Cisco CCNP Security 350-701 Questions & Answers

• Question 541:

  Which two tasks allow NetFlow on a Cisco ASA 5500 Series firewall? (Choose two)

  A. Enable NetFlow Version 9.

  B. Create an ACL to allow UDP traffic on port 9996.

  C. Apply NetFlow Exporter to the outside interface in the inbound direction.

  D. Create a class map to match interesting traffic.

  E. Define a NetFlow collector by using the flow-export command

  Correct Answer: DE

  Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/special/netflow/guide/asa_netflow.html#pgfId-1330480

• Question 542:

  How does Cisco Stealthwatch Cloud provide security for cloud environments?

  A. It delivers visibility and threat detection.

  B. It prevents exfiltration of sensitive data.

  C. It assigns Internet-based DNS protection for clients and servers.

  D. It facilitates secure connectivity between public and private networks.

  Correct Answer: A

  Cisco Stealthwatch Cloud: Available as an SaaS product offer to provide visibility and threat detection within public cloud infrastructures such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

• Question 543:

  Which attack is commonly associated with C and C++ programming languages?

  A. cross-site scripting

  B. water holing

  C. DDoS

  D. buffer overflow

  Correct Answer: D

  A buffer overflow (or buffer overrun) occurs when the volume of data exceeds the storage capacity of the memory buffer. As a result, the program attempting to write the data to the buffer overwrites adjacent memory locations. Buffer overflow is a vulnerability in low level codes of C and C++. An attacker can cause the program to crash, make data corrupt, steal some private information or run his/her own code. It basically means to access any buffer outside of it's alloted memory space. This happens quite frequently in the case of arrays.

• Question 544:

  On Cisco Firepower Management Center, which policy is used to collect health modules alerts from managed devices?

  A. health policy

  B. system policy

  C. correlation policy

  D. access control policy

  E. health awareness policy

  Correct Answer: A

• Question 545:

  Refer to the exhibit.

  

  Which command was used to display this output?

  A. show dot1x all

  B. show dot1x

  C. show dot1x all summary

  D. show dot1x interface gi1/0/12

  Correct Answer: A

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x- pba.html

• Question 546:

  Refer to the exhibit.

  

  What is a result of the configuration?

  A. Traffic from the DMZ network is redirected

  B. Traffic from the inside network is redirected

  C. All TCP traffic is redirected

  D. Traffic from the inside and DMZ networks is redirected

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-firepower- services/118644-configurefirepower-00.html

• Question 547:

  In which cloud services model is the tenant responsible for virtual machine OS patching?

  A. IaaS

  B. UCaaS

  C. PaaS

  D. SaaS

  Correct Answer: A

  Only in On-site (on-premises) and IaaS we (tenant) manage O/S (Operating System).

  

• Question 548:

  How is Cisco Umbrella configured to log only security events?

  A. per policy

  B. in the Reporting settings

  C. in the Security Settings section

  D. per network in the Deployments section

  Correct Answer: A

  Reference: https://docs.umbrella.com/deployment-umbrella/docs/log-management

• Question 549:

  Which command enables 802.1X globally on a Cisco switch?

  A. dot1x system-auth-control

  B. dot1x pae authenticator

  C. authentication port-control aut

  D. aaa new-model

  Correct Answer: A

  The command to globally enable 802.1x authentication on the switch, use the dot1x system-auth-control command in Global Configuration mode. https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-small-business-300-series-managed-switches/smb5635-configure-global-802-1x-properties-on-a-switch-through-the-c.html

• Question 550:

  Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

  A. To view bandwidth usage for NetFlow records, the QoS feature must be enabled.

  B. A sysopt command can be used to enable NSEL on a specific interface.

  C. NSEL can be used without a collector configured.

  D. A flow-export event type must be defined under a policy

  Correct Answer: D