Steps Necessary To Pass The 350-701 Exam from Training Expert TroytecDumps
Valid Way To Pass CCNP Security's 350-701 Exam
NEW QUESTION 23
An organization received a large amount of SPAM messages over a short time period. In order to take action on the messages, it must be determined how harmful the messages are and this needs to happen dynamically.
What must be configured to accomplish this?
- A. Configure the Cisco ESA to modify policies based on the traffic seen.
- B. Configure the Cisco WSA to modify policies based on the traffic seen.
- C. Configure the Cisco WSA to receive real-time updates from Talos.
- D. Configure the Cisco ESA to receive real-time updates from Talos
Answer: D
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/security/esa/esa120/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Adm
NEW QUESTION 24
Refer to the exhibit.
An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?
- A. dotlx reauthentication
- B. cisp enable
- C. authentication open
- D. dot1x pae authenticator
Answer: D
NEW QUESTION 25 
Refer to the exhibit. An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?
- A. cisp enable
- B. authentication open
- C. dot1x pae authenticator
- D. dot1x reauthentication
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 26
Drag and drop the Firepower Next Generation Intrustion Prevention System detectors from the left onto the correct definitions on the right.
Answer:
Explanation:
NEW QUESTION 27
Which algorithm provides asymmetric encryption?
- A. AES
- B. RSA
- C. 3DES
- D. RC4
Answer: B
Explanation:
Reference:
https://securityboulevard.com/2020/05/types-of-encryption-5-encryption-algorithms-how-to-choose-the-right-one/#:~:text=Standard%20asymmetric%20encryption%20algorithms%20include,%2C%20El%20Gamal%2C%20and%20DSA.
NEW QUESTION 28
Which two preventive measures are used to control cross-site scripting? (Choose two.)
- A. Disable cookie inspection in the HTML inspection engine.
- B. Run untrusted HTML input through an HTML sanitization engine.
- C. SameSite cookie attribute should not be used.
- D. Incorporate contextual output encoding/escaping.
- E. Enable client-side scripts on a per-domain basis.
Answer: D,E
NEW QUESTION 29
An organization has two systems in their DMZ that have an unencrypted link between them for communication. The organization does not have a defined password policy and uses several default accounts on the systems. The application used on those systems also have not gone through stringent code reviews. Which vulnerability would help an attacker brute force their way into the systems?
- A. weak passwords
- B. lack of file permission
- C. lack of input validation
- D. missing encryption
Answer: D
NEW QUESTION 30
Which two descriptions of AES encryption are true? (Choose two.)
- A. AES is more secure than 3DES.
- B. AES can use a 168-bit key for encryption.
- C. AES encrypts and decrypts a key three times in sequence.
- D. AES can use a 256-bit key for encryption.
- E. AES is less secure than 3DES.
Answer: A,D
NEW QUESTION 31
An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?
- A. Modify the access control policy to trust the industrial traffic
- B. Implement pre-filter policies for the CIP preprocessor
- C. Configure intrusion rules for the DNP3 preprocessor
- D. Enable traffic analysis in the Cisco FTD
Answer: B
Explanation:
Explanation The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct. The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields. The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine. You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-configguide-v63/scada_preprocessors.html Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications. Note: + An intrusion rule is a specified set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities in your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule, and triggers the rule if the data packet meets all the conditions specified in the rule. + Preprocessor rules, which are rules associated with preprocessors and packet decoder detection options in the network analysis policy. Most preprocessor rules are disabled by default.
The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct.
The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields.
The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine.
You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic.
Reference:
Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications.
Note:
Explanation The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct. The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields. The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine. You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-configguide-v63/scada_preprocessors.html Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications. Note: + An intrusion rule is a specified set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities in your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule, and triggers the rule if the data packet meets all the conditions specified in the rule. + Preprocessor rules, which are rules associated with preprocessors and packet decoder detection options in the network analysis policy. Most preprocessor rules are disabled by default.
NEW QUESTION 32
An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group.
Which probe must be enabled for this type of profiling to work?
- A. NMAP
- B. NetFlow
- C. DHCP
- D. SNMP
Answer: A
NEW QUESTION 33
What is a commonality between DMVPN and FlexVPN technologies?
- A. FlexVPN and DMVPN use the same hashing algorithms.
- B. FlexVPN and DMVPN use IS-IS routing protocol to communicate with spokes
- C. IOS routers run the same NHRP code for DMVPN and FlexVPN.
- D. FlexVPN and DMVPN use the new key management protocol.
Answer: C
NEW QUESTION 34
Which two capabilities of Integration APIs are utilized with Cisco DNA center? (Choose two)
- A. Connect to Information Technology Service Management Platforms
- B. Create new SSIDs on a wireless LAN controller
- C. Upgrade software on switches and routers
- D. Automatically deploy new virtual routers
- E. Application monitors for power utilization of devices and IoT sensors
Answer: A,E
Explanation:
Explanation Integration API (Westbound) Integration capabilities are part of Westbound interfaces. To meet the need to scale and accelerate operations in modern data centers, IT operators require intelligent, end-to-end work flows built with open APIs. The Cisco DNA Center platform provides mechanisms for integrating Cisco DNA Assurance workflows and data with thirdparty IT Service Management (ITSM) solutions. Reference: https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/events-andnotifications-eastbound -> Therefore answer D is correct. Westbound-Integration APIs Cisco DNA Center platform can power end-to-end IT processes across the value chain by integrating various domains such as ITSM, IPAM, and reporting. By leveraging the REST-based Integration Adapter APIs, bidirectional interfaces can be built to allow the exchange of contextual information between Cisco DNA Center and the external, third-party IT systems. The westbound APIs provide the capability to publish the network data, events and notifications to the external systems and consume information in Cisco DNA Center from the connected systems. Reference: https://blogs.cisco.com/networking/with-apis-cisco-dna-center-can-improve-your-competitiveadvantage Therefore the most suitable choice is Integration APIs can monitor for power utilization of devices and IoT sensors -> Answer C is correct.
Integration API (Westbound)
Integration capabilities are part of Westbound interfaces. To meet the need to scale and accelerate operations in modern data centers, IT operators require intelligent, end-to-end work flows built with open APIs. The Cisco DNA Center platform provides mechanisms for integrating Cisco DNA Assurance workflows and data with thirdparty IT Service Management (ITSM) solutions.
Reference:
-> Therefore answer D is correct.
Westbound-Integration APIs
Cisco DNA Center platform can power end-to-end IT processes across the value chain by integrating various domains such as ITSM, IPAM, and reporting. By leveraging the REST-based Integration Adapter APIs, bidirectional interfaces can be built to allow the exchange of contextual information between Cisco DNA Center and the external, third-party IT systems. The westbound APIs provide the capability to publish the network data, events and notifications to the external systems and consume information in Cisco DNA Center from the connected systems.
Therefore the most suitable choice is Integration APIs can monitor for power utilization of devices and IoT Explanation Integration API (Westbound) Integration capabilities are part of Westbound interfaces. To meet the need to scale and accelerate operations in modern data centers, IT operators require intelligent, end-to-end work flows built with open APIs. The Cisco DNA Center platform provides mechanisms for integrating Cisco DNA Assurance workflows and data with thirdparty IT Service Management (ITSM) solutions. Reference: https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/events-andnotifications-eastbound -> Therefore answer D is correct. Westbound-Integration APIs Cisco DNA Center platform can power end-to-end IT processes across the value chain by integrating various domains such as ITSM, IPAM, and reporting. By leveraging the REST-based Integration Adapter APIs, bidirectional interfaces can be built to allow the exchange of contextual information between Cisco DNA Center and the external, third-party IT systems. The westbound APIs provide the capability to publish the network data, events and notifications to the external systems and consume information in Cisco DNA Center from the connected systems. Reference: https://blogs.cisco.com/networking/with-apis-cisco-dna-center-can-improve-your-competitiveadvantage Therefore the most suitable choice is Integration APIs can monitor for power utilization of devices and IoT sensors -> Answer C is correct.
NEW QUESTION 35
An organization has a Cisco Stealthwatch Cloud deployment in their environment. Cloud logging is working as expected, but logs are not being received from the on-premise network, what action will resolve this issue?
- A. Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud
- B. Configure security appliances to send NetFlow to Cisco Stealthwatch Cloud
- C. Configure security appliances to send syslogs to Cisco Stealthwatch Cloud
- D. Deploy a Cisco FTD sensor to send events to Cisco Stealthwatch Cloud
Answer: A
Explanation:
You can also monitor on-premises networks in your organizations using Cisco Stealthwatch Cloud. In order to do so, you need to deploy at least one Cisco Stealthwatch Cloud Sensor appliance (virtual or physical appliance).
NEW QUESTION 36
In an laaS cloud services modal, which security function is the provider responsible for managing?
- A. firewalling virtual machines
- B. CASB
- C. Internet proxy
- D. hypervisor OS hardening
Answer: D
Explanation:
Infrastructure as a Service (IaaS) in cloud computing is one of the most significant and fastest growing field. In this service model, cloud providers offer resources to users/machines that include computers as virtual machines, raw (block) storage, firewalls, load balancers, and network devices.
NEW QUESTION 37
How does Cisco Umbrella archive logs to an enterprise-owned storage?
- A. by using the Application Programming Interface to fetch the logs
- B. by being configured to send logs to a self-managed AWS S3 bucket
- C. by sending logs via syslog to an on-premises or cloud-based syslog server
- D. by the system administrator downloading the logs from the Cisco Umbrella web portal
Answer: B
NEW QUESTION 38
What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two)
- A. The Cisco WSA responds with its own IP address only if it is running in explicit mode.
- B. When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request destination.
- C. The Cisco WSA is configured in a web browser only if it is running in transparent mode.
- D. The Cisco WSA responds with its own IP address only if it is running in transparent mode.
- E. The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.
Answer: D,E
Explanation:
Explanation
The Cisco Web Security Appliance (WSA) includes a web proxy, a threat analytics engine, antimalware engine, policy management, and reporting in a single physical or virtual appliance. The main use of the Cisco WSA is to protect users from accessing malicious websites and being infected by malware.
You can deploy the Cisco WSA in two different modes:
- Explicit forward mode
- Transparent mode
In explicit forward mode, the client is configured to explicitly use the proxy, subsequently sending all web traffic to the proxy. Because the client knows there is a proxy and sends all traffic to the proxy in explicit forward mode, the client does not perform a DNS lookup of the domain before requesting the URL. The Cisco WSA is responsible for DNS resolution, as well.
When you configure the Cisco WSA in explicit mode, you do not need to configure any other network infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA. -> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct. When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches. The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers. Reference: https://www.cisco.com/c/en/us/tech/content-networking/web-cache-communications-protocol-wccp/index.html ->Therefore answer D is correct as redirection can be done on Layer 3 device only. In transparent mode, the client is unaware its traffic is being sent to a proxy (Cisco WSA) and, as a result, the client uses DNS to resolve the domain name in the URL and send the web request destined for the web server (not the proxy). When you configure the Cisco WSA in transparent mode, you need to identify a network choke point with a redirection device (a Cisco ASA) to redirect traffic to the proxy.
infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA.
-> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct.
When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches.
The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers.
Reference:
->Therefore answer D is correct as redirection can be done on Layer 3 device only.
When you configure the Cisco WSA in explicit mode, you do not need to configure any other network infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA. -> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct. When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches. The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers. Reference: https://www.cisco.com/c/en/us/tech/content-networking/web-cache-communications-protocol-wccp/index.html ->Therefore answer D is correct as redirection can be done on Layer 3 device only. In transparent mode, the client is unaware its traffic is being sent to a proxy (Cisco WSA) and, as a result, the client uses DNS to resolve the domain name in the URL and send the web request destined for the web server (not the proxy). When you configure the Cisco WSA in transparent mode, you need to identify a network choke point with a redirection device (a Cisco ASA) to redirect traffic to the proxy.
WSA in Transparent mode
-> Therefore in Transparent mode, WSA uses its own IP address to initiate a new connection the Web Server (in step 4 above) -> Answer E is correct.
Answer C is surely not correct as WSA cannot be configured in a web browser in either mode.
Answer A seems to be correct but it is not. This answer is correct if it states "When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request source" (not destination).
NEW QUESTION 39
Refer to the exhibit.
What does the number 15 represent in this configuration?
- A. privilege level for an authorized user to this router
- B. access list that identifies the SNMP devices that can access the router
- C. number of possible failed attempts until the SNMPv3 user is locked out
- D. interval in seconds between SNMPv3 authentication attempts
Answer: B
Explanation:
Explanation
The syntax of this command is shown below:
snmp-server group [group-name {v1 | v2c | v3 [auth | noauth | priv]}] [read read-view] [write write-view] [notify notify-view] [access access-list] The command above restricts which IP source addresses are allowed to access SNMP functions on the router. You could restrict SNMP access by simply applying an interface ACL to block incoming SNMP packets that don't come from trusted servers. However, this would not be as effective as using the global SNMP commands shown in this recipe. Because you can apply this method once for the whole router, it is much simpler than applying ACLs to block SNMP on all interfaces separately. Also, using interface ACLs would block not only SNMP packets intended for this router, but also may stop SNMP packets that just happened to be passing through on their way to some other destination device.
NEW QUESTION 40
A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?
- A. The ESA immediately makes another attempt to upload the file.
- B. AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.
- C. The file upload is abandoned.
- D. The file is queued for upload when connectivity is restored.
Answer: B
Explanation:
Explanation
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118796-technote-esa-00.html
NEW QUESTION 41
Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two.)
- A. authentication
- B. automation
- C. encryption
- D. accounting
- E. assurance
Answer: B,E
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/products/cloud-systems-management/dna-center/index.html
NEW QUESTION 42
Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?
- A. proxy gateway
- B. redirection
- C. transparent
- D. forward
Answer: C
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117940-qa-wsa-
00.html
NEW QUESTION 43
Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?
- A. proxy gateway
- B. redirection
- C. transparent
- D. forward
Answer: C
NEW QUESTION 44
......
All 350-701 Dumps and Implementing and Operating Cisco Security Core Technologies Training Courses: https://www.troytecdumps.com/350-701-troytec-exam-dumps.html
Free Test Engine For Implementing and Operating Cisco Security Core Technologies Certification Exams: https://drive.google.com/open?id=1Bf58bQgdG_B_16obJEvzfahuU2hSXvcs