Pre-Winter Sale - Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65percent

Welcome To DumpsPedia

350-701 Sample Questions Answers

Questions 4

What is the intent of a basic SYN flood attack?

Options:

A.

to solicit DNS responses

B.

to exceed the threshold limit of the connection queue

C.

to flush the register stack to re-initiate the buffers

D.

to cause the buffer to overflow

Buy Now
Questions 5

Which Linux system call loads an eBPF program and manages eBPF maps within the kernel?

Options:

A.

perf_event_open()

B.

ioctl()

C.

prctl()

D.

bpf()

Buy Now
Questions 6

Refer to the exhibit.

6

A security engineer is publishing a public web server located in the DMZ of a Cisco Secure Firewall Threat Defense device managed by Cisco Secure Firewall Management Center. The required network objects, Webserver_Private and Webserver_Public, are already defined, and an Auto NAT static rule mapping the public address to the private DMZ address is in place. The web server must be reachable from any source on the Internet. The engineer must configure a new Access Control Rule within the existing Access Control Policy. Which two configuration actions must be performed to meet the requirements? (Choose two.)

Options:

A.

Add DMZ as the Source Zone and Outside as the Destination Zone.

B.

Add Webserver_Private as the Source Network and Webserver_Public as the Destination Network.

C.

Add Any as the Source Network and Webserver_Private as the Destination Network.

D.

Add Any as the Source Network and Webserver_Public as the Destination Network.

E.

Add Outside as the Source Zone and DMZ as the Destination Zone.

Buy Now
Questions 7

Which two products are used to forecast capacity needs accurately in real time? (Choose two.)

Options:

A.

Cisco Secure Workload

B.

Cisco Umbrella

C.

Cisco Workload Optimization Manager

D.

Cisco AppDynamics

E.

Cisco Cloudlock

Buy Now
Questions 8

Which two types of policies are used by ZTNA to provide access to an application? (Choose two.)

Options:

A.

Context

B.

Access

C.

Site-to-site

D.

Identity

E.

Remote access

Buy Now
Questions 9

Which Cisco WSA feature supports access control using URL categories?

Options:

A.

transparent user identification

B.

SOCKS proxy services

C.

web usage controls

D.

user session restrictions

Buy Now
Questions 10

Drag and drop the threats from the left onto examples of that threat on the right

10

Options:

Buy Now
Questions 11

For which type of attack is multifactor authentication an effective deterrent?

Options:

A.

Ping of death

B.

Teardrop

C.

SYN flood

D.

Phishing

Buy Now
Questions 12

In a federated single sign-on environment, which protocol exchanges XML-based assertions between an identity provider and a service provider for authentication?

Options:

A.

SAML

B.

OAuth 2.0

C.

LDAP

D.

RADIUS

Buy Now
Questions 13

A security engineer must create a policy based on the reputation verdict of a file from a Cisco Secure Email Gateway. The file with an undetermined verdict must be dropped. Which action must the security engineer take to meet the requirement?

Options:

A.

Configure threshold settings for files with no score to be allowed.

B.

Set up a policy to automatically drop files with no reputation score.

C.

Implement a policy to disable file analysis.

D.

Create a policy to send a file to quarantine.

Buy Now
Questions 14

Which two configurations must be made on Cisco ISE and on Cisco TrustSec devices to force a session to be adjusted after a policy change is made? (Choose two)

Options:

A.

posture assessment

B.

aaa authorization exec default local

C.

tacacs-server host 10.1.1.250 key password

D.

aaa server radius dynamic-author

E.

CoA

Buy Now
Questions 15

Refer to the exhibit.

15

What will occur when this device tries to connect to the port?

Options:

A.

802.1X will not work, but MAB will start and allow the device on the network.

B.

802.1X will not work and the device will not be allowed network access

C.

802 1X will work and the device will be allowed on the network

D.

802 1X and MAB will both be used and ISE can use policy to determine the access level

Buy Now
Questions 16

An engineer needs to detect and quarantine a file named abc424400664 zip based on the MD5 signature of the file using the Outbreak Control list feature within Cisco Advanced Malware Protection (AMP) for Endpoints The configured detection method must work on files of unknown disposition Which Outbreak Control list must be configured to provide this?

Options:

A.

Blocked Application

B.

Simple Custom Detection

C.

Advanced Custom Detection

D.

Android Custom Detection

Buy Now
Questions 17

Refer to the exhibit.

17

A Cisco Secure Endpoint malware event shows that a file was convicted as malicious and that its remediation status is Quarantine Failed. Before escalating the incident, the analyst must determine what can be concluded from the available event data. What is occurring based on the logs?

Options:

A.

The event data does not establish whether the threat remains present or was remediated through another mechanism.

B.

The failed-quarantine status proves that the endpoint was unable to apply the configured remediation policy.

C.

The failed-quarantine status proves that the file remained accessible to the operating system after the remediation attempt.

D.

The failed-quarantine status proves that the threat continued executing after the remediation attempt.

Buy Now
Questions 18

What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?

Options:

A.

Multiple NetFlow collectors are supported

B.

Advanced NetFlow v9 templates and legacy v5 formatting are supported

C.

Secure NetFlow connections are optimized for Cisco Prime Infrastructure

D.

Flow-create events are delayed

Buy Now
Questions 19

19

Refer to the exhibit. An engineer must enable secure SSH protocols and enters this configuration. What are two results of running this set of commands on a Cisco router? (Choose two.)

Options:

A.

Labels the key pair to be used for SSH

B.

Uses the FQDN with the label command

C.

Generates AES key pairs on the router

D.

Generates RSA key pair on the router

E.

Enables SSHv1 on the router

Buy Now
Questions 20

Which two components do southbound APIs use to communicate with downstream devices? (Choose two.)

Options:

A.

services running over the network

B.

OpenFlow

C.

external application APIs

D.

applications running over the network

E.

OpFlex

Buy Now
Questions 21

What is provided by the Secure Hash Algorithm in a VPN?

Options:

A.

integrity

B.

key exchange

C.

encryption

D.

authentication

Buy Now
Questions 22

Refer to the exhibit.

22

What is the result of this Python script of the Cisco DNA Center API?

Options:

A.

adds authentication to a switch

B.

adds a switch to Cisco DNA Center

C.

receives information about a switch

D.

deletes a switch from Cisco DNA Center

Buy Now
Questions 23

An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users.

Options:

A.

Upload the organization root CA to the Umbrella admin portal

B.

Modify the user ' s browser settings to suppress errors from Umbrella.

C.

Restrict access to only websites with trusted third-party signed certificates.

D.

Import the Umbrella root CA into the trusted root store on the user ' s device.

Buy Now
Questions 24

Which Secure Email Gateway implementation method segregates inbound and outbound email?

Options:

A.

Pair of logical listeners on a single physical interface with two unique logical IPv4 addresses and one IPv6 address

B.

One listener on one logical IPv4 address on a single logical interface

C.

Pair of logical IPv4 listeners and a pair of IPv6 listeners on two physically separate interfaces

D.

One listener on a single physical interface

Buy Now
Questions 25

An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?

Options:

A.

Implement pre-filter policies for the CIP preprocessor

B.

Enable traffic analysis in the Cisco FTD

C.

Configure intrusion rules for the DNP3 preprocessor

D.

Modify the access control policy to trust the industrial traffic

Buy Now
Questions 26

Which feature enables a Cisco ISR to use the default bypass list automatically for web filtering?

Options:

A.

filters

B.

group key

C.

company key

D.

connector

Buy Now
Questions 27

Which cryptographic process provides origin confidentiality, integrity, and origin authentication for packets?

Options:

A.

IKEv1

B.

AH

C.

ESP

D.

IKEv2

Buy Now
Questions 28

Which action must be taken in the AMP for Endpoints console to detect specific MD5 signatures on endpoints and then quarantine the files?

Options:

A.

Configure an advanced custom detection list.

B.

Configure an IP Block & Allow custom detection list

C.

Configure an application custom detection list

D.

Configure a simple custom detection list

Buy Now
Questions 29

An organization has two systems in their DMZ that have an unencrypted link between them for communication.

The organization does not have a defined password policy and uses several default accounts on the systems.

The application used on those systems also have not gone through stringent code reviews. Which vulnerability

would help an attacker brute force their way into the systems?

Options:

A.

weak passwords

B.

lack of input validation

C.

missing encryption

D.

lack of file permission

Buy Now
Questions 30

When a Cisco Secure Web Appliance checks a web request, what occurs if it is unable to match a user-defined policy?

Options:

A.

It applies the next identification profile policy.

B.

It applies the advanced policy.

C.

It applies the global policy.

D.

It blocks the request.

Buy Now
Questions 31

Which feature is leveraged by advanced antimalware capabilities to be an effective endpomt protection platform?

Options:

A.

big data

B.

storm centers

C.

sandboxing

D.

blocklisting

Buy Now
Questions 32

Which two statements about a Cisco WSA configured in Transparent mode are true? (Choose two)

Options:

A.

It can handle explicit HTTP requests.

B.

It requires a PAC file for the client web browser.

C.

It requires a proxy for the client web browser.

D.

WCCP v2-enabled devices can automatically redirect traffic destined to port 80.

E.

Layer 4 switches can automatically redirect traffic destined to port 80.

Buy Now
Questions 33

What is an attribute of Cisco Talos?

Options:

A.

Introduction of attributes that use objects and narrative relations

B.

Fast and intelligent responses based on threat data

C.

Cyber threat intelligence interchange and maintenance

D.

Cyber threats posing as authorized users and devices

Buy Now
Questions 34

Which technology provides the benefit of Layer 3 through Layer 7 innovative deep packet inspection,

enabling the platform to identify and output various applications within the network traffic flows?

Options:

A.

Cisco NBAR2

B.

Cisco ASAV

C.

Account on Resolution

D.

Cisco Prime Infrastructure

Buy Now
Questions 35

What is the primary role of the Cisco Email Security Appliance?

Options:

A.

Mail Submission Agent

B.

Mail Transfer Agent

C.

Mail Delivery Agent

D.

Mail User Agent

Buy Now
Questions 36

Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention

System?

Options:

A.

Correlation

B.

Intrusion

C.

Access Control

D.

Network Discovery

Buy Now
Questions 37

An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites

but other sites are not accessible due to an error. Why is the error occurring?

Options:

A.

Client computers do not have the Cisco Umbrella Root CA certificate installed.

B.

IP-Layer Enforcement is not configured.

C.

Client computers do not have an SSL certificate deployed from an internal CA server.

D.

Intelligent proxy and SSL decryption is disabled in the policy

Buy Now
Questions 38

Cisco SensorBase gaihers threat information from a variety of Cisco products and services and performs analytics to find patterns on threats Which term describes this process?

Options:

A.

deployment

B.

consumption

C.

authoring

D.

sharing

Buy Now
Questions 39

Which Cisco Umbrella package supports selective proxy for Inspection of traffic from risky domains?

Options:

A.

SIG Advantage

B.

DNS Security Essentials

C.

SIG Essentials

D.

DNS Security Advantage

Buy Now
Questions 40

An engineer needs to add protection for data in transit and have headers in the email message Which configuration is needed to accomplish this goal?

Options:

A.

Provision the email appliance

B.

Deploy an encryption appliance.

C.

Map sender !P addresses to a host interface.

D.

Enable flagged message handling

Buy Now
Questions 41

Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?

Options:

A.

DNS tunneling

B.

DNSCrypt

C.

DNS security

D.

DNSSEC

Buy Now
Questions 42

What is a function of 3DES in reference to cryptography?

Options:

A.

It hashes files.

B.

It creates one-time use passwords.

C.

It encrypts traffic.

D.

It generates private keys.

Buy Now
Questions 43

Refer to the exhibit.

43

Refer to the exhibit. A Cisco ISE administrator adds a new switch to an 802.1X deployment and has difficulty with some endpoints gaining access.

Most PCs and IP phones can connect and authenticate using their machine certificate credentials. However printer and video cameras cannot base d on the interface configuration provided, what must be to get these devices on to the network using Cisco ISE for authentication and authorization while maintaining security controls?

Options:

A.

Change the default policy in Cisco ISE to allow all devices not using machine authentication .

B.

Enable insecure protocols within Cisco ISE in the allowed protocols configuration.

C.

Configure authentication event fail retry 2 action authorize vlan 41 on the interface

D.

Add mab to the interface configuration.

Buy Now
Questions 44

A security engineer must add destinations into a destination list in Cisco Umbrella. What describes the application of these changes?

Options:

A.

The changes are applied immediately it the destination list is part or a policy.

B.

The destination list must be removed from the policy before changes are made to It.

C.

The changes are applied only after the configuration is saved in Cisco Umbrella.

D.

The user role of Block Page Bypass or higher is needed to perform these changes.

Buy Now
Questions 45

A network engineer must prevent endpoints from becoming infected by malicious files. The infrastructure includes Cisco Secure Endpoint, which must execute suspicious files in a cloud sandbox. Which feature must the engineer configure on Cisco Secure Endpoint to meet the requirement?

Options:

A.

Dynamic File Analysis

B.

Orbital Advanced Search

C.

Layer 4 Traffic Monitor

D.

Cisco Application Visibility and Control

Buy Now
Questions 46

Which VMware platform does Cisco ACI integrate with to provide enhanced visibility, provide policy integration and deployment, and implement security policies with access lists?

Options:

A.

VMware APIC

B.

VMwarevRealize

C.

VMware fusion

D.

VMware horizons

Buy Now
Questions 47

Which mitigation strategy should be used to protect against session hijacking attacks in a cloud environment?

Options:

A.

Implement input validation.

B.

Use secure cookies.

C.

Apply the principle of least privilege.

D.

Use anti-cross-site request forgery tokens.

Buy Now
Questions 48

Which command is used to log all events to a destination colector 209.165.201.107?

Options:

A.

CiscoASA(config-pmap-c)#flow-export event-type flow-update destination 209.165.201.10

B.

CiscoASA(config-cmap)# flow-export event-type all destination 209.165.201.

C.

CiscoASA(config-pmap-c)#flow-export event-type all destination 209.165.201.10

D.

CiscoASA(config-cmap)#flow-export event-type flow-update destination 209.165.201.10

Buy Now
Questions 49

Which method of attack is used by a hacker to send malicious code through a web application to an unsuspecting user to request that the victim ' s web browser executes the code?

Options:

A.

buffer overflow

B.

browser WGET

C.

SQL injection

D.

cross-site scripting

Buy Now
Questions 50

A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing

authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?

Options:

A.

Adaptive Network Control Policy List

B.

Context Visibility

C.

Accounting Reports

D.

RADIUS Live Logs

Buy Now
Questions 51

An organization recently installed a Cisco Secure Web Appliance and would like to take advantage of the AVC engine to allow the organization to create a policy to control application-specific activity. After enabling the AVC engine, what must be done to implement this?

Options:

A.

Use an access policy group to configure application control settings.

B.

Use security services to configure the traffic monitor.

C.

Use URL categorization to prevent the application traffic.

D.

Use web security reporting to validate engine functionality.

Buy Now
Questions 52

What must be used to share data between multiple security products?

Options:

A.

Cisco Rapid Threat Containment

B.

Cisco Platform Exchange Grid

C.

Cisco Advanced Malware Protection

D.

Cisco Stealthwatch Cloud

Buy Now
Questions 53

Which security control is required for identifying and neutralizing malicious code that attempts to execute on an endpoint?

Options:

A.

EPP

B.

XDR

C.

SWG

D.

CASB

Buy Now
Questions 54

A network engineer is deciding whether to use stateful or stateless failover when configuring two Cisco ASAs for high availability. What is the connection status in both cases?

Options:

A.

Need to be reestablished with both stateful and stateless failover

B.

Need to be reestablished with stateful failover and preserved with stateless failover

C.

Preserved with both stateful and stateless failover

D.

Preserved with stateful failover and need to be reestablished with stateless failover

Buy Now
Questions 55

A company has 5000 Windows users on its campus. Which two precautions should IT take to prevent WannaCry ransomware from spreading to all clients? (Choose two.)

Options:

A.

Segment different departments to different IP blocks and enable Dynamic ARp inspection on all VLANs

B.

Ensure that noncompliant endpoints are segmented off to contain any potential damage.

C.

Ensure that a user cannot enter the network of another department.

D.

Perform a posture check to allow only network access to (hose Windows devices that are already patched.

E.

Put all company users in the trusted segment of NGFW and put all servers to the DMZ segment of the Cisco NGFW. ni

Buy Now
Questions 56

What are two features of NetFlow flow monitoring? (Choose two)

Options:

A.

Can track ingress and egress information

B.

Include the flow record and the flow importer

C.

Copies all ingress flow information to an interface

D.

Does not required packet sampling on interfaces

E.

Can be used to track multicast, MPLS, or bridged traffic

Buy Now
Questions 57

An engineer is configuring Cisco Secure Endpoint to enhance network security by specifying a large set of external IP addresses that must be monitored for potential threats. The engineer is configuring an IP List and must add the IP addresses to the list. Which configuration action must the engineer take next to meet the requirement?

Options:

A.

Add the IP addresses using the global bulk configuration wizard.

B.

Automate a threat-feed subscription using an API.

C.

Use the data-upload function and import a file formatted as JSON.

D.

Use the Add Multiple Rows feature and paste all addresses into the input field.

Buy Now
Questions 58

Which feature is used in a push model to allow for session identification, host reauthentication, and session termination?

Options:

A.

AAA attributes

B.

CoA request

C.

AV pair

D.

carrier-grade NAT

Buy Now
Questions 59

A network administrator needs to find out what assets currently exist on the network. Third-party systems need to be able to feed host data into Cisco Firepower. What must be configured to accomplish this?

Options:

A.

a Network Discovery policy to receive data from the host

B.

a Threat Intelligence policy to download the data from the host

C.

a File Analysis policy to send file data into Cisco Firepower

D.

a Network Analysis policy to receive NetFlow data from the host

Buy Now
Questions 60

What is a difference between a DoS attack and a DDoS attack?

Options:

A.

A DoS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where multiple systems target a single system with a DoS attack

B.

A DoS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where a computer is used to flood multiple servers that are distributed over a LAN

C.

A DoS attack is where a computer is used to flood a server with UDP packets whereas a DDoS attack is where a computer is used to flood a server with TCP packets

D.

A DoS attack is where a computer is used to flood a server with TCP packets whereas a DDoS attack is where a computer is used to flood a server with UDP packets

Buy Now
Questions 61

What is a characteristic of Dynamic ARP Inspection?

Options:

A.

DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCPsnooping binding database.

B.

In a typical network, make all ports as trusted except for the ports connecting to switches, which areuntrusted

C.

DAI associates a trust state with each switch.

D.

DAI intercepts all ARP requests and responses on trusted ports only.

Buy Now
Questions 62

What is a commonality between DMVPN and FlexVPN technologies?

Options:

A.

FlexVPN and DMVPN use IS-IS routing protocol to communicate with spokes

B.

FlexVPN and DMVPN use the new key management protocol

C.

FlexVPN and DMVPN use the same hashing algorithms

D.

IOS routers run the same NHRP code for DMVPN and FlexVPN

Buy Now
Questions 63

Which two actions does the Cisco identity Services Engine posture module provide that ensures endpoint security?(Choose two.)

Options:

A.

The latest antivirus updates are applied before access is allowed.

B.

Assignments to endpoint groups are made dynamically, based on endpoint attributes.

C.

Patch management remediation is performed.

D.

A centralized management solution is deployed.

E.

Endpoint supplicant configuration is deployed.

Buy Now
Questions 64

What provides visibility and awareness into what is currently occurring on the network?

Options:

A.

CMX

B.

WMI

C.

Prime Infrastructure

D.

Telemetry

Buy Now
Questions 65

What must be configured on Cisco Secure Endpoint to create a custom detection tile list to detect and quarantine future files?

Options:

A.

Use the simple custom detection feature and add each detection to the list.

B.

Add a network IP block allowed list to the configuration and add the blocked files.

C.

Create an advanced custom detection and upload the hash of each file

D.

Configure an application control allowed applications list to block the files

Buy Now
Questions 66

What is a functional difference between Cisco Secure Endpoint and Cisco Umbrella Roaming Client?

Options:

A.

Secure Endpoint authenticates users and provides segmentation, and the Umbrella Roaming Client allows only for VPN connectivity.

B.

Secure Endpoint stops and tracks malicious activity on hosts, and the Umbrella Roaming Client tracks only URL-based threats.

C.

The Umbrella Roaming Client authenticates users and provides segmentation, and Secure Endpoint allows only for VPN connectivity.

D.

The Umbrella Roaming client stops and tracks malicious activity on hosts, and Secure Endpoint tracks only URL-based threats.

Buy Now
Questions 67

What is a feature of the open platform capabilities of Cisco DNA Center?

Options:

A.

intent-based APIs

B.

automation adapters

C.

domain integration

D.

application adapters

Buy Now
Questions 68

Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent?

(Choose two)

Options:

A.

Outgoing traffic is allowed so users can communicate with outside organizations.

B.

Malware infects the messenger application on the user endpoint to send company data.

C.

Traffic is encrypted, which prevents visibility on firewalls and IPS systems.

D.

An exposed API for the messaging platform is used to send large amounts of data.

E.

Messenger applications cannot be segmented with standard network controls

Buy Now
Questions 69

Which open standard underpins OpenID Connect, enabling Cisco Duo to authorize application access?

Options:

A.

OAuth 2.0

B.

SCEP

C.

RSTP

D.

Kerberos

Buy Now
Questions 70

Which feature within Cisco ISE verifies the compliance of an endpoint before providing access to the

network?

Options:

A.

Posture

B.

Profiling

C.

pxGrid

D.

MAB

Buy Now
Questions 71

What is the difference between EPP and EDR?

Options:

A.

EPP focuses primarily on threats that have evaded front-line defenses that entered the environment.

B.

Having an EPP solution allows an engineer to detect, investigate, and remediate modern threats.

C.

EDR focuses solely on prevention at the perimeter.

D.

Having an EDR solution gives an engineer the capability to flag offending files at the first sign of malicious behavior.

Buy Now
Questions 72

Which VPN provides scalability for organizations with many remote sites?

Options:

A.

DMVPN

B.

site-to-site iPsec

C.

SSL VPN

D.

GRE over IPsec

Buy Now
Questions 73

Which feature is configured for managed devices in the device platform settings of the Firepower Management

Center?

Options:

A.

quality of service

B.

time synchronization

C.

network address translations

D.

intrusion policy

Buy Now
Questions 74

With Cisco AMP for Endpoints, which option shows a list of all files that have been executed in your

environment?

Options:

A.

Prevalence

B.

File analysis

C.

Detections

D.

Vulnerable software

E.

Threat root cause

Buy Now
Questions 75

Refer to the exhibit.

75

An engineer must configure a Cisco switch to perform PPP authentication via a TACACS server located at IP address 10.1.1.10. Authentication must fall back to the local database using the username LocalUser and password C1Sc0451069341l if the TACACS server is unreachable.

Drag and drop the commands from the left onto the corresponding configuration steps on the right.

75

Options:

Buy Now
Questions 76

An administrator is trying to determine which applications are being used in the network but does not want the

network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?

Options:

A.

NetFlow

B.

Packet Tracer

C.

Network Discovery

D.

Access Control

Buy Now
Questions 77

An organization recently installed a Cisco WSA and would like to take advantage of the AVC engine to allow the organization to create a policy to control application specific activity. After enabling the AVC engine, what must be done to implement this?

Options:

A.

Use security services to configure the traffic monitor, .

B.

Use URL categorization to prevent the application traffic.

C.

Use an access policy group to configure application control settings.

D.

Use web security reporting to validate engine functionality

Buy Now
Questions 78

How does Cisco Umbrella protect clients when they operate outside of the corporate network?

Options:

A.

by modifying the registry for DNS lookups

B.

by using Active Directory group policies to enforce Cisco Umbrella DNS servers

C.

by using the Cisco Umbrella roaming client

D.

by forcing DNS queries to the corporate name servers

Buy Now
Questions 79

What does endpoint isolation in Cisco AMP for Endpoints security protect from?

Options:

A.

an infection spreading across the network E

B.

a malware spreading across the user device

C.

an infection spreading across the LDAP or Active Directory domain from a user account

D.

a malware spreading across the LDAP or Active Directory domain from a user account

Buy Now
Questions 80

A network engineer must distribute an operating system image to a network device and activate the image on that device by using the Cisco Catalyst Center API. Which two API requests perform the required operations? (Choose two.)

Options:

A.

POST /dna/intent/api/v1/image/distribution

B.

POST /dna/intent/api/v1/onboarding/pnp-device/import

C.

POST /dna/intent/api/v1/image/activation/device

D.

POST /dna/intent/api/v1/network/{site_id}

E.

POST /dna/intent/api/v1/template-programmer/project/{project_id}/template

Buy Now
Questions 81

A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available. What must be done in order to securely connect this device to the network?

Options:

A.

Use MAB with profiling

B.

Use MAB with posture assessment.

C.

Use 802.1X with posture assessment.

D.

Use 802.1X with profiling.

Buy Now
Questions 82

Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)

Options:

A.

virtualization

B.

middleware

C.

operating systems

D.

applications

E.

data

Buy Now
Questions 83

Which two cryptographic algorithms are used with IPsec? (Choose two)

Options:

A.

AES-BAC

B.

AES-ABC

C.

HMAC-SHA1/SHA2

D.

Triple AMC-CBC

E.

AES-CBC

Buy Now
Questions 84

What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?

Options:

A.

Cisco AMP for Endpoints is a cloud-based service, and Cisco Umbrella is not.

B.

Cisco AMP for Endpoints prevents connections to malicious destinations, and C malware.

C.

Cisco AMP for Endpoints automatically researches indicators of compromise ..

D.

Cisco AMP for Endpoints prevents, detects, and responds to attacks before and against Internet threats.

Buy Now
Questions 85

What is the role of an endpoint in protecting a user from a phishing attack?

Options:

A.

Use Cisco Stealthwatch and Cisco ISE Integration.

B.

Utilize 802.1X network security to ensure unauthorized access to resources.

C.

Use machine learning models to help identify anomalies and determine expected sending behavior.

D.

Ensure that antivirus and anti malware software is up to date

Buy Now
Questions 86

A network administrator is configuring a role in an access control policy to block certain URLs and selects the " Chat and instant Messaging " category. which reputation score should be selected to accomplish

this goal?

Options:

A.

3

B.

5

C.

10

D.

1

Buy Now
Questions 87

Which Cisco cloud security software centrally manages policies on multiple platforms such as Cisco ASA, Cisco Firepower, Cisco Meraki, and AWS?

Options:

A.

Cisco Defense Orchestrator

B.

Cisco Configuration Professional

C.

Cisco Secureworks

D.

Cisco DNAC

Buy Now
Questions 88

An organization has a requirement to collect full metadata information about the traffic going through their AWS cloud services They want to use this information for behavior analytics and statistics Which two actions must be taken to implement this requirement? (Choose two.)

Options:

A.

Configure Cisco ACI to ingest AWS information.

B.

Configure Cisco Thousand Eyes to ingest AWS information.

C.

Send syslog from AWS to Cisco Stealthwatch Cloud.

D.

Send VPC Flow Logs to Cisco Stealthwatch Cloud.

E.

Configure Cisco Stealthwatch Cloud to ingest AWS information

Buy Now
Questions 89

A network engineer is deciding whether to use stateful or stateless failover when configuring two ASAs for high availability. What is the connection status in both cases?

Options:

A.

need to be reestablished with stateful failover and preserved with stateless failover

B.

preserved with stateful failover and need to be reestablished with stateless failover

C.

preserved with both stateful and stateless failover

D.

need to be reestablished with both stateful and stateless failover

Buy Now
Questions 90

How many interfaces per bridge group does an ASA bridge group deployment support?

Options:

A.

up to 2

B.

up to 4

C.

up to 8

D.

up to 16

Buy Now
Questions 91

Which solution for remote workers enables protection, detection, and response on the endpoint against known and unknown threats?

Options:

A.

Cisco AMP for Endpoints

B.

Cisco AnyConnect

C.

Cisco Umbrella

D.

Cisco Duo

Buy Now
Questions 92

Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

Options:

A.

transparent

B.

redirection

C.

forward

D.

proxy gateway

Buy Now
Questions 93

An engineer is configuring Cisco WSA and needs to deploy it in transparent mode. Which configuration component must be used to accomplish this goal?

Options:

A.

MDA on the router

B.

PBR on Cisco WSA

C.

WCCP on switch

D.

DNS resolution on Cisco WSA

Buy Now
Questions 94

An engineer is configuring cloud logging on Cisco ASA and needs events to compress. Which component must be configured to accomplish this goal?

Options:

A.

CDO event viewer

B.

SWC service

C.

Cisco analytics

D.

SDC VM

Buy Now
Questions 95

What is a difference between weak passwords and missing encryption?

Options:

A.

Weak passwords allow programs to be renamed, and missing encryption hides .exe extensions.

B.

Weak passwords cause programs to crash, and missing encryption sends data to a memory location.

C.

Weak passwords consume bandwidth, and missing encryption allows user information to be hijacked.

D.

Weak passwords are guessed easily, and missing encryption allows information to be decrypted.

Buy Now
Questions 96

What is the purpose of a denial-of-service attack?

Options:

A.

to disrupt the normal operation of a targeted system by overwhelming It

B.

to exploit a security vulnerability on a computer system to steal sensitive information

C.

to prevent or limit access to data on a computer system by encrypting It

D.

to spread throughout a computer system by self-replicating to additional hosts

Buy Now
Questions 97

In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint Protection Platform?

Options:

A.

When there is a need to have more advanced detection capabilities

B.

When there is a need for traditional anti-malware detection

C.

When there is no need to have the solution centrally managed

D.

When there is no firewall on the network

Buy Now
Questions 98

A security engineer must protect endpoints when a file appears harmless during initial inspection but later shows malicious behavior. The solution must continuously observe process and file activity after execution and respond when a threat emerges. The infrastructure includes Cisco Secure Endpoint. Which feature must the engineer configure to meet the requirements?

Options:

A.

File Reputation

B.

Continuous Behavioral Monitoring

C.

Forensic Analysis

D.

System Process Protection

Buy Now
Questions 99

What is the function of the crypto is a kmp key cisc406397954 address 0.0.0.0 0.0.0.0 command when establishing an IPsec VPN tunnel?

Options:

A.

It defines what data is going to be encrypted via the VPN

B.

lt configures the pre-shared authentication key

C.

It prevents all IP addresses from connecting to the VPN server.

D.

It configures the local address for the VPN server.

Buy Now
Questions 100

Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to

network resources?

Options:

A.

BYOD on boarding

B.

Simple Certificate Enrollment Protocol

C.

Client provisioning

D.

MAC authentication bypass

Buy Now
Questions 101

101

Refer to the exhibit. What is the result of the Python script?

Options:

A.

It uses the POST HTTP method to obtain a username and password to be used for authentication.

B.

It uses the POST HTTP method to obtain a token to be used for authentication.

C.

It uses the GET HTTP method to obtain a token to be used for authentication.

D.

It uses the GET HTTP method to obtain a username and password to be used for authentication

Buy Now
Questions 102

A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?

Options:

A.

The policy was created to send a message to quarantine instead of drop

B.

The file has a reputation score that is above the threshold

C.

The file has a reputation score that is below the threshold

D.

The policy was created to disable file analysis

Buy Now
Questions 103

103

Refer to the exhibit. When configuring this access control rule in Cisco FMC, what happens with the traffic destined to the DMZ_inside zone once the configuration is deployed?

Options:

A.

All traffic from any zone will be allowed to the DMZ_inside zone only after inspection.

B.

No traffic will be allowed through to the DMZ_inside zone regardless of if it ' s trusted or not.

C.

No traffic will be allowed through to the DMZ_inside zone unless it ' s already trusted.

D.

All traffic from any zone to the DMZ_inside zone will be permitted with no further inspection.

Buy Now
Questions 104

Which DevSecOps implementation process gives a weekly or daily update instead of monthly or quarterly in the applications?

Options:

A.

Orchestration

B.

CI/CD pipeline

C.

Container

D.

Security

Buy Now
Questions 105

Why should organizations migrate to an MFA strategy for authentication?

Options:

A.

Single methods of authentication can be compromised more easily than MFA.

B.

Biometrics authentication leads to the need for MFA due to its ability to be hacked easily.

C.

MFA methods of authentication are never compromised.

D.

MFA does not require any piece of evidence for an authentication mechanism.

Buy Now
Questions 106

A network engineer must enable SSH and SCP on a Cisco IOS router. The engineer has already generated the encryption keys and enabled SCP services on the router. Which configuration action must be performed next?

Options:

A.

Enable SSHv2 in the configuration.

B.

Restrict access to specific SSH commands.

C.

Enable SCP strict host-key checking.

D.

Add an ACL to deny access from the LAN.

Buy Now
Questions 107

What is a function of Cisco AMP for Endpoints?

Options:

A.

It detects DNS attacks

B.

It protects against web-based attacks

C.

It blocks email-based attacks

D.

It automates threat responses of an infected host

Buy Now
Questions 108

Which Cisco security solution integrates with cloud applications like Dropbox and Office 365 while protecting data from being exfiltrated?

Options:

A.

Cisco Tajos

B.

Cisco Steaithwatch Cloud

C.

Cisco Cloudlock

D.

Cisco Umbrella Investigate

Buy Now
Questions 109

An organization has DHCP servers set up to allocate IP addresses to clients on the LAN. What must be done to ensure the LAN switches prevent malicious DHCP traffic while also distributing IP addresses to the correct endpoints?

Options:

A.

Configure Dynamic ARP inspection and add entries in the DHCP snooping database.

B.

Configure DHCP snooping and set trusted interfaces for all client connections.

C.

Configure Dynamic ARP inspection and antispoofing ACLs in the DHCP snooping database.

D.

Configure DHCP snooping and set a trusted interface for the DHCP server.

Buy Now
Questions 110

What is the function of the Context Directory Agent?

Options:

A.

maintains users’ group memberships

B.

relays user authentication requests from Web Security Appliance to Active Directory

C.

reads the Active Directory logs to map IP addresses to usernames

D.

accepts user authentication requests on behalf of Web Security Appliance for user identification

Buy Now
Questions 111

Which Cisco firewall solution supports configuration via Cisco Policy Language?

Options:

A.

CBAC

B.

ZFW

C.

IPS

D.

NGFW

Buy Now
Questions 112

An engineer is configuring Cisco WSA and needs to enable a separated email transfer flow from the Internet and from the LAN. Which deployment mode must be used to accomplish this goal?

Options:

A.

single interface

B.

multi-context

C.

transparent

D.

two-interface

Buy Now
Questions 113

Refer to the exhibit.

113

A network engineer is testing NTP authentication and realizes that any device synchronizes time with this router and that NTP authentication is not enforced What is the cause of this issue?

Options:

A.

The key was configured in plain text.

B.

NTP authentication is not enabled.

C.

The hashing algorithm that was used was MD5. which is unsupported.

D.

The router was not rebooted after the NTP configuration updated.

Buy Now
Questions 114

What are the two types of managed Intercloud Fabric deployment models? (Choose two.)

Options:

A.

Public managed

B.

Service Provider managed

C.

Enterprise managed

D.

User managed

E.

Hybrid managed

Buy Now
Questions 115

What is the difference between deceptive phishing and spear phishing?

Options:

A.

Deceptive phishing is an attacked aimed at a specific user in the organization who holds a C-level role.

B.

A spear phishing campaign is aimed at a specific person versus a group of people.

C.

Spear phishing is when the attack is aimed at the C-level executives of an organization.

D.

Deceptive phishing hijacks and manipulates the DNS server of the victim and redirects the user to a false webpage.

Buy Now
Questions 116

What are two advantages of using Cisco Any connect over DMVPN? (Choose two)

Options:

A.

It provides spoke-to-spoke communications without traversing the hub

B.

It allows different routing protocols to work over the tunnel

C.

It allows customization of access policies based on user identity

D.

It allows multiple sites to connect to the data center

E.

It enables VPN access for individual users from their machines

Buy Now
Questions 117

Which benefit does DMVPN provide over GETVPN?

Options:

A.

DMVPN supports QoS, multicast, and routing, and GETVPN supports only QoS.

B.

DMVPN is a tunnel-less VPN, and GETVPN is tunnel-based.

C.

DMVPN supports non-IP protocols, and GETVPN supports only IP protocols.

D.

DMVPN can be used over the public Internet, and GETVPN requires a private network.

Buy Now
Questions 118

Drag and drop the NetFlow export formats from the left onto the descriptions on the right.

118

Options:

Buy Now
Questions 119

In which two ways does a system administrator send web traffic transparently to the Web Security Appliance?

(Choose two)

Options:

A.

configure Active Directory Group Policies to push proxy settings

B.

configure policy-based routing on the network infrastructure

C.

reference a Proxy Auto Config file

D.

configure the proxy IP address in the web-browser settings

E.

use Web Cache Communication Protocol

Buy Now
Questions 120

Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

Options:

A.

AMP

B.

AnyConnect

C.

DynDNS

D.

Talos

Buy Now
Questions 121

An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which

probe must be enabled for this type of profiling to work?

Options:

A.

NetFlow

B.

NMAP

C.

SNMP

D.

DHCP

Buy Now
Questions 122

Which two fields are defined in the NetFlow flow? (Choose two)

Options:

A.

type of service byte

B.

class of service bits

C.

Layer 4 protocol type

D.

destination port

E.

output logical interface

Buy Now
Questions 123

Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat?

Options:

A.

westbound AP

B.

southbound API

C.

northbound API

D.

eastbound API

Buy Now
Questions 124

Based on the NIST 800-145 guide, which cloud architecture may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises?

Options:

A.

hybrid cloud

B.

private cloud

C.

public cloud

D.

community cloud

Buy Now
Questions 125

Which Cisco ISE service checks the compliance of endpoints before allowing the endpoints to connect to

the network?

Options:

A.

posture

B.

profiler

C.

Cisco TrustSec

D.

Threat Centric NAC

Buy Now
Questions 126

Which action configures the IEEE 802.1X Flexible Authentication feature lo support Layer 3 authentication mechanisms?

Options:

A.

Identity the devices using this feature and create a policy that allows them to pass Layer 2 authentication.

B.

Configure WebAuth so the hosts are redirected to a web page for authentication.

C.

Modify the Dot1x configuration on the VPN server lo send Layer 3 authentications to an external authentication database

D.

Add MAB into the switch to allow redirection to a Layer 3 device for authentication.

Buy Now
Questions 127

Which two preventive measures are used to control cross-site scripting? (Choose two)

Options:

A.

Enable client-side scripts on a per-domain basis.

B.

Incorporate contextual output encoding/escaping.

C.

Disable cookie inspection in the HTML inspection engine.

D.

Run untrusted HTML input through an HTML sanitization engine.

E.

Same Site cookie attribute should not be used.

Buy Now
Questions 128

An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization

needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of

172.19.20.24. Which command on the hub will allow the administrator to accomplish this?

Options:

A.

crypto ca identity 172.19.20.24

B.

crypto isakmp key Cisco0123456789 172.19.20.24

C.

crypto enrollment peer address 172.19.20.24

D.

crypto isakmp identity address 172.19.20.24

Buy Now
Questions 129

What is a description of microsegmentation?

Options:

A.

Environments apply a zero-trust model and specify how applications on different servers or containers can communicate

B.

Environments deploy a container orchestration platform, such as Kubernetes, to manage the application delivery

C.

Environments implement private VLAN segmentation to group servers with similar applications.

D.

Environments deploy centrally managed host-based firewall rules on each server or container

Buy Now
Questions 130

Which algorithm provides asymmetric encryption?

Options:

A.

RC4

B.

AES

C.

RSA

D.

3DES

Buy Now
Questions 131

Which feature must be configured before implementing NetFlow on a router?

Options:

A.

SNMPv3

B.

syslog

C.

VRF

D.

IP routing

Buy Now
Questions 132

A security engineer is deploying an IPsec site-to-site VPN between headquarters and a remote plant, protected by Cisco Secure Firewall Threat Defense managed by Cisco Secure Firewall Management Center. The following configurations have already been completed:

    Matching IKEv2 proposals, preshared keys, and IPsec transform sets

    Access control rules permitting the traffic

    Crypto maps applied to the outside interfaces

    VPN traffic exempted from inspection

During a packet capture on the firewall, the engineer observes that the traffic is translated to the public IP address, preventing tunnel establishment. Which configuration action must be performed next?

Options:

A.

Configure NAT exemption for traffic between the interesting subnet pairs.

B.

Create a tunnel group with preshared-key authentication under connection profiles.

C.

Enable IKEv2 fragmentation on both peers to reduce packet size.

D.

Attach the new VPN policy to the global prefilter default action.

Buy Now
Questions 133

Which feature of a secure CI/CD pipeline defends container workloads against detected exploits, application flaws, configuration errors, and policy violations?

Options:

A.

Control groups

B.

Separation of duties

C.

Runtime protection

D.

Cloud-native firewalling

Buy Now
Questions 134

Which method must be used to connect Cisco Secure Workload to external orchestrators at a client site when the client does not allow incoming connections?

Options:

A.

source NAT

B.

reverse tunnel

C.

GRE tunnel

D.

destination NAT

Buy Now
Questions 135

Refer to the exhibit.

135

Which configuration item makes it possible to have the AAA session on the network?

Options:

A.

aaa authentication login console ise

B.

aaa authentication enable default enable

C.

aaa authorization network default group ise

D.

aaa authorization exec default ise

Buy Now
Questions 136

A Cisco FTD engineer is creating a new IKEv2 policy called s2s00123456789 for their organization to allow for additional protocols to terminate network devices with. They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy. What should be done in order to support this?

Options:

A.

Change the integrity algorithms to SHA* to support all SHA algorithms in the primary policy

B.

Make the priority for the new policy 5 and the primary policy 1

C.

Change the encryption to AES* to support all AES algorithms in the primary policy

D.

Make the priority for the primary policy 10 and the new policy 1

Buy Now
Questions 137

Which system performs compliance checks and remote wiping?

Options:

A.

MDM

B.

ISE

C.

AMP

D.

OTP

Buy Now
Questions 138

Which technology should be used to help prevent an attacker from stealing usernames and passwords of users within an organization?

Options:

A.

RADIUS-based REAP

B.

fingerprinting

C.

Dynamic ARP Inspection

D.

multifactor authentication

Buy Now
Questions 139

Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention

System? (Choose two)

Options:

A.

packet decoder

B.

SIP

C.

modbus

D.

inline normalization

E.

SSL

Buy Now
Questions 140

Which two capabilities of Integration APIs are utilized with Cisco DNA center? (Choose two)

Options:

A.

Upgrade software on switches and routers

B.

Third party reporting

C.

Connect to ITSM platforms

D.

Create new SSIDs on a wireless LAN controller

E.

Automatically deploy new virtual routers

Buy Now
Questions 141

Drag and drop the solutions from the left onto the solution ' s benefits on the right.

141

Options:

Buy Now
Questions 142

An engineer is deploying a Cisco Secure Email Gateway and must ensure it reaches the Cisco update servers to retrieve new rules. The engineer must now manually configure the Outbreak Filter rules on an AsyncOS for Cisco Secure Email Gateway. Only outdated rules must be replaced. Up-to-date rules must be retained. Which action must the engineer take next to complete the configuration?

Options:

A.

Select Outbreak Filters

B.

Perform a backup/restore of the database

C.

Use the outbreakconfig command in CLI

D.

Click Update Rules Now

Buy Now
Questions 143

Which technology limits communication between nodes on the same network segment to individual applications?

Options:

A.

serverless infrastructure

B.

microsegmentation

C.

SaaS deployment

D.

machine-to-machine firewalling

Buy Now
Questions 144

Which algorithm provides encryption and authentication for data plane communication?

Options:

A.

AES-GCM

B.

SHA-96

C.

AES-256

D.

SHA-384

Buy Now
Questions 145

Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

Options:

A.

Nexus

B.

Stealthwatch

C.

Firepower

D.

Tetration

Buy Now
Questions 146

Which feature is supported when deploying Cisco ASAv within AWS public cloud?

Options:

A.

multiple context mode

B.

user deployment of Layer 3 networks

C.

IPv6

D.

clustering

Buy Now
Questions 147

For a given policy in Cisco Umbrella, how should a customer block websites based on a custom list?

Options:

A.

By adding the websites to a blocked type destination list

B.

By specifying blocked domains in the policy settings

C.

By adding the website IP addresses to the Cisco Umbrella blocklist

D.

By specifying the websites in a custom blocked category

Buy Now
Questions 148

A mall provides security services to customers with a shared appliance. The mall wants separation of

management on the shared appliance. Which ASA deployment mode meets these needs?

Options:

A.

routed mode

B.

transparent mode

C.

multiple context mode

D.

multiple zone mode

Buy Now
Questions 149

What are two functionalities of northbound and southbound APIs within Cisco SDN architecture? (Choose two.)

Options:

A.

Southbound APIs are used to define how SDN controllers integrate with applications.

B.

Southbound interfaces utilize device configurations such as VLANs and IP addresses.

C.

Northbound APIs utilize RESTful API methods such as GET, POST, and DELETE.

D.

Southbound APIs utilize CLI, SNMP, and RESTCONF.

E.

Northbound interfaces utilize OpenFlow and OpFlex to integrate with network devices.

Buy Now
Questions 150

A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen

on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose

two)

Options:

A.

permit

B.

trust

C.

reset

D.

allow

E.

monitor

Buy Now
Questions 151

Which cloud service model offers an environment for cloud consumers to develop and deploy applications

without needing to manage or maintain the underlying cloud infrastructure?

Options:

A.

PaaS

B.

XaaS

C.

IaaS

D.

SaaS

Buy Now
Questions 152

An engineer must configure AsyncOS for Cisco Secure Web Appliance to push log files to a syslog server using the SCP retrieval method. Drag and drop the steps from the left into the sequence on the right to complete the configuration.

152

Options:

Buy Now
Questions 153

Which Cisco IOS XE command rejects packets with a source IP address that fails a reverse-path-forwarding prefix check on the ingress interface?

Options:

A.

ip verify unicast source reachable-via both

B.

ip verify unicast source reachable-via rx

C.

ip verify unicast source reachable-via tx

D.

ip verify unicast source reachable-via any

Buy Now
Questions 154

What is the most commonly used protocol for network telemetry?

Options:

A.

SMTP

B.

SNMP

C.

TFTP

D.

NctFlow

Buy Now
Questions 155

Why is it important to have logical security controls on endpoints even though the users are trained to spot security threats and the network devices already help prevent them?

Options:

A.

to prevent theft of the endpoints

B.

because defense-in-depth stops at the network

C.

to expose the endpoint to more threats

D.

because human error or insider threats will still exist

Buy Now
Questions 156

Which two capabilities does TAXII support? (Choose two)

Options:

A.

Exchange

B.

Pull messaging

C.

Binding

D.

Correlation

E.

Mitigating

Buy Now
Questions 157

An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed

through the Cisco Umbrella network. Which action tests the routing?

Options:

A.

Ensure that the client computers are pointing to the on-premises DNS servers.

B.

Enable the Intelligent Proxy to validate that traffic is being routed correctly.

C.

Add the public IP address that the client computers are behind to a Core Identity.

D.

Browse to http://welcome.umbrella.com/ to validate that the new identity is working.

Buy Now
Questions 158

Which parameter is required when configuring a Netflow exporter on a Cisco Router?

Options:

A.

DSCP value

B.

Source interface

C.

Exporter name

D.

Exporter description

Buy Now
Questions 159

In which scenario is endpoint-based security the solution?

Options:

A.

inspecting encrypted traffic

B.

device profiling and authorization

C.

performing signature-based application control

D.

inspecting a password-protected archive

Buy Now
Questions 160

Which Talos reputation center allows you to track the reputation of IP addresses for email and web traffic?

Options:

A.

IP Blacklist Center

B.

File Reputation Center

C.

AMP Reputation Center

D.

IP and Domain Reputation Center

Buy Now
Questions 161

A network engineer entered the snmp-server user asmith myv7 auth sha cisco priv aes 256

cisc0xxxxxxxxx command and needs to send SNMP information to a host at 10.255.255.1. Which

command achieves this goal?

Options:

A.

snmp-server host inside 10.255.255.1 version 3 myv7

B.

snmp-server host inside 10.255.255.1 snmpv3 myv7

C.

snmp-server host inside 10.255.255.1 version 3 asmith

D.

snmp-server host inside 10.255.255.1 snmpv3 asmith

Buy Now
Questions 162

What is a benefit of using Cisco AVC (Application Visibility and Control) for application control?

Options:

A.

management of application sessions

B.

retrospective application analysis

C.

zero-trust approach

D.

dynamic application scanning

Buy Now
Questions 163

Which capability is exclusive to a Cisco AMP public cloud instance as compared to a private cloud instance?

Options:

A.

RBAC

B.

ETHOS detection engine

C.

SPERO detection engine

D.

TETRA detection engine

Buy Now
Questions 164

What is a benefit of a Cisco Secure Email Gateway Virtual as compared to a physical Secure Email Gateway?

Options:

A.

simplifies the distribution of software updates

B.

provides faster performance

C.

provides an automated setup process

D.

enables the allocation of additional resources

Buy Now
Questions 165

An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices The default management port conflicts with other communications on the network and must be changed What must be done to ensure that all devices can communicate together?

Options:

A.

Set the sftunnel to go through the Cisco FTD

B.

Change the management port on Cisco FMC so that it pushes the change to all managed Cisco FTD devices

C.

Set the sftunnel port to 8305.

D.

Manually change the management port on Cisco FMC and all managed Cisco FTD devices

Buy Now
Questions 166

What are the components of endpoint protection against social engineering attacks?

Options:

A.

IPsec

B.

IDS

C.

Firewall

D.

Cisco Secure Email Gateway

Buy Now
Questions 167

An organization is using DNS services for their network and want to help improve the security of the DNS infrastructure. Which action accomplishes this task?

Options:

A.

Use DNSSEC between the endpoints and Cisco Umbrella DNS servers.

B.

Modify the Cisco Umbrella configuration to pass queries only to non-DNSSEC capable zones.

C.

Integrate Cisco Umbrella with Cisco CloudLock to ensure that DNSSEC is functional.

D.

Configure Cisco Umbrella and use DNSSEC for domain authentication to authoritative servers.

Buy Now
Questions 168

An organization must add new firewalls to its infrastructure and wants to use Cisco ASA or Cisco FTD.

The chosen firewalls must provide methods of blocking traffic that include offering the user the option to bypass the block for certain sites after displaying a warning page and to reset the connection. Which solution should the organization choose?

Options:

A.

Cisco FTD because it supports system rate level traffic blocking, whereas Cisco ASA does not

B.

Cisco ASA because it allows for interactive blocking and blocking with reset to be configured via the GUI, whereas Cisco FTD does not.

C.

Cisco FTD because it enables interactive blocking and blocking with reset natively, whereas Cisco ASA does not

D.

Cisco ASA because it has an additional module that can be installed to provide multiple blocking capabilities, whereas Cisco FTD does not.

Buy Now
Questions 169

Which two parameters are used for device compliance checks? (Choose two.)

Options:

A.

endpoint protection software version

B.

Windows registry values

C.

DHCP snooping checks

D.

DNS integrity checks

E.

device operating system version

Buy Now
Questions 170

Which term describes when the Cisco Firepower downloads threat intelligence updates from Cisco Talos?

Options:

A.

consumption

B.

sharing

C.

analysis

D.

authoring

Buy Now
Questions 171

How does the Cisco WSA enforce bandwidth restrictions for web applications?

Options:

A.

It implements a policy route to redirect application traffic to a lower-bandwidth link.

B.

It dynamically creates a scavenger class QoS policy and applies it to each client that connects through the WSA.

C.

It sends commands to the uplink router to apply traffic policing to the application traffic.

D.

It simulates a slower link by introducing latency into application traffic.

Buy Now
Questions 172

In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?

Options:

A.

LDAP injection

B.

man-in-the-middle

C.

cross-site scripting

D.

insecure API

Buy Now
Questions 173

A security engineer is deploying an IPsec site-to-site VPN between headquarters and a remote plant, protected by Cisco Secure Firewall Threat Defense managed by Cisco Secure Firewall Management Center. The following configurations have already been completed:

    Matching IKEv2 proposals, preshared keys, and IPsec transform sets

    Access control rules permitting the traffic

    Crypto maps applied to the outside interfaces

    VPN traffic exempted from inspection

During a packet capture on the firewall, the engineer observes that the traffic is translated to the public IP address, preventing tunnel establishment. Which configuration action must be performed next?

Options:

A.

Configure NAT exemption for traffic between the interesting subnet pairs.

B.

Create a tunnel group with preshared-key authentication under connection profiles.

C.

Enable IKEv2 fragmentation on both peers to reduce packet size.

D.

Attach the new VPN policy to the global prefilter default action.

Buy Now
Questions 174

Which algorithm is an NGE hash function?

Options:

A.

HMAC

B.

SHA-1

C.

MD5

D.

SISHA-2

Buy Now
Questions 175

An engineer notices traffic interruption on the network. Upon further investigation, it is learned that broadcast

packets have been flooding the network. What must be configured, based on a predefined threshold, to

address this issue?

Options:

A.

Bridge Protocol Data Unit guard

B.

embedded event monitoring

C.

storm control

D.

access control lists

Buy Now
Questions 176

Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?

Options:

A.

TLSv1.2

B.

TLSv1.1

C.

BJTLSv1

D.

DTLSv1

Buy Now
Questions 177

Which two request methods of REST API are valid on the Cisco ASA Platform? (Choose two.)

Options:

A.

GET

B.

CONNECT

C.

PUSH

D.

OPTIONS

E.

PUT

Buy Now
Questions 178

Which solution offers automated blocking of known threats and visibility into zero-day attack behavior, with the ability to respond directly from the console?

Options:

A.

EPP solution with an HIDS integration

B.

Cloud-native antivirus with offline update support

C.

EDR with behavioral analytics and remote containment

D.

Secure Email Gateway with phishing sandboxing

Buy Now
Questions 179

An engineer is deploying a Cisco Secure Email Gateway and must configure a sender group that decides which mail policy will process the mail. The configuration must accept incoming mails and relay the outgoing mails from the internal server. Which component must be configured to accept the connection to the listener and meet these requirements on a Cisco Secure Email Gateway?

Options:

A.

RAT

B.

HAT

C.

Sender list

D.

Access list

Buy Now
Questions 180

An engineer is configuring 802.1X authentication on Cisco switches in the network and is using CoA as a mechanism. Which port on the firewall must be opened to allow the CoA traffic to traverse the network?

Options:

A.

TCP 6514

B.

UDP 1700

C.

TCP 49

D.

UDP 1812

Buy Now
Questions 181

A malicious user gained network access by spoofing printer connections that were authorized using MAB on

four different switch ports at the same time. What two catalyst switch security features will prevent further

violations? (Choose two)

Options:

A.

DHCP Snooping

B.

802.1AE MacSec

C.

Port security

D.

IP Device track

E.

Dynamic ARP inspection

F.

Private VLANs

Buy Now
Questions 182

Drag and drop the concepts from the left onto the correct descriptions on the right

182

Options:

Buy Now
Questions 183

What is a language format designed to exchange threat intelligence that can be transported over the TAXII

protocol?

Options:

A.

STIX

B.

XMPP

C.

pxGrid

D.

SMTP

Buy Now
Questions 184

How does a WCCP-configured router identify if the Cisco WSA is functional?

Options:

A.

If an ICMP ping fails three consecutive times between a router and the WSA, traffic is no longer transmitted to the router.

B.

If an ICMP ping fails three consecutive times between a router and the WSA, traffic is no longertransmitted to the WSA.

C.

The WSA sends a Here-l-Am message every 10 seconds, and the router acknowledges with an ISee-You message.

D.

The router sends a Here-l-Am message every 10 seconds, and the WSA acknowledges with an ISee-You message.

Buy Now
Questions 185

Which statement about IOS zone-based firewalls is true?

Options:

A.

An unassigned interface can communicate with assigned interfaces

B.

Only one interface can be assigned to a zone.

C.

An interface can be assigned to multiple zones.

D.

An interface can be assigned only to one zone.

Buy Now
Questions 186

186

Refer to the exhibit. Traffic is not passing through IPsec site-to-site VPN on the Secure Firewall Threat Defense appliance. What is causing this issue?

Options:

A.

No split-tunnel policy is defined on the Secure Firewall Threat Defense appliance.

B.

Site-to-site VPN preshared keys are mismatched.

C.

The access control policy is not allowing VPN traffic in.

D.

Site-to-site VPN peers are using different encryption algorithms.

Buy Now
Questions 187

187

Refer to the exhibit. An engineer is implementing a certificate-based VPN. What is the result of the existing configuration?

Options:

A.

The OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER.

B.

The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.

C.

Only an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully.

D.

The OU of the IKEv2 peer certificate is set to MANGLER.

Buy Now
Questions 188

How does Cisco Workload Optimization portion of the network do EPP solutions solely performance issues?

Options:

A.

It deploys an AWS Lambda system

B.

It automates resource resizing

C.

It optimizes a flow path

D.

It sets up a workload forensic score

Buy Now
Questions 189

Which Cisco security solution secures public, private, hybrid, and community clouds?

Options:

A.

Cisco ISE

B.

Cisco ASAv

C.

Cisco Cloudlock

D.

Cisco pxGrid

Buy Now
Questions 190

Which functions of an SDN architecture require southbound APIs to enable communication?

Options:

A.

SDN controller and the network elements

B.

management console and the SDN controller

C.

management console and the cloud

D.

SDN controller and the cloud

Buy Now
Questions 191

Drag and drop the steps from the left into the correct order on the right to enable AppDynamics to monitor an EC2 instance in Amazon Web Services.

191

Options:

Buy Now
Questions 192

A large retail enterprise is deploying Cisco Secure Private Access to enable remote employees to reach internal applications without manual intervention. The IT department requires a seamless, zero-touch enrollment process in which users are registered and authenticated transparently without requiring end-user action. The architecture must support robust high availability for back-end connectivity to ensure continuous access to private resources. Which configuration approach must the administrator implement to meet the requirement?

Options:

A.

Implement ZTA with Certificate Enrollment and multiple Connector Groups associated with the private resource.

B.

Configure ZTA with SAML Enrollment and multiple Connector Groups associated with the private resource.

C.

Define a VPN Machine Tunnel with Certificate Enrollment and Connector Groups associated with the private resource.

D.

Apply ZTA with SAML Enrollment, including passwordless enrollment, and a single Connector associated with the private resource.

Buy Now
Questions 193

A large enterprise is currently managing a hybrid environment consisting of a private data center and multiple public cloud providers. The security engineering team is concerned about “Shadow IT” and the lack of visibility into unauthorized cloud services being used by various departments. The architect must select a solution that provides comprehensive discovery of cloud application usage and assesses the risk of each service based on industry certifications. Which technical solution must be used to provide cross-environment visibility?

Options:

A.

EDR

B.

CASB

C.

Secure Firewall

D.

CWPP

Buy Now
Questions 194

What is a feature of container orchestration?

Options:

A.

ability to deploy Amazon ECS clusters by using the Cisco Container Platform data plane

B.

ability to deploy Amazon EKS clusters by using the Cisco Container Platform data plane

C.

ability to deploy Kubernetes clusters in air-gapped sites

D.

automated daily updates

Buy Now
Questions 195

A Cisco Secure Email Gateway network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Secure Email Gateway is not dropping files that have an undetermined verdict. What is causing this issue?

Options:

A.

The file has a reputation score that is below the threshold.

B.

The file has a reputation score that is above the threshold.

C.

The policy was created to disable file analysis.

D.

The policy was created to send a message to quarantine instead of drop.

Buy Now
Questions 196

An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1 1 11 using the flow record Stea!thwatch406397954 command Which additional command is required to complete the flow record?

Options:

A.

transport udp 2055

B.

match ipv4 ttl

C.

cache timeout active 60

D.

destination 1.1.1.1

Buy Now
Questions 197

Refer to the exhibit.

197

A site-to-site IKEv2 VPN between two Cisco Secure Firewall Threat Defense devices at a healthcare organization completes IKE Phase 1 successfully but fails during CREATE_CHILD_SA. The engineer captures the debug output from the initiating Cisco Secure Firewall. Which action must be performed to resolve the issue?

Options:

A.

Align the protected network definitions on both firewalls so that the local and remote traffic selectors proposed during CREATE_CHILD_SA match on both peers.

B.

Change the IPsec encryption algorithm from AES-256 to AES-128 on the initiating firewall and redeploy the VPN policy.

C.

Extend the IKE SA lifetime on both firewalls to give CREATE_CHILD_SA sufficient time to complete the negotiation before the Phase 1 SA expires.

D.

Remove DH Group 19 from the IPsec proposal on the initiating FTD because the TS_UNACCEPTABLE notification indicates that the responder does not support the proposed PFS group.

Buy Now
Questions 198

A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network

is congested and is affecting communication. How will the Cisco ESA handle any files which need analysis?

Options:

A.

AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.

B.

The file is queued for upload when connectivity is restored.

C.

The file upload is abandoned.

D.

The ESA immediately makes another attempt to upload the file.

Buy Now
Questions 199

Which public cloud provider supports the Cisco Next Generation Firewall Virtual?

Options:

A.

Google Cloud Platform

B.

Red Hat Enterprise Visualization

C.

VMware ESXi

D.

Amazon Web Services

Buy Now
Questions 200

Which two devices support WCCP for traffic redirection? (Choose two.)

Options:

A.

Cisco Secure Web Appliance

B.

Cisco IOS

C.

proxy server

D.

Cisco ASA

E.

Cisco IPS

Buy Now
Questions 201

A network engineer is enabling RADIUS CoA on a fleet of Cisco Catalyst switches so that Cisco ISE can quarantine compromised endpoints in real time. To uniquely target an active session for disconnect or reauthorization, Cisco ISE must include IETF attribute 31 to identify the endpoint. Which configuration action must be performed on Cisco ISE to meet the requirement?

Options:

A.

Configure the Calling-Station-ID attribute for CoA session identification.

B.

Apply the Message-Authenticator attribute for endpoint session lookup.

C.

Implement the Acct-Session-ID attribute for matching the active session.

D.

Use the NAS-Port-ID attribute for the CoA disconnect request.

Buy Now
Questions 202

Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?

Options:

A.

Encrypted Traffic Analytics

B.

Threat Intelligence Director

C.

Cognitive Threat Analytics

D.

Cisco Talos Intelligence

Buy Now
Questions 203

What provides total management for mobile and PC including managing inventory and device tracking, remote view, and live troubleshooting using the included native remote desktop support?

Options:

A.

mobile device management

B.

mobile content management

C.

mobile application management

D.

mobile access management

Buy Now
Questions 204

A Cisco ESA administrator has been tasked with configuring the Cisco ESA to ensure there are no viruses before quarantined emails are delivered. In addition, delivery of mail from known bad mail servers must be prevented. Which two actions must be taken in order to meet these requirements? (Choose two)

Options:

A.

Use outbreak filters from SenderBase

B.

Enable a message tracking service

C.

Configure a recipient access table

D.

Deploy the Cisco ESA in the DMZ

E.

Scan quarantined emails using AntiVirus signatures

Buy Now
Questions 205

A small organization needs to reduce the VPN bandwidth load on their headend Cisco ASA in order to

ensure that bandwidth is available for VPN users needing access to corporate resources on the10.0.0.0/24 local HQ network. How is this accomplished without adding additional devices to the

network?

Options:

A.

Use split tunneling to tunnel traffic for the 10.0.0.0/24 network only.

B.

Configure VPN load balancing to distribute traffic for the 10.0.0.0/24 network,

C.

Configure VPN load balancing to send non-corporate traffic straight to the internet.

D.

Use split tunneling to tunnel all traffic except for the 10.0.0.0/24 network.

Buy Now
Questions 206

Which Cisco DNA Center Intent API action is used to retrieve the number of devices known to a DNA Center?

Options:

A.

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device/count

B.

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device

C.

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/networkdevice?parameter1=value & parameter2=value & ....

D.

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v 1/networkdevice/startIndex/recordsToReturn

Buy Now
Questions 207

A security engineer is tasked with configuring TACACS on a Cisco ASA firewall. The engineer must be able to access the firewall command line interface remotely. The authentication must fall back to the local user database of the Cisco ASA firewall. AAA server group named TACACS-GROUP is already configured with TACACS server IP address 192.168.10.10 and key C1sc0512222832!. Which configuration must be done next to meet the requirement?

Options:

A.

aaa authentication ssh console LOCAL TACACS-GROUP

B.

aaa authentication ssh console TACACS-GROUP LOCAL

C.

aaa authentication serial console LOCAL TACACS-GROUP

D.

aaa authentication http console TACACS-GROUP LOCAL

Buy Now
Questions 208

An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system’s applications. Which

vulnerability allows the attacker to see the passwords being transmitted in clear text?

Options:

A.

weak passwords for authentication

B.

unencrypted links for traffic

C.

software bugs on applications

D.

improper file security

Buy Now
Questions 209

Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?

Options:

A.

file access from a different user

B.

interesting file access

C.

user login suspicious behavior

D.

privilege escalation

Buy Now
Questions 210

What are two workload security models? (Choose two.)

Options:

A.

SaaS

B.

PaaS

C.

off-premises

D.

on-premises

E.

IaaS

Buy Now
Questions 211

Which Cisco platform onboards the endpoint and can issue a CA signed certificate while also automatically configuring endpoint network settings to use the signed endpoint certificate, allowing the endpoint to gain network access?

Options:

A.

Cisco ISE

B.

Cisco NAC

C.

Cisco TACACS+

D.

Cisco WSA

Buy Now
Questions 212

Which MDM configuration provides scalability?

Options:

A.

pushing WPA2-Enterprise settings automatically to devices

B.

enabling use of device features such as camera use

C.

BYOD support without extra appliance or licenses

D.

automatic device classification with level 7 fingerprinting

Buy Now
Questions 213

A financial services firm is concerned about employees inadvertently pasting sensitive customer account information into public generative AI websites. The security team needs to implement a solution that inspects outbound traffic and prevents the transmission of sensitive data to AI platforms. Which two configuration actions must the administrator perform on Cisco Secure Access to achieve the requirement? (Choose two.)

Options:

A.

Apply an AI Guardrail rule to block uploads to unauthorized AI domains.

B.

Implement a strict firewall rule to block all outbound traffic on port 443 for the entire organization.

C.

Disable all web-browser access for employees to prevent them from navigating to any external websites.

D.

Configure a DLP policy to inspect outbound traffic for sensitive data patterns.

E.

Enable the local endpoint firewall to block all traffic to known AI-service IP addresses.

Buy Now
Questions 214

What are two rootkit types? (Choose two)

Options:

A.

registry

B.

virtual

C.

bootloader

D.

user mode

E.

buffer mode

Buy Now
Questions 215

Which two services are provided by the Cisco Talos Incident Response group? (Choose two.)

Options:

A.

Security policy authorization

B.

Bug identification

C.

Automatic vulnerability remediation

D.

Threat hunting

E.

Cyber range training

Buy Now
Questions 216

Which OWASP LLM risk involves an attacker embedding hidden instructions in user input to manipulate the model’s behavior?

Options:

A.

Output Truncation

B.

Prompt Injection

C.

System Prompt Leakage

D.

Data Exfiltration

Buy Now
Questions 217

What are two functions of TAXII in threat intelligence sharing? (Choose two.)

Options:

A.

determines the " what " of threat intelligence

B.

Supports STIX information

C.

allows users to describe threat motivations and abilities

D.

exchanges trusted anomaly intelligence information

E.

determines how threat intelligence information is relayed

Buy Now
Questions 218

What is the benefit of integrating Cisco ISE with a MDM solution?

Options:

A.

It provides compliance checks for access to the network

B.

It provides the ability to update other applications on the mobile device

C.

It provides the ability to add applications to the mobile device through Cisco ISE

D.

It provides network device administration access

Buy Now
Questions 219

Which network monitoring solution uses streams and pushes operational data to provide a near real-time view

of activity?

Options:

A.

SNMP

B.

SMTP

C.

syslog

D.

model-driven telemetry

Buy Now
Questions 220

What is a benefit of performing device compliance?

Options:

A.

Verification of the latest OS patches

B.

Device classification and authorization

C.

Providing multi-factor authentication

D.

Providing attribute-driven policies

Buy Now
Questions 221

Which two global commands must the network administrator implement to limit the attack surface of an internet-facing Cisco router? (Choose two.)

Options:

A.

no service password-recovery

B.

no cdp run

C.

service tcp-keepalives-in

D.

no ip http server

E.

ip ssh version 2

Buy Now
Questions 222

Which two are valid suppression types on a Cisco Next Generation Intrusion Prevention System? (Choose two)

Options:

A.

Port

B.

Rule

C.

Source

D.

Application

E.

Protocol

Buy Now
Questions 223

Which Cisco ASA deployment model is used to filter traffic between hosts in the same IP subnet using higher-level protocols without readdressing the network?

Options:

A.

routed mode

B.

transparent mode

C.

single context mode

D.

multiple context mode

Buy Now
Questions 224

Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses and malware?

(Choose two)

Options:

A.

Sophos engine

B.

white list

C.

RAT

D.

outbreak filters

E.

DLP

Buy Now
Questions 225

Which VPN technology can support a multivendor environment and secure traffic between sites?

Options:

A.

SSL VPN

B.

GET VPN

C.

FlexVPN

D.

DMVPN

Buy Now
Questions 226

226

Refer to the exhibit. Which configuration item makes it possible to have the AAA session on the network?

Options:

A.

aaa authorization exec default ise

B.

aaa authentication enable default enable

C.

aaa authorization network default group ise

D.

aaa authorization login console ise

Buy Now
Questions 227

What is a difference between DMVPN and sVTI?

Options:

A.

DMVPN supports tunnel encryption, whereas sVTI does not.

B.

DMVPN supports dynamic tunnel establishment, whereas sVTI does not.

C.

DMVPN supports static tunnel establishment, whereas sVTI does not.

D.

DMVPN provides interoperability with other vendors, whereas sVTI does not.

Buy Now
Questions 228

Refer to the exhibit.

228

A network administrator configured a site-to-site VPN tunnel between two Cisco IOS routers, and hosts are unable to communicate between two sites of VPN. The network administrator runs the debug crypto isakmp sa command to track VPN status. What is the problem according to this command output?

Options:

A.

hashing algorithm mismatch

B.

encryption algorithm mismatch

C.

authentication key mismatch

D.

interesting traffic was not applied

Buy Now
Questions 229

What is the process of performing automated static and dynamic analysis of files against preloaded

behavioral indicators for threat analysis?

Options:

A.

deep visibility scan

B.

point-in-time checks

C.

advanced sandboxing

D.

advanced scanning

Buy Now
Questions 230

An engineer recently completed the system setup on a Cisco WSA Which URL information does the system send to SensorBase Network servers?

Options:

A.

Summarized server-name information and MD5-hashed path information

B.

complete URL,without obfuscating the path segments

C.

URL information collected from clients that connect to the Cisco WSA using Cisco AnyConnect

D.

none because SensorBase Network Participation is disabled by default

Buy Now
Questions 231

What is an advantage of network telemetry over SNMP pulls?

Options:

A.

accuracy

B.

encapsulation

C.

security

D.

scalability

Buy Now
Questions 232

What is the purpose of the My Devices Portal in a Cisco ISE environment?

Options:

A.

to register new laptops and mobile devices

B.

to request a newly provisioned mobile device

C.

to provision userless and agentless systems

D.

to manage and deploy antivirus definitions and patches on systems owned by the end user

Buy Now
Questions 233

What is the difference between a vulnerability and an exploit?

Options:

A.

A vulnerability is a hypothetical event for an attacker to exploit

B.

A vulnerability is a weakness that can be exploited by an attacker

C.

An exploit is a weakness that can cause a vulnerability in the network

D.

An exploit is a hypothetical event that causes a vulnerability in the network

Buy Now
Questions 234

A healthcare organization is deploying Cisco Secure Access to prevent protected health information from being shared with generative AI services. The security team requires real-time DLP inspection only for traffic destined for AI applications, with minimal false positives during general web browsing. The policy must permit tuning based on the proximity and match counts of PHI identifiers. Which configuration action must the engineer perform?

Options:

A.

Configure a real-time DLP rule referencing a built-in PHI data classification with default thresholds, scoped to a web profile that includes all Internet traffic.

B.

Implement an API-based DLP rule referencing a custom PHI data classification with tuned proximity and match-count thresholds, scoped to the generative AI application category.

C.

Deploy a real-time DLP rule referencing a built-in PHI data classification with tuned match-count thresholds, scoped to a web profile filtered by destination lists for known AI vendors.

D.

Apply a real-time DLP rule referencing a custom PHI data classification with tuned proximity and match-count thresholds, scoped to a web profile filtered by the generative AI application category.

Buy Now
Questions 235

An engineer implements Cisco CloudLock to secure a Microsoft Office 365 application in the cloud. The engineer must configure protection for corporate files in case of any incidents. Which two actions must be taken to complete the implementation? (Choose two.)

Options:

A.

Expire the public share URL

B.

Send Cisco Webex message to specified users when an incident is triggered

C.

Transfer ownership of the files to a specified owner and folder

D.

Remove all users as collaborators on the files

E.

Disable the ability for commenters and viewers to download and copy the files

Buy Now
Questions 236

What is a characteristic of a bridge group in ASA Firewall transparent mode?

Options:

A.

It includes multiple interfaces and access rules between interfaces are customizable

B.

It is a Layer 3 segment and includes one port and customizable access rules

C.

It allows ARP traffic with a single access rule

D.

It has an IP address on its BVI interface and is used for management traffic

Buy Now
Questions 237

Which attack is commonly associated with C and C++ programming languages?

Options:

A.

cross-site scripting

B.

water holing

C.

DDoS

D.

buffer overflow

Buy Now
Questions 238

Refer to the exhibit.

238

A network administrator configures command authorization for the admin5 user. What is the admin5 user able to do on HQ_Router after this configuration?

Options:

A.

set the IP address of an interface

B.

complete no configurations

C.

complete all configurations

D.

add subinterfaces

Buy Now
Questions 239

Which two functions does the Cisco Advanced Phishing Protection solution perform in trying to protect from phishing attacks? (Choose two.)

Options:

A.

blocks malicious websites and adds them to a block list

B.

does a real-time user web browsing behavior analysis

C.

provides a defense for on-premises email deployments

D.

uses a static algorithm to determine malicious

E.

determines if the email messages are malicious

Buy Now
Questions 240

An organization wants to improve its cybersecurity processes and to add intelligence to its data The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA What must be done to accomplish these objectives?

Options:

A.

Create a Cisco pxGrid connection to NIST to import this information into the security products for policy use

B.

Create an automated download of the Internet Storm Center intelligence feed into the Cisco FTD and Cisco WSA databases to tie to the dynamic access control policies.

C.

Download the threat intelligence feed from the IETF and import it into the Cisco FTD and Cisco WSA databases

D.

Configure the integrations with Talos Intelligence to take advantage of the threat intelligence that it provides.

Buy Now
Exam Code: 350-701
Exam Name: Implementing and Operating Cisco Security Core Technologies (SCOR 350-701 v2.0)
Last Update: Oct 14, 2026
Questions: 801

PDF + Testing Engine

$59.99 $171.4

Testing Engine

$44.99 $128.55

PDF (Q&A)

$49.99 $142.82