Cisco CCNP Security 350-701 Questions & Answers

• Question 201:

  An engineer configures new features within the Cisco Umbrella dashboard and wants to identify and proxy traffic that is categorized as risky domains and may contain safe and malicious content. Which action accomplishes these objectives?

  A. Configure URL filtering within Cisco Umbrella to track the URLs and proxy the requests for those categories and below.

  B. Configure intelligent proxy within Cisco Umbrella to intercept and proxy the requests for only those categories.

  C. Upload the threat intelligence database to Cisco Umbrella for the most current information on reputations and to have the destination lists block them.

  D. Create a new site within Cisco Umbrella to block requests from those categories so they can be sent to the proxy device.

  Correct Answer: B

  The intelligent proxy is the ability for Umbrella to intercept and proxy requests for malicious files embedded within certain so-called "grey" domains. Some websites, especially those with large user communities or the ability to upload and share files, have content that most users want to access while also posing a risk because of the possibility of hosting malware. Administrators wouldn't want to block access to the whole "grey" domain for everyone but they also don't want your users to access files that could harm their computers, compromise your company data or worse!

• Question 202:

  An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence. Which protocol accomplishes this goal?

  A. AES-192

  B. IKEv1

  C. AES-256

  D. ESP

  Correct Answer: D

• Question 203:

  What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

  A. lf four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.

  B. After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL

  C. After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL1

  D. If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

  Correct Answer: D

  https://websistent.com/cisco-account-lockout-using-login-block-for/

• Question 204:

  A Cisco AMP for Endpoints administrator configures a custom detection policy to add specific MD5 signatures The configuration is created in the simple detection policy section, but it does not work. What is the reason for this failure?

  A. The administrator must upload the file instead of the hash for Cisco AMP to use.

  B. The MD5 hash uploaded to the simple detection policy is in the incorrect format

  C. The APK must be uploaded for the application that the detection is intended

  D. Detections for MD5 signatures must be configured in the advanced custom detection policies

  Correct Answer: D

• Question 205:

  What are two characteristics of the RESTful architecture used within Cisco DNA Center? (Choose two.)

  A. REST uses methods such as GET, PUT, POST, and DELETE.

  B. REST codes can be compiled with any programming language.

  C. REST is a Linux platform-based architecture.

  D. The POST action replaces existing data at the URL path.

  E. REST uses HTTP to send a request to a web service.

  Correct Answer: AE

• Question 206:

  What are two things to consider when using PAC files with the Cisco WSA? (Choose two.)

  A. If the WSA host port is changed, the default port redirects web traffic to the correct port automatically.

  B. PAC files use if-else statements to determine whether to use a proxy or a direct connection for traffic between the PC and the host.

  C. The WSA hosts PAC files on port 9001 by default.

  D. The WSA hosts PAC files on port 6001 by default.

  E. By default, they direct traffic through a proxy when the PC and the host are on the same subnet.

  Correct Answer: BC

  https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118082-qanda-wsa-00.html

• Question 207:

  Which metric is used by the monitoring agent to collect and output packet loss and jitter information?

  A. WSAv performance

  B. AVC performance

  C. OTCP performance

  D. RTP performance

  Correct Answer: D

• Question 208:

  An engineer is trying to decide between using L2TP or GRE over IPsec for their site-to-site VPN implementation. What must be un solution?

  A. L2TP is an IP packet encapsulation protocol, and GRE over IPsec is a tunneling protocol.

  B. L2TP uses TCP port 47 and GRE over IPsec uses UDP port 1701.

  C. GRE over IPsec adds its own header, and L2TP does not.

  D. GRE over IPsec cannot be used as a standalone protocol, and L2TP can.

  Correct Answer: A

• Question 209:

  What are two security benefits of an MDM deployment? (Choose two.)

  A. robust security policy enforcement

  B. privacy control checks

  C. on-device content management

  D. distributed software upgrade

  E. distributed dashboard

  Correct Answer: AC

• Question 210:

  Which Cisco platform provides an agentless solution to provide visibility across the network including encrypted traffic analytics to detect malware in encrypted traffic without the need for decryption?

  A. Cisco Advanced Malware Protection

  B. Cisco Stealthwatch

  C. Cisco Identity Services Engine

  D. Cisco AnyConnect

  Correct Answer: B