Free CCNP Security 350-701 Ultimate Study Guide (Updated 630 Questions)
Get to the Top with 350-701 Practice Exam Questions
NEW QUESTION # 189
For Cisco IOS PKI, which two types of Servers are used as a distribution point for CRLs? (Choose two)
- A. SDP
- B. subordinate CA
- C. SCP
- D. HTTP
- E. LDAP
Answer: D,E
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/15-mt/sec-pki-15-mtbook/sec-pk
NEW QUESTION # 190
An engineer needs a cloud solution that will monitor traffic, create incidents based on events, and integrate with other cloud solutions via an API. Which solution should be used to accomplish this goal?
- A. SIEM
- B. CASB
- C. Cisco Cloudlock
- D. Adaptive MFA
Answer: C
Explanation:
+ Cisco Cloudlock continuously monitors cloud environments with a cloud Data Loss Prevention (DLP) engine to identify sensitive information stored in cloud environments in violation of policy.
+ Cloudlock is API-based.
+ Incidents are a key resource in the Cisco Cloudlock application. They are triggered by the Cloudlock policy engine when a policy detection criteria result in a match in an object (document, field, folder, post, or file).
Reference:
Note:
+ Security information and event management (SIEM) platforms collect log and event data from security systems, networks and computers, and turn it into actionable security insights.
+ An incident is a record of the triggering of an alerting policy. Cloud Monitoring opens an incident when a condition of an alerting policy has been met.
NEW QUESTION # 191
An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?
- A. Modify the access control policy to trust the industrial traffic
- B. Configure intrusion rules for the DNP3 preprocessor
- C. Implement pre-filter policies for the CIP preprocessor
- D. Enable traffic analysis in the Cisco FTD
Answer: B
Explanation:
Explanation"configure INTRUSION RULES for DNP3" -> Documentation states, that enabling INTRUSION RULES is mandatory for CIP to work + required preprocessors (in Network Access Policy - NAP) will be enabled automatically:
"If you want the CIP preprocessor rules listed in the following table to generate events, you MUST enable them. See Setting Intrusion Rule States for information on enabling rules."
"If the Modbus, DNP3, or CIP preprocessor is disabled, and you enable and deploy an intrusion rule that requires one of these preprocessors, the system automatically uses the required preprocessor, with its current settings, although the preprocessor remains disabled in the web interface for the corresponding network analysis policy."
[1]
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/scada
NEW QUESTION # 192
What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?
- A. Its events match all traffic classes in parallel.
- B. It provides stateless IP flow tracking that exports all records of a specific flow.
- C. It tracks the flow continuously and provides updates every 10 seconds.
- D. It tracks flow-create, flow-teardown, and flow-denied events.
Answer: D
Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/ monitor-nsel.html
NEW QUESTION # 193
What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two)
- A. URL categorization
- B. command and control communication
- C. intelligent proxy
- D. data exfiltration
- E. snort
Answer: B,D
Explanation:
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before. Detection and analytics features provided in Cognitive Threat Analytics are shown below: + Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content + Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats ... Reference: https://www.cisco.com/c/dam/en/us/products/collateral/security/cognitive-threat-analytics/at-aglance-c45-736555.pdf Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before. Detection and analytics features provided in Cognitive Threat Analytics are shown below: + Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content + Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats ... Reference: https://www.cisco.com/c/dam/en/us/products/collateral/security/cognitive-threat-analytics/at-aglance-c45-736555.pdf
NEW QUESTION # 194
Which algorithm provides encryption and authentication for data plane communication?
- A. SHA-96
- B. AES-256
- C. AES-GCM
- D. SHA-384
Answer: C
Explanation:
Explanation The data plane of any network is responsible for handling data packets that are transported across the network. (The data plane is also sometimes called the forwarding plane.) Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?). In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates. Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge/security-book/ security-overview.html The data plane of any network is responsible for handling data packets that are transported across the network.
(The data plane is also sometimes called the forwarding plane.)
Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?).
In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates.
Explanation The data plane of any network is responsible for handling data packets that are transported across the network. (The data plane is also sometimes called the forwarding plane.) Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?). In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates. Reference: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/security/vedge/security-book/ security-overview.html
NEW QUESTION # 195
Refer to the exhibit.
An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?
- A. authentication open
- B. cisp enable
- C. dot1x pae authenticator
- D. dotlx reauthentication
Answer: C
NEW QUESTION # 196
Which group within Cisco writes and publishes a weekly newsletter to help cybersecurity professionals remain aware of the ongoing and most prevalent threats?
- A. CSIRT
- B. DEVNET
- C. PSIRT
- D. Talos
Answer: D
Explanation:
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Reference:
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
NEW QUESTION # 197
An engineer needs to configure a Cisco Secure Email Gateway (SEG) to prompt users to enter multiple forms of identification before gaining access to the SEG. The SEG must also join a cluster using the preshared key of cisc421555367. What steps must be taken to support this?
- A. Enable two-factor authentication through a RADIUS server, and then join the cluster via the SEG CLI
- B. Enable two-factor authentication through a TACACS+ server, and then join the cluster via the SEG GUI.
- C. Enable two-factor authentication through a TACACS+ server, and then join the cluster via the SEG CLI.
- D. Enable two-factor authentication through a RADIUS server, and then join the cluster via the SEG GUI.
Answer: A
NEW QUESTION # 198
Which two protocols must be configured to authenticate end users to the Cisco WSA? (Choose two.)
- A. Kerberos
- B. RADIUS
- C. NTLMSSP
- D. CHAP
- E. TACACS+
Answer: A,C
Explanation:
The Cisco WSA supports mainly two authentication protocols: LDAP and NTLM. LDAP is a standard protocol for accessing directory services, such as Active Directory or OpenLDAP. NTLM is a proprietary protocol for authenticating Windows clients to Windows servers. NTLM has two versions: NTLMv1 and NTLMv2. NTLMSSP (NT LAN Manager Security Support Provider) is a variant of NTLMv2 that provides additional security features, such as message integrity and confidentiality. The Cisco WSA supports both LDAP and NTLMSSP using basic authentication, which requires the user to enter a username and password.
The Cisco WSA also supports Kerberos, which is a network authentication protocol that uses tickets to authenticate users and services. Kerberos is based on symmetric-key cryptography and requires a trusted third party, called the Key Distribution Center (KDC), to issue and validate tickets. Kerberos is more secure and efficient than NTLM, as it does not require the user to enter credentials repeatedly and does not send passwords over the network. The Cisco WSA supports Kerberos only in standard mode, not in cloud connector mode. The Cisco WSA does not support TACACS+ or CHAP as authentication protocols. TACACS+ is a Cisco proprietary protocol for authenticating network devices and users to a central server. CHAP is a challenge-response protocol for authenticating PPP connections. These protocols are not designed for web security appliances and are not compatible with the Cisco WSA. References:
* User Guide for AsyncOS 11.0 for Cisco Web Security Appliances (Section: Acquire End-User Credentials)
* Cisco WSA Authentication
* WSA Authentication
NEW QUESTION # 199
What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?
- A. Flow-create events are delayed.
- B. Advanced NetFlow v9 templates and legacy v5 formatting are supported.
- C. Secure NetFlow connections are optimized for Cisco Prime Infrastructure
- D. Multiple NetFlow collectors are supported.
Answer: A
Explanation:
Reference:
NEW QUESTION # 200
Drag and drop the threats from the left onto examples of that threat on the right
Answer:
Explanation:
NEW QUESTION # 201
Drag and drop the posture assessment flow actions from the left into a sequence on the right.
Answer:
Explanation:
NEW QUESTION # 202
Which risk is created when using an Internet browser to access cloud-based service?
- A. misconfiguration of infrastructure, which allows unauthorized access
- B. insecure implementation of API
- C. vulnerabilities within protocol
- D. intermittent connection to the cloud connectors
Answer: B
NEW QUESTION # 203
What is the function of the crypto is a kmp key cisc406397954 address 0.0.0.0 0.0.0.0 command when establishing an IPsec VPN tunnel?
- A. lt configures the pre-shared authentication key
- B. It prevents all IP addresses from connecting to the VPN server.
- C. It configures the local address for the VPN server.
- D. It defines what data is going to be encrypted via the VPN
Answer: A
NEW QUESTION # 204
What is a benefit of using Cisco CWS compared to an on-premises Cisco WSA?
- A. Cisco CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Cisco WSA does not
- B. Content scanning for SAAS cloud applications is available through Cisco CWS and not available through Cisco WSA
- C. Cisco CWS minimizes the load on the internal network and security infrastructure as compared to Cisco WSA.
- D. URL categories are updated more frequently on Cisco CWS than they are on Cisco WSA
Answer: B
NEW QUESTION # 205
Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?
- A. Threat Intelligence Director
- B. Cisco Talos Intelligence
- C. Cognitive Threat Analytics
- D. Encrypted Traffic Analytics
Answer: A
Explanation:
The product that allows Cisco FMC to push security intelligence observable to its sensors from other products is Threat Intelligence Director (TID). TID is a feature of Cisco FMC that enables you to integrate third-party threat intelligence feeds into your security policies. TID collects, aggregates, and correlates observables from multiple sources, such as Cisco Talos Intelligence, Cisco Umbrella, and other external providers. TID then pushes the observables to the sensors that are managed by FMC, such as Firepower Threat Defense (FTD) devices, Firepower appliances, and Cisco Secure Firewall Cloud Native. The sensors can then use the observables to block or monitor traffic based on the reputation and threat level of the IP addresses, URLs, and domains12.
References: 1: Firepower Management Center Configuration Guide, Version 6.6 - Threat Intelligence Director
[Cisco Secure Firewall Management Center] - Cisco 2: Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.6 - Threat Intelligence Director [Cisco Firepower NGFW] - Cisco
NEW QUESTION # 206
Refer to the exhibit.
Which statement about the authentication protocol used in the configuration is true?
- A. There are separate authentication and authorization request packets
- B. The authentication request contains only a username
- C. The authentication request contains only a password
- D. The authentication and authorization requests are grouped in a single packet
Answer: D
Explanation:
ExplanationThis command uses RADIUS which combines authentication and authorization in one function (packet).
NEW QUESTION # 207
What are the two types of managed Intercloud Fabric deployment models? (Choose two.)
- A. Service Provider managed
- B. User managed
- C. Hybrid managed
- D. Enterprise managed
- E. Public managed
Answer: A,C
Explanation:
Reference:
NEW QUESTION # 208
Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?
- A. aaa server radius dynamic-author
- B. aaa new-model
- C. auth-type all
- D. ip device-tracking
Answer: B
NEW QUESTION # 209
Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?
- A. security intelligence
- B. URL filtering
- C. impact flags
- D. health monitoring
Answer: A
NEW QUESTION # 210
Which action must be taken in the AMP for Endpoints console to detect specific MD5 signatures on endpoints and then quarantine the files?
- A. Configure an application custom detection list
- B. Configure an IP Block & Allow custom detection list
- C. Configure an advanced custom detection list.
- D. Configure a simple custom detection list
Answer: C
NEW QUESTION # 211
Under which two circumstances is a CoA issued? (Choose two.)
- A. An endpoint is profiled for the first time.
- B. An endpoint is deleted on the Identity Service Engine server.
- C. A new Identity Source Sequence is created and referenced in the authentication policy.
- D. A new Identity Service Engine server is added to the deployment with the Administration persona.
- E. A new authentication rule was added to the policy on the Policy Service node.
Answer: A,B
Explanation:
Explanation/Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html
NEW QUESTION # 212
A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address Error! Hyperlink reference not valid. IP>/capure/CAPI/pcap/test.pcap, an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?
- A. Disable the proxy setting on the browser
- B. Disable the HTTPS server and use HTTP instead
- C. Use the Cisco FTD IP address as the proxy server setting on the browser
- D. Enable the HTTPS server for the device platform policy
Answer: D
NEW QUESTION # 213
What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?
- A. Cisco Threat Grid
- B. Cisco Umbrella
- C. Cisco Stealthwatch
- D. External Threat Feeds
Answer: A
Explanation:
Reference:
https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligencedirector
NEW QUESTION # 214
......
Pass Cisco 350-701 exam - questions - convert Tets Engine to PDF: https://guidetorrent.dumpstorrent.com/350-701-exam-prep.html