Cisco CCNP Security 350-701 Questions & Answers

• Question 371:

  What is managed by Cisco Security Manager?

  A. Cisco WLC

  B. Cisco ESA

  C. Cisco WSA

  D. Cisco ASA

  Correct Answer: D

  https://www.cisco.com/c/en/us/products/security/security-manager/index.html

• Question 372:

  Which type of algorithm provides the highest level of protection against brute-force attacks?

  A. PFS

  B. HMAC

  C. MD5

  D. SHA

  Correct Answer: D

• Question 373:

  Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)

  A. virtualization

  B. middleware

  C. operating systems

  D. applications

  E. data

  Correct Answer: DE

  Customers must manage applications and data in PaaS.

  

• Question 374:

  What must be configured in Cisco ISE to enforce reauthentication of an endpoint session when an endpoint is deleted from an identity group?

  A. posture assessment

  B. CoA

  C. external identity source

  D. SNMP probe

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/1- 3/admin_guide/b_ise_admin_guide_13/b_ise_admin_guide_sample_chapter_010101.html

• Question 375:

  What is a benefit of conducting device compliance checks?

  A. It indicates what type of operating system is connecting to the network.

  B. It validates if anti-virus software is installed.

  C. It scans endpoints to determine if malicious activity is taking place.

  D. It detects email phishing attacks.

  Correct Answer: B

• Question 376:

  Refer to the exhibit.

  

  An administrator is adding a new Cisco FTD device to their network and wants to manage it with Cisco FMC. The Cisco FTD is not behind a NAT device. Which command is needed to enable this on the Cisco FTD?

  A. configure manager add DONTRESOLVE kregistration key>

  B. configure manager add 16

  C. configure manager add DONTRESOLVE FTD123

  D. configure manager add

  Correct Answer: D

  Reference: https://cyruslab.net/2019/09/03/ciscocisco-firepower-lab-setup/

• Question 377:

  What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?

  A. To protect the endpoint against malicious file transfers

  B. To ensure that assets are secure from malicious links on and off the corporate network

  C. To establish secure VPN connectivity to the corporate network

  D. To enforce posture compliance and mandatory software

  Correct Answer: B

  Umbrella Roaming is a cloud-delivered security service for Cisco's next-generation firewall. It protects your employees even when they are off the VPN.

• Question 378:

  A network engineer is deciding whether to use stateful or stateless failover when configuring two ASAs for high availability. What is the connection status in both cases?

  A. need to be reestablished with stateful failover and preserved with stateless failover

  B. preserved with stateful failover and need to be reestablished with stateless failover

  C. preserved with both stateful and stateless failover

  D. need to be reestablished with both stateful and stateless failover

  Correct Answer: B

• Question 379:

  An organization recently installed a Cisco WSA and would like to take advantage of the AVC engine to allow the organization to create a policy to control application specific activity. After enabling the AVC engine, what must be done to implement this?

  A. Use security services to configure the traffic monitor, .

  B. Use URL categorization to prevent the application traffic.

  C. Use an access policy group to configure application control settings.

  D. Use web security reporting to validate engine functionality

  Correct Answer: C

  The Application Visibility and Control (AVC) engine lets you create policies to control application activity on the network without having to fully understand the underlying technology of each application. You can configure application control settings in Access Policy groups. You can block or allow applications individually or according to application type. You can also apply controls to particular application types.

• Question 380:

  For Cisco IOS PKI, which two types of Servers are used as a distribution point for CRLs? (Choose two)

  A. SDP

  B. LDAP

  C. subordinate CA

  D. SCP

  E. HTTP

  Correct Answer: BE

  Reference: https://www.cisco.com/c/en/us/td/docs/ios- xml/ios/sec_conn_pki/configuration/15-mt/sec-pki-15-mtbook/sec-pki-overview.html