Pass Your CCNP Security 350-701 Exam on Dec 03, 2021 with 358 Questions
350-701 Free Exam Study Guide! (Updated 358 Questions)
Best Revision Book: Introducing Cisco 350-701 Official Certification Guide
The CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide (1st Edition) is one of the most comprehensive study materials you can use to pass 350-701 exam. Why? Because it features a lot of exciting resources that will cover everything about the final test. Written by Omar Santos, this book presents the best combination of tools to help you master all the exam concepts easily. It has quizzes at the beginning of every chapter to help you know what you will cover in every section. Besides, it also has chapter review tasks that will help you achieve much more than just drilling on the vital exam concepts. All in all, the official cert guide for the Cisco 350-701 exam is not only valuable because of the exciting study plans it provides but also for the video instruction from the author, a lot of questions and exercises, and unmatched detail on every test objective to ensure you get everything right at the first attempt.
NEW QUESTION 63
Drag and drop the NetFlow export formats from the left onto the descriptions on the right.
Answer:
Explanation:
NEW QUESTION 64
A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?
- A. The file has a reputation score that is below the threshold
- B. The file has a reputation score that is above the threshold
- C. The policy was created to disable file analysis
- D. The policy was created to send a message to quarantine instead of drop
Answer: C
Explanation:
Maybe the "newly installed service" in this Qmentions about Advanced Malware Protection (AMP) which can be used along with ESA. AMP allows superior protection across the attack continuum.
+ File Reputation - captures a fingerprint of each file as it traverses the ESA and sends it to AMP's cloudbased intelligence network for a reputation verdict. Given these results, you can automatically block malicious files and apply administrator-defined policy.
+ File Analysis - provides the ability to analyze unknown files that are traversing the ESA. A highly secure sandbox environment enables AMP to glean precise details about the file's behavior and to combine that data with detailed human and machine analysis to determine the file's threat level. This disposition is then fed into AMP cloud-based intelligence network and used to dynamically update and expand the AMP cloud data set for enhanced protection
NEW QUESTION 65
Refer to the exhibit.
A network administrator configures command authorization for the admm5 user. What is the admin5 user able to do on HQ_Router after this configuration?
- A. add subinterfaces
- B. set the IP address of an interface
- C. complete all configurations
- D. complete no configurations
Answer: D
NEW QUESTION 66
Which SNMPv3 configuration must be used to support the strongest security possible?
- A. asa-host(config)#snmp-server group myv3 v3 priv
asa-host(config)#snmp-server user andy myv3 auth sha cisco priv des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy - B. asa-host(config)#snmp-server group myv3 v3 noauth
asa-host(config)#snmp-server user andy myv3 auth sha cisco priv 3des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy - C. asa-host(config)#snmp-server group myv3 v3 priv
asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy - D. asa-host(config)#snmp-server group myv3 v3 noauth
asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy
Answer: C
NEW QUESTION 67
Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?
- A. It defines a traffic baseline for traffic anomaly deduction.
- B. It allows traffic if it does not meet the profile.
- C. It blocks traffic if it does not meet the profile.
- D. It inspects hosts that meet the profile with more intrusion rules.
Answer: A
NEW QUESTION 68
Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat? (Choose Two)
- A. eastbound API
- B. westbound AP
- C. southbound API
- D. northbound API
Answer: C,D
NEW QUESTION 69
.
Refer to the exhibit What will happen when the Python script is executed?
- A. The hostname will be printed for the client in the client ID field.
- B. The script will translate the IP address to FODN and print it
- C. The hostname will be translated to an IP address and printed.
- D. The script will pull all computer hostnames and print them.
Answer: D
NEW QUESTION 70
What is the purpose of CA in a PKI?
- A. To create the private key for a digital certificate
- B. To validate the authenticity of a digital certificate
- C. To certify the ownership of a public key by the named subject
- D. To issue and revoke digital certificates
Answer: D
Explanation:
Explanation A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues. Reference: https://cheapsslsecurity.com/blog/understanding-the-role-of-certificate-authorities-in-pki/ A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues.
Explanation A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues. Reference: https://cheapsslsecurity.com/blog/understanding-the-role-of-certificate-authorities-in-pki/
NEW QUESTION 71
An MDM provides which two advantages to an organization with regards to device management? (Choose two.)
- A. critical device management
- B. network device management
- C. allowed application management
- D. asset inventory management
- E. Active Directory group policy management
Answer: A,C
NEW QUESTION 72
What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two)
- A. URL categorization
- B. command and control communication
- C. snort
- D. intelligent proxy
- E. data exfiltration
Answer: B,E
Explanation:
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
Reference:
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
NEW QUESTION 73
A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0380739941 address 0.0.0.0 command on host A.
The tunnel is not being established to hostB. What action is needed to authenticate the VPN?
- A. Change isakmp to ikev2 in the command on hostA.
- B. Enter the command with a different password on hostB.
- C. Enter the same command on hostB.
- D. Change the password on hostA to the default password.
Answer: C
NEW QUESTION 74
What is a benefit of using Cisco FMC over Cisco ASDM?
- A. Cisco FMC supports pushing configurations to devices while Cisco ASDM does not.
- B. Cisco FMC provides centralized management while Cisco ASDM does not.
- C. Cisco FMC supports all firewall products whereas Cisco ASDM only supports Cisco ASA devices
- D. Cisco FMC uses Java while Cisco ASDM uses HTML5.
Answer: B
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html
NEW QUESTION 75
Which feature is supported when deploying Cisco ASAv within AWS public cloud?
- A. IPv6
- B. multiple context mode
- C. clustering
- D. user deployment of Layer 3 networks
Answer: D
Explanation:
Explanation The ASAv on AWS supports the following features: + Support for Amazon EC2 C5 instances, the next generation of the Amazon EC2 Compute Optimized instance family. + Deployment in the Virtual Private Cloud (VPC) + Enhanced networking (SR-IOV) where available + Deployment from Amazon Marketplace + Maximum of four vCPUs per instance + User deployment of L3 networks + Routed mode (default) Note: The Cisco Adaptive Security Virtual Appliance (ASAv) runs the same software as physical Cisco ASAs to deliver proven security functionality in a virtual form factor. The ASAv can be deployed in the public AWS cloud. It can then be configured to protect virtual and physical data center workloads that expand, contract, or shift their location over time. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asav/quick-start-book/asav-96 qsg/asavaws.html The ASAv on AWS supports the following features:
+ Support for Amazon EC2 C5 instances, the next generation of the Amazon EC2 Compute Optimized instance family.
+ Deployment in the Virtual Private Cloud (VPC)
+ Enhanced networking (SR-IOV) where available
+ Deployment from Amazon Marketplace
+ Maximum of four vCPUs per instance
+ User deployment of L3 networks
+ Routed mode (default)
Note: The Cisco Adaptive Security Virtual Appliance (ASAv) runs the same software as physical Cisco ASAs to deliver proven security functionality in a virtual form factor. The ASAv can be deployed in the public AWS cloud.
Explanation The ASAv on AWS supports the following features: + Support for Amazon EC2 C5 instances, the next generation of the Amazon EC2 Compute Optimized instance family. + Deployment in the Virtual Private Cloud (VPC) + Enhanced networking (SR-IOV) where available + Deployment from Amazon Marketplace + Maximum of four vCPUs per instance + User deployment of L3 networks + Routed mode (default) Note: The Cisco Adaptive Security Virtual Appliance (ASAv) runs the same software as physical Cisco ASAs to deliver proven security functionality in a virtual form factor. The ASAv can be deployed in the public AWS cloud. It can then be configured to protect virtual and physical data center workloads that expand, contract, or shift their location over time. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asav/quick-start-book/asav-96 qsg/asavaws.html
NEW QUESTION 76
What provides visibility and awareness into what is currently occurring on the network?
- A. Telemetry
- B. CMX
- C. WMI
- D. Prime Infrastructure
Answer: A
Explanation:
Explanation : Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks. Reference: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/activethreat-analytics-premier.pdf Explanation:
Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks.
Explanation : Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks. Reference: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/activethreat-analytics-premier.pdf
NEW QUESTION 77
A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available. What must be done in order to securely connect this device to the network?
- A. Use 802.1X with posture assessment.
- B. Use MAB with posture assessment.
- C. Use 802.1X with profiling.
- D. Use MAB with profiling
Answer: D
Explanation:
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
Reference:
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
NEW QUESTION 78
An engineer has been tasked with implementing a solution that can be leveraged for securing the cloud users, data, and applications. There is a requirement to use the Cisco cloud native CASB and cloud cybersecurity platform. What should be used to meet these requirements?
- A. Cisco NGFW
- B. Cisco Umbrella
- C. Cisco Cloud Email Security
- D. Cisco Cloudlock
Answer: D
Explanation:
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
Reference:
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
NEW QUESTION 79
Refer to the exhibit.
A network administrator configured a site-to-site VPN tunnel between two Cisco IOS routers, and hosts are unable to communicate between two sites of VPN. The network administrator runs the debug crypto isakmp sa command to track VPN status What is the problem according to this command output?
- A. interesting traffic was not applied
- B. encryption algorithm mismatch
- C. hashing algorithm mismatch
- D. authentication key mismatch
Answer: D
NEW QUESTION 80
Which type of attack is social engineering?
- A. phishing
- B. malware
- C. MITM
- D. trojan
Answer: A
NEW QUESTION 81
An organization wants to secure users, data, and applications in the cloud. The solution must be API-based and operate as a cloud-native CASB. Which solution must be used for this implementation?
- A. Cisco Firepower Next-Generation Firewall
- B. Cisco Umbrella
- C. Cisco Cloud Email Security
- D. Cisco Cloudlock
Answer: D
Explanation:
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
Reference:
738565.pdf
Cisco Cloudlock: Secure your cloud users, data, and applications with the cloud-native Cloud Access Security Broker (CASB) and cloud cybersecurity platform.
738565.pdf
NEW QUESTION 82
A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?
- A. The file upload is abandoned.
- B. The file is queued for upload when connectivity is restored.
- C. The ESA immediately makes another attempt to upload the file.
- D. AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.
Answer: D
Explanation:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
NEW QUESTION 83
Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses and malware? (Choose two).
- A. DLP
- B. Sophos engine
- C. white list
- D. outbreak filters
- E. RAT
Answer: B,D
NEW QUESTION 84
Which public cloud provider supports the Cisco Next Generation Firewall Virtual?
- A. Google Cloud Platform
- B. VMware ESXi
- C. Red Hat Enterprise Visualization
- D. Amazon Web Services
Answer: D
Explanation:
Explanation
NEW QUESTION 85
......
350-701 Dumps for CCNP Security Certified Exam Questions & Answer: https://www.prep4away.com/Cisco-certification/braindumps.350-701.ete.file.html
Realistic Verified 350-701 exam dumps Q&As - 350-701 Free Update : https://drive.google.com/open?id=1otqqoy-4Ecrw2rqoCW8ccDM3WjnF64y2