Cisco CCNP Security 350-701 Questions & Answers

• Question 381:

  When configuring ISAKMP for IKEv1 Phase1 on a Cisco IOS router, an administrator needs to input the command crypto isakmp key cisco address 0.0.0.0. The administrator is not sure what the IP addressing in this command issued for. What would be the effect of changing the IP address from 0.0.0.0 to 1.2.3.4?

  A. The key server that is managing the keys for the connection will be at 1.2.3.4

  B. The remote connection will only be allowed from 1.2.3.4

  C. The address that will be used as the crypto validation authority

  D. All IP addresses other than 1.2.3.4 will be allowed

  Correct Answer: B

  The command crypto isakmp key cisco address 1.2.3.4 authenticates the IP address of the 1.2.3.4 peer by using the key cisco. The address of "0.0.0.0" will authenticate any address with this key

• Question 382:

  A network administrator needs to find out what assets currently exist on the network. Third- party systems need to be able to feed host data into Cisco Firepower. What must be configured to accomplish this?

  A. a Network Discovery policy to receive data from the host

  B. a Threat Intelligence policy to download the data from the host

  C. a File Analysis policy to send file data into Cisco Firepower

  D. a Network Analysis policy to receive NetFlow data from the host

  Correct Answer: A

  You can configure discovery rules to tailor the discovery of host and application data to your needs.The Firepower System can use data from NetFlow exporters to generate connection and discovery events, and to add host and application data to the network map.A network analysis policy governs how traffic is decoded and preprocessed so it can be further evaluated, especially for anomalous traffic that might signal an intrusion attempt -> Answer D is not correct.

• Question 383:

  Which type of API is being used when a controller within a software-defined network architecture dynamically makes configuration changes on switches within the network?

  A. westbound AP

  B. southbound API

  C. northbound API

  D. eastbound API

  Correct Answer: B

  ExplanationSouthbound APIs enable SDN controllers to dynamically make changes based on real-time demands andscalability needs.

  

• Question 384:

  What is the purpose of the My Devices Portal in a Cisco ISE environment?

  A. to register new laptops and mobile devices

  B. to request a newly provisioned mobile device

  C. to provision userless and agentless systems

  D. to manage and deploy antivirus definitions and patches on systems owned by the end user

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2- 4/mydevices/b_mydevices_2x.html

• Question 385:

  Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?

  A. Cisco WiSM

  B. Cisco ESA

  C. Cisco ISE

  D. Cisco Prime Infrastructure

  Correct Answer: C

  A posture policy is a collection of posture requirements, which are associated with one or more identity groups, and operating systems. We can configure ISE to check for the Windows patch at Work Centers > Posture > Posture Elements > Conditions > File.In this example, we are going to use the predefined file check to ensure that our Windows 10 clients have the critical security patch installed to prevent the Wanna Cry malware; and we can also configure ISE to update the client with this patch.

  

• Question 386:

  What does Cisco AMP for Endpoints use to help an organization detect different families of malware?

  A. Ethos Engine to perform fuzzy fingerprinting

  B. Tetra Engine to detect malware when me endpoint is connected to the cloud

  C. Clam AV Engine to perform email scanning

  D. Spero Engine with machine learning to perform dynamic analysis

  Correct Answer: A

  https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdfETHOS = Fuzzy Fingerprinting using static/passive heuristics https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/BRKSEC- 2139.pdf

• Question 387:

  What are the two types of managed Intercloud Fabric deployment models? (Choose two)

  A. Service Provider managed

  B. Public managed

  C. Hybrid managed

  D. User managed

  E. Enterprise managed

  Correct Answer: AE

  Reference:

  https://www.cisco.com/c/en/us/td/docs/solutions/Hybrid_Cloud/Intercloud/Intercloud_Fabric/ Intercloud_Fabric_2.html

• Question 388:

  In an IaaS cloud services model, which security function is the provider responsible for managing?

  A. Internet proxy

  B. firewalling virtual machines

  C. CASB

  D. hypervisor OS hardening

  Correct Answer: B

  In this IaaS model, cloud providers offer resources to users/machines that include computers as virtualmachines, raw (block) storage, firewalls , load balancers, and network devices.Note: Cloud access security broker (CASB) provides visibility and compliance checks, protects data against misuse and exfiltration, and provides threat protections against malware such as ransomware.

• Question 389:

  How does Cisco Advanced Phishing Protection protect users?

  A. It validates the sender by using DKIM.

  B. It determines which identities are perceived by the sender

  C. It utilizes sensors that send messages securely.

  D. It uses machine learning and real-time behavior analytics.

  Correct Answer: D

  Reference: https://docs.ces.cisco.com/docs/advanced-phishing-protection

• Question 390:

  Refer to the exhibit.

  

  When configuring a remote access VPN solution terminating on the Cisco ASA, an administrator would like to utilize an external token authentication mechanism in conjunction with AAA authentication using machine certificates. Which configuration item must be modified to allow this?

  A. Group Policy

  B. Method

  C. SAML Server

  D. DHCP Servers

  Correct Answer: B

  In order to use AAA along with an external token authentication mechanism, set the "Method" as "Both" inthe Authentication.