Cisco CCNP Security 350-701 Questions & Answers

• Question 451:

  What are two benefits of Flexible NetFlow records? (Choose two)

  A. They allow the user to configure flow information to perform customized traffic identification

  B. They provide attack prevention by dropping the traffic

  C. They provide accounting and billing enhancements

  D. They converge multiple accounting technologies into one accounting mechanism

  E. They provide monitoring of a wider range of IP packet information from Layer 2 to 4

  Correct Answer: AD

  Reference:

  https://www.cisco.com/en/US/docs/ios/fnetflow/configuration/guide/cust_fnflow_rec_mon_e xternal_docbase_0900e4b18055d0d2_4container_external_docbase_0900e4b181b413 d9.html#wp1057997Note: Traditional NetFlow allows us to

  monitor from Layer 2 to 4 but Flexible NetFlow goes beyond theselayers.

• Question 452:

  Why is it important to implement MFA inside of an organization?

  A. To prevent man-the-middle attacks from being successful.

  B. To prevent DoS attacks from being successful.

  C. To prevent brute force attacks from being successful.

  D. To prevent phishing attacks from being successful.

  Correct Answer: C

• Question 453:

  What is the purpose of the certificate signing request when adding a new certificate for a server?

  A. It is the password for the certificate that is needed to install it with.

  B. It provides the server information so a certificate can be created and signed

  C. It provides the certificate client information so the server can authenticate against it when installing

  D. It is the certificate that will be loaded onto the server

  Correct Answer: B

  A certificate signing request (CSR) is one of the first steps towards getting your own SSL Certificate. Generated on the same server you plan to install the certificate on, the CSR contains information (e.g. common name, organization, country) that the Certificate Authority (CA) will use to create your certificate. It also contains the public key that will be included in your certificate and is signed with the corresponding private key

• Question 454:

  A network administrator is configuring a rule in an access control policy to block certain URLs and selects the "Chat and Instant Messaging" category. Which reputation score should be selected to accomplish this goal?

  A. 1

  B. 3

  C. 5

  D. 10

  Correct Answer: D

  We choose "Chat and Instant Messaging" category in "URL Category":

  

  To block certain URLs we need to choose URL Reputation from 6 to 10.

  

• Question 455:

  After a recent breach, an organization determined that phishing was used to gain initial access to the network before regaining persistence. The information gained from the phishing attack was a result of users visiting known malicious websites. What must be done in order to prevent this from happening in the future?

  A. Modify an access policy

  B. Modify identification profiles

  C. Modify outbound malware scanning policies

  D. Modify web proxy settings

  Correct Answer: D

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc- config-guidev60/Access_Control_Rules__URL_Filtering.html

• Question 456:

  An engineer needs behavioral analysis to detect malicious activity on the hosts, and is configuring the organization's public cloud to send telemetry using the cloud provider's mechanisms to a security device. Which mechanism should the engineer configure to accomplish this goal?

  A. mirror port

  B. Flow

  C. NetFlow

  D. VPC flow logs

  Correct Answer: D

  https://aws.amazon.com/marketplace/pp/prodview-woiawecmdlezq

• Question 457:

  A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?

  A. The policy was created to send a message to quarantine instead of drop

  B. The file has a reputation score that is above the threshold

  C. The file has a reputation score that is below the threshold

  D. The policy was created to disable file analysis

  Correct Answer: C

  Quarantine is only for unrecognised files. When file is undetermined, reputation score is checked. Reputation 1-59: Deliver file / Reputation 60-100: Block file Look at - Figure 1. Advanced Malware Protection Workflow for Public-Cloud File Analysis Deployments https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010000.html

• Question 458:

  A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?

  A. Adaptive Network Control Policy List

  B. Context Visibility

  C. Accounting Reports

  D. RADIUS Live Logs

  Correct Answer: D

  ExplanationHow To Troubleshoot ISE Failed Authentications and AuthorizationsCheck the ISE Live LogsLogin to the primary ISE Policy Administration Node (PAN).Go to Operations > RADIUS > Live Logs(Optional) If the event is not present in the RADIUS Live Logs, go to Operations > Reports > Reports >Endpoints and Users > RADIUS AuthenticationsCheck for Any Failed Authentication Attempts in the Log

  Reference: https://community.cisco.com/t5/security-documents/how-to-troubleshoot-ise- failed-authenticationsamp/ta-p/3630960

• Question 459:

  Refer to the exhibit.

  

  What is the result of this Python script of the Cisco DNA Center API?

  A. adds authentication to a switch

  B. adds a switch to Cisco DNA Center

  C. receives information about a switch

  Correct Answer: B

• Question 460:

  A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0380739941 address 0.0.0.0 command on hostA. The tunnel is not being established to hostB. What action is needed to authenticate the VPN?

  A. Change isakmp to ikev2 in the command on hostA.

  B. Enter the command with a different password on hostB.

  C. Enter the same command on hostB.

  D. Change the password on hostA to the default password.

  Correct Answer: C