[Apr-2023] The Best CCNP Security 350-701 Professional Exam Questions
Try 100% Updated 350-701 Exam Questions [2023]
NEW QUESTION # 92
Drag and drop the posture assessment flow actions from the left into a sequence on the right.
Answer:
Explanation:
NEW QUESTION # 93
Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other third-party management tools, and prioritize application traffic?
- A. Cisco Security Intelligence
- B. Cisco DNA Center
- C. Cisco Application Visibility and Control
- D. Cisco Model Driven Telemetry
Answer: C
NEW QUESTION # 94
Refer to the exhibit.
What is a result of the configuration?
- A. Traffic from the DMZ network is redirected.
- B. Traffic from the inside network is redirected.
- C. Traffic from the inside and DMZ networks is redirected.
- D. All TCP traffic is redirected.
Answer: C
NEW QUESTION # 95
What is a key difference between Cisco Firepower and Cisco ASA?
- A. Cisco ASA provides SSL inspection while Cisco Firepower does not.
- B. Cisco Firepower provides identity-based access control while Cisco ASA does not.
- C. Cisco ASA provides access control while Cisco Firepower does not.
- D. Cisco Firepower natively provides intrusion prevention capabilities while Cisco ASA does not.
Answer: D
NEW QUESTION # 96
Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)
- A. SSL
- B. inline normalization
- C. SIP
- D. packet decoder
- E. modbus
Answer: A,C
NEW QUESTION # 97
What does Cisco AMP for Endpoints use to help an organization detect different families of malware?
- A. Spero Engine with machine learning to perform dynamic analysis
- B. Ethos Engine to perform fuzzy fingerprinting
- C. Tetra Engine to detect malware when me endpoint is connected to the cloud
- D. Clam AV Engine to perform email scanning
Answer: B
Explanation:
ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected.
ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected.
ETHOS is the Cisco file grouping engine. It allows us to group families of files together so if we see variants of a malware, we mark the ETHOS hash as malicious and whole families of malware are instantly detected.
Reference:
ETHOS = Fuzzy Fingerprinting using static/passive heuristics
ETHOS = Fuzzy Fingerprinting using static/passive heuristics
NEW QUESTION # 98
An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows
10.What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?
- A. Cisco Stealthwatch and Cisco Identity Services Engine integration
- B. Cisco Identity Services Engine and AnyConnect Posture module
- C. Cisco Identity Services Engine with PxGrid services enabled
- D. Cisco ASA firewall with Dynamic Access Policies configured
Answer: B
NEW QUESTION # 99
An organization is implementing URL blocking using Cisco Umbrell
a. The users are able to go to some sites
but other sites are not accessible due to an error. Why is the error occurring?
- A. Intelligent proxy and SSL decryption is disabled in the policy
- B. Client computers do not have the Cisco Umbrella Root CA certificate installed.
- C. IP-Layer Enforcement is not configured.
- D. Client computers do not have an SSL certificate deployed from an internal CA server.
Answer: B
Explanation:
Other features are dependent on SSL Decryption functionality, which requires the Cisco Umbrella root certificate. Having the SSL Decryption feature improves:
Custom URL Blocking-Required to block the HTTPS version of a URL.
...
Umbrella's Block Page and Block Page Bypass features present an SSL certificate to browsers that make connections to HTTPS sites. This SSL certificate matches the requested site but will be signed by the Cisco Umbrella certificate authority (CA). If the CA is not trusted by your browser, an error page may be displayed.
Typical errors include "The security certificate presented by this website was not issued by a trusted certificate authority" (Internet Explorer), "The site's security certificate is not trusted!" (Google Chrome) or "This Connection is Untrusted" (Mozilla Firefox). Although the error page is expected, the message displayed can be confusing and you may wish to prevent it from appearing.
To avoid these error pages, install the Cisco Umbrella root certificate into your browser or the browsers of your users-if you're a network admin.
Other features are dependent on SSL Decryption functionality, which requires the Cisco Umbrella root certificate. Having the SSL Decryption feature improves:
Custom URL Blocking-Required to block the HTTPS version of a URL.
...
Umbrella's Block Page and Block Page Bypass features present an SSL certificate to browsers that make connections to HTTPS sites. This SSL certificate matches the requested site but will be signed by the Cisco Umbrella certificate authority (CA). If the CA is not trusted by your browser, an error page may be displayed.
Typical errors include "The security certificate presented by this website was not issued by a trusted certificate authority" (Internet Explorer), "The site's security certificate is not trusted!" (Google Chrome) or "This Connection is Untrusted" (Mozilla Firefox). Although the error page is expected, the message displayed can be confusing and you may wish to prevent it from appearing.
To avoid these error pages, install the Cisco Umbrella root certificate into your browser or the browsers of your users-if you're a network admin.
Reference:
Other features are dependent on SSL Decryption functionality, which requires the Cisco Umbrella root certificate. Having the SSL Decryption feature improves:
Custom URL Blocking-Required to block the HTTPS version of a URL.
...
Umbrella's Block Page and Block Page Bypass features present an SSL certificate to browsers that make connections to HTTPS sites. This SSL certificate matches the requested site but will be signed by the Cisco Umbrella certificate authority (CA). If the CA is not trusted by your browser, an error page may be displayed.
Typical errors include "The security certificate presented by this website was not issued by a trusted certificate authority" (Internet Explorer), "The site's security certificate is not trusted!" (Google Chrome) or "This Connection is Untrusted" (Mozilla Firefox). Although the error page is expected, the message displayed can be confusing and you may wish to prevent it from appearing.
To avoid these error pages, install the Cisco Umbrella root certificate into your browser or the browsers of your users-if you're a network admin.
NEW QUESTION # 100
Drag and drop the solutions from the left onto the solution's benefits on the right.
Answer:
Explanation:
Explanation:
Cisco Stealthwatch - rapidly collects and analyzes netflow and telementy data to deliver in-depth visibility and understanding of network traffic Cisco ISE - obtains contextual identity and profiles for all users and device Cisco TrustSec - software defined segmentation that uses SGTs Cisco Umbrella - secure internet gateway ion the cloud that provides a security solution
NEW QUESTION # 101
The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic.
Where must the ASA be added on the Cisco UC Manager platform?
- A. Secured Collaboration Proxy
- B. Endpoint Trust List
- C. Certificate Trust List
- D. Enterprise Proxy Service
Answer: C
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/special/unified-communications/guide/unified- comm/unified-comm-tlsproxy.html
NEW QUESTION # 102
An organization has noticed an increase in malicious content downloads and wants to use Cisco Umbrella to prevent this activity for suspicious domains while allowing normal web traffic. Which action will accomplish this task?
- A. Configure the intelligent proxy.
- B. Configure application block lists.
- C. Set content settings to High
- D. Use destination block lists.
Answer: A
Explanation:
Obviously, if you allow all traffic to these risky domains, users might access malicious content, resulting in an infection or data leak. But if you block traffic, you can expect false positives, an increase in support inquiries, and thus, more headaches. By only proxying risky domains, the intelligent proxy delivers more granular visibility and control.
The intelligent proxy bridges the gap by allowing access to most known good sites without being proxied and only proxying those that pose a potential risk. The proxy then filters and blocks against specific URLs hosting malware while allowing access to everything else.
Obviously, if you allow all traffic to these risky domains, users might access malicious content, resulting in an infection or data leak. But if you block traffic, you can expect false positives, an increase in support inquiries, and thus, more headaches. By only proxying risky domains, the intelligent proxy delivers more granular visibility and control.
The intelligent proxy bridges the gap by allowing access to most known good sites without being proxied and only proxying those that pose a potential risk. The proxy then filters and blocks against specific URLs hosting malware while allowing access to everything else.
Reference:
Obviously, if you allow all traffic to these risky domains, users might access malicious content, resulting in an infection or data leak. But if you block traffic, you can expect false positives, an increase in support inquiries, and thus, more headaches. By only proxying risky domains, the intelligent proxy delivers more granular visibility and control.
The intelligent proxy bridges the gap by allowing access to most known good sites without being proxied and only proxying those that pose a potential risk. The proxy then filters and blocks against specific URLs hosting malware while allowing access to everything else.
NEW QUESTION # 103
What is the result of running thecrypto isakmp key ciscXXXXXXXX address 172.16.0.0command?
- A. secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX
- B. authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
- C. authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
- D. authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
Answer: D
NEW QUESTION # 104
What must be configured in Cisco ISE to enforce reauthentication of an endpoint session when an endpoint is deleted from an identity group?
- A. external identity source
- B. SNMP probe
- C. CoA
- D. posture assessment
Answer: D
NEW QUESTION # 105
Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based?
(Choose two)
- A. port numbers
- B. URLs
- C. protocol IDs
- D. MAC addresses
- E. IP addresses
Answer: B,E
Explanation:
Security Intelligence Sources ... Custom Block lists or feeds (or objects or groups) Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-configguide-v623/security_intelligence_blacklisting.html
...
Custom Block lists or feeds (or objects or groups)
Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy.
Security Intelligence Sources ... Custom Block lists or feeds (or objects or groups) Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses, you can also use network objects or groups.) For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-configguide-v623/security_intelligence_blacklisting.html
NEW QUESTION # 106
What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?
- A. Secure NetFlow connections are optimized for Cisco Prime Infrastructure
- B. Flow-create events are delayed
- C. Multiple NetFlow collectors are supported
- D. Advanced NetFlow v9 templates and legacy v5 formatting are supported
Answer: D
Explanation:
The ASA and ASASM implementations of NetFlow Secure Event Logging (NSEL) provide the following major functions: ... - Delays the export of flow-create events. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/ monitor-nsel.pdf
...
- Delays the export of flow-create events.
The ASA and ASASM implementations of NetFlow Secure Event Logging (NSEL) provide the following major functions: ... - Delays the export of flow-create events. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/ monitor-nsel.pdf
NEW QUESTION # 107
A network administrator is configuring a rule in an access control policy to block certain URLs and selects the "Chat and Instant Messaging" category. Which reputation score should be selected to accomplish this goal?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
We choose "Chat and Instant Messaging" category in "URL Category":
To block certain URLs we need to choose URL Reputation from 6 to 10.
NEW QUESTION # 108
An organization has DHCP servers set up to allocate IP addresses to clients on the LAN. What must be done to ensure the LAN switches prevent malicious DHCP traffic while also distributing IP addresses to the correct endpoints?
- A. Configure DHCP snooping and set a trusted interface for the DHCP server
- B. Configure Dynamic ARP Inspection and add entries in the DHCP snooping database
- C. Configure DHCP snooping and set an untrusted interface for all clients
- D. Configure Dynamic ARP Inspection and antispoofing ACLs in the DHCP snooping database
Answer: B
NEW QUESTION # 109
What are two recommended approaches to stop DNS tunneling for data exfiltration and command and control call backs? (Choose two.)
- A. Use Cisco Umbrella.
- B. Use next generation firewalls.
- C. Enforce security over port 53.
- D. Use intrusion prevention system.
- E. Block all TXT DNS records.
Answer: A,C
NEW QUESTION # 110
An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?
- A. Cisco Stealthwatch
- B. Cisco AMP
- C. Cisco Umbrella
- D. Cisco Tetration
Answer: D
Explanation:
Explanation Explanation Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud. Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies. To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change. Reference: https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/solutionoverview-c22-739268.pdf Explanation Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud.
Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies.
To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change.
Explanation Explanation Micro-segmentation secures applications by expressly allowing particular application traffic and, by default, denying all other traffic. Micro-segmentation is the foundation for implementing a zero-trust security model for application workloads in the data center and cloud. Cisco Tetration is an application workload security platform designed to secure your compute instances across any infrastructure and any cloud. To achieve this, it uses behavior and attribute-driven microsegmentation policy generation and enforcement. It enables trusted access through automated, exhaustive context from various systems to automatically adapt security policies. To generate accurate microsegmentation policy, Cisco Tetration performs application dependency mapping to discover the relationships between different application tiers and infrastructure services. In addition, the platform supports "what-if" policy analysis using real-time data or historical data to assist in the validation and risk assessment of policy application pre-enforcement to ensure ongoing application availability. The normalized microsegmentation policy can be enforced through the application workload itself for a consistent approach to workload microsegmentation across any environment, including virtualized, bare-metal, and container workloads running in any public cloud or any data center. Once the microsegmentation policy is enforced, Cisco Tetration continues to monitor for compliance deviations, ensuring the segmentation policy is up to date as the application behavior change. Reference: https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/solutionoverview-c22-739268.pdf
NEW QUESTION # 111
Which benefit does DMVPN provide over GETVPN?
- A. DMVPN supports QoS, multicast, and routing, and GETVPN supports only QoS.
- B. DMVPN is a tunnel-less VPN, and GETVPN is tunnel-based.
- C. DMVPN can be used over the public Internet, and GETVPN requires a private network.
- D. DMVPN supports non-IP protocols, and GETVPN supports only IP protocols.
Answer: C
NEW QUESTION # 112
......
350-701 Exam Questions Get Updated [2023] with Correct Answers: https://www.dumpstillvalid.com/350-701-prep4sure-review.html
Pass 350-701 Exam - Real Questions and Answers: https://drive.google.com/open?id=1TIjfB5v_DFWlTpmnoXIaKLgdoVh_h6_m
