Cisco CCNP Security 350-701 Questions & Answers

• Question 191:

  What are two features of NetFlow flow monitoring? (Choose two)

  A. Can track ingress and egress information

  B. Include the flow record and the flow importer

  C. Copies all ingress flow information to an interface

  D. Does not required packet sampling on interfaces

  E. Can be used to track multicast, MPLS, or bridged traffic

  Correct Answer: AE

  Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15- mt/nf-15-mt-book/cfgmpls-netflow.html

• Question 192:

  Which technology provides the benefit of Layer 3 through Layer 7 innovative deep packet inspection, enabling the platform to identify and output various applications within the network traffic flows?

  A. Cisco NBAR2

  B. Cisco ASAV

  C. Account on Resolution

  D. Cisco Prime Infrastructure

  Correct Answer: A

• Question 193:

  How does the Cisco WSA enforce bandwidth restrictions for web applications?

  A. It implements a policy route to redirect application traffic to a lower-bandwidth link.

  B. It dynamically creates a scavenger class QoS policy and applies it to each client that connects through the WSA.

  C. It sends commands to the uplink router to apply traffic policing to the application traffic.

  D. It simulates a slower link by introducing latency into application traffic.

  Correct Answer: C

• Question 194:

  An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed. What must be done to ensure that all devices can communicate together?

  A. Manually change the management port on Cisco FMC and all managed Cisco FTD devices

  B. Set the tunnel to go through the Cisco FTD

  C. Change the management port on Cisco FMC so that it pushes the change to all managed Cisco FTD devices

  D. Set the tunnel port to 8305

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Security__Internet_Access__and_Communication_Ports.html

• Question 195:

  Which two methods must be used to add switches into the fabric so that administrators can control how switches are added into DCNM for private cloud management? (Choose two.)

  A. Cisco Cloud Director

  B. Cisco Prime Infrastructure

  C. PowerOn Auto Provisioning

  D. Seed IP

  E. CDP AutoDiscovery

  Correct Answer: CD

• Question 196:

  What is the term for having information about threats and threat actors that helps mitigate harmful events that would otherwise compromise networks or systems?

  A. trusted automated exchange

  B. Indicators of Compromise

  C. The Exploit Database

  D. threat intelligence

  Correct Answer: D

  The term for having information about threats and threat actors that helps mitigate harmful events that would otherwise compromise networks or systems is "threat intelligence." Threat intelligence refers to the knowledge and insights gained from analyzing and understanding potential threats and threat actors, including their tactics, techniques, and procedures (TTPs).

  By leveraging threat intelligence, organizations can better understand the risks they face and take proactive steps to prevent or mitigate potential attacks. Threat intelligence can come from a variety of sources, including open-source intelligence, commercial threat intelligence feeds, and internal security operations.

• Question 197:

  Which feature within Cisco ISE verifies the compliance of an endpoint before providing access to the network?

  A. Posture

  B. Profiling

  C. pxGrid

  D. MAB

  Correct Answer: A

• Question 198:

  Which Cisco solution extends network visibility, threat detection, and analytics to public cloud environments?

  A. Cisco Umbrella

  B. Cisco Stealthwatch Cloud

  C. Cisco Appdynamics

  D. Cisco CloudLock

  Correct Answer: B

• Question 199:

  An engineer adds a custom detection policy to a Cisco AMP deployment and encounters issues with the configuration. The simple detection mechanism is configured, but the dashboard indicates that the hash is not 64 characters and is nonzero. What is the issue?

  A. The engineer is attempting to upload a hash created using MD5 instead of SHA-256

  B. The file being uploaded is incompatible with simple detections and must use advanced detections

  C. The hash being uploaded is part of a set in an incorrect format

  D. The engineer is attempting to upload a file instead of a hash

  Correct Answer: A

• Question 200:

  What does endpoint isolation in Cisco AMP for Endpoints security protect from?

  A. an infection spreading across the network

  B. a malware spreading across the user device

  C. an infection spreading across the LDAP or Active Directory domain from a user account

  D. a malware spreading across the LDAP or Active Directory domain from a user account

  Correct Answer: A

  When an endpoint is identified as compromised or infected with malware, endpoint isolation isolates the infected endpoint from the network to prevent the infection from spreading to other devices or systems. By isolating the infected endpoint, it helps contain the threat and prevents lateral movement of the malware within the network. This helps in minimizing the impact of the infection and allows security teams to investigate and remediate the compromised endpoint effectively.