Cisco CCNP Security 350-701 Questions & Answers

• Question 181:

  What is a function of the Layer 4 Traffic Monitor on a Cisco WSA?

  A. blocks traffic from URL categories that are known to contain malicious content

  B. decrypts SSL traffic to monitor for malicious content

  C. monitors suspicious traffic across all the TCP/UDP ports

  D. prevents data exfiltration by searching all the network traffic for specified sensitive information

  Correct Answer: C

• Question 182:

  What is a benefit of using Cisco CWS compared to an on-premises Cisco WSA?

  A. Cisco CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Cisco WSA does not

  B. Cisco CWS minimizes the load on the internal network and security infrastructure as compared to Cisco WSA.

  C. URL categories are updated more frequently on Cisco CWS than they are on Cisco WSA

  D. Content scanning for SAAS cloud applications is available through Cisco CWS and not available through Cisco WSA

  Correct Answer: A

• Question 183:

  An organization deploys multiple Cisco FTD appliances and wants to manage them using one centralized solution. The organization does not have a local VM but does have existing Cisco ASAs that must migrate over to Cisco FTDs. Which solution meets the needs of the organization?

  A. Cisco FMC

  B. CSM

  C. Cisco FDM

  D. CDO

  Correct Answer: A

• Question 184:

  An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users.

  A. Upload the organization root CA to the Umbrella admin portal

  B. Modify the user's browser settings to suppress errors from Umbrella.

  C. Restrict access to only websites with trusted third-party signed certificates.

  D. Import the Umbrella root CA into the trusted root store on the user's device.

  Correct Answer: A

• Question 185:

  What is the purpose of CA in a PKI?

  A. To issue and revoke digital certificates

  B. To validate the authenticity of a digital certificate

  C. To create the private key for a digital certificate

  D. To certify the ownership of a public key by the named subject

  Correct Answer: A

  Reference: https://cheapsslsecurity.com/blog/understanding-the-role-of-certificate- authorities-in-pki/

• Question 186:

  How does a cloud access security broker function?

  A. It is an authentication broker to enable single sign-on and multi-factor authentication for a cloud solution

  B. lt integrates with other cloud solutions via APIs and monitors and creates incidents based on events from the cloud solution

  C. It acts as a security information and event management solution and receives syslog from other cloud solutions.

  D. It scans other cloud solutions being used within the network and identifies vulnerabilities

  Correct Answer: B

  A Cloud Access Security Broker (CASB) is a security solution that integrates with cloud solutions such as Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS) via APIs. It monitors cloud usage and creates incidents based on events from the cloud solution. This allows organizations to gain visibility into and control over their cloud usage, helping to protect against security threats and ensure compliance with security policies and regulations. CASBs can perform a variety of security-related functions, including identity and access management, data loss prevention, threat protection, and compliance enforcement, among others. By acting as an intermediary between cloud solutions and the organization, CASBs help to bridge the gap between security and cloud adoption, allowing organizations to securely adopt and manage cloud services.

• Question 187:

  A customer has various external HTTP resources available including Intranet. Extranet, and Internet, with a proxy configuration running in explicit mode. Which method allows the client desktop browsers to be configured to select when to connect direct or when to use the proxy?

  A. Transparent mode

  B. Forward file

  C. PAC file

  D. Bridge mode

  Correct Answer: C

• Question 188:

  Which technology should be used to help prevent an attacker from stealing usernames and passwords of users within an organization?

  A. RADIUS-based REAP

  B. fingerprinting

  C. Dynamic ARP Inspection

  D. multifactor authentication

  Correct Answer: C

• Question 189:

  Which two criteria must a certificate meet before the WSA uses it to decrypt application traffic? (Choose two.)

  A. It must include the current date.

  B. It must reside in the trusted store of the WSA.

  C. It must reside in the trusted store of the endpoint.

  D. It must have been signed by an internal CA.

  E. it must contain a SAN.

  Correct Answer: AB

• Question 190:

  What is the intent of a basic SYN flood attack?

  A. to solicit DNS responses

  B. to exceed the threshold limit of the connection queue

  C. to flush the register stack to re-initiate the buffers

  D. to cause the buffer to overflow

  Correct Answer: B