Cisco CCNP Security 350-701 Questions & Answers

• Question 121:

  What are two facts about WSA HTTP proxy configuration with a PAC file? (Choose two.)

  A. It is defined as a Transparent proxy deployment.

  B. In a dual-NIC configuration, the PAC file directs traffic through the two NICs to the proxy.

  C. The PAC file, which references the proxy, is deployed to the client web browser.

  D. It is defined as an Explicit proxy deployment.

  E. It is defined as a Bridge proxy deployment.

  Correct Answer: CD

• Question 122:

  Which endpoint solution protects a user from a phishing attack?

  A. Cisco Identity Services Engine

  B. Cisco AnyConnect with ISE Posture module

  C. Cisco AnyConnect with Network Access Manager module

  D. Cisco AnyConnect with Umbrella Roaming Security module

  Correct Answer: D

• Question 123:

  An organization wants to provide visibility and to identify active threats in its network using a VM. The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network. Which solution meets these requirements?

  A. Cisco Umbrella Cloud

  B. Cisco Stealthwatch Cloud PNM

  C. Cisco Stealthwatch Cloud PCM

  D. Cisco Umbrella On-Premises

  Correct Answer: B

  Reference: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/5eU6DfQV/LTRSEC-2240- LG2.pdf

• Question 124:

  With Cisco AMP for Endpoints, which option shows a list of all files that have been executed in your environment?

  A. Prevalence

  B. File analysis

  C. Detections

  D. Vulnerable software

  E. Threat root cause

  Correct Answer: A

  Reference: https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf

• Question 125:

  Why is it important for the organization to have an endpoint patching strategy?

  A. so the organization can identify endpoint vulnerabilities

  B. so the internal PSIRT organization is aware of the latest bugs

  C. so the network administrator is notified when an existing bug is encountered

  D. so the latest security fixes are installed on the endpoints

  Correct Answer: D

• Question 126:

  Which direction do attackers encode data in DNS requests during exfiltration using DNS tunneling?

  A. inbound

  B. north-south

  C. east-west

  D. outbound

  Correct Answer: D

• Question 127:

  What are two workloaded security models? (Choose two)

  A. SaaS

  B. IaaS

  C. on-premises

  D. off-premises

  E. PaaS

  Correct Answer: CD

• Question 128:

  Which Cisco AMP feature allows an engineer to look back to trace past activities, such as file and process activity on an endpoint?

  A. endpoint isolation

  B. advanced search

  C. advanced investigation

  D. retrospective security

  Correct Answer: D

• Question 129:

  What is a difference between GETVPN and IPsec?

  A. GETVPN reduces latency and provides encryption over MPLS without the use of a central hub

  B. GETVPN provides key management and security association management

  C. GETVPN is based on IKEv2 and does not support IKEv1

  D. GETVPN is used to build a VPN network with multiple sites without having to statically configure all devices

  Correct Answer: A

  GETVPN Simplifies branch-to-branch instantaneous communications - Ensures low latency and jitter by enabling full-time, direct communications between sites, without requiring transport through a central hub

  Maximizes security - Provides encryption for MPLS networks while maintaining network intelligence such as full-mesh connectivity, natural routing path, and quality of service (QoS)

  Complies with governmental regulation and privacy laws - Helps you meet security compliance and internal regulation by encrypting all WAN traffic

  Offers management flexibility - Eliminates complex peer-to-peer key management with group encryption keys

• Question 130:

  Why should organizations migrate to an MFA strategy for authentication?

  A. Single methods of authentication can be compromised more easily than MFA.

  B. Biometrics authentication leads to the need for MFA due to its ability to be hacked easily.

  C. MFA methods of authentication are never compromised.

  D. MFA does not require any piece of evidence for an authentication mechanism.

  Correct Answer: A