Cisco CCNP Security 350-701 Questions & Answers

• Question 241:

  Which Cisco security solution stops exfiltration using HTTPS?

  A. Cisco FTD

  B. Cisco AnyConnect

  C. Cisco CTA

  D. Cisco ASA

  Correct Answer: C

  https://www.cisco.com/c/dam/en/us/products/collateral/security/cognitive- threat-analytics/at-a-glance-c45-736555.pdf

• Question 242:

  A network engineer must migrate a Cisco WSA virtual appliance from one physical host to another physical host by using VMware vMotion. What is a requirement for both physical hosts?

  A. The hosts must run Cisco AsyncOS 10.0 or greater.

  B. The hosts must run different versions of Cisco AsyncOS.

  C. The hosts must have access to the same defined network.

  D. The hosts must use a different datastore than the virtual appliance.

  Correct Answer: C

• Question 243:

  What is a characteristic of an EDR solution and not of an EPP solution?

  A. stops all ransomware attacks

  B. retrospective analysis

  C. decrypts SSL traffic for better visibility

  D. performs signature-based detection

  Correct Answer: B

• Question 244:

  

  Refer to the exhibit. What is the result of the Python script?

  A. It uses the POST HTTP method to obtain a username and password to be used for authentication.

  B. It uses the POST HTTP method to obtain a token to be used for authentication.

  C. It uses the GET HTTP method to obtain a token to be used for authentication.

  D. It uses the GET HTTP method to obtain a username and password to be used for authentication

  Correct Answer: B

• Question 245:

  Which configuration method provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with Vmware VDS or Microsoft vSwitch?

  A. inter-EPG isolation

  B. inter-VLAN security

  C. intra-EPG isolation

  D. placement in separate EPGs

  Correct Answer: C

  C. Intra-EPG Intra-EPG Isolation for VMware VDS or Microsoft Hyper-V Virtual Switch

  Intra-EPG Isolation is an option to prevent physical or virtual endpoint devices that are in the same base EPG or microsegmented (uSeg) EPG from communicating with each other. By default, endpoint devices included in the same EPG are allowed to communicate with one another. However, conditions exist in which total isolation of the endpoint devices from on another within an EPG is desirable. For example, you may want to enforce intra-EPG isolation if the endpoint VMs in the same EPG belong to multiple tenants, or to prevent

• Question 246:

  Which system facilitates deploying microsegmentation and multi-tenancy services with a policy-based container?

  A. SDLC

  B. Docker

  C. Lambda

  D. Contiv

  Correct Answer: D

  With Contiv, cloud architects and IT admin teams can create, manage and consistently enforce operational policies such as multi-tenant traffic isolation, microsegmentation, bandwidth prioritization, latency requirements, and policies

• Question 247:

  Which API method and required attribute are used to add a device into DNAC with the native API?

  A. lastSyncTime and pid

  B. POST and name

  C. userSudiSerialNos and devicelnfo

  D. GET and serialNumber

  Correct Answer: B

  To add a device into Cisco DNA Center with the native API, the API method used is POST which creates a new resource. One of the required attribute to add a device is the "name" attribute, which is used to specify the name of the device being added. The device name should be unique and it's used to identify the device within the Cisco DNA Center platform.

  A GET request is used to retrieve information from a resource. "SerialNumber" and "userSudiSerialNos" are attributes used to identify a device but they are not required to add a device into Cisco DNA Center, they are needed to retrieve a specific device information. "lastSyncTime" is an attribute used to indicate when the device last synced with Cisco DNA Center, it's not required to add a device. "pid" is an attribute used to identify a device's product ID, and it's not required to add a device.

• Question 248:

  Which Cisco solution integrates Encrypted Traffic Analytics to perform enhanced visibility,promote compliance,shorten response times, and provide administrators with the information needed to provide educated and automated decisions to secure the environment?

  A. Cisco DNA Center

  B. Cisco SDN

  C. Cisco ISE

  D. Cisco Security Compiance Solution

  Correct Answer: A

  https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/eta-sda-fabric-deployment-guide-2019sep.pdf

• Question 249:

  An organization wants to secure data in a cloud environment. Its security model requires that all users be authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and data. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these requirements?

  A. Virtual routing and forwarding

  B. Microsegmentation

  C. Access control policy

  D. Virtual LAN

  Correct Answer: C

  Microsegmentation is NOT for posturing checking. All the requirements criteria is met by Access Control Policies where you can define in ISE, Authentication, Authorization (Assign SGT in this part, which is the microsegmentation), then use Access List to deny or allow traffic

• Question 250:

  What is a benefit of using Cisco Umbrella?

  A. DNS queries are resolved faster.

  B. Attacks can be mitigated before the application connection occurs.

  C. Files are scanned for viruses before they are allowed to run.

  D. It prevents malicious inbound traffic.

  Correct Answer: B