Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNP Sec > 350-701 > Flashcards

350-701 Flashcards

1
Q

What are two list types within AMP for Endpoints Outbreak Control? (Choose two.)

A

simple custom detections

allowed applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which command enables 802.1X globally on a Cisco switch?

A

dot1x system-auth-control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the function of Cisco Cloudlock for data security?

A

data loss prevention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two.)

A

Windows service

Windows firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a characteristic of Dynamic ARP Inspection?

A

DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the
DHCP snooping binding database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the deployment?

A

AMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where are individual sites specified to be blacklisted in Cisco Umbrella?

A

destination lists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which statement about IOS zone-based firewalls is true?

A

An interface can be assigned only to one zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which two activities can be done using Cisco DNA Center? (Choose two.)

A

design

provision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

A

Active Directory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which VPN technology can support a multivendor environment and secure traffic between sites?

A

FlexVPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which SNMPv3 configuration must be used to support the strongest security possible?

A

asa-host(config)#snmp-server group myv3 v3 priv
asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX
asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other third-party management tools, and prioritize application traffic?

A

Cisco Application Visibility and Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which two endpoint measures are used to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two.)

A

Install a spam and virus email filter.

Protect systems with an up-to-date antimalware program.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransomware infection? (Choose two.)

A

Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.
Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network.D. Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why would a user choose an on-premises ESA versus the CES solution?

A

Sensitive data must remain onsite.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

A

GET VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which cloud service model offers an environment for cloud consumers to develop and deploy applications
without needing to manage or maintain the underlying cloud infrastructure?

A

PaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?

A

Enable Intelligent Proxy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses andmalware? (Choose two.)

A

Sophos engine

outbreak filters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How is Cisco Umbrella configured to log only security events?

A

per policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

A

EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

On which part of the IT environment does DevSecOps focus?

A

application development

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which functions of an SDN architecture require southbound APIs to enable communication?

A

SDN controller and the network elements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a characteristic of traffic storm control behavior?

A

Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which two request of REST API are valid on the Cisco ASA Platform? (Choose two.)

A

put

get

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

In a PaaS model, which layer is the tenant responsible for maintaining and patching?

A

application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak control method is used to accomplish this task?

A

application blocking list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which ASA deployment mode can provide separation of management on a shared appliance?

A

multiple context mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two.)

A

Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS
Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?

A

Cisco Threat Grid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What provides visibility and awareness into what is currently occurring on the network?

A

Telemetry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Which attack is commonly associated with C and C++ programming languages?

A

buffer overflow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE.
Which CoA type achieves this goal?

A

CoA Reauth

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Refer to the exhibit. Which command was used to display this output?

A

show dot1x all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two.)

A

Check integer, float, or Boolean string parameters to ensure accurate values.
Use prepared statements and parameterized queries.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How does Cisco Stealthwatch Cloud provide security for cloud environments?

A

It delivers visibility and threat detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)

A

SIP

SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which feature is configured for managed devices in the device platform settings of the Firepower Management Center?

A

time synchronization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

A

SDN controller and the management solution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Refer to the exhibit. What is a result of the configuration?

A

Traffic from the inside network is redirected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which information is required when adding a device to Firepower Management Center?

A

registration key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Which two services must remain as on-premises equipment when a hybrid email solution is deployed? (Choose two.)

A

encryption

DLP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?

A

It tracks flow-create, flow-teardown, and flow-denied events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

A

SSL Decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Which two kinds of attacks are prevented by multifactor authentication? (Choose two.)

A

brute force

man-in-the-middle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Which two kinds of attacks are prevented by multifactor authentication? (Choose two.)

A

prevalence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Which RADIUS attribute can you use to filter MAB requests in an 802.1x deployment?

A

6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Which two features of Cisco Email Security can protect your organization against email threats?(choose two)

A

Data loss prevention

Geolocation-based filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Drag and drop the steps from the left into the correct order on the right to enable AppDynamics to monitor an EC2 instance in Amazon Web Services.

A

Step 1 - Configure a Machine Agent or SIM Agent
Step 2 - Install monitoring extension for AWS EC2
Step 3 - Update config.yaml
Step 4 - Restart the Machine Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?

A

impact flags

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Refer to the exhibit. Which statement about the authentication protocol used in the configuration is true?

A

The authentication and authorization requests are grouped in a single packet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Which two preventive measures are used to control cross-site scripting? (Choose two.)

A

Enable client-side scripts on a per-domain basis.

Incorporate contextual output encoding/escaping.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

A

network discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Refer to the exhibit. Which command was used to generate this output and to show which ports are authenticating with dot1x or mab?

A

show authentication sessions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

An engineer is configuring a Cisco ESA and wants to control whether to accept or reject email messages to a recipient address.
Which list contains the allowed recipient addresses?

A

RAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Which two capabilities does TAXII support? (Choose two.)

A

pull messaging

binding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?

A

platform service policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network.
The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10. What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

A

Cisco Identity Services Engine and AnyConnect Posture module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two.)

A

data exfiltration

command and control communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?

A

cross-site scripting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which two conditions are prerequisites for stateful failover for IPsec? (Choose two.)

A

The IPsec configuration that is set up on the active device must be duplicated on the standby device.
The active and standby devices must run the same version of the Cisco IOS software and must be the same type of device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What Cisco command shows you the status of an 802.1X connection on interface gi0/1?

A

show authen sess int gi0/1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports at the same time. What two catalyst switch security features will prevent further violations? (Choose two)

A

DHCP Snooping

Dynamic ARP inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring aninline posture node?

A

RADIUS Change of Authorization

66
Q

What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

A

authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX

67
Q

Which two probes are configured to gather attributes of connected endpoints using Cisco Identity Services Engine? (Choose two.)

A

RADIUS

DHCP

68
Q

Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

A

Tetration

69
Q

What are the two most commonly used authentication factors in multifactor authentication? (Choose two.)

A

time factor

knowledge factor

70
Q

Which two key and block sizes are valid for AES? (Choose two.)

A

128-bit block size, 192-bit key length

128-bit block size, 256-bit key length

71
Q

After deploying a Cisco ESA on your network, you notice that some messages fail to reach their destinations.
Which task can you perform to determine where each message was lost?

A

Configure the trackingconfig command to enable message tracking.

72
Q

Elliptic curve cryptography is a stronger more efficient cryptography method meant to replace which current encryption technology?

A

RSA

73
Q

How is ICMP used an exfiltration technique?

A

by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host

74
Q

What is the difference between deceptive phishing and spear phishing?

A

A spear phishing campaign is aimed at a specific person versus a group of people.

75
Q

An engineer needs a solution for TACACS+ authentication and authorization for device administration. The engineer also wants to enhance wired and wireless network security by requiring users and endpoints to use 802.1X, MAB, or WebAuth.
Which product meets all of these requirements?

A

Cisco Identity Services Engine

76
Q

When wired 802.1X authentication is implemented, which two components are required? (Choose two.)

A

authentication server: Cisco Identity Service Engine

authenticator: Cisco Catalyst switch

77
Q

The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic. Where must the ASA be added on the Cisco UC Manager platform?

A

Certificate Trust List

78
Q

Which API is used for Content Security?

A

AsyncOS API

79
Q

Which two behavioral patterns characterize a ping of death attack? (Choose two.)

A

The attack is fragmented into groups of 8 octets before transmission.
Malformed packets are used to crash systems.

80
Q

Which two mechanisms are used to control phishing attacks? (Choose two.)

A

Enable browser alerts for fraudulent websites.

Implement email filtering techniques.

81
Q

When web policies are configured in Cisco Umbrella, what provides the ability to ensure that domains are blocked when they host malware, command and control, phishing, and more threats?

A

Security Category Blocking

82
Q

What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two.)

A

central web auth

local web auth

83
Q

Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?

A

user input validation in a web page or web application

84
Q

Which deployment model is the most secure when considering risks to cloud adoption?

A

private cloud

85
Q

What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?

A

It discovers and controls cloud apps that are connected to a company’s corporate environment.

86
Q

What is the primary benefit of deploying an ESA in hybrid mode?

A

It provides email security while supporting the transition to the cloud

87
Q

Which option is the main function of Cisco Firepower impact flags?

A

They correlate data about intrusions and vulnerability.

88
Q

Which two deployment modes does the Cisco ASA FirePOWER module support? (Choose two.)

A

inline mode

passive monitor-only mode

89
Q

Drag and drop the Firepower Next Generation Intrusion Prevention System detectors from the left onto
the correct definitions on the right.

A

Distributed PortScan - Many to one portscan in which multiple hosts scan a single host for open ports
Decoy PortScan - one to one portscan, atacker mixes spoofed source address inter-mixed with the real scanning address
Port Sweep - one to many port sweep, an attacker against a few hosts to scan a single port on multiple targets
PortScan Detection - one to one PortScan, an attacker against one, few hosts to scan one or multiple ports

90
Q

Drag and drop the capabilities from the left onto the correct technologies on the right.

A

Next Generation Intrusion Prevention System - provides superior threat prevention and mitigation for known and unknown threats.
Advanced Malware Protection - detection, blocking, tracking, analysis, and remediation to protect against targeted persistant malware attacks.
Application control and URL filtering - application layer control and ability to enforce usage and tailor detection policies based on custom application and URLs
Cisco Web Security Appliance - combine integrated solution of strong defense and web protection, visibility, and controlling solutions

91
Q

Drag and drop the descriptions from the left onto the correct protocol versions on the right.

A

IKEv1
uses six packets in main mode to establish phase 1
uses three packets in aggressive mode to establish phase 1
IKEv2
standard includes NAT-T
uses four packets packets to establish phase 1 and phase 2
uses EAP for authenticating remote access clients

92
Q

Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

A

Talos

93
Q

What is the purpose of the Decrypt for Application Detection feature within the WSA Decryption options?

A

It provides enhanced HTTPS application detection for AsyncOS.

94
Q

What is the primary role of the Cisco Email Security Appliance?

A

Mail Transfer Agent

95
Q

Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two.)

A

assurance

automation

96
Q

Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?

A

DNS tunneling

97
Q

Which algorithm provides encryption and authentication for data plane communication?

A

AES-GCM

98
Q

How does Cisco Umbrella archive logs to an enterprise-owned storage?

A

by being configured to send logs to a self-managed AWS S3 bucket

99
Q

In which cloud services model is the tenant responsible for virtual machine OS patching?

A

IaaS

100
Q

Which two descriptions of AES encryption are true? (Choose two.)

A

AES is more secure than 3DES.

AES can use a 256-bit key for encryption.

101
Q

Which technology is used to improve web traffic performance by proxy caching?

A

WSA

102
Q

Which two statements about a Cisco WSA configured in Transparent mode are true? (Choose two.)

A

WCCP v2-enabled devices can automatically redirect traffic destined to port 80.
Layer 4 switches can automatically redirect traffic destined to port 80.

103
Q

Which action controls the amount of URI text that is stored in Cisco WSA logs files?

A

Configure the advancedproxyconfig command with the HTTPS subcommand

104
Q

Which technology reduces data loss by identifying sensitive information stored in public computing environments?

A

Cisco Cloudlock

105
Q

Refer to the exhibit. What does the number 15 represent in this configuration?

A

access list that identifies the SNMP devices that can access the router

106
Q

Which network monitoring solution uses streams and pushes operational data to provide a near real-time view of activity?

A

model-driven telemetry

107
Q

Which feature is supported when deploying Cisco ASA within AWS public cloud?

A

user deployment of Layer 3 networks

108
Q

Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

A

transparent

109
Q

An MDM provides which two advantages to an organization with regards to device management? (Choose two.)

A

asset inventory management

allowed application management

110
Q

Which Talos reputation center allows you to track the reputation of IP addresses for email and web traffic?

A

IP and Domain Reputation Center

111
Q

Under which two circumstances is a CoA issued? (Choose two.)

A

An endpoint is deleted on the Identity Service Engine server.
An endpoint is profiled for the first time.

112
Q

Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

A

A flow-export event type must be defined under a policy.

113
Q

Which benefit does endpoint security provide the overall security posture of an organization?

A

It allows the organization to detect and mitigate threats that the perimeter security devices do not

114
Q

An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network. Which action tests the routing?

A

Browse to http://welcome.umbrellA.com/to validate that the new identity is working.

115
Q

What is a language format designed to exchange threat intelligence that can be transported over the TAXII protocol?

A

STIX

116
Q

When using Cisco AMP for Networks, which feature copies a file to the Cisco AMP cloud for analysis?

A

dynamic analysis

117
Q

Which Cisco Advanced Malware protection for Endpoints deployment architecture is designed to keep data within a network perimeter?

A

private cloud

118
Q

Which IPS engine detects ARP spoofing?

A

Atomic ARP Engine

119
Q

Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?

A

It defines a traffic baseline for traffic anomaly deduction.

120
Q

Which two are valid suppression types on a Cisco Next Generation Intrusion Prevention System?

A

Rule

Source

121
Q

Which license is required for Cisco Security Intelligence to work on the Cisco Next Generation Intrusion Prevention System?

A

protect

122
Q

Which policy is used to capture host information on the Cisco Next Generation Intrusion Prevention System?

A

network discovery

123
Q

On Cisco Firepower Management Center, which policy is used to collect health modules alerts from managed devices?

A

health policy

124
Q

Which CLI command is used to register a Cisco FirePOWER sensor to Firepower Management Center?

A

configure manager add

125
Q

Which Cisco AMP file disposition valid?

A

malware

126
Q

Which capability is exclusive to a Cisco AMP public cloud instance as compared to a private cloud instance?

A

ETHOS detection engine

127
Q

Which function is the primary function of Cisco AMP threat Grid?

A

automated malware analysis

128
Q

Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent? (Choose two.)

A

Outgoing traffic is allowed so users can communicate with outside organizations.
Messenger applications cannot be segmented with standard network controls.

129
Q

How many interfaces per bridge group does an ASA bridge group deployment support?

A

up to 8

130
Q

Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

A

It allows the endpoint to authenticate with 802.1xor MAB.

131
Q

What is a feature of the open platform capabilities of Cisco DNA Center?

A

intent-based APIs

132
Q

Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

A

interpacket variation

133
Q

In which two ways does a system administrator send web traffic transparently to the Web Security Appliance? (Choose two.)

A

reference a Proxy Auto Config file

use Web Cache Communication Protocol

134
Q

Which form of attack is launched using botnets?

A

EIDDOS

135
Q

How is DNS tunneling used to exfiltrate data out of a corporate network?

A

lt encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.

136
Q

Which Cisco security solution protects remote users against phishing attacks when they are not connected to the VPN?

A

Cisco Umbrella

137
Q

Which two tasks allow NetFlow on a Cisco ASA 5500 Series firewall? (Choose two.)

A

Apply NetFlow Exporter to the outside interface in the inbound direction.
Define a NetFlow collector by using the flow-export command.

138
Q

What is a difference between FlexVPN and DMVPN?

A

FlexVPN uses IKEv2. DMVPN uses IKEvI or IKEv2.

139
Q

A mall provides security services to customers with a shared appliance. The mall wants separation of management on the shared appliance. Which ASA deployment mode meets these needs?

A

multiple context mode

140
Q

What is the function of the Context Directory Agent?

A

reads the Active Directory logs to map IP addresses to usernames

141
Q

What is a commonality between DMVPN and FlexVPN technologies?

A

IOS routers run the same NHRP code for DMVPN and FlexVPN.

142
Q

Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two.)

A

ARP spoofing

malware

143
Q

Which threat involves software being used to gain unauthorized access to a computer system?

A

virus

144
Q

What is a characteristic of Firepower NGIPS inline deployment mode?

A

it must have inline interface pairs configured.

145
Q

What are two rootkit types? (Choose two)

A

buffer mode

user mode

146
Q

An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA.
Which Cisco ASA command must be used?

A

flow-export destination inside 1.1.1.1 2055

147
Q

Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?

A

aaa new-model

148
Q

Refer to the exhibit. What is the result of this Python script of the Cisco DNA Center API?

A

adds a switch to Cisco DNA Center

149
Q

What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two.)

A

secure access to on-premises and cloud applications

single sign-on access to on-premises and cloud applications

150
Q

Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?

A

DTLSv1

151
Q

Which Cisco product is open, scalable, and built on IETF standards to allow multiple security products from Cisco and other vendors to share data and interoperate with each other?

A

Platform Exchange Grid

152
Q

A network engineer has entered the snmp-server user andy myv3 auth sha cisco priv aes 256 cisc0380739941 command and needs to send SNMP information to a host at 10.255.254.1.
Which command achieves this goal?

A

snmp-server host inside 10.255.254.1 version 3 myv3

153
Q

Which type of attack is social engineering?

A

phishing

154
Q

Which compliance status is shown when a configured posture policy requirement is not met?

A

noncompliant

155
Q

What must be used to share data between multiple security products?

A

Cisco Platform Exchange Grid

156
Q

An engineer wants to automatically assign endpoints that have a specific OUl into a new endpoint group.
Which probe must be enabled for this type of profiling to work?

A

NMAP

157
Q

Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server?

A

profile

158
Q

A network engineer is configuring DMVPN and entered the crypto is akmp key cisc0380739941 address 0.0.0.0 command on host A The tunnel is not being established to host B.
What action is needed to authenticate the VPN?

A

Enter the same command on host B.

159
Q

on that switch are unable to communicate with any destination. The network administrator checks the interface status of all interfaces, and there is no err- disabled interface.
What is causing this problem?

A

DHCP snooping has not been enabled on all VLANs.

160
Q

Refer to the exhibit. What does the API do when connected to a Cisco security appliance?

A

gather the network interface information about the computers AMP sees

CCNP Sec (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions