Cisco CCNP Security 350-701 Questions & Answers

• Question 651:

  A network administrator is modifying a remote access VPN on an FTD managed by an FMC. The administrator wants to offload traffic to certain trusted domains. The administrator wants this traffic to go out of the client's local internet and send other internet- bound traffic over the VPN Which feature must the administrator configure?

  A. dynamic split tunneling

  B. local LAN access

  C. dynamic access policies

  D. reverse route injection

  Correct Answer: A

  Explanation: In a remote access VPN configuration, dynamic split tunneling allows traffic to certain trusted domains to bypass the VPN tunnel and exit through the client's local internet gateway. This feature selectively directs only the necessary traffic over the VPN, while allowing direct internet access for specific domains or traffic deemed safe or trusted, optimizing bandwidth and performance for remote users.

• Question 652:

  What is a benefit of a Cisco Secure Email Gateway Virtual as compared to a physical Secure Email Gateway?

  A. simplifies the distribution of software updates

  B. provides faster performance

  C. provides an automated setup process

  D. enables the allocation of additional resources

  Correct Answer: D

  Explanation: One of the benefits of a Cisco Secure Email Gateway Virtual appliance compared to a physical one is the ability to allocate additional resources as needed. Virtual appliances can be easily scaled up by allocating more CPU, memory, or storage resources, providing flexibility and scalability in response to changing demands or growth.

• Question 653:

  What is a difference between GRE over IPsec and IPsec with crypto map?

  A. Multicast traffic is supported by IPsec with crypto map.

  B. GRE over IPsec supports non-IP protocols.

  C. GRE provides its own encryption mechanism.

  D. IPsec with crypto map oilers better scalability.

  Correct Answer: B

  Explanation: The difference between GRE over IPsec and IPsec with crypto map is that GRE (Generic Routing Encapsulation) over IPsec can encapsulate and transport non-IP protocols across an IP network, whereas IPsec with crypto map is typically used for IP traffic. GRE tunnels wrapped in IPsec provide a way to transport multicast traffic and other protocol types across an IPsec VPN, offering greater flexibility in the types of traffic that can be secured.

• Question 654:

  A security test performed on one of the applications shows that user input is not validated. Which security vulnerability is the application more susceptible to because of this lack of validation?

  A. denial -of-service

  B. cross-site request forgery

  C. man-in-the-middle

  D. SQL injection

  Correct Answer: D

  Explanation: An application that does not validate user input is particularly susceptible to SQL injection attacks. In an SQL injection attack, an attacker can insert or "inject" a SQL query via the input data from the client to the application. Due to the lack of validation, the malicious SQL commands are executed by the database server, leading to unauthorized access or manipulation of the database.

• Question 655:

  A network administrator is setting up Cisco FMC to send logs to Cisco Security Analytics and Logging (SaaS). The network administrator is anticipating a high volume of logging events from the firewalls and wants lo limit the strain on firewall resources. Which method must the administrator use to send these logs to Cisco Security Analytics and Logging?

  A. SFTP using the FMCCLI

  B. syslog using the Secure Event Connector

  C. direct connection using SNMP traps

  D. HTTP POST using the Security Analytics FMC plugin

  Correct Answer: B

  Explanation: The Secure Event Connector is a component of the Security Analytics and Logging (SaaS) solution that enables the FMC to send logs to the cloud-based service. The Secure Event Connector uses syslog to forward events from

  the FMC and the managed devices to the cloud. This method reduces the load on the firewall resources, as the events are sent in batches and compressed before transmission. The Secure Event Connector also provides encryption,

  authentication, and reliability for the log data. The other methods are not supported by the Security Analytics and Logging (SaaS) solution12 References := 1:

  Cisco Security Analytics and Logging (On Premises)