Cisco CCNP Security 350-701 Questions & Answers

• Question 281:

  Based on the NIST 800-145 guide, which cloud architecture may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises?

  A. hybrid cloud

  B. private cloud

  C. public cloud

  D. community cloud

  Correct Answer: D

• Question 282:

  An organization wants to improve its cybersecurity processes and to add intelligence to its data The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA What must be done to accomplish these objectives?

  A. Create a Cisco pxGrid connection to NIST to import this information into the security products for policy use

  B. Create an automated download of the Internet Storm Center intelligence feed into the Cisco FTD and Cisco WSA databases to tie to the dynamic access control policies.

  C. Download the threat intelligence feed from the IETF and import it into the Cisco FTD and Cisco WSA databases

  D. Configure the integrations with Talos Intelligence to take advantage of the threat intelligence that it provides.

  Correct Answer: D

• Question 283:

  What do tools like Jenkins, Octopus Deploy, and Azure DevOps provide in terms of application and infrastructure automation?

  A. continuous integration and continuous deployment

  B. cloud application security broker

  C. compile-time instrumentation

  D. container orchestration

  Correct Answer: A

• Question 284:

  An engineer is configuring Cisco WSA and needs to enable a separated email transfer flow from the Internet and from the LAN. Which deployment mode must be used to accomplish this goal?

  A. single interface

  B. multi-context

  C. transparent

  D. two-interface

  Correct Answer: D

• Question 285:

  Which CoA response code is sent if an authorization state is changed successfully on a Cisco IOS device?

  A. CoA-NCL

  B. CoA-NAK

  C.

  D. CoA-ACK

  Correct Answer: D

• Question 286:

  Which Cisco ASA Platform mode disables the threat detection features except for Advanced Threat Statistics?

  A. cluster

  B. transparent

  C. routed

  D. multiple context

  Correct Answer: B

• Question 287:

  Which industry standard is used to integrate Cisco ISE and pxGrid to each other and with other interoperable security platforms?

  A. IEEE

  B. IETF

  C. NIST

  D. ANSI

  Correct Answer: B

• Question 288:

  What is a difference between an XSS attack and an SQL injection attack?

  A. SQL injection is a hacking method used to attack SQL databases, whereas XSS attacks can exist in many different types of applications

  B. XSS is a hacking method used to attack SQL databases, whereas SQL injection attacks can exist in many different types of applications

  C. SQL injection attacks are used to steal information from databases whereas XSS attacks are used to redirect users to websites where attackers can steal data from them

  D. XSS attacks are used to steal information from databases whereas SQL injection attacks are used to redirect users to websites where attackers can steal data from them

  Correct Answer: C

  In XSS, an attacker will try to inject his malicious code (usually malicious links) into a database. When other users follow his links, their web browsers are redirected to websites where attackers can steal data from them. In a SQL Injection, an attacker will try to inject SQL code (via his browser) into forms, cookies, or HTTP headers that do not use data sanitizing or validation methods of GET/POST parameters.

• Question 289:

  A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https:///capure/CAPI/pcap/test.pcap, an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?

  A. Disable the proxy setting on the browser

  B. Disable the HTTPS server and use HTTP instead

  C. Use the Cisco FTD IP address as the proxy server setting on the browser

  D. Enable the HTTPS server for the device platform policy

  Correct Answer: D

• Question 290:

  What is the process of performing automated static and dynamic analysis of files against preloaded behavioral indicators for threat analysis?

  A. deep visibility scan

  B. point-in-time checks

  C. advanced sandboxing

  D. advanced scanning

  Correct Answer: C