Cisco CCNP Security 350-701 Questions & Answers

• Question 291:

  Which Cisco security solution determines if an endpoint has the latest OS updates and patches installed on the system?

  A. Cisco Endpoint Security Analytics

  B. Cisco AMP for Endpoints

  C. Endpoint Compliance Scanner

  D. Security Posture Assessment Service

  Correct Answer: D

  https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/Security_Posture_Assessment_SPA_Support.pdf

• Question 292:

  Which Cisco ASA deployment model is used to filter traffic between hosts in the same IP subnet using higher-level protocols without readdressing the network?

  A. routed mode

  B. transparent mode

  C. single context mode

  D. multiple context mode

  Correct Answer: B

• Question 293:

  A customer has various external HTTP resources available including Intranet Extranet and Internet, with a proxy configuration running in explicit mode. Which method allows the client desktop browsers to be configured to select when to connect direct or when to use the proxy?

  A. Transport mode

  B. Forward file

  C. PAC file

  D. Bridge mode

  Correct Answer: C

  A Proxy Auto-Configuration (PAC) file is a JavaScript function definition that determines whether web browserrequests (HTTP, HTTPS, and FTP) go direct to the destination or are forwarded to a web proxy server.PAC files are used to support explicit proxy deployments in which client browsers are explicitly configured tosend traffic to the web proxy. The big advantage of PAC files is that they are usually relatively easy to createand maintain.

• Question 294:

  What is the most common type of data exfiltration that organizations currently experience?

  A. HTTPS file upload site

  B. Microsoft Windows network shares

  C. SQL database injections

  D. encrypted SMTP

  Correct Answer: B

• Question 295:

  Which security solution is used for posture assessment of the endpoints in a BYOD solution?

  A. Cisco FTD

  B. Cisco ASA

  C. Cisco Umbrella

  D. Cisco ISE

  Correct Answer: D

• Question 296:

  What is an advantage of network telemetry over SNMP pulls?

  A. accuracy

  B. encapsulation

  C. security

  D. scalability

  Correct Answer: A

• Question 297:

  A Cisco FTD engineer is creating a new IKEv2 policy called s2s00123456789 for their organization to allow for additional protocols to terminate network devices with. They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy. What should be done in order to support this?

  A. Change the integrity algorithms to SHA* to support all SHA algorithms in the primary policy

  B. Make the priority for the new policy 5 and the primary policy 1

  C. Change the encryption to AES* to support all AES algorithms in the primary policy

  D. Make the priority for the primary policy 10 and the new policy 1

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike- protocols/215470- site-to-site-vpn-configuration-on-ftd-ma.html

• Question 298:

  Why is it important to patch endpoints consistently?

  A. Patching reduces the attack surface of the infrastructure.

  B. Patching helps to mitigate vulnerabilities.

  C. Patching is required per the vendor contract.

  D. Patching allows for creating a honeypot.

  Correct Answer: B

• Question 299:

  An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users. Which action accomplishes this goal?

  A. Restrict access to only websites with trusted third-party signed certificates.

  B. Modify the user's browser settings to suppress errors from Cisco Umbrella.

  C. Upload the organization root CA to Cisco Umbrella.

  D. Install the Cisco Umbrella root CA onto the user's device.

  Correct Answer: D

  https://docs.umbrella.com/deployment-msp/docs/install-the-cisco-umbrella-root-certificate

• Question 300:

  Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two.)

  A. Assignments to endpoint groups are made dynamically, based on endpoint attributes.

  B. Endpoint supplicant configuration is deployed.

  C. A centralized management solution is deployed.

  D. Patch management remediation is performed.

  E. The latest antivirus updates are applied before access is allowed.

  Correct Answer: AD