Cisco CCNP Security 350-701 Questions & Answers

• Question 321:

  Refer to the exhibit.

  

  What are two indications of the Cisco Firepower Services Module configuration? (Choose two.)

  A. The module is operating in IDS mode.

  B. The module fails to receive redirected traffic

  C. Traffic is blocked if the module fails.

  D. Traffic continues to flow if the module fails.

  E. The module is operating in IPS mode.

  Correct Answer: AD

  sfr {fail-open | fail-close [monitor-only]} <- There's a couple different options here. The first one is fail-open which means that if the Firepower software module is unavailable, the ASA will continue to forward traffic. fail-close means that if the Firepower module fails, the traffic will stop flowing. While this doesn't seem ideal, there might be a use case for it when securing highly regulated environments. The monitor-only switch can be used with both and basically puts the Firepower services into IDS-mode only. This might be useful for initial testing or setup.

• Question 322:

  Which benefit does DMVPN provide over GETVPN?

  A. DMVPN supports QoS, multicast, and routing, and GETVPN supports only QoS.

  B. DMVPN is a tunnel-less VPN, and GETVPN is tunnel-based.

  C. DMVPN supports non-IP protocols, and GETVPN supports only IP protocols.

  D. DMVPN can be used over the public Internet, and GETVPN requires a private network.

  Correct Answer: D

• Question 323:

  Which two actions does the Cisco identity Services Engine posture module provide that ensures endpoint security?(Choose two.)

  A. The latest antivirus updates are applied before access is allowed.

  B. Assignments to endpoint groups are made dynamically, based on endpoint attributes.

  C. Patch management remediation is performed.

  D. A centralized management solution is deployed.

  E. Endpoint supplicant configuration is deployed.

  Correct Answer: AC

  ISE posture assessment includes a set of rules in a security policy that define a series of checks before an endpoint is granted access to the network. Posture assessment checks include the installation of OS patches, host based firewall, antivirus and anti-malware software, disk encryption and more

• Question 324:

  Refer to the exhibit.

  

  All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and all servers must communicate with default gateway multilayer switch. Which type of private VLAN ports should be configured to prevent communication between DNS servers and the file server?

  A. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as isolated port, and GigabitEthernet0/3 and GigabitEthernet0/4 as promiscuous ports.

  B. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as promiscuous port, Gigabit Ethernet0/3 and GigabitEthernet0/4 as isolated ports.

  C. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port and GigabitEthernet0/3 and GrgabitEthernet0/4 as community ports

  D. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as community port, and GigabitEthernet0/3 and GrgabitEthernet0/4 as isolated ports.

  Correct Answer: C

• Question 325:

  A company discovered an attack propagating through their network via a file. A custom file policy was created in order to track this in the future and ensure no other endpoints execute the infected file. In addition, it was discovered during testing that the scans are not detecting the file as an indicator of compromise. What must be done in order to ensure that the created is functioning as it should?

  A. Create an IP block list for the website from which the file was downloaded

  B. Block the application that the file was using to open

  C. Upload the hash for the file into the policy

  D. Send the file to Cisco Threat Grid for dynamic analysis

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/file_policies_and_advanced_malware_protection.html

• Question 326:

  Which method of attack is used by a hacker to send malicious code through a web application to an unsuspecting user to request that the victim's web browser executes the code?

  A. buffer overflow

  B. browser WGET

  C. SQL injection

  D. cross-site scripting

  Correct Answer: D

• Question 327:

  Refer to the exhibit.

  

  The DHCP snooping database resides on router R1, and dynamic ARP inspection is configured only on switch SW2. Which ports must be configured as untrusted so that dynamic ARP inspection operates normally?

  A. P2 and P3 only

  B. P5, P6, and P7 only

  C. P1, P2, P3, and P4 only

  D. P2, P3, and P6 only

  Correct Answer: D

• Question 328:

  Which type of data exfiltration technique encodes data in outbound DNS requests to specific servers and can be stopped by Cisco Umbrella?

  A. DNS tunneling

  B. DNS flood attack

  C. cache poisoning

  D. DNS hijacking

  Correct Answer: A

• Question 329:

  An engineer is configuring device-hardening on a router in order to prevent credentials from being seen if the router configuration was compromised. Which command should be used?

  A. service password-encryption

  B. username privilege 15 password

  C. service password-recovery

  D. username < username> password

  Correct Answer: A

• Question 330:

  Which two capabilities of Integration APIs are utilized with Cisco DNA center? (Choose two)

  A. Automatically deploy new virtual routers

  B. Upgrade software on switches and routers

  C. Application monitors for power utilization of devices and IoT sensors

  D. Connect to Information Technology Service Management Platforms

  E. Create new SSIDs on a wireless LAN controller

  Correct Answer: CD