Cisco CCNP Security 350-701 Questions & Answers

• Question 161:

  Which function is performed by certificate authorities but is a limitation of registration authorities?

  A. accepts enrollment requests

  B. certificate re-enrollment

  C. verifying user identity

  D. CRL publishing

  Correct Answer: C

• Question 162:

  Which security product enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access?

  A. Cisco Content Platform

  B. Cisco Container Controller

  C. Cisco Container Platform

  D. Cisco Cloud Platform

  Correct Answer: C

• Question 163:

  An engineer is adding a Cisco DUO solution to the current TACACS+ deployment using Cisco ISE. The engineer wants to authenticate users using their account when they log into network devices. Which action accomplishes this task?

  A. Configure Cisco DUO with the external Active Directory connector and tie it to the policy set within Cisco ISE.

  B. Install and configure the Cisco DUO Authentication Proxy and configure the identity source sequence within Cisco ISE

  C. Create an identity policy within Cisco ISE to send all authentication requests to Cisco DUO.

  D. Modify the current policy with the condition MFASourceSequence DUO=true in the authorization conditions within Cisco ISE

  Correct Answer: B

  https://community.cisco.com/t5/security-documents/duo-mfa-integration-with-ise-for-tacacsdevice-administration/ta-p/3881767

• Question 164:

  When a next-generation endpoint security solution is selected for a company, what are two key deliverables that help justify the implementation? (Choose two.)

  A. signature-based endpoint protection on company endpoints

  B. macro-based protection to keep connected endpoints safe

  C. continuous monitoring of all files that are located on connected endpoints

  D. email integration to protect endpoints from malicious content that is located in email

  E. real-time feeds from global threat intelligence centers

  Correct Answer: CE

• Question 165:

  What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.)

  A. The eDirectory client must be installed on each client workstation.

  B. Create NTLM or Kerberos authentication realm and enable transparent user identification

  C. Deploy a separate Active Directory agent such as Cisco Context Directory Agent.

  D. Create an LDAP authentication realm and disable transparent user identification.

  E. Deploy a separate eDirectory server: the client IP address is recorded in this server

  Correct Answer: AB

  Details:

  https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11- 0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01001.html#:~:text=Transp arently%20identify%20users%20with%20authentication,User%20Identification%20with%

  20 LDAP.

• Question 166:

  An engineer needs to add protection for data in transit and have headers in the email message. Which configuration is needed to accomplish this goal?

  A. Provision the email appliance

  B. Deploy an encryption appliance.

  C. Map sender !P addresses to a host interface.

  D. Enable flagged message handling

  Correct Answer: A

• Question 167:

  What are two functionalities of SDN Northbound APIs? (Choose two.)

  A. Northbound APIs provide a programmable interface for applications to dynamically configure the network.

  B. Northbound APIs form the interface between the SDN controller and business applications.

  C. OpenFlow is a standardized northbound API protocol.

  D. Northbound APIs use the NETCONF protocol to communicate with applications.

  E. Northbound APIs form the interface between the SDN controller and the network switches or routers.

  Correct Answer: AB

• Question 168:

  How is data sent out to the attacker during a DNS tunneling attack?

  A. as part of the UDP/53 packet payload

  B. as part of the domain name

  C. as part of the TCP/53 packet header

  D. as part of the DNS response packet

  Correct Answer: B

  https://www.cynet.com/attack-techniques-hands-on/how-hackers-use-dns-tunneling-to-own-your-network/

• Question 169:

  What is a feature of NetFlow Secure Event Logging?

  A. It exports only records that indicate significant events in a flow.

  B. It filters NSEL events based on the traffic and event type through RSVP.

  C. It delivers data records to NSEL collectors through NetFlow over TCP only.

  D. It supports v5 and v8 templates.

  Correct Answer: A

• Question 170:

  How does Cisco Workload Optimization portion of the network do EPP solutions solely performance issues?

  A. It deploys an AWS Lambda system

  B. It automates resource resizing

  C. It optimizes a flow path

  D. It sets up a workload forensic score

  Correct Answer: B