Cisco CCNP Security 350-701 Questions & Answers

• Question 111:

  DRAG DROP

  Drag and drop the Firepower Next Generation Intrustion Prevention System detectors from the left onto the correct definitions on the right.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/detecting_specific_threats.html

• Question 112:

  DRAG DROP

  Drag and drop the capabilities from the left onto the correct technologies on the right.

  Select and Place:

  

  Correct Answer:

  

  prevention = Next generation intrusion prevention system Protect = Advanced Malware Protection Application Layer = Application control and URL filtering Combined integrated = Cisco web security Appliance

• Question 113:

  Which solution stops unauthorized access to the system if a user's password is compromised?

  A. VPN

  B. MFA

  C. AMP

  D. SSL

  Correct Answer: B

• Question 114:

  Refer to the exhibit.

  

  Which configuration item makes it possible to have the AAA session on the network?

  A. aaa authentication login console ise

  B. aaa authentication enable default enable

  C. aaa authorization network default group ise

  D. aaa authorization exec default ise

  Correct Answer: C

• Question 115:

  Refer to the exhibit.

  

  What is the function of the Python script code snippet for the Cisco ASA REST API?

  A. adds a global rule into policies

  B. changes the hostname of the Cisco ASA

  C. deletes a global rule from policies

  D. obtains the saved configuration of the Cisco ASA firewall

  Correct Answer: A

• Question 116:

  Which type of attack is MFA an effective deterrent for?

  A. ping of death

  B. phishing

  C. teardrop

  D. syn flood

  Correct Answer: B

• Question 117:

  Refer to the exhibit.

  

  What does the API key do while working with https://api.amp.cisco.com/v1/computers?

  A. displays client ID

  B. HTTP authorization

  C. Imports requests

  D. HTTP authentication

  Correct Answer: D

• Question 118:

  An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router.

  The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of 172.19.20.24. Which command on the hub will allow the administrator to accomplish this?

  A. crypto ca identity 172.19.20.24

  B. crypto isakmp key Cisco0123456789 172.19.20.24

  C. crypto enrollment peer address 172.19.20.24

  D. crypto isakmp identity address 172.19.20.24

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr- book/sec-crc4.html

  #wp3880782430The command "crypto enrollment peer address" is not valid either.The command "crypto ca identity ..." is only used to declare a trusted CA for the router and puts you in the caidentity configuration mode. Also it should be followed by a name, not an IP address. For example: "crypto caidentity CA-Server" -> Answer A is not correct.Only answer B is the best choice left.

• Question 119:

  Which security solution protects users leveraging DNS-layer security?

  A. Cisco ISE

  B. Cisco FTD

  C. Cisco Umbrella

  D. Cisco ASA

  Correct Answer: C

• Question 120:

  Which technology enables integration between Cisco ISE and other platforms to gather and share network and vulnerability data and SIEM and location information?

  A. pxGrid

  B. NetFlow

  C. SNMP

  D. Cisco Talos

  Correct Answer: A