Cisco CCNP Security 350-701 Questions & Answers

• Question 331:

  What is a description of microsegmentation?

  A. Environments apply a zero-trust model and specify how applications on different servers or containers can communicate

  B. Environments deploy a container orchestration platform, such as Kubernetes, to manage the application delivery

  C. Environments implement private VLAN segmentation to group servers with similar applications.

  D. Environments deploy centrally managed host-based firewall rules on each server or container

  Correct Answer: D

• Question 332:

  What is the purpose of the Cisco Endpoint loC feature?

  A. It provides stealth threat prevention.

  B. lt is a signature-based engine.

  C. lt is an incident response tool

  D. It provides precompromise detection.

  Correct Answer: C

  The Endpoint Indication of Compromise (IOC) feature is a powerful incident response tool for scanning of post-compromise indicators across multiple computers.

  https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/ Cisco_Secure_Managed_Endpoint.pdf

• Question 333:

  Which attribute has the ability to change during the RADIUS CoA?

  A. NTP

  B. Authorization

  C. Accessibility

  D. Membership

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/ios- xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html

• Question 334:

  A network engineer entered the snmp-server user asmith myv7 auth sha cisco priv aes 256 cisc0xxxxxxxxx command and needs to send SNMP information to a host at 10.255.255.1. Which command achieves this goal?

  A. snmp-server host inside 10.255.255.1 version 3 myv7

  B. snmp-server host inside 10.255.255.1 snmpv3 myv7

  C. snmp-server host inside 10.255.255.1 version 3 asmith

  D. snmp-server host inside 10.255.255.1 snmpv3 asmith

  Correct Answer: C

• Question 335:

  When a Cisco WSA checks a web request, what occurs if it is unable to match a user- defined policy?

  A. It blocks the request.

  B. It applies the global policy.

  C. It applies the next identification profile policy.

  D. It applies the advanced policy.

  Correct Answer: B

• Question 336:

  Which two protocols must be configured to authenticate end users to the Web Security Appliance? (Choose two.)

  A. NTLMSSP

  B. Kerberos

  C. CHAP

  D. TACACS+

  E. RADIUS

  Correct Answer: AB

  Neither RADIUS or TACACS+ authenticates the user. They facilitate communication to the authentication server. Kerberos and NTLMSSP do authenticate the user.

• Question 337:

  Which two functions does the Cisco Advanced Phishing Protection solution perform in trying to protect from phishing attacks? (Choose two.)

  A. blocks malicious websites and adds them to a block list

  B. does a real-time user web browsing behavior analysis

  C. provides a defense for on-premises email deployments

  D. uses a static algorithm to determine malicious

  E. determines if the email messages are malicious

  Correct Answer: CE

• Question 338:

  What is the function of the crypto is a kmp key cisc406397954 address 0.0.0.0 0.0.0.0 command when establishing an IPsec VPN tunnel?

  A. It defines what data is going to be encrypted via the VPN

  B. lt configures the pre-shared authentication key

  C. It prevents all IP addresses from connecting to the VPN server.

  D. It configures the local address for the VPN server.

  Correct Answer: B

  This command is used to configure pre-shared-key for IPsec remote acess users on the Cisco router. Address is mentioned as 0.0.0.0 0.0.0.0 because the users will be connecting from random ip addresses and it is almost impossible to mention all the ip addresses. Hence, 0.0.0.0 0.0.0.0 is used to allow all public ip addresses.

• Question 339:

  An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively u: of the default policy elements. What else must be done to accomplish this task?

  A. Add the specified addresses to the identities list and create a block action.

  B. Create a destination list for addresses to be allowed or blocked.

  C. Use content categories to block or allow specific addresses.

  D. Modify the application settings to allow only applications to connect to required addresses.

  Correct Answer: B

• Question 340:

  A small organization needs to reduce the VPN bandwidth load on their headend Cisco ASA in order to ensure that bandwidth is available for VPN users needing access to corporate resources on the10.0.0.0/24 local HQ network. How is this accomplished without adding additional devices to the network?

  A. Use split tunneling to tunnel traffic for the 10.0.0.0/24 network only.

  B. Configure VPN load balancing to distribute traffic for the 10.0.0.0/24 network,

  C. Configure VPN load balancing to send non-corporate traffic straight to the internet.

  D. Use split tunneling to tunnel all traffic except for the 10.0.0.0/24 network.

  Correct Answer: A