Cisco CCNP Security 350-701 Questions & Answers

• Question 81:

  Client workstations are experiencing extremely poor response time. An engineer suspects that an attacker is eavesdropping and making independent connections while relaying messages between victims to make them think they are talking to each other over a private connection. Which feature must be enabled and configured to provide relief from this type of attack?

  A. Link Aggregation

  B. Reverse ARP

  C. private VLANs

  D. Dynamic ARP Inspection

  Correct Answer: D

• Question 82:

  Which type of DNS abuse exchanges data between two computers even when there is no direct connection?

  A. Malware installation

  B. Command-and-control communication

  C. Network footprinting

  D. Data exfiltration

  Correct Answer: D

  Reference: https://www.netsurion.com/articles/5-types-of-dns-attacks-and-how-to-detect- them

• Question 83:

  Which solution detects threats across a private network, public clouds, and encrypted traffic?

  A. Cisco Stealthwatch

  B. Cisco CTA

  C. Cisco Encrypted Traffic Analytics

  D. Cisco Umbrella

  Correct Answer: A

• Question 84:

  Which DevSecOps implementation process gives a weekly or daily update instead of monthly or quarterly in the applications?

  A. Orchestration

  B. CI/CD pipeline

  C. Container

  D. Security

  Correct Answer: B

  Reference: https://devops.com/how-to-implement-an-effective-ci-cd-pipeline/

• Question 85:

  When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key establishment?

  A. RSA is an asymmetric key establishment algorithm intended to output symmetric keys

  B. RSA is a symmetric key establishment algorithm intended to output asymmetric keys

  C. DH is a symmetric key establishment algorithm intended to output asymmetric keys

  D. DH is on asymmetric key establishment algorithm intended to output symmetric keys

  Correct Answer: D

  Diffie Hellman (DH) uses a private-public key pair to establish a shared secret, typically a symmetric key. DH is not a symmetric algorithm ?it is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm.

• Question 86:

  Refer to the exhibit.

  

  An engineer is implementing a certificate based VPN. What is the result of the existing configuration?

  A. The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.

  B. Only an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully

  C. The OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER

  D. The OU of the IKEv2 peer certificate is set to MANGLER

  Correct Answer: A

  The "match identity certificate" command in the IKEv2 authorization policy is used to specify that the OU (Organizational Unit) attribute of the IKEv2 peer certificate should be used as the identity when matching the policy. The OU attribute is set to "MANGLER" in this case.

  So, when an IKEv2 peer with a certificate that has an OU attribute of "MANGLER" attempts to establish an IKEv2 SA, the router will use the OU attribute as the identity when matching the authorization policy. If the policy is a match, the SA will be established successfully.

• Question 87:

  Which CLI command is used to enable URL filtering support for shortened URLs on the Cisco ESA?

  A. webadvancedconfig

  B. websecurity advancedconfig

  C. outbreakconfig

  D. websecurity config

  Correct Answer: B

• Question 88:

  Which standard is used to automate exchanging cyber threat information?

  A. TAXII

  B. MITRE

  C. IoC

  D. STIX

  Correct Answer: A

• Question 89:

  An engineer is configuring Dropbox integration with Cisco Cloudlock. Which action must be taken before granting API access in the Dropbox admin console?

  A. Authorize Dropbox within the Platform settings in the Cisco Cloudlock portal.

  B. Add Dropbox to the Cisco Cloudlock Authentication and API section in the Cisco Cloudlock portal.

  C. Send an API request to Cisco Cloudlock from Dropbox admin portal.

  D. Add Cisco Cloudlock to the Dropbox admin portal.

  Correct Answer: A

• Question 90:

  A large organization wants to deploy a security appliance in the public cloud to form a site- to-site VPN and link the public cloud environment to the private cloud in the headquarters data center. Which Cisco security appliance meets these requirements?

  A. Cisco Cloud Orchestrator

  B. Cisco ASAV

  C. Cisco WSAV

  D. Cisco Stealthwatch Cloud

  Correct Answer: B