Cisco CCNP Security 350-701 Questions & Answers

• Question 391:

  An organization has two systems in their DMZ that have an unencrypted link between them for communication.

  The organization does not have a defined password policy and uses several default accounts on the systems.

  The application used on those systems also have not gone through stringent code reviews.

  Which vulnerability would help an attacker brute force their way into the systems?

  A. weak passwords

  B. lack of input validation

  C. missing encryption

  D. lack of file permission

  Correct Answer: A

  Reference: https://tools.ietf.org/html/rfc3954

• Question 392:

  A network administrator is configuring SNMPv3 on a new router. The users have already been created; however, an additional configuration is needed to facilitate access to the SNMP views. What must the administrator do to accomplish this?

  A. map SNMPv3 users to SNMP views

  B. set the password to be used for SNMPv3 authentication

  C. define the encryption algorithm to be used by SNMPv3

  D. specify the UDP port used by SNMP

  Correct Answer: A

• Question 393:

  Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?

  A. file access from a different user

  B. interesting file access

  C. user login suspicious behavior

  D. privilege escalation

  Correct Answer: A

  Table 1. Cisco Tetration platform primary features and benefits Feature Benefit Zero-trust model using microsegmentation Cisco Tetration platform allows only the required traffic between application components and users, blocking everything else. This approach prevents a persistent threat from entering or searching for additional vulnerabilities. Also allows for micro segmentation so you can deny file access from different users.

  https://cdw-prod.adobecqms.net/content/dam/cdw/on-domain-cdw/brands/cisco/data-center-tetration-data-sheet.pdf

• Question 394:

  What features does Cisco FTDv provide over Cisco ASAv?

  A. Cisco FTDv runs on VMWare while ASAv does not

  B. Cisco FTDv provides 1GB of firewall throughput while Cisco ASAv does not

  C. Cisco FTDv runs on AWS while ASAv does not

  D. Cisco FTDv supports URL filtering while ASAv does not

  Correct Answer: D

• Question 395:

  Refer to the exhibit.

  

  Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance. What is causing this issue?

  A. No split-tunnel policy is defined on the Firepower Threat Defense appliance.

  B. The access control policy is not allowing VPN traffic in.

  C. Site-to-site VPN peers are using different encryption algorithms.

  D. Site-to-site VPN preshared keys are mismatched.

  Correct Answer: B

• Question 396:

  When planning a VPN deployment, for which reason does an engineer opt for an active/active FlexVPN configuration as opposed to DMVPN?

  A. Multiple routers or VRFs are required.

  B. Traffic is distributed statically by default.

  C. Floating static routes are required.

  D. HSRP is used for faliover.

  Correct Answer: B

• Question 397:

  Refer to the exhibit.

  

  Which type of authentication is in use?

  A. LDAP authentication for Microsoft Outlook

  B. POP3 authentication

  C. SMTP relay server authentication

  D. external user and relay mail authentication

  Correct Answer: A

  https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118545-technote-esa-00.html

• Question 398:

  What is the role of an endpoint in protecting a user from a phishing attack?

  A. Use Cisco Stealthwatch and Cisco ISE Integration.

  B. Utilize 802.1X network security to ensure unauthorized access to resources.

  C. Use machine learning models to help identify anomalies and determine expected sending behavior.

  D. Ensure that antivirus and anti malware software is up to date

  Correct Answer: C

• Question 399:

  An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites but other sites are not accessible due to an error. Why is the error occurring?

  A. Client computers do not have the Cisco Umbrella Root CA certificate installed.

  B. IP-Layer Enforcement is not configured.

  C. Client computers do not have an SSL certificate deployed from an internal CA server.

  D. Intelligent proxy and SSL decryption is disabled in the policy

  Correct Answer: A

  Reference: https://docs.umbrella.com/deployment-umbrella/docs/rebrand-cisco-certificate- import-information

• Question 400:

  What is provided by the Secure Hash Algorithm in a VPN?

  A. integrity

  B. key exchange

  C. encryption

  D. authentication

  Correct Answer: A

  Reference: https://www.ciscopress.com/articles/article.asp?p=24833andseqNum=4