Cisco CCNP Security 350-701 Questions & Answers

• Question 551:

  An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10. What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

  A. Cisco Identity Services Engine and AnyConnect Posture module

  B. Cisco Stealthwatch and Cisco Identity Services Engine integration

  C. Cisco ASA firewall with Dynamic Access Policies configured

  D. Cisco Identity Services Engine with PxGrid services enabled

  Correct Answer: A

• Question 552:

  Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?

  A. TLSv1.2

  B. TLSv1.1

  C. BJTLSv1

  D. DTLSv1

  Correct Answer: D

  DTLS is used for delay sensitive applications (voice and video) as its UDP based while TLS is TCP based.Therefore DTLS offers strongest throughput performance. The throughput of DTLS at the time of AnyConnect connection can be expected to have processing performance close to VPN throughput.

• Question 553:

  What is a language format designed to exchange threat intelligence that can be transported over the TAXII protocol?

  A. STIX

  B. XMPP

  C. pxGrid

  D. SMTP

  Correct Answer: A

  STIX (Structured Threat Information eXpression) is a language format designed to exchange threat intelligence that can be transported over the TAXII (Trusted Automated eXchange of Indicator Information) protocol. STIX enables organizations to share cyber threat intelligence, such as information about malware, vulnerabilities, and indicators of compromise, in a structured and machine-readable format. It allows for the exchange of information about the cyber threats, including details on the threat actors, their tools, and tactics, techniques and procedures (TTPs).

• Question 554:

  In a PaaS model, which layer is the tenant responsible for maintaining and patching?

  A. hypervisor

  B. virtual machine

  C. network

  D. application

  Correct Answer: D

  https://www.bmc.com/blogs/saas-vs-paas-vs-iaas-whats-the-difference-and-how-to-choose/

• Question 555:

  Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two)

  A. packet decoder

  B. SIP

  C. modbus

  D. inline normalization

  E. SSL

  Correct Answer: BE

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Application_Layer_Preprocessors.html

• Question 556:

  Which feature is configured for managed devices in the device platform settings of the Firepower Management Center?

  A. quality of service

  B. time synchronization

  C. network address translations

  D. intrusion policy

  Correct Answer: B

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Firepower_Software_Platform_Settings.html#task_EF18AE3D5CA9457AB65791B9654FD46C

• Question 557:

  Which technology is used to improve web traffic performance by proxy caching?

  A. WSA

  B. Firepower

  C. FireSIGHT

  D. ASA

  Correct Answer: A

• Question 558:

  Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent? (Choose two)

  A. Outgoing traffic is allowed so users can communicate with outside organizations.

  B. Malware infects the messenger application on the user endpoint to send company data.

  C. Traffic is encrypted, which prevents visibility on firewalls and IPS systems.

  D. An exposed API for the messaging platform is used to send large amounts of data.

  E. Messenger applications cannot be segmented with standard network controls

  Correct Answer: CE

• Question 559:

  Which IPS engine detects ARP spoofing?

  A. Atomic ARP Engine

  B. Service Generic Engine

  C. ARP Inspection Engine

  D. AIC Engine

  Correct Answer: A

• Question 560:

  Refer to the exhibit.

  

  Which command was used to generate this output and to show which ports are authenticating with dot1x or mab?

  A. show authentication registrations

  B. show authentication method

  C. show dot1x all

  D. show authentication sessions

  Correct Answer: D

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-xe-3se- 3850-cr-book/sec-s1-xe-3se-3850-cr-book_chapter_01.html#wp3404908137 Displaying the Summary of All Auth Manager Sessions on the Switch Enter the following:

  Switch# show authentication sessions Interface MAC Address Method Domain Status Session ID Gi1/48 0015.63b0.f676 dot1x DATA Authz Success 0A3462B1000000102983C05C Gi1/5 000f.23c4.a401 mab DATA Authz Success 0A3462B10000000D24F80B58 Gi1/5 0014.bf5d.d26d dot1x DATA Authz Success 0A3462B10000000E29811B94