOps implementation process gives a weekly or daily update instead of monthly or quarterly in the applications?

Orchestration

CI/CD pipeline

Container

Security

73. What is the difference between Cross-site Scripting and SQL Injection, attacks?

Cross-site Scripting is an attack where code is injected into a database, whereas SQL Injection is an attack where code is injected into a browser.

Cross-site Scripting is a brute force attack targeting remote sites, whereas SQL Injection is a social engineering attack.

Cross-site Scripting is when executives in a corporation are attacked, whereas SQL Injection is when a database is manipulated.

Cross-site Scripting is an attack where code is executed from the server side, whereas SQL Injection is an attack where code is executed from the client side.

74. Which attribute has the ability to change during the RADIUS CoA?

NTP

Authorization

Accessibility

Membership

75. When configuring ISAKMP for IKEv1 Phase1 on a Cisco IOS router, an administrator needs to input the command crypto isakmp key cisco address 0.0.0.0. The administrator is not sure what the IP addressing in this command issued for .

What would be the effect of changing the IP address from 0.0.0.0 to 1.2.3.4?

The key server that is managing the keys for the connection will be at 1.2.3.4

The remote connection will only be allowed from 1.2.3.4

The address that will be used as the crypto validation authority

All IP addresses other than 1.2.3.4 will be allowed

76. What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?

To protect the endpoint against malicious file transfers

To ensure that assets are secure from malicious links on and off the corporate network

To establish secure VPN connectivity to the corporate network

To enforce posture compliance and mandatory software

77. What is the role of an endpoint in protecting a user from a phishing attack?

Use Cisco Stealthwatch and Cisco ISE Integration.

Utilize 802.1X network security to ensure unauthorized access to resources.

Use machine learning models to help identify anomalies and determine expected sending behavior.

Ensure that antivirus and anti malware software is up to date.

78. An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower .

Which feature should be used to accomplish this?

NetFlow

Packet Tracer

Network Discovery

Access Control

79. An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence .

Which protocol accomplishes this goal?

AES-192

IKEv1

AES-256

ESP

80. Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node?

RADIUS Change of Authorization

device tracking

DHCP snooping

VLAN hopping

Page 9 of 9

81. Refer to the exhibit.

Which type of authentication is in use?

LDAP authentication for Microsoft Outlook

POP3 authentication

SMTP relay server authentication

external user and relay mail authentication

82. Which service allows a user export application usage and performance statistics with Cisco Application Visibility and control?

SNORT

NetFlow

SNMP

802.1X

Attempt 2021 Free CCNP Security 350-701 Practice Questions to Test Yourself

Attempt 2021 Free CCNP Security 350-701 Practice Questions to Test Yourself

Try Latest Free CCNP Security 350-701 Practice Questions

Share this post

Author

Leave a Reply Cancel reply

Related Posts