Best Tips to Pass CCNP Security SCOR 350-701 Exam Successfully

test2022-09-01T06:57:14+00:00

350-701 SCOR exam is the core test for the CCNP Security certification and the written exam for the CCIE Security certification. FreeTestShare has updated CCNP Security SCOR 350-701 dumps which include real exam questions and answers to assist you in preparing for the 350-701 SCOR exam and get your desired certification. We provides 100% authentic CCNP Security SCOR 350-701 dumps that will not only help you pass the Cisco CCNP 350-701 exam, but will also allow you to operate at the highest level in the industry.Our CCNP Security SCOR 350-701 dumps will help you familiarize yourself with the exam. You can assess your preparation by taking the complete Cisco 350-701 exam dumps for your single success.

You can now use our free 350-701 practice test to help you prepare for the exam.

Page 1 of 15

1. Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?

file access from a different user

interesting file access

user login suspicious behavior

privilege escalation

2. Which function is the primary function of Cisco AMP threat Grid?

automated email encryption

applying a real-time URI blacklist

automated malware analysis

monitoring network traffic

3. Which type of protection encrypts RSA keys when they are exported and imported?

file

passphrase

NGE

nonexportable

4. What are two advantages of using Cisco Any connect over DMVPN? (Choose two)

It provides spoke-to-spoke communications without traversing the hub

It allows different routing protocols to work over the tunnel

It allows customization of access policies based on user identity

It allows multiple sites to connect to the data center

It enables VPN access for individual users from their machines

5. An organization has noticed an increase in malicious content downloads and wants to use Cisco Umbrella to prevent this activity for suspicious domains while allowing normal web traffic.

Which action will accomplish this task?

Set content settings to High

Configure the intelligent proxy.

Use destination block lists.

Configure application block lists.

6. Elliptic curve cryptography is a stronger more efficient cryptography method meant to replace which current

encryption technology?

3DES

RSA

DES

AES

7. What are two facts about WSA HTTP proxy configuration with a PAC file? (Choose two.)

It is defined as a Transparent proxy deployment.

In a dual-NIC configuration, the PAC file directs traffic through the two NICs to the proxy.

The PAC file, which references the proxy, is deployed to the client web browser.

It is defined as an Explicit proxy deployment.

It is defined as a Bridge proxy deployment.

8. Which Cisco ISE service checks the compliance of endpoints before allowing the endpoints to connect to

the network?

posture

profiler

Cisco TrustSec

Threat Centric NAC

9. Which solution is made from a collection of secure development practices and guidelines that

developers must follow to build secure applications?

AFL

Fuzzing Framework

Radamsa

OWASP

10. What is a benefit of using Cisco Tetration?

It collects telemetry data from servers and then uses software sensors to analyze flow information.

It collects policy compliance data and process details.

It collects enforcement data from servers and collects interpacket variation.

It collects near-real time data from servers and inventories the software packages that exist on servers.

Page 2 of 15

11. Which RADIUS attribute can you use to filter MAB requests in an 802.1 x deployment?

12. What is a characteristic of traffic storm control behavior?

Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.

Traffic storm control cannot determine if the packet is unicast or broadcast.

Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.

Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.

13. A Cisco ESA administrator has been tasked with configuring the Cisco ESA to ensure there are no viruses before quarantined emails are delivered. In addition, delivery of mail from known bad mail servers must be prevented.

Which two actions must be taken in order to meet these requirements? (Choose two)

Use outbreak filters from SenderBase

Enable a message tracking service

Configure a recipient access table

Deploy the Cisco ESA in the DMZ

Scan quarantined emails using AntiVirus signatures

14. Which technology limits communication between nodes on the same network segment to individual applications?

serverless infrastructure

microsegmentation

SaaS deployment

machine-to-machine firewalling

15. Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server?

url

terminal

profile

selfsigned

16. An administrator is configuring N I P on Cisco ASA via ASDM and needs to ensure that rogue NTP servers cannot insert themselves as the authoritative time source Which two steps must be taken to accomplish this task? (Choose two)

Specify the NTP version

Configure the NTP stratum

Set the authentication key

Choose the interface for syncing to the NTP server

Set the NTP DNS hostname

17. What are two DDoS attack categories? (Choose two)

sequential

protocol

database

volume-based

screen-based

18. Which two preventive measures are used to control cross-site scripting? (Choose two)

Enable client-side scripts on a per-domain basis.

Incorporate contextual output encoding/escaping.

Disable cookie inspection in the HTML inspection engine.

Run untrusted HTML input through an HTML sanitization engine.

Same Site cookie attribute should not be used.

19. What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?

To protect the endpoint against malicious file transfers

To ensure that assets are secure from malicious links on and off the corporate network

To establish secure VPN connectivity to the corporate network

To enforce posture compliance and mandatory software

20. Which open standard creates a framework for sharing threat intelligence in a machine-digestible format?

OpenC2

OpenlOC

CybOX

STIX

Page 3 of 15

21. When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?

Spero analysis

dynamic analysis

sandbox analysis

malware analysis

22. Refer to the exhibit.

Text

Description automatically generated

Which type of authentication is in use?

LDAP authentication for Microsoft Outlook

POP3 authentication

SMTP relay server authentication

external user and relay mail authentication

23. Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses and malware?

(Choose two)

Sophos engine

white list

RAT

outbreak filters

DLP

24. What is the purpose of a NetFlow version 9 template record?

It specifies the data format of NetFlow processes.

It provides a standardized set of information about an IP flow.

lt defines the format of data records.

It serves as a unique identification number to distinguish individual data records

25. Which Cisco AMP file disposition valid?

pristine

malware

dirty

non malicious

26. Which type of encryption uses a public key and private key?

Asymmetric

Symmetric

Linear

Nonlinear

27. What is a benefit of performing device compliance?

Verification of the latest OS patches

Device classification and authorization

Providing multi-factor authentication

Providing attribute-driven policies

28. An engineer recently completed the system setup on a Cisco WSA Which URL information does the system send to SensorBase Network servers?

Summarized server-name information and MD5-hashed path information

complete URL,without obfuscating the path segments

URL information collected from clients that connect to the Cisco WSA using Cisco AnyConnect

none because SensorBase Network Participation is disabled by default

29. A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict.

What is causing this issue?

The policy was created to send a message to quarantine instead of drop

The file has a reputation score that is above the threshold

The file has a reputation score that is below the threshold

The policy was created to disable file analysis

30. An engineer is configuring AMP for endpoints and wants to block certain files from executing.

Which outbreak

control method is used to accomplish this task?

device flow correlation

simple detections

application blocking list

advanced custom detections

Page 4 of 15

31. How does Cisco Umbrella archive logs to an enterprise owned storage?

by using the Application Programming Interface to fetch the logs

by sending logs via syslog to an on-premises or cloud-based syslog server

by the system administrator downloading the logs from the Cisco Umbrella web portal

by being configured to send logs to a self-managed AWS S3 bucket

32. An engineer adds a custom detection policy to a Cisco AMP deployment and encounters issues with the configuration. The simple detection mechanism is configured, but the dashboard indicates that the hash is not 64 characters and is non-zero.

What is the issue?

The engineer is attempting to upload a hash created using MD5 instead of SHA-256

The file being uploaded is incompatible with simple detections and must use advanced detections

The hash being uploaded is part of a set in an incorrect format

The engineer is attempting to upload a file instead of a hash

33. What is the intent of a basic SYN flood attack?

to solicit DNS responses

to exceed the threshold limit of the connection queue

to flush the register stack to re-initiate the buffers

to cause the buffer to overflow

34. Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

interpacket variation

software package variation

flow insight variation

process details variation

35. Which feature enables a Cisco ISR to use the default bypass list automatically for web filtering?

filters

group key

company key

connector

36. What is a characteristic of Dynamic ARP Inspection?

DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.

In a typical network, make all ports as trusted except for the ports connecting to switches, which are untrusted

DAI associates a trust state with each switch.

DAI intercepts all ARP requests and responses on trusted ports only.

37. Which solution allows an administrator to provision, monitor, and secure mobile devices on Windows and Mac computers from a centralized dashboard?

Cisco Umbrella

Cisco AMP for Endpoints

Cisco ISE

Cisco Stealthwatch

38. Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the

deployment?

NGFW

AMP

WSA

ESA

39. What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?

Enable IP Layer enforcement.

Activate the Advanced Malware Protection license

Activate SSL decryption.

Enable Intelligent Proxy.

40. Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

To view bandwidth usage for NetFlow records, the QoS feature must be enabled.

A sysopt command can be used to enable NSEL on a specific interface.

NSEL can be used without a collector configured.

A flow-export event type must be defined under a policy

Page 5 of 15

41. Which Talos reputation center allows you to track the reputation of IP addresses for email and web traffic?

IP Blacklist Center

File Reputation Center

AMP Reputation Center

IP and Domain Reputation Center

42. On which part of the IT environment does DevSecOps focus?

application development

wireless network

data center

perimeter network

43. An organization wants to use Cisco FTD or Cisco ASA devices. Specific URLs must be blocked from being accessed via the firewall which requires that the administrator input the bad URL categories that the

organization wants blocked into the access policy.

Which solution should be used to meet this requirement?

Cisco ASA because it enables URL filtering and blocks malicious URLs by default, whereas Cisco FTD does not

Cisco ASA because it includes URL filtering in the access control policy capabilities, whereas Cisco FTD does not

Cisco FTD because it includes URL filtering in the access control policy capabilities, whereas Cisco ASA does not

Cisco FTD because it enables URL filtering and blocks malicious URLs by default, whereas Cisco ASA does not

44. An MDM provides which two advantages to an organization with regards to device management? (Choose two)

asset inventory management

allowed application management

Active Directory group policy management

network device management

critical device management

45. Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?

It allows traffic if it does not meet the profile.

It defines a traffic baseline for traffic anomaly deduction.

It inspects hosts that meet the profile with more intrusion rules.

It blocks traffic if it does not meet the profile.

46. Refer to the exhibit.

Consider that any feature of DNS requests, such as the length off the domain name

and the number of subdomains, can be used to construct models of expected behavior to which

observed values can be compared.

Which type of malicious attack are these values associated with?

Spectre Worm

Eternal Blue Windows

Heartbleed SSL Bug

W32/AutoRun worm

47. An organization wants to improve its cybersecurity processes and to add intelligence to its data The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA What must be done to accomplish these objectives?

Create a Cisco pxGrid connection to NIST to import this information into the security products for policy use

Create an automated download of the Internet Storm Center intelligence feed into the Cisco FTD and Cisco WSA databases to tie to the dynamic access control policies.

Download the threat intelligence feed from the IETF and import it into the Cisco FTD and Cisco WSA databases

Configure the integrations with Talos Intelligence to take advantage of the threat intelligence that it provides.

48. DRAG DROP

Drag and drop the descriptions from the left onto the correct protocol versions on the right.

Diagram

Description automatically generated with low confidence

Diagram

Description automatically generated with low confidence

49. What is a benefit of conducting device compliance checks?

It indicates what type of operating system is connecting to the network.

It validates if anti-virus software is installed.

It scans endpoints to determine if malicious activity is taking place.

It detects email phishing attacks.

50. A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available.

What must be done in order to securely connect this device to the network?

Use MAB with profiling

Use MAB with posture assessment.

Use 802.1X with posture assessment.

Use 802.1X with profiling.

Page 6 of 15

51. 1.In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?

Smurf

distributed denial of service

cross-site scripting

rootkit exploit

52. Which MDM configuration provides scalability?

pushing WPA2-Enterprise settings automatically to devices

enabling use of device features such as camera use

BYOD support without extra appliance or licenses

automatic device classification with level 7 fingerprinting

53. A user has a device in the network that is receiving too many connection requests from multiple machines.

Which type of attack is the device undergoing?

phishing

slowloris

pharming

SYN flood

54. What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

lf four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.

After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL

After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL1

If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

55. Which feature is configured for managed devices in the device platform settings of the Firepower Management

Center?

quality of service

time synchronization

network address translations

intrusion policy

56. What provides the ability to program and monitor networks from somewhere other than the DNAC GUI?

NetFlow

desktop client

ASDM

API

57. What is a difference between a DoS attack and a DDoS attack?

A DoS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where multiple systems target a single system with a DoS attack

A DoS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where a computer is used to flood multiple servers that are distributed over a LAN

A DoS attack is where a computer is used to flood a server with UDP packets whereas a DDoS attack is where a computer is used to flood a server with TCP packets

A DoS attack is where a computer is used to flood a server with TCP packets whereas a DDoS attack is where a computer is used to flood a server with UDP packets

58. An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence.

Which protocol accomplishes this goal?

AES-192

IKEv1

AES-256

ESP

59. Which characteristic is unique to a Cisco WSAv as compared to a physical appliance?

supports VMware vMotion on VMware ESXi

requires an additional license

performs transparent redirection

supports SSL decryption

60. What are two features of NetFlow flow monitoring? (Choose two)

Can track ingress and egress information

Include the flow record and the flow importer

Copies all ingress flow information to an interface

Does not required packet sampling on interfaces

Can be used to track multicast, MPLS, or bridged traffic

Page 7 of 15

61. A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing

authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?

Adaptive Network Control Policy List

Context Visibility

Accounting Reports

RADIUS Live Logs

62. A network engineer must monitor user and device behavior within the on-premises network. This data must be sent to the Cisco Stealthwatch Cloud analytics platform for analysis.

What must be done to meet this

requirement using the Ubuntu-based VM appliance deployed in a VMware-based hypervisor?

Configure a Cisco FMC to send syslogs to Cisco Stealthwatch Cloud

Deploy the Cisco Stealthwatch Cloud PNM sensor that sends data to Cisco Stealthwatch Cloud

Deploy a Cisco FTD sensor to send network events to Cisco Stealthwatch Cloud

Configure a Cisco FMC to send NetFlow to Cisco Stealthwatch Cloud

63. What are two benefits of using an MDM solution? (Choose two.)

grants administrators a way to remotely wipe a lost or stolen device

provides simple and streamlined login experience for multiple applications and users

native integration that helps secure applications across multiple cloud platforms or on-premises environments

encrypts data that is stored on endpoints

allows for centralized management of endpoint device applications and configurations

64. An organization has DHCP servers set up to allocate IP addresses to clients on the LAN.

What must be

done to ensure the LAN switches prevent malicious DHCP traffic while also distributing IP addresses to

the correct endpoints?

Configure Dynamic ARP Inspection and add entries in the DHCP snooping database

Configure DHCP snooping and set an untrusted interface for all clients

Configure Dynamic ARP Inspection and antispoofing ACLs in the DHCP snooping database

Configure DHCP snooping and set a trusted interface for the DHCP server

65. Which technology provides the benefit of Layer 3 through Layer 7 innovative deep packet inspection, enabling the platform to identify and output various applications within the network traffic flows?

Cisco NBAR2

Cisco ASAV

Account on Resolution

Cisco Prime Infrastructure

66. Which type of attack is social engineering?

trojan

phishing

malware

MITM

67. What is the process of performing automated static and dynamic analysis of files against preloaded

behavioral indicators for threat analysis?

deep visibility scan

point-in-time checks

advanced sandboxing

advanced scanning

68. An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites

but other sites are not accessible due to an error.

Why is the error occurring?

Client computers do not have the Cisco Umbrella Root CA certificate installed.

IP-Layer Enforcement is not configured.

Client computers do not have an SSL certificate deployed from an internal CA server.

Intelligent proxy and SSL decryption is disabled in the policy

69. The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic. Where must the

ASA be added on the Cisco UC Manager platform?

Certificate Trust List

Endpoint Trust List

Enterprise Proxy Service

Secured Collaboration Proxy

70. Which standard is used to automate exchanging cyber threat information?

TAXII

MITRE

IoC

STIX

Page 8 of 15

71. Which service allows a user export application usage and performance statistics with Cisco Application Visibility

and control?

SNORT

NetFlow

SNMP

802.1X

72. What are two ways that Cisco Container Platform provides value to customers who utilize cloud service providers? (Choose two.)

Allows developers to create code once and deploy to multiple clouds

helps maintain source code for cloud deployments

manages Docker containers

manages Kubernetes clusters

Creates complex tasks for managing code

73. Which CoA response code is sent if an authorization state is changed successfully on a Cisco IOS device?

CoA-NCL

CoA-NAK

СоА-МАВ

CoA-ACK

74. An engineer needs behavioral analysis to detect malicious activity on the hosts, and is configuring the

organization’s public cloud to send telemetry using the cloud provider’s mechanisms to a security device.

Which mechanism should the engineer configure to accomplish this goal?

mirror port

Flow

NetFlow

VPC flow logs

75. Refer to the exhibit.

What will occur when this device tries to connect to the port?

802.1X will not work, but MAB will start and allow the device on the network.

802.1X will not work and the device will not be allowed network access

802 1X will work and the device will be allowed on the network

802 1X and MAB will both be used and ISE can use policy to determine the access level

76. How is Cisco Umbrella configured to log only security events?

per policy

in the Reporting settings

in the Security Settings section

per network in the Deployments section

77. Which two functions does the Cisco Advanced Phishing Protection solution perform in trying to protect

from phishing attacks? (Choose two.)

blocks malicious websites and adds them to a block list

does a real-time user web browsing behavior analysis

provides a defense for on-premises email deployments

uses a static algorithm to determine malicious

determines if the email messages are malicious

78. What does Cisco AMP for Endpoints use to help an organization detect different families of malware?

Ethos Engine to perform fuzzy fingerprinting

Tetra Engine to detect malware when me endpoint is connected to the cloud

Clam AV Engine to perform email scanning

Spero Engine with machine learning to perform dynamic analysis

79. What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.)

Create an LDAP authentication realm and disable transparent user identification.

Create NTLM or Kerberos authentication realm and enable transparent user identification.

Deploy a separate Active Directory agent such as Cisco Context Directory Agent.

The eDirectory client must be installed on each client workstation.

Deploy a separate eDirectory server; the dent IP address is recorded in this server.

80. Which two mechanisms are used to control phishing attacks? (Choose two)

Enable browser alerts for fraudulent websites.

Define security group memberships.

Revoke expired CRL of the websites.

Use antispyware software.

Implement email filtering techniques.

Page 9 of 15

81. What are two rootkit types? (Choose two)

registry

virtual

bootloader

user mode

buffer mode

82. What limits communication between applications or containers on the same node?

microsegmentation

container orchestration

microservicing

Software-Defined Access

83. DRAG DROP

Drag and drop the concepts from the left onto the correct descriptions on the right

84. With which components does a southbound API within a software-defined network architecture communicate?

controllers within the network

applications

appliances

devices such as routers and switches

85. An organization is receiving SPAM emails from a known malicious domain.

What must be configured in order to

prevent the session during the initial TCP communication?

Configure the Cisco ESA to drop the malicious emails

Configure policies to quarantine malicious emails

Configure policies to stop and reject communication

Configure the Cisco ESA to reset the TCP connection

86. DRAG DROP

Drag and drop the exploits from the left onto the type of security vulnerability on the right.

87. An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA.

Which Cisco ASA

command must be used?

flow-export destination inside 1.1.1.1 2055

ip flow monitor input

ip flow-export destination 1.1.1.1 2055

flow exporter

88. What is the function of the Context Directory Agent?

maintains users’ group memberships

relays user authentication requests from Web Security Appliance to Active Directory

reads the Active Directory logs to map IP addresses to usernames

accepts user authentication requests on behalf of Web Security Appliance for user identification

89. What is a characteristic of a bridge group in ASA Firewall transparent mode?

It includes multiple interfaces and access rules between interfaces are customizable

It is a Layer 3 segment and includes one port and customizable access rules

It allows ARP traffic with a single access rule

It has an IP address on its BVI interface and is used for management traffic

90. An administrator is configuring a DHCP server to better secure their environment. They need to be able to ratelimit the traffic and ensure that legitimate requests are not dropped.

How would this be accomplished?

Set a trusted interface for the DHCP server

Set the DHCP snooping bit to 1

Add entries in the DHCP snooping database

Enable ARP inspection for the required VLAN

Page 10 of 15

91. Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two)

Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS

Cisco FTDv with one management interface and two traffic interfaces configured

Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises

Cisco FTDv with two management interfaces and one traffic interface configured

Cisco FTDv configured in routed mode and IPv6 configured

92. What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.) The eDirectory client must be installed on each client workstation.

Create NTLM or Kerberos authentication realm and enable transparent user identification

Deploy a separate Active Directory agent such as Cisco Context Directory Agent.

Create an LDAP authentication realm and disable transparent user identification.

Deploy a separate eDirectory server: the client IP address is recorded in this server

93. What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an

organization? (Choose two)

flexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications

single sign-on access to on-premises and cloud applications

integration with 802.1x security using native Microsoft Windows supplicant

secure access to on-premises and cloud applications

identification and correction of application vulnerabilities before allowing access to resources

94. An organization has two systems in their DMZ that have an unencrypted link between them for communication.

The organization does not have a defined password policy and uses several default accounts on the systems.The application used on those systems also have not gone through stringent code reviews.

Which vulnerability would help an attacker brute force their way into the systems?

weak passwords

lack of input validation

missing encryption

lack of file permission

95. Which two fields are defined in the NetFlow flow? (Choose two)

type of service byte

class of service bits

Layer 4 protocol type

destination port

output logical interface

96. Which statement about IOS zone-based firewalls is true?

An unassigned interface can communicate with assigned interfaces

Only one interface can be assigned to a zone.

An interface can be assigned to multiple zones.

An interface can be assigned only to one zone.

97. Which deployment model is the most secure when considering risks to cloud adoption?

Public Cloud

Hybrid Cloud

Community Cloud

Private Cloud

98. A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0380739941 address 0.0.0.0 command on hostA. The tunnel is not being established to hostB.

What action is needed to authenticate the VPN?

Change isakmp to ikev2 in the command on host

Enter the command with a different password on host

Enter the same command on host

Change the password on hostA to the default password.

99. What is a capability of Cisco ASA Netflow?

It filters NSEL events based on traffic

It generates NSEL events even if the MPF is not configured

It logs all event types only to the same collector

It sends NetFlow data records from active and standby ASAs in an active standby failover pair

100. Which two request of REST API are valid on the Cisco ASA Platform? (Choose two)

put

options

get

push

connect

Page 11 of 15

101. In which cloud services model is the tenant responsible for virtual machine OS patching?

IaaS

UCaaS

PaaS

SaaS

102. Refer to the exhibit.

Which command was used to generate this output and to show which ports are

authenticating with dot1x or mab?

show authentication registrations

show authentication method

show dot1x all

show authentication sessions

103. Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

It allows the endpoint to authenticate with 802.1x or MA

It verifies that the endpoint has the latest Microsoft security patches installed.

It adds endpoints to identity groups dynamically.

It allows CoA to be applied if the endpoint status is compliant.

104. An organization configures Cisco Umbrella to be used for its DNS services. The organization must be able to block traffic based on the subnet that the endpoint is on but it sees only the requests from its public IP address instead of each internal IP address.

What must be done to resolve this issue?

Set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address

Use the tenant control features to identify each subnet being used and track the connections within the Cisco Umbrella dashboard

Install the Microsoft Active Directory Connector to give IP address information stitched to the requests in the Cisco Umbrella dashboard

Configure an internal domain within Cisco Umbrella to help identify each address and create policy from the domains

105. Which benefit does DMVPN provide over GETVPN?

DMVPN supports QoS, multicast, and routing, and GETVPN supports only Qo

DMVPN is a tunnel-less VPN, and GETVPN is tunnel-based.

DMVPN supports non-IP protocols, and GETVPN supports only IP protocols.

DMVPN can be used over the public Internet, and GETVPN requires a private network.

106. Which technology must be used to implement secure VPN connectivity among company branches over aprivate IP cloud with any-to-any scalable connectivity?

DMVPN

FlexVPN

IPsec DVTI

GET VPN

107. Which type of attack is MFA an effective deterrent for?

ping of death

phishing

teardrop

syn flood

108. Which two cryptographic algorithms are used with IPsec? (Choose two)

AES-BAC

AES-ABC

HMAC-SHA1/SHA2

Triple AMC-CBC

AES-CBC

109. Which two are valid suppression types on a Cisco Next Generation Intrusion Prevention System? (Choose two)

Port

Rule

Source

Application

Protocol

110. Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

Nexus

Stealthwatch

Firepower

Tetration

Page 12 of 15

111. A network administrator is configuring a rule in an access control policy to block certain URLs and selects the “Chat and Instant Messaging” category.

Which reputation score should be selected to accomplish this goal?

112. Which two protocols must be configured to authenticate end users to the Web Security Appliance? (Choose two.)

NTLMSSP

Kerberos

CHAP

TACACS+

RADIUS

113. What is the difference between a vulnerability and an exploit?

A vulnerability is a hypothetical event for an attacker to exploit

A vulnerability is a weakness that can be exploited by an attacker

An exploit is a weakness that can cause a vulnerability in the network

An exploit is a hypothetical event that causes a vulnerability in the network

114. Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

transparent

redirection

forward

proxy gateway

115. An engineer integrates Cisco FMC and Cisco ISE using pxGrid Which role is assigned for Cisco FMC?

client

server

controller

publisher

116. Under which two circumstances is a CoA issued? (Choose two)

A new authentication rule was added to the policy on the Policy Service node.

An endpoint is deleted on the Identity Service Engine server.

A new Identity Source Sequence is created and referenced in the authentication policy.

An endpoint is profiled for the first time.

A new Identity Service Engine server is added to the deployment with the Administration persona

117. On Cisco Firepower Management Center, which policy is used to collect health modules alerts from managed

devices?

health policy

system policy

correlation policy

access control policy

health awareness policy

118. Why is it important to have logical security controls on endpoints even though the users are trained to spot security threats and the network devices already help prevent them?

to prevent theft of the endpoints

because defense-in-depth stops at the network

to expose the endpoint to more threats

because human error or insider threats will still exist

119. A small organization needs to reduce the VPN bandwidth load on their headend Cisco ASA in order to ensure that bandwidth is available for VPN users needing access to corporate resources on the10.0.0.0/24 local HQ network.

How is this accomplished without adding additional devices to the network?

Use split tunneling to tunnel traffic for the 10.0.0.0/24 network only.

Configure VPN load balancing to distribute traffic for the 10.0.0.0/24 network,

Configure VPN load balancing to send non-corporate traffic straight to the internet.

Use split tunneling to tunnel all traffic except for the 10.0.0.0/24 network.

120. Which Cisco solution extends network visibility, threat detection, and analytics to public cloud environments?

Cisco Umbrella

Cisco Stealthwatch Cloud

Cisco Appdynamics

Cisco CloudLock

Page 13 of 15

121. Why is it important to have a patching strategy for endpoints?

to take advantage of new features released with patches

so that functionality is increased on a faster scale when it is used

so that known vulnerabilities are targeted and having a regular patch cycle reduces risks

so that patching strategies can assist with disabling nonsecure protocols in applications

122. Why is it important to patch endpoints consistently?

Patching reduces the attack surface of the infrastructure.

Patching helps to mitigate vulnerabilities.

Patching is required per the vendor contract.

Patching allows for creating a honeypot.

123. Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?

DNS tunneling

DNSCrypt

DNS security

DNSSEC

124. How is data sent out to the attacker during a DNS tunneling attack?

as part of the UDP/53 packet payload

as part of the domain name

as part of the TCP/53 packet header

as part of the DNS response packet

125. Which feature within Cisco ISE verifies the compliance of an endpoint before providing access to the

network?

Posture

Profiling

pxGrid

MAB

126. How is ICMP used an exfiltration technique?

by flooding the destination host with unreachable packets

by sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address

by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host

by overwhelming a targeted host with ICMP echo-request packets

127. Which two conditions are prerequisites for stateful failover for IPsec? (Choose two)

Only the IKE configuration that is set up on the active device must be duplicated on the standby device; the IPsec configuration is copied automatically

The active and standby devices can run different versions of the Cisco IOS software but must be the same type of device.

The IPsec configuration that is set up on the active device must be duplicated on the standby device

Only the IPsec configuration that is set up on the active device must be duplicated on the standby device; the IKE configuration is copied automatically.

The active and standby devices must run the same version of the Cisco IOS software and must be the same type of device

128. An organization has a Cisco ESA set up with policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation.

Which actions must be performed in order to provide this capability?

deliver and send copies to other recipients

quarantine and send a DLP violation notification

quarantine and alter the subject header with a DLP violation

deliver and add disclaimer text

129. Which Cisco DNA Center Intent API action is used to retrieve the number of devices known to a DNA

Center?

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device/count

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/networkdevice?parameter1=value&parameter2=value&....

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v 1/networkdevice/startIndex/recordsToReturn

130. In which two ways does a system administrator send web traffic transparently to the Web Security Appliance?

(Choose two)

configure Active Directory Group Policies to push proxy settings

configure policy-based routing on the network infrastructure

reference a Proxy Auto Config file

configure the proxy IP address in the web-browser settings

use Web Cache Communication Protocol

Page 14 of 15

131. What is a function of the Layer 4 Traffic Monitor on a Cisco WSA?

blocks traffic from URL categories that are known to contain malicious content

decrypts SSL traffic to monitor for malicious content

monitors suspicious traffic across all the TCP/UDP ports

prevents data exfiltration by searching all the network traffic for specified sensitive information

132. A switch with Dynamic ARP Inspection enabled has received a spoofed ARP response on a trusted interface.

How does the switch behave in this situation?

It forwards the packet after validation by using the MAC Binding Table.

It drops the packet after validation by using the IP & MAC Binding Table.

It forwards the packet without validation.

It drops the packet without validation.

133. What is the difference between Cross-site Scripting and SQL Injection, attacks?

Cross-site Scripting is an attack where code is injected into a database, whereas SQL Injection is an attack where code is injected into a browser.

Cross-site Scripting is a brute force attack targeting remote sites, whereas SQL Injection is a social engineering attack.

Cross-site Scripting is when executives in a corporation are attacked, whereas SQL Injection is when a database is manipulated.

Cross-site Scripting is an attack where code is executed from the server side, whereas SQL Injection is an attack where code is executed from the client side.

134. When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key

establishment?

RSA is an asymmetric key establishment algorithm intended to output symmetric keys

RSA is a symmetric key establishment algorithm intended to output asymmetric keys

DH is a symmetric key establishment algorithm intended to output asymmetric keys

DH is on asymmetric key establishment algorithm intended to output symmetric keys

135. A Cisco AMP for Endpoints administrator configures a custom detection policy to add specific MD5 signatures The configuration is created in the simple detection policy section, but it does not work What is the reason for this failure?

The administrator must upload the file instead of the hash for Cisco AMP to use.

The MD5 hash uploaded to the simple detection policy is in the incorrect format

The APK must be uploaded for the application that the detection is intended

Detections for MD5 signatures must be configured in the advanced custom detection policies

136. Which solution stops unauthorized access to the system if a user's password is compromised?

VPN

MFA

AMP

SSL

137. Refer to the exhibit.

Text, letter

Description automatically generated

What is the result of this Python script of the Cisco DNA Center API?

adds authentication to a switch

adds a switch to Cisco DNA Center

receives information about a switch

138. When network telemetry is implemented, what is important to be enabled across all network infrastructure devices to correlate different sources?

CDP

NTP

syslog

DNS

139. An engineer is adding a Cisco router to an existing environment. NTP authentication is configured on all devices in the environment with the command ntp authentication-key 1 md5 Clsc427128380. There are two routers on the network that are configured as NTP servers for redundancy, 192.168.1.110 and 192.168.1.111. 192.168.1.110 is configured as the authoritative time source.

What command must be configured on the new router to use 192.168.1.110 as its primary time source without the new router attempting to offer time to existing devices?

ntp server 192.168.1.110 primary key 1

ntp peer 192.168.1.110 prefer key 1

ntp server 192.168.1.110 key 1 prefer

ntp peer 192.168.1.110 key 1 primary

140. How does a cloud access security broker function?

It is an authentication broker to enable single sign-on and multi-factor authentication for a cloud solution

lt integrates with other cloud solutions via APIs and monitors and creates incidents based on events from the cloud solution

It acts as a security information and event management solution and receives syslog from other cloud solutions.

It scans other cloud solutions being used within the network and identifies vulnerabilities

Page 15 of 15

141. DRAG DROP

Drag and drop the cloud security assessment components from the left onto the definitions on the right.