Cisco CCNP Security 350-701 Questions & Answers

• Question 131:

  When NetFlow is applied to an interface, which component creates the flow monitor cache that is used to collect traffic based on the key and nonkey fields in the configured record?

  A. records

  B. flow exporter

  C. flow sampler

  D. flow monitor

  Correct Answer: D

• Question 132:

  What is the term for the concept of limiting communication between applications or containers on the same node?

  A. container orchestration

  B. software-defined access

  C. microservicing

  D. microsegmentation

  Correct Answer: D

• Question 133:

  What is the recommendation in a zero-trust model before granting access to corporate applications and resources?

  A. to use multifactor authentication

  B. to use strong passwords

  C. to use a wired network, not wireless

  D. to disconnect from the network when inactive

  Correct Answer: A

• Question 134:

  What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?

  A. Telemetry uses a pull mehod, which makes it more reliable than SNMP

  B. Telemetry uses push and pull, which makes it more scalable than SNMP

  C. Telemetry uses push and pull which makes it more secure than SNMP

  D. Telemetry uses a push method which makes it faster than SNMP

  Correct Answer: D

  SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real- time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios- xe/#!streaming-telemetry-quick-startguide/streaming telemetry

• Question 135:

  An administrator enables Cisco Threat Intelligence Director on a Cisco FMC. Which process uses STIX and allows uploads and downloads of block lists?

  A. consumption

  B. sharing

  C. editing

  D. authoring

  Correct Answer: A

• Question 136:

  What is a functional difference between Cisco AMP for Endpoints and Cisco Umbrella Roaming Client?

  A. The Umbrella Roaming client stops and tracks malicious activity on hosts, and AMP for Endpoints tracks only URL-based threats.

  B. The Umbrella Roaming Client authenticates users and provides segmentation, and AMP for Endpoints allows only for VPN connectivity

  C. AMP for Endpoints authenticates users and provides segmentation, and the Umbrella Roaming Client allows only for VPN connectivity.

  D. AMP for Endpoints stops and tracks malicious activity on hosts, and the Umbrella Roaming Client tracks only URL-based threats.

  Correct Answer: B

• Question 137:

  What is a description of microsegmentation?

  A. Environments deploy a container orchestration platform, such as Kubernetes, to manage the application delivery.

  B. Environments apply a zero-trust model and specify how applications on different servers or containers can communicate.

  C. Environments deploy centrally managed host-based firewall rules on each server or container.

  D. Environments implement private VLAN segmentation to group servers with similar applications.

  Correct Answer: B

• Question 138:

  Which type of data does the Cisco Stealthwatch system collect and analyze from routers, switches, and firewalls?

  A. NTP

  B. syslog

  C. SNMP

  D. NetFlow

  Correct Answer: D

• Question 139:

  An administrator configures new authorization policies within Cisco ISE and has difficulty profiling the devices. Attributes for the new Cisco IP phones that are profiled based on the RADIUS authentication are seen however the attributes for CDP or DHCP are not. What should the administrator do to address this issue?

  A. Configure the ip dhcp snooping trust command on the DHCP interfaces to get the information to Cisco ISE

  B. Configure the authentication port-control auto feature within Cisco ISE to identify the devices that are trying to connect

  C. Configure a service template within the switch to standardize the port configurations so that the correct information is sent to Cisco ISE

  D. Configure the device sensor feature within the switch to send the appropriate protocol information

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services- engine/200292-ConfigureDevice-Sensor-for-ISE-Profilin.html

• Question 140:

  Refer to the exhibit.

  

  A network engineer is testing NTP authentication and realizes that any device synchronizes time with this router and that NTP authentication is not enforced. What is the cause of this issue?

  A. The key was configured in plain text.

  B. NTP authentication is not enabled.

  C. The hashing algorithm that was used was MD5. which is unsupported.

  D. The router was not rebooted after the NTP configuration updated.

  Correct Answer: B