Cisco CCNP Security 350-701 Questions & Answers

• Question 481:

  Which two request of REST API are valid on the Cisco ASA Platform? (Choose two)

  A. put

  B. options

  C. get

  D. push

  E. connect

  Correct Answer: AC

  Available request methods are:

  GET – Retrieves data from the specified object.

  PUT – Adds the supplied information to the specified object; returns a 404 Resource Not Found error if the object does not exist.

  POST – Creates the object with the supplied information.

  DELETE – Deletes the specified object.

  PATCH – Applies partial modifications to the specified object.

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/api/qsg-asa-api.html

• Question 482:

  Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

  A. RSA SecureID

  B. Internal Database

  C. Active Directory

  D. LDAP

  Correct Answer: A

• Question 483:

  Which form of attack is launched using botnets?

  A. EIDDOS

  B. virus

  C. DDOS

  D. TCP flood

  Correct Answer: C

  A botnet is a collection of internet-connected devices infected by malware that allow hackers to control them.Cyber criminals use botnets to instigate botnet attacks, which include malicious activities such as credentialsleaks, unauthorized access, data theft and DDoS attacks.

• Question 484:

  Which license is required for Cisco Security Intelligence to work on the Cisco Next Generation Intrusion Prevention System?

  A. control

  B. malware

  C. URL filtering

  D. protect

  Correct Answer: D

• Question 485:

  Which feature is supported when deploying Cisco ASAv within AWS public cloud?

  A. multiple context mode

  B. user deployment of Layer 3 networks

  C. IPv6

  D. clustering

  Correct Answer: B

  The ASAv on AWS supports the following features:+ Support for Amazon EC2 C5 instances, the next generation of the Amazon EC2 Compute Optimized instancefamily.+ Deployment in the Virtual Private Cloud (VPC)+ Enhanced networking (SR-IOV) where available+ Deployment from Amazon Marketplace+ Maximum of four vCPUs per instance+ User deployment of L3 networks+ Routed mode (default)Note: The Cisco Adaptive Security Virtual Appliance (ASAv) runs the same software as physical Cisco ASAs to deliver proven security functionality in a virtual form factor. The ASAv can be deployed in the public AWS cloud.It can then be configured to protect virtual and physical data center workloads that expand, contract, or shift their location over time. Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asav/quick-start- book/asav-96 qsg/asavaws.html

• Question 486:

  What is a difference between FlexVPN and DMVPN?

  A. DMVPN uses IKEv1 or IKEv2, FlexVPN only uses IKEv1

  B. DMVPN uses only IKEv1 FlexVPN uses only IKEv2

  C. FlexVPN uses IKEv2, DMVPN uses IKEv1 or IKEv2

  D. FlexVPN uses IKEv1 or IKEv2, DMVPN uses only IKEv2

  Correct Answer: C

• Question 487:

  Which two deployment modes does the Cisco ASA FirePower module support? (Choose two)

  A. transparent mode

  B. routed mode

  C. inline mode

  D. active mode

  E. passive monitor-only mode

  Correct Answer: AB

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/asdm72/firewall/asa- firewall-asdm/modules-sfr.html

• Question 488:

  Which two services must remain as on-premises equipment when a hybrid email solution is deployed? (Choose two)

  A. DDoS

  B. antispam

  C. antivirus

  D. encryption

  E. DLP

  Correct Answer: DE

  Reference:

  https://www.cisco.com/c/dam/en/us/td/docs/security/ces/overview_guide/Cisco_Cloud_Hyb rid_Email_Security_Overview_Guide.pdf

• Question 489:

  What is a characteristic of Firepower NGIPS inline deployment mode?

  A. ASA with Firepower module cannot be deployed.

  B. It cannot take actions such as blocking traffic.

  C. It is out-of-band from traffic.

  D. It must have inline interface pairs configured.

  Correct Answer: D

  https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html#anc2

• Question 490:

  An engineer is configuring a Cisco ESA and wants to control whether to accept or reject email messages to a recipient address. Which list contains the allowed recipient addresses?

  A. SAT

  B. BAT

  C. HAT

  D. RAT

  Correct Answer: D