Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cisco 350-701 > Exam D > Flashcards

Exam D Flashcards

1
Q

What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two)

A. Create NTLM or Kerberos authentication realm and enable transparent user identification

B. The eDirectory client must be installed on each client workstation

C. Deploy a separate eDirectory server; the client IP address is recorded in this server

D. Create an LDAP authentication realm and disable transparent user identification

E. Deploy a separate Active Directory agent such as Cisco Context Directory Agent

A

Create NTLM or Kerberos authentication realm and enable transparent user identification

Deploy a separate Active Directory agent such as Cisco Context Directory Agent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which MDM configuration provides scalability?

A. BYOD support without extra appliance or licenses
B. enabling use of device features such as camera use
C. pushing WPA2-Enterprise settings automatically to devices
D. automatic device classification with level 7 fingerprinting

A

pushing WPA2-Enterprise settings automatically to devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

```An engineer is configuring device-hardening on a router in order to prevent credentials from being seen if the router configuration was compromised. Which command should be used?

A. username < username> password
B. username privilege 15 password
C. service password-recovery
D. service password-encryption```

A

service password-encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are two security benefits of an MDM deployment? (Choose two)

A. distributed software upgrade
B. robust security policy enforcement
C. on-device content management
D. privacy control checks
E. distributed dashboard

A

robust security policy enforcement

on-device content management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which Cisco platform provides an agentless solution to provide visibility across the network including encrypted traffic analytics to detect malware in encrypted traffic without the need for decryption?

A. Cisco Advanced Malware Protection
B. Cisco Stealthwatch
C. Cisco Identity Services Engine
D. Cisco AnyConnect

A

Cisco Stealthwatch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two)

A. RADIUS communication must be permitted between the ISE server and the domain controller

B. The ISE account must be a domain administrator in Active Directory to perform JOIN operations

C. Active Directory only supports user authentication by using MSCHAPv2

D. LDAP communication must be permitted between the ISE server and the domain controller

E. Active Directory supports user and machine authentication by using MSCHAPv2

A

LDAP communication must be permitted between the ISE server and the domain controller

Active Directory supports user and machine authentication by using MSCHAPv2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which CoA response code is sent if an authorization state is changed successfully on a Cisco IOS device?

A. CoA-ACK
B. CoA-NAK
C. CoA-MAB
D. CoA-NCL

A

CoA-ACK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a feature of container orchestration?

A. ability to deploy Amazon ECS clusters by using the Cisco Container Platform data plane

B. ability to deploy Kubernetes clusters in air-gapped sites

C. ability to deploy Amazon EKS clusters by using the Cisco Container Platform data plane

D. automated daily updates

A

ability to deploy Kubernetes clusters in air-gapped sites

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which metric is used by the monitoring agent to collect and output packet loss and jitter information?

A. WSAv performance
B. AVC performance
C. RTP performance
D. OTCP performance

A

RTP performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which solution for remote workers enables protection, detection, and response on the endpoint against known and unknown threats?

A. Cisco AMP for Endpoints
B. Cisco AnyConnect
C. Cisco Umbrella
D. Cisco Duo

A

Cisco AMP for Endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which two components do southbound APIs use to communicate with downstream devices? (Choose two)

A. services running over the network
B. external application APIs
C. OpenFlow
D. applications running over the network
E. OpFlex

A

OpenFlow

OpFlex

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which solution detects threats across a private network, public clouds, and encrypted traffic?

A. Cisco Stealthwatch
B. Cisco CTA
C. Cisco Encrypted Traffic Analytics
D. Cisco Umbrella

A

Cisco Stealthwatch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which Cisco security solution integrates with cloud applications like Dropbox and Office 365 while protecting data from being exfiltrated?

A. Cisco Talos
B. Cisco Stealthwatch Cloud
C. Cisco Cloudlock
D. Cisco Umbrella Investigate

A

Cisco Cloudlock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do tools like Jenkins, Octopus Deploy, and Azure DevOps provide in terms of application and infrastructure automation?

A. container orchestration
B. cloud application security broker
C. compile-time instrumentation
D. continuous integration and continuous deployment

A

continuous integration and continuous deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which type of attack is MFA an effective deterrent for?

A. ping of death
B. phishing
C. teardrop
D. syn flood

A

phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users. Which action accomplishes this goal?

A. Install the Cisco Umbrella root CA onto the user’s device.

B. Modify the user’s browser settings to suppress errors from Cisco Umbrella.

C. Upload the organization root CA to Cisco Umbrella.

D. Restrict access to only websites with trusted third-party signed certificates.

A

Install the Cisco Umbrella root CA onto the user’s device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

A network engineer has configured a NTP server on a Cisco ASA. The Cisco ASA has IP reachability to the NTP server and is not filtering any traffic. The show ntp association detail command indicates that the configured NTP server is unsynchronized and has a stratum of 16. What is the cause of this issue?

A. Resynchronization of NTP is not forced

B. NTP is not configured to use a working server

C. An access list entry for UDP port 123 on the inside interface is missing

D. An access list entry for UDP port 123 on the outside interface is missing

A

NTP is not configured to use a working server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which direction do attackers encode data in DNS requests during exfiltration using DNS tunneling?

A. inbound
B. north-south
C. east-west
D. outbound

A

outbound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which solution should be leveraged for secure access of a CI/CD pipeline?

A. SSL WebVPN
B. remote access client
C. Duo Network Gateway
D. Cisco FTD network gateway

A

Duo Network Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which type of data exfiltration technique encodes data in outbound DNS requests to specific servers and can be stopped by Cisco Umbrella?

A. DNS tunneling
B. DNS flood attack
C. cache poisoning
D. DNS hijacking

A

DNS tunneling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which system performs compliance checks and remote wiping?

A. OTP
B. MDM
C. AMP
D. ISE

A

MDM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why is it important to patch endpoints consistently?

A. Patching helps to mitigate vulnerabilities.
B. Patching reduces the attack surface of the infrastructure.
C. Patching is required per the vendor contract.
D. Patching allows for creating a honeypot.

A

Patching helps to mitigate vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are two facts about WSA HTTP proxy configuration with a PAC file? (Choose two)

A. It is defined as a Transparent proxy deployment.
B. In a dual-NIC configuration, the PAC file directs traffic through the two NICs to the proxy.
C. The PAC file, which references the proxy, is deployed to the client web browser.
D. It is defined as an Explicit proxy deployment.
E. It is defined as a Bridge proxy deployment.

A

The PAC file, which references the proxy, is deployed to the client web browser.

It is defined as an Explicit proxy deployment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How does Cisco Umbrella protect clients when they operate outside of the corporate network?

A. by modifying the registry for DNS lookups

B. by using Active Directory group policies to enforce Cisco Umbrella DNS servers

C. by forcing DNS queries to the corporate name servers

D. by using the Cisco Umbrella roaming client

A

by using the Cisco Umbrella roaming client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which function is included when Cisco AMP is added to web security?

A. multifactor, authentication-based user identity
B. detailed analytics of the unknown file’s behavior
C. phishing detection on emails
D. threat prevention on an infected endpoint

A

detailed analytics of the unknown file’s behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

When a next-generation endpoint security solution is selected for a company, what are two key deliverables that help justify the implementation? (Choose two)

A. continuous monitoring of all files that are located on connected endpoints

B. macro-based protection to keep connected endpoints safe

C. signature-based endpoint protection on company endpoints

D. email integration to protect endpoints from malicious content that is located in email

E. real-time feeds from global threat intelligence centers

A

continuous monitoring of all files that are located on connected endpoints

real-time feeds from global threat intelligence centers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two)

A. The latest antivirus updates are applied before access is allowed.
B. Assignments to endpoint groups are made dynamically, based on endpoint attributes.
C. Patch management remediation is performed.
D. A centralized management solution is deployed.
E. Endpoint supplicant configuration is deployed.

A

The latest antivirus updates are applied before access is allowed.

A centralized management solution is deployed.

28
Q

Why should organizations migrate to an MFA strategy for authentication?

A. Single methods of authentication can be compromised more easily than MFA.

B. Biometrics authentication leads to the need for MFA due to its ability to be hacked easily.

C. MFA methods of authentication are never compromised.

D. MFA does not require any piece of evidence for an authentication mechanism.

A

Single methods of authentication can be compromised more easily than MFA.

29
Q

What is the purpose of joining Cisco WSAs to an appliance group?

A. All WSAs in the group can view file analysis results

B. It simplifies the task of patching multiple appliances

C. It supports cluster operations to expedite the malware analysis process

D. The group supports improved redundancy

A

The group supports improved redundancy

30
Q

Which Cisco solution extends network visibility, threat detection, and analytics to public cloud environments?

A. Cisco Umbrella
B. Cisco Stealthwatch Cloud
C. Cisco Appdynamics
D. Cisco CloudLock

A

Cisco Stealthwatch Cloud

31
Q

Which two Cisco ISE components must be configured for BYOD? (Choose two)

A. central WebAuth
B. local WebAuth
C. null WebAuth
D. guest
E. dual

A

central WebAuth

guest

32
Q

Which configuration method provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with Vmware VDS or Microsoft vSwitch?

A. inter-EPG isolation
B. intra-EPG isolation
C. inter-VLAN security
D. placement in separate EPGs

A

intra-EPG isolation

33
Q

In which scenario is endpoint-based security the solution?

A. inspecting encrypted traffic
B. device profiling and authorization
C. performing signature-based application control
D. inspecting a password-protected archive

A

inspecting a password-protected archive

34
Q

What are two ways that Cisco Container Platform provides value to customers who utilize cloud service providers? (Choose two)

A. allows developers to create code once and deploy to multiple clouds
B. helps maintain source code for cloud deployments
C. manages Docker containers
D. manages Kubernetes clusters
E. creates complex tasks for managing code

A

allows developers to create code once and deploy to multiple clouds

manages Kubernetes clusters

35
Q

What is the recommendation in a zero-trust model before granting access to corporate applications and resources?

A. to use multifactor authentication
B. to use strong passwords
C. to use a wired network, not wireless
D. to disconnect from the network when inactive

A

to use multifactor authentication

36
Q

An organization must add new firewalls to its infrastructure and wants to use Cisco ASA or Cisco FTD. The chosen firewalls must provide methods of blocking traffic that include offering the user the option to bypass the block for certain sites after displaying a warning page and to reset the connection. Which solution should the organization choose?

A. Cisco FTD because it supports system rate level traffic blocking, whereas Cisco ASA does not
B. Cisco ASA because it allows for interactive blocking and blocking with reset to be configured via the GUI, whereas Cisco FTD does not.
C. Cisco FTD because it enables interactive blocking and blocking with reset natively, whereas Cisco ASA does not
D. Cisco ASA because it has an additional module that can be installed to provide multiple blocking capabilities, whereas Cisco FTD does not.

A

Cisco FTD because it enables interactive blocking and blocking with reset natively

37
Q

Which IETF attribute is supported for the RADIUS CoA feature?

A. 81 Message-Authenticator
B. 30 Calling-Station-ID
C. 42 Acct-Session-ID
D. 24 State

A

24 State

38
Q

Which Cisco cloud security software centrally manages policies on multiple platforms such as Cisco ASA, Cisco Firepower, Cisco Meraki, and AWS?

A. Cisco Secureworks
B. Cisco Configuration Professional
C. Cisco Defense Orchestrator
D. Cisco DNAC

A

Cisco Defense Orchestrator

39
Q

Which Cisco DNA Center Intent API action is used to retrieve the number of devices known to a DNA Center?

A. GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device/count
B. GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device
C. GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/networkdevice?parameter1=value&parameter2=value&….
D. GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/networkdevice/startIndex/recordsToReturn

A

GET https://fqdnOrlPofDnaCenterPlatform/dna/intent/api/v1/network-device/count

40
Q

What is the difference between a vulnerability and an exploit?

A. A vulnerability is a hypothetical event for an attacker to exploit
B. An exploit is a hypothetical event that causes a vulnerability in the network
C. An exploit is a weakness that can cause a vulnerability in the network
D. A vulnerability is a weakness that can be exploited by an attacker

A

A vulnerability is a weakness that can be exploited by an attacker

41
Q

An administrator needs to configure the Cisco ASA via ASDM such that the network management system can actively monitor the host using SNMPv3. Which two tasks must be performed for this configuration? (Choose two)

A. Specify the SNMP manager and UDP port.
B. Specify an SNMP user group
C. Specify a community string.
D. Add an SNMP USM entry
E. Add an SNMP host access entry

A

Specify the SNMP manager and UDP port.

Add an SNMP host access entry

42
Q

Which Cisco security solution determines if an endpoint has the latest OS updates and patches installed on the system?

A. Cisco Endpoint Security Analytics
B. Cisco AMP for Endpoints
C. Endpoint Compliance Scanner
D. Security Posture Assessment Service

A

Security Posture Assessment Service

43
Q

When a transparent authentication fails on the Web Security Appliance, which type of access does the end user get?

A. guest
B. limited Internet
C. blocked
D. full Internet

A

blocked

44
Q

Using Cisco Cognitive Threat Analytics, which platform automatically blocks risky sites, and test unknown sites for hidden advanced threats before allowing users to click them?

A. Cisco Identity Services Engine
B. Cisco Enterprise Security Appliance
C. Cisco Web Security Appliance
D. Cisco Advanced Stealthwatch Appliance

A

Cisco Web Security Appliance

45
Q

Which technology provides a combination of endpoint protection endpoint detection, and response?

A. Cisco AMP
B. Cisco Talos
C. Cisco Threat Grid
D. Cisco Umbrella

A

Cisco AMP

46
Q

When a Cisco WSA checks a web request, what occurs if it is unable to match a user-defined policy?

A. It blocks the request.
B. It applies the global policy.
C. It applies the next identification profile policy.
D. It applies the advanced policy.

A

It applies the global policy.

47
Q

Which solution supports high availability in routed or transparent mode as well as in northbound and southbound deployments?

A. Cisco FTD with Cisco ASDM
B. Cisco FTD with Cisco FMC
C. Cisco Firepower NGFW physical appliance with Cisco. FMC
D. Cisco Firepower NGFW Virtual appliance with Cisco FMC

A

Cisco FTD with Cisco FMC

48
Q

Which endpoint protection and detection feature performs correlation of telemetry, files, and intrusion events that are flagged as possible active breaches?

A. retrospective detection
B. elastic search
C. file trajectory
D. indication of compromise

A

indication of compromise

49
Q

Which RADIUS feature provides a mechanism to change the AAA attributes of a session after it is authenticated?

A. Authorization
B. Accounting
C. Authentication
D. CoA

A

CoA

50
Q

Which two authentication protocols are supported by the Cisco WSA? (Choose two)

A. WCCP
B. NTLM
C. TLS
D. SSL
E. LDAP

A

NTLM

LDAP

51
Q

Which technology should be used to help prevent an attacker from stealing usernames and passwords of users within an organization?

A. RADIUS-based REAP
B. fingerprinting
C. Dynamic ARP Inspection
D. multifactor authentication

A

multifactor authentication

52
Q

Which baseline form of telemetry is recommended for network infrastructure devices?

A. SDNS
B. NetFlow
C. passive taps
D. SNMP

A

SNMP

53
Q

Which Cisco WSA feature supports access control using URL categories?

A. transparent user identification
B. SOCKS proxy services
C. web usage controls
D. user session restrictions

A

transparent user identification

54
Q

What is an advantage of the Cisco Umbrella roaming client?

A. the ability to see all traffic without requiring TLS decryption
B. visibility into IP-based threats by tunneling suspicious IP connections
C. the ability to dynamically categorize traffic to previously uncategorized sites
D. visibility into traffic that is destined to sites within the office environment

A

the ability to dynamically categorize traffic to previously uncategorized sites

55
Q

An organization has DHCP servers set up to allocate IP addresses to clients on the LAN. What must be done to ensure the LAN switches prevent malicious DHCP traffic while also distributing IP addresses to the correct endpoints?

A. Configure Dynamic ARP Inspection and add entries in the DHCP snooping database

B. Configure DHCP snooping and set an untrusted interface for all clients

C. Configure Dynamic ARP Inspection and antispoofing ACLs in the DHCP snooping database

D. Configure DHCP snooping and set a trusted interface for the DHCP server

A

Configure Dynamic ARP Inspection and add entries in the DHCP snooping database

56
Q

Which solution stops unauthorized access to the system if a user’s password is compromised?

A. VPN
B. MFA
C. AMP
D. SSL

A

MFA

57
Q

Which feature enables a Cisco ISR to use the default bypass list automatically for web filtering?

A. filters
B. group key
C. company key
D. connector

A

connector

58
Q

Which industry standard is used to integrate Cisco ISE and pxGrid to each other and with other interoperable security platforms?

A. IEEE
B. IETF
C. NIST
D. ANSI

A

IETF

59
Q

What is a function of the Layer 4 Traffic Monitor on a Cisco WSA?

A. blocks traffic from URL categories that are known to contain malicious content

B. decrypts SSL traffic to monitor for malicious content

C. monitors suspicious traffic across all the TCP/UDP ports

D. prevents data exfiltration by searching all the network traffic for specified sensitive information

A

monitors suspicious traffic across all the TCP/UDP ports

60
Q

Which solution is made from a collection of secure development practices and guidelines that developers must follow to build secure applications?

A. OWASP
B. Fuzzing Framework
C. Radamsa
D. AFL

A

OWASP

61
Q

What is the process of performing automated static and dynamic analysis of files against preloaded behavioral indicators for threat analysis?

A. deep visibility scan
B. point-in-time checks
C. advanced sandboxing
D. advanced scanning

A

advanced sandboxing

62
Q

Which Cisco ISE service checks the compliance of endpoints before allowing the endpoints to connect to the network?

A. posture
B. profiler
C. Cisco TrustSec
D. Threat Centric NAC

A

posture

63
Q

Refer to the exhibit.

import requests
client_id = ‘a1b2c3d4e5f6g7h8i9j0’
api_key = ‘a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6’

What does the API key do while working with https://api.amp.cisco.com/v1/computers?

A. displays client ID
B. HTTP authorization
C. Imports requests
D. HTTP authentication

A

Imports requests

64
Q

How does the Cisco WSA enforce bandwidth restrictions for web applications?

A. It implements a policy route to redirect application traffic to a lower-bandwidth link

B. It dynamically creates a scavenger class QoS policy and applies it to each client that connects through the WSA

C. It sends commands to the uplink router to apply traffic policing to the application traffic

D. It simulates a slower link by introducing latency into application traffic

A

It sends commands to the uplink router to apply traffic policing to the application traffic

65
Q

Which Cisco AMP feature allows an engineer to look back to trace past activities, such as file and process activity on an endpoint?

A. endpoint isolation
B. advanced search
C. advanced investigation
D. retrospective security

A

retrospective security

Cisco 350-701 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions