Cisco CCNP Security 350-701 Questions & Answers

• Question 41:

  Which capability is provided by application visibility and control?

  A. reputation filtering

  B. data obfuscation

  C. data encryption

  D. deep packet inspection

  Correct Answer: D

• Question 42:

  Which Cisco Firewall solution requires zone definition?

  A. CBAC

  B. Cisco AMP

  C. ZBFW

  D. Cisco ASA

  Correct Answer: C

• Question 43:

  An engineer is configuring cloud logging using a company-managed Amazon S3 bucket for Cisco Umbrella logs. What benefit does this configuration provide for accessing log data?

  A. It is included m the license cost for the multi-org console of Cisco Umbrella

  B. It can grant third-party SIEM integrations write access to the S3 bucket

  C. No other applications except Cisco Umbrella can write to the S3 bucket

  D. Data can be stored offline for 30 days.

  Correct Answer: D

• Question 44:

  Which two capabilities does an MDM provide? (Choose two.)

  A. delivery of network malware reports to an inbox in a schedule

  B. unified management of mobile devices, Macs, and PCs from a centralized dashboard

  C. enforcement of device security policies from a centralized dashboard

  D. manual identification and classification of client devices

  E. unified management of Android and Apple devices from a centralized dashboard

  Correct Answer: CE

• Question 45:

  A company identified a phishing vulnerability during a pentest.

  What are two ways the company can protect employees from the attack? (Choose two.)

  A. using Cisco Umbrella

  B. using Cisco ESA

  C. using Cisco FTD

  D. using an inline IPS/IDS in the network E. using Cisco ISE

  Correct Answer: AB

• Question 46:

  What is a function of Cisco AMP for Endpoints?

  A. It detects DNS attacks

  B. It protects against web-based attacks

  C. It blocks email-based attacks

  D. It automates threat responses of an infected host

  Correct Answer: D

• Question 47:

  An engineer mus?set up 200 new laptops on a network and wants to prevent the users from moving their laptops around to simplify administration.

  Which switch port MAC address security setting must be used?

  A. sticky

  B. static

  C. aging

  D. maximum

  Correct Answer: A

• Question 48:

  Which feature requires that network telemetry be enabled?

  A. per-interface stats

  B. SNMP trap notification

  C. Layer 2 device discovery

  D. central syslog system

  Correct Answer: D

• Question 49:

  An engineer is adding a Cisco router to an existing environment. NTP authentication is configured on all devices in the environment with the command ntp authentication-key 1 md5 Clsc427128380. There are two routers on the network that are configured as NTP servers for redundancy, 192.168.1.110 and 192.168.1.111. 192.168.1.110 is configured as the authoritative time source. What command must be configured on the new router to use 192.168.1.110 as its primary time source without the new router attempting to offer time to existing devices?

  A. ntp server 192.168.1.110 primary key 1

  B. ntp peer 192.168.1.110 prefer key 1

  C. ntp server 192.168.1.110 key 1 prefer

  D. ntp peer 192.168.1.110 key 1 primary

  Correct Answer: C

• Question 50:

  Which ESA implementation method segregates inbound and outbound email?

  A. one listener on a single physical Interface

  B. pair of logical listeners on a single physical interface with two unique logical IPv4 addresses and one IPv6 address

  C. pair of logical IPv4 listeners and a pair Of IPv6 listeners on two physically separate interfaces

  D. one listener on one logical IPv4 address on a single logical interface

  Correct Answer: D