Cisco CCNP Security 350-701 Questions & Answers

• Question 71:

  Which Cisco ISE feature helps to detect missing patches and helps with remediation?

  A. posture assessment

  B. profiling policy

  C. authentication policy

  D. enabling probes

  Correct Answer: A

  Posture assessment is a feature of Cisco Identity Services Engine (ISE) that helps to detect missing patches and helps with remediation. It assesses the security posture of endpoint devices connecting to the network by checking for compliance with security policies and identifying any vulnerabilities, such as missing patches. Once non-compliant devices are identified, ISE can take appropriate actions, such as quarantining the device or providing instructions for remediation.

• Question 72:

  An engineer is configuring Cisco WSA and needs to deploy it in transparent mode. Which configuration component must be used to accomplish this goal?

  A. MDA on the router

  B. PBR on Cisco WSA

  C. WCCP on switch

  D. DNS resolution on Cisco WSA

  Correct Answer: C

• Question 73:

  What are two workload security models? (Choose two.)

  A. SaaS

  B. PaaS

  C. off-premises

  D. on-premises

  E. IaaS

  Correct Answer: AD

• Question 74:

  Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)

  A. Apex licensing

  B. TACACS+

  C. profiling

  D. DHCP and SNMP probes

  E. posture agents

  Correct Answer: CE

• Question 75:

  What is the most commonly used protocol for network telemetry?

  A. NetFlow

  B. SNMP

  C. TFTP

  D. SMTP

  Correct Answer: A

• Question 76:

  What are two functions of IKEv1 but not IKEv2? (Choose two.)

  A. IKEv1 conversations are initiated by the IKE_SA_INIT message.

  B. With IKEv1, aggressive mode negotiates faster than main mode.

  C. IKEv1 uses EAP for authentication.

  D. NAT-T is supported in IKEv1 but not in IKEv2.

  E. With IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext.

  Correct Answer: BE

  Reference: https://community.cisco.com/t5/routing/internet-key-exchange-ike-aggressive-mode/td-p/2081283

• Question 77:

  What does Cisco ISE use to collect endpoint attributes that are used in profiling?

  A. probes

  B. posture assessment

  C. Cisco AnyConnect Secure Mobility Client

  D. Cisco pxGrid

  Correct Answer: A

  Reference:

  https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-6/ admin_guide/b_ise_admin_guide_26/ b_ise_admin_guide_26_chapter_010100.html.xml#:~:text=Network %20probe%20is%20a%

  20method,in%20the%20Cisco%20ISE%20database

• Question 78:

  An administrator is testing new configuration on a network device. The network device had a previously established association with the NTP server but is no longer processing time updates. What is the cause of this issue?

  A. The server changed its time source to stratum 1.

  B. The network device is sending the wrong password to the server.

  C. NTP authentication has been configured on the network device.

  D. NTP authentication has been configured on the NTP server.

  Correct Answer: C

• Question 79:

  During a recent security audit, a Cisco IOS router with a working IPSEC configuration using IKEv1 was flagged for using a wildcard mask with the crypto isakmp key command. The VPN peer is a SOHO router with a dynamically assigned IP address. Dynamic DNS has been configured on the SOHO router to map the dynamic IP address to the host name of vpn.sohoroutercompany.com. In addition to the command crypto isakmp key Cisc123456789 hostname vpn.sohoroutercompany.com, what other two commands are now required on the Cisco IOS router far the VPN to continue to function after the wildcard command is removed? (Choose two.)

  A. ip host vpn.sohoroutercompany.com

  B. crypto isakmp identity hostname

  C. Add the dynamic keyword to the existing crypto map command

  D. fqdn vpn.sohoroutercompany.com

  E. ip name-server

  Correct Answer: BC

• Question 80:

  Which command is used to log all events to a destination collector 209.165.201.10?

  A. CiscoASA(config-pmap-c)# flow-export event-type all destination 209.165.201.10

  B. CiscoASA(config-cmap)# flow-export event-type flow-update destination 209.165.201.10

  C. CiscoASA(config-pmap-c)# flow-export event-type flow-update destination 209.165.201.10

  D. CiscoASA(config-cmap)# flow-export event-type all destination 209.165.201.10

  Correct Answer: A

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ monitor_nsel.html