Cisco CCNP Security 350-701 Questions & Answers

• Question 591:

  Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two)

  A. Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS

  B. Cisco FTDv with one management interface and two traffic interfaces configured

  C. Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises

  D. Cisco FTDv with two management interfaces and one traffic interface configured

  E. Cisco FTDv configured in routed mode and IPv6 configured

  Correct Answer: AC

  https://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-virtual-appliance-asav/white-paper-c11-740505.html

• Question 592:

  What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

  A. EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.

  B. EDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter defenses.

  C. EPP focuses on network security, and EDR focuses on device security.

  D. EDR focuses on network security, and EPP focuses on device security.

  Correct Answer: A

• Question 593:

  Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

  A. It allows the endpoint to authenticate with 802.1x or MAB.

  B. It verifies that the endpoint has the latest Microsoft security patches installed.

  C. It adds endpoints to identity groups dynamically.

  D. It allows CoA to be applied if the endpoint status is compliant.

  Correct Answer: B

• Question 594:

  When wired 802.1X authentication is implemented, which two components are required? (Choose two)

  A. authentication server: Cisco Identity Service Engine

  B. supplicant: Cisco AnyConnect ISE Posture module

  C. authenticator: Cisco Catalyst switch

  D. authenticator: Cisco Identity Services Engine

  E. authentication server: Cisco Prime Infrastructure

  Correct Answer: AC

  https://www.lookingpoint.com/blog/ise-series-802.1x

• Question 595:

  Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

  A. interpacket variation

  B. software package variation

  C. flow insight variation

  D. process details variation

  Correct Answer: A

  Reference:

  https://www.cisco.com/c/dam/global/en_uk/products/switches/cisco_nexus_9300_ex_platfo rm_switches_white_paper_uki.pdf

• Question 596:

  What is the function of Cisco Cloudlock for data security?

  A. data loss prevention

  B. controls malicious cloud apps

  C. detects anomalies

  D. user and entity behavior analytics

  Correct Answer: A

  https://umbrella.cisco.com/products/casb

• Question 597:

  The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

  A. SDN controller and the cloud

  B. management console and the SDN controller

  C. management console and the cloud

  D. SDN controller and the management solution

  Correct Answer: D

  Northbound APIs are the link between the applications and the SDN controller. The applications can tell the network what they need (data, storage, bandwidth, and so on) and the network can deliver those resources, or communicate what it has.

• Question 598:

  After deploying a Cisco ESA on your network, you notice that some messages fail to reach their destinations.

  Which task can you perform to determine where each message was lost?

  A. Configure the trackingconfig command to enable message tracking.

  B. Generate a system report.

  C. Review the log files.

  D. Perform a trace.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12- 0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011110.ht ml

• Question 599:

  What are two rootkit types? (Choose two)

  A. registry

  B. virtual

  C. bootloader

  D. user mode

  E. buffer mode

  Correct Answer: CD

  The term `rootkit' originally comes from the Unix world, where the word `root' is used to describe a user with thehighest possible level of access privileges, similar to an `Administrator' in Windows. The word `kit' refers to thesoftware that grants root-level access to the machine. Put the two together and you get `rootkit', a program thatgives someone ?with legitimate or malicious intentions ?privileged access to a computer.There are four main types of rootkits: Kernel rootkits, User mode rootkits, Bootloader rootkits, Memory rootkits

• Question 600:

  What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two)

  A. flexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications

  B. single sign-on access to on-premises and cloud applications

  C. integration with 802.1x security using native Microsoft Windows supplicant

  D. secure access to on-premises and cloud applications

  E. identification and correction of application vulnerabilities before allowing access to resources

  Correct Answer: AD

  Two-factor authentication adds a second layer of security to your online accounts. Verifying your identity using asecond factor (like your phone or other mobile device) prevents anyone but you from logging in, even if theyknow your password.Note: Single sign-on (SSO) is a property of identity and access management that enables users to securelyauthenticate with multiple applications and websites by logging in only once with just one set of credentials(username and password). With SSO, the application or website that the user is trying to access relies on atrusted third party to verify that users are who they say they are.