Cisco CCNP Security 350-701 Questions & Answers

• Question 11:

  Refer to the exhibit.

  

  Which command results in these messages when attempting to troubleshoot an IPsec VPN connection?

  A. debug crypto isakmp connection

  B. debug crypto ipsec

  C. debug crypto ipsec endpoint

  D. debug crypto isakmp

  Correct Answer: D

• Question 12:

  Refer to the exhibit.

  

  An engineer must enable secure SSH protocols and enters this configuration. What are two results of running this set of commands on a Cisco router? (Choose two.)

  A. generates RSA key pairs on the router

  B. enables SSHv1 on the router

  C. uses the FQDN with the label command

  D. labels the key pairs to be used for SSH

  E. generates AES key pairs on the router

  Correct Answer: AD

• Question 13:

  A security audit recently revealed that an administrator is using the same password of C1$c0448845217 for his personal account across multiple systems. What must be implemented by the company to reduce the chances of this happening again?

  A. centralized user authentication

  B. role based access control

  C. security awareness training

  D. strict password policies

  Correct Answer: D

• Question 14:

  Which solution is more secure than the traditional use of a username and password and encompasses at least two of the methods of authentication?

  A. RADIUS/LDAP authentication

  B. single-sign on

  C. Kerberos security solution

  D. multifactor authentication

  Correct Answer: D

• Question 15:

  Which Cisco Umbrella package supports selective proxy for inspection of traffic from risky domains?

  A. DNS Security Advantage

  B. SIG Essentials

  C. DNS Security Essentials

  D. SIG Advantage

  Correct Answer: A

• Question 16:

  What are the two distribution methods available to an administrator when performing a fresh rollout of the Cisco AnyConnect Secure Mobility Client? (Choose two.)

  A. web deploy

  B. SFTP

  C. TFTP

  D. cloud update

  E. predeploy

  Correct Answer: AE

• Question 17:

  Which Cisco network security device supports contextual awareness?

  A. ISE

  B. Cisco IOS

  C. Cisco ASA

  D. Firepower

  Correct Answer: A

• Question 18:

  An organization is moving toward the zero-trust model. Which Cisco solution enables administrators to deploy and control microsegmentation of endpoints that are connected to a Cisco Data Center Virtual Edge, Cisco Application Virtual Switch, Microsoft vSwitch, and VMware vSphere Distributed Switch?

  A. Cisco Titration

  B. Cisco DCNM

  C. Cisco Stealthwatch

  D. Cisco ACI

  Correct Answer: D

• Question 19:

  In which two customer environments is the Cisco WSAv connector traffic direction method selected? (Choose two.)

  A. Customer owns ASA Appliance and Virtual Form Factor is required.

  B. Customer does not own Cisco hardware and needs Explicit Proxy.

  C. Customer owns ASA Appliance and SSL Tunneling is required.

  D. Customer needs to support roaming users.

  E. Customer does not own Cisco hardware and needs Transparent Redirection (WCCP).

  Correct Answer: AE

• Question 20:

  Which two VPN tunneling protocols support the use of IPsec to provide data integrity, authentication, and data encryption? (Choose two.)

  A. Secure Socket Tunneling Protocol

  B. OpenVPN

  C. Generic Routing Encapsulation Protocol

  D. Layer 2 Tunneling Protocol

  E. Point-to-Point Tunneling Protocol

  Correct Answer: CD