Cisco CCNP Security 350-701 Questions & Answers

• Question 501:

  What is the purpose of the Decrypt for Application Detection feature within the WSA Decryption options?

  A. It decrypts HTTPS application traffic for unauthenticated users.

  B. It alerts users when the WSA decrypts their traffic.

  C. It decrypts HTTPS application traffic for authenticated users.

  D. It provides enhanced HTTPS application detection for AsyncOS.

  Correct Answer: D

• Question 502:

  What is the function of the Context Directory Agent?

  A. maintains users' group memberships

  B. relays user authentication requests from Web Security Appliance to Active Directory

  C. reads the Active Directory logs to map IP addresses to usernames

  D. accepts user authentication requests on behalf of Web Security Appliance for user identification

  Correct Answer: C

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10/cda_ oveviw.html

• Question 503:

  Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

  A. AMP

  B. AnyConnect

  C. DynDNS

  D. Talos

  Correct Answer: D

  When Umbrella receives a DNS request, it uses intelligence to determine if the request is safe, malicious or risky -- meaning the domain contains both malicious and legitimate content. Safe and malicious requests are routed as usual or blocked, respectively. Risky requests are routed to our cloud-based proxy for deeper inspection. The Umbrella proxy uses Cisco Talos web reputation and other third- party feeds to determine if a URL is malicious.

• Question 504:

  Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?

  A. It allows traffic if it does not meet the profile.

  B. It defines a traffic baseline for traffic anomaly deduction.

  C. It inspects hosts that meet the profile with more intrusion rules.

  D. It blocks traffic if it does not meet the profile.

  Correct Answer: B

• Question 505:

  Which two fields are defined in the NetFlow flow? (Choose two)

  A. type of service byte

  B. class of service bits

  C. Layer 4 protocol type

  D. destination port

  E. output logical interface

  Correct Answer: AD

  Cisco standard NetFlow version 5 defines a flow as a unidirectional sequence of packets that all share seven values which define a unique key for the flow:+ Ingress interface (SNMP ifIndex)+ Source IP address+ Destination IP address+ IP

  protocol+ Source port for UDP or TCP, 0 for other protocols+ Destination port for UDP or TCP, type and code for ICMP, or 0 for other protocols+ IP Type of ServiceNote:

  A flow is a unidirectional series of packets between a given source and destination.

• Question 506:

  An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which probe must be enabled for this type of profiling to work?

  A. NetFlow

  B. NMAP

  C. SNMP

  D. DHCP

  Correct Answer: D

• Question 507:

  A company is experiencing exfiltration of credit card numbers that are not being stored on- premise. The company needs to be able to protect sensitive data throughout the full environment. Which tool should be used to accomplish this goal?

  A. Security Manager

  B. Cloudlock

  C. Web Security Appliance

  D. Cisco ISE

  Correct Answer: B

  Cisco Cloudlock is a cloud-native cloud access security broker (CASB) that helps you move to the cloud safely. It protects your cloud users, data, and apps. Cisco Cloudlock provides visibility and compliance checks, protects data against misuse and exfiltration, and provides threat protections against malware like ransomware.

• Question 508:

  Which Talos reputation center allows you to track the reputation of IP addresses for email and web traffic?

  A. IP Blacklist Center

  B. File Reputation Center

  C. AMP Reputation Center

  D. IP and Domain Reputation Center

  Correct Answer: D

• Question 509:

  How is ICMP used an exfiltration technique?

  A. by flooding the destination host with unreachable packets

  B. by sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address

  C. by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host

  D. by overwhelming a targeted host with ICMP echo-request packets

  Correct Answer: C

• Question 510:

  Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?

  A. aaa server radius dynamic-author

  B. aaa new-model

  C. auth-type all

  D. ip device-tracking

  Correct Answer: B

  aaa server radius dynamic-author Sets up the local AAA server for the dynamic authorization service, which must be enabled to support the CoA functionality to push the policy map in an input and output direction, and enters dynamic authorization local server configuration mode.

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html