Cisco CCNP Security 350-701 Questions & Answers

• Question 561:

  Which option is the main function of Cisco Firepower impact flags?

  A. They alert administrators when critical events occur.

  B. They highlight known and suspected malicious IP addresses in reports.

  C. They correlate data about intrusions and vulnerability.

  D. They identify data that the ASA sends to the Firepower module.

  Correct Answer: C

• Question 562:

  Which two kinds of attacks are prevented by multifactor authentication? (Choose two)

  A. phishing

  B. brute force

  C. man-in-the-middle

  D. DDOS

  E. teardrop

  Correct Answer: AB

  https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/cisco-mfa-password-security-infographic.pdf

• Question 563:

  A mall provides security services to customers with a shared appliance. The mall wants separation of management on the shared appliance. Which ASA deployment mode meets these needs?

  A. routed mode

  B. transparent mode

  C. multiple context mode

  D. multiple zone mode

  Correct Answer: C

• Question 564:

  What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two)

  A. multiple factor auth

  B. local web auth

  C. single sign-on

  D. central web auth

  E. TACACS+

  Correct Answer: BD

  https://community.cisco.com/t5/security-knowledge-base/collection-of-ise-auth-and-service-flows/ta-p/3641835

• Question 565:

  Which deployment model is the most secure when considering risks to cloud adoption?

  A. Public Cloud

  B. Hybrid Cloud

  C. Community Cloud

  D. Private Cloud

  Correct Answer: D

• Question 566:

  Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?

  A. Group Policy

  B. Access Control Policy

  C. Device Management Policy

  D. Platform Service Policy

  Correct Answer: D

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc- configguide-v62/platform_settings_policies_for_managed_devices.html

  Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the bestanswer here so we have to choose it.

• Question 567:

  Which functions of an SDN architecture require southbound APIs to enable communication?

  A. SDN controller and the network elements

  B. management console and the SDN controller

  C. management console and the cloud

  D. SDN controller and the cloud

  Correct Answer: A

  The Southbound API is used to communicate between Controllers and network devices

• Question 568:

  Which API is used for Content Security?

  A. NX-OS API

  B. IOS XR API

  C. OpenVuln API

  D. AsyncOS API

  Correct Answer: D

• Question 569:

  Refer to the exhibit.

  

  What does the number 15 represent in this configuration?

  A. privilege level for an authorized user to this router

  B. access list that identifies the SNMP devices that can access the router

  C. interval in seconds between SNMPv3 authentication attempts

  D. number of possible failed attempts until the SNMPv3 user is locked out

  Correct Answer: B

  The syntax of this command is shown below: snmp-server group [group-name {v1 | v2c | v3 [auth | noauth | priv]}] [read read-view] [ write write-view] [notify notify-view] [access access-list] The command above restricts which IP source addresses are allowed to access SNMP functions on the router. You could restrict SNMP access by simply applying an interface ACL to block incoming SNMP packets that don't come from trusted servers. However, this would not be as effective as using the global SNMP commands shown in this recipe. Because you can apply this method once for the whole router, it is much simpler than applying ACLs to block SNMP on all interfaces separately. Also, using interface ACLs would block not only SNMP packets intended for this router, but also may stop SNMP packets that just happened to be passing through on their way to some other destination device.

• Question 570:

  Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node?

  A. RADIUS Change of Authorization

  B. device tracking

  C. DHCP snooping

  D. VLAN hopping

  Correct Answer: A