Cisco CCNP Security 350-701 Questions & Answers

• Question 631:

  What is the ideal deployment mode to use when you need to manage separate security policies for multiple customers on a Cisco ASA device?

  A. spanned cluster mode

  B. IRB mode

  C. VRF mode

  D. multiple context mode

  Correct Answer: D

• Question 632:

  A network administrator is setting up a site-to-site VPN from a Cisco FTD to a cloud environment. After the administrator configures the VPN on both sides, they still cannot reach the cloud environment. Which command must the administrator run on the FTD to verify that the VPN is encrypting traffic in both directions?

  A. show crypto ipsec sa

  B. show crypto ipsec stats

  C. show vpn-sessiondb detail l2l

  D. show crypto isakmp sa

  Correct Answer: A

• Question 633:

  Which two tasks are required when a decryption policy is implemented on a Cisco WSA? (Choose two.)

  A. Configure invalid certificate handling.

  B. Upload a root certificate and private key.

  C. Enable real-time revocation status checking.

  D. Enable HTTPS attack protection.

  E. Enable the HTTPS proxy.

  Correct Answer: BE

• Question 634:

  Which two activities are performed using Cisco DNA Center? (Choose two.)

  A. accounting

  B. design

  C. provision

  D. DNS

  E. DHCP

  Correct Answer: BC

• Question 635:

  In which cloud services model is the customer responsible for scanning for and mitigation of application vulnerabilities?

  A. VMaaS

  B. IaaS

  C. PaaS

  D. SaaS

  Correct Answer: C

• Question 636:

  A security engineer must add destinations into a destination list in Cisco Umbrella. What describes the application of these changes?

  A. The changes are applied immediately it the destination list is part or a policy.

  B. The destination list must be removed from the policy before changes are made to It.

  C. The changes are applied only after the configuration is saved in Cisco Umbrella.

  D. The user role of Block Page Bypass or higher is needed to perform these changes.

  Correct Answer: A

• Question 637:

  Which action configures the IEEE 802.1X Flexible Authentication feature lo support Layer 3 authentication mechanisms?

  A. Identity the devices using this feature and create a policy that allows them to pass Layer 2 authentication.

  B. Configure WebAuth so the hosts are redirected to a web page for authentication.

  C. Modify the Dot1x configuration on the VPN server lo send Layer 3 authentications to an external authentication database

  D. Add MAB into the switch to allow redirection to a Layer 3 device for authentication.

  Correct Answer: D

  Explanation: Configuring the IEEE 802.1X Flexible Authentication feature to support Layer 3 authentication mechanisms involves adding MAC Authentication Bypass (MAB) into the switch configuration. This allows devices that do not support 802.1X to be authenticated using their MAC address. Once MAB identifies the device, it can then be redirected to a Layer 3 device for further authentication, thus providing a mechanism to support devices requiring Layer 3 authentication methods.

• Question 638:

  Which two types of connectors are used to generate telemetry data from IPFIX records in a Cisco Secure Workload implementation? (Choose two.)

  A. ADC

  B. ERSPAN

  C. Cisco ASA

  D. NetFlow

  E. Cisco Secure Workload

  Correct Answer: DE

  Explanation: In a Cisco Secure Workload implementation, telemetry data can be generated from IPFIX (Internet Protocol Flow Information Export) records using NetFlow connectors and Cisco Secure Workload itself. NetFlow provides insights into network traffic flow and volume, while Cisco Secure Workload uses this data for visibility, segmentation, and security analytics within the data center.

• Question 639:

  Which two devices support WCCP for traffic redirection? (Choose two.)

  A. Cisco Secure Web Appliance

  B. Cisco IOS

  C. proxy server

  D. Cisco ASA

  E. Cisco IPS

  Correct Answer: BD

  Explanation: Web Cache Communication Protocol (WCCP) is supported on Cisco IOS routers and Cisco ASA firewalls. WCCP allows these devices to redirect traffic to a WCCP- capable device, such as a web cache or a Cisco Secure Web Appliance, for processing. This redirection can be used for tasks like content filtering, web caching, and load balancing.

• Question 640:

  What is the default action before identifying the URL during HTTPS inspection in Cisco Secure Firewall Threat Defense software?

  A. reset

  B. buffer

  C. pass

  D. drop

  Correct Answer: C

  Explanation: Before identifying the URL during HTTPS inspection in Cisco Secure Firewall Threat Defense software, the default action is to "pass." This means that the traffic is allowed through without inspection until the URL can be identified, at which point appropriate security policies can be applied based on the URL categorization and reputation.