Cisco CCNP Security 350-701 Questions & Answers

• Question 411:

  Which risk is created when using an Internet browser to access cloud-based service?

  A. misconfiguration of infrastructure, which allows unauthorized access

  B. intermittent connection to the cloud connectors

  C. vulnerabilities within protocol

  D. insecure implementation of API

  Correct Answer: C

• Question 412:

  An organization has noticed an increase in malicious content downloads and wants to use Cisco Umbrella to prevent this activity for suspicious domains while allowing normal web traffic. Which action will accomplish this task?

  A. Set content settings to High

  B. Configure the intelligent proxy.

  C. Use destination block lists.

  D. Configure application block lists.

  Correct Answer: B

  Reference: https://docs.umbrella.com/deployment-umbrella/docs/what-is-the-intelligent- proxy

• Question 413:

  An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system's applications. Which vulnerability allows the attacker to see the passwords being transmitted in clear text?

  A. weak passwords for authentication

  B. unencrypted links for traffic

  C. software bugs on applications

  D. improper file security

  Correct Answer: B

• Question 414:

  In which two ways does Easy Connect help control network access when used with Cisco TrustSec? (Choose two)

  A. It allows multiple security products to share information and work together to enhance security posture in the network.

  B. It creates a dashboard in Cisco ISE that provides full visibility of all connected endpoints.

  C. It allows for the assignment of Security Group Tags and does not require 802.1x to be configured on the switch or the endpoint.

  D. It integrates with third-party products to provide better visibility throughout the network.

  E. It allows for managed endpoints that authenticate to AD to be mapped to Security Groups (PassiveID).

  Correct Answer: CE

  Reference: https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise- networks/trustsec/trustsec-witheasy-connect-configuration-guide.pdf

• Question 415:

  What are two DDoS attack categories? (Choose two)

  A. sequential

  B. protocol

  C. database

  D. volume-based

  E. screen-based

  Correct Answer: BD

  There are three basic categories of attack:+ volume-based attacks, which use high traffic to inundate the network bandwidth+ protocol attacks, which focus on exploiting server resources+ application attacks, which focus on web applications and are considered the most sophisticated and serious type of attacks Reference: https://www.esecurityplanet.com/networks/types-of-ddos-attacks/

• Question 416:

  What are two functions of secret key cryptography? (Choose two)

  A. key selection without integer factorization

  B. utilization of different keys for encryption and decryption

  C. utilization of large prime number iterations

  D. provides the capability to only know the key on one side

  E. utilization of less memory

  Correct Answer: AE

• Question 417:

  An organization has two systems in their DMZ that have an unencrypted link between them for communication.

  The organization does not have a defined password policy and uses several default accounts on the systems.

  The application used on those systems also have not gone through stringent code reviews.

  Which vulnerability would help an attacker brute force their way into the systems?

  A. weak passwords

  B. lack of input validation

  C. missing encryption

  D. lack of file permission

  Correct Answer: A

• Question 418:

  An administrator is configuring a DHCP server to better secure their environment. They need to be able to ratelimit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?

  A. Set a trusted interface for the DHCP server

  B. Set the DHCP snooping bit to 1

  C. Add entries in the DHCP snooping database

  D. Enable ARP inspection for the required VLAN

  Correct Answer: A

• Question 419:

  Which component of Cisco umbrella architecture increases reliability of the service?

  A. Anycast IP

  B. AMP Threat grid

  C. Cisco Talos

  D. BGP route reflector

  Correct Answer: A

  Anycast would increase the resiliency of the product. Reliability and resiliency are different. With Cisco Talos, the reliability of Cisco Umbrella threat detection is increased.

• Question 420:

  What is the Cisco API-based broker that helps reduce compromises, application risks, and data breaches in an environment that is not on-premise?

  A. Cisco Cloudlock

  B. Cisco Umbrella

  C. Cisco AMP

  D. Cisco App Dynamics

  Correct Answer: A

  Cisco Cloudlock is a cloud-native cloud access security broker (CASB) that helps you move to the cloud safely.It protects your cloud users, data, and apps. Cisco Cloudlock provides visibility and compliance checks,protects data against misuse and exfiltration, and provides threat protections against malware like ransomware.