Cisco CCNP Security 350-701 Questions & Answers

• Question 61:

  When network telemetry is implemented, what is important to be enabled across all network infrastructure devices to correlate different sources?

  A. CDP

  B. syslog

  C. NTP

  D. DNS

  Correct Answer: C

• Question 62:

  What is the function of the crypto isakmp key cisc123456789 address 192.168.50.1 255.255.255.255 command when establishing an IPsec VPN tunnel?

  A. It configures the pre-shared authentication key for host 192.168.50.1.

  B. It prevents 192.168.50.1 from connecting to the VPN server.

  C. It configures the local address for the VPN server 192.168.50.1.

  D. It defines the data destined to 192.168.50.1 is going to be encrypted.

  Correct Answer: A

• Question 63:

  What are two recommended approaches to stop DNS tunneling for data exfiltration and command and control call backs? (Choose two.)

  A. Use intrusion prevention system.

  B. Block all TXT DNS records.

  C. Enforce security over port 53.

  D. Use next generation firewalls.

  E. Use Cisco Umbrella.

  Correct Answer: CE

• Question 64:

  Which algorithm is an NGE hash function?

  A. HMAC

  B. SHA-1

  C. MD5

  D. SISHA-2

  Correct Answer: D

• Question 65:

  Which Cisco security solution gives the most complete view of the relationships and evolution of Internet domains, IPs, and files, and helps to pinpoint attackers' infrastructures and predict future threat?

  A. Cisco Umbrella Investigate

  B. Cisco Stealthwatch

  C. Cisco pxGrid

  D. Cisco Stealthwatch Cloud

  Correct Answer: A

  Reference: https://umbrella.cisco.com/products/umbrella-investigate

• Question 66:

  A company recently discovered an attack propagating throughout their Windows network via a file named abc428565580xyz exe The malicious file was uploaded to a Simple Custom Detection list in the AMP for Endpoints Portal and the currently applied policy for the Windows clients was updated to reference the detection list Verification testing scans on known infected systems shows that AMP for Endpoints is not detecting the presence of this file as an indicator of compromise.

  What must be performed to ensure detection of the malicious file?

  A. Upload the malicious file to the Blocked Application Control List

  B. Use an Advanced Custom Detection List instead of a Simple Custom Detection List

  C. Check the box in the policy configuration to send the file to Cisco Threat Grid for dynamic analysis

  D. Upload the SHA-256 hash for the file to the Simple Custom Detection List

  Correct Answer: D

• Question 67:

  An engineer is trying to decide whether to use Cisco Umbrella, Cisco CloudLock, Cisco Stealthwatch, or Cisco AppDynamics Cloud Monitoring for visibility into data transfers as well as protection against data exfiltration.

  Which solution best meets these requirements?

  A. Cisco CloudLock

  B. Cisco AppDynamics Cloud Monitoring

  C. Cisco Umbrella

  D. Cisco Stealthwatch

  Correct Answer: D

• Question 68:

  An engineer needs to detect and quarantine a file named abc424400664 zip based on the MD5 signature of the file using the Outbreak Control list feature within Cisco Advanced Malware Protection (AMP) for Endpoints The configured detection method must work on files of unknown disposition Which Outbreak Control list must be configured to provide this?

  A. Blocked Application

  B. Simple Custom Detection

  C. Advanced Custom Detection

  D. Android Custom Detection

  Correct Answer: C

• Question 69:

  For a given policy in Cisco Umbrella, how should a customer block website based on a custom list?

  A. by specifying blocked domains in me policy settings

  B. by specifying the websites in a custom blocked category

  C. by adding the websites to a blocked type destination list

  D. by adding the website IP addresses to the Cisco Umbrella blocklist

  Correct Answer: C

• Question 70:

  Which VMware platform does Cisco ACI integrate with to provide enhanced visibility, provide policy integration and deployment, and implement security policies with access lists?

  A. VMware APIC

  B. VMwarevRealize

  C. VMware fusion

  D. VMware horizons

  Correct Answer: B