my cards 4 Flashcards
my cards 4
What are two things to consider when using PAC files with the Cisco WSA? (Choose two.)
A. If the WSA host port is changed, the default port redirects web traffic to the correct port automatically.
B. PAC files use if-else statements to determine whether to use a proxy or a direct connection for traffic between the PC and the host.
C. The WSA hosts PAC files on port 9001 by default.
D. The WSA hosts PAC files on port 6001 by default.
E. By default, they direct traffic through a proxy when the PC and the host are on the same subnet.
B. PAC files use if-else statements to determine whether to use a proxy or a direct connection for traffic between the PC and the host.
C. The WSA hosts PAC files on port 9001 by default.
Which IETF attribute is supported for the RADIUS CoA feature?
A. 24 State
B. 30 Calling-Station-ID
C. 42 Acct-Session-ID
D. 81 Message-Authenticator
A. 24 State
When a transparent authentication fails on the Web Security Appliance, which type of access does the end user get?
A. guest
B. limited Internet
C. blocked
D. full Internet
C. blocked
What are two ways that Cisco Container Platform provides value to customers who utilize cloud service providers? (Choose two.)
A. Allows developers to create code once and deploy to multiple clouds
B. helps maintain source code for cloud deployments
C. manages Docker containers
D. manages Kubernetes clusters
E. Creates complex tasks for managing code
A. Allows developers to create code once and deploy to multiple clouds
E. Creates complex tasks for managing code
Drag and drop the posture assessment flow actions from the left into a sequence on the right.
Select and Place: order
Validate user credentials
check device compliance with security policy
grant appropiate access with compliance device
apply updates or take other neccesary action
permit just enough for the posture assesment
Validate user credentials
permit just enough for the posture assesment
check device compliance with security policy
apply updates or take other neccesary action
grant appropiate access with compliance device
Refer to the exhibit.
What does the API key do while working with https://api.amp.cisco.com/v1/computers?
import requests client_id = 'a1jjgñalsjfñaslkjflñajsñ' api_key = 'sldfjñasldjkfañlsjdfñaslkjfñlasjfñakdjflñasdjf'
A. displays client ID
B. HTTP authorization
C. Imports requests
D. HTTP authentication
D. HTTP authentication
Which statement describes a serverless application?
A. The application delivery controller in front of the server farm designates on which server the application runs each time.
B. The application runs from an ephemeral, event-triggered, and stateless container that is fully managed by a cloud provider.
C. The application is installed on network equipment and not on physical servers.
D. The application runs from a containerized environment that is managed by Kubernetes or Docker Swarm.
B. The application runs from an ephemeral, event-triggered, and stateless container that is fully managed by a cloud provider.
What is a description of microsegmentation?
A. Environments deploy a container orchestration platform, such as Kubernetes, to manage the application delivery.
B. Environments apply a zero-trust model and specify how applications on different servers or containers can communicate.
C. Environments deploy centrally managed host-based firewall rules on each server or container.
D. Environments implement private VLAN segmentation to group servers with similar applications.
B. Environments apply a zero-trust model and specify how applications on different servers or containers can communicate.
Which Cisco WSA feature supports access control using URL categories?
A. transparent user identification
B. SOCKS proxy services
C. web usage controls
D. user session restrictions
C. web usage controls
Which technology limits communication between nodes on the same network segment to individual applications?
A. serverless infrastructure
B. microsegmentation
C. SaaS deployment
D. machine-to-machine firewalling
B. microsegmentation
An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users. Which action accomplishes this goal?
A. Restrict access to only websites with trusted third-party signed certificates.
B. Modify the user’s browser settings to suppress errors from Cisco Umbrella.
C. Upload the organization root CA to Cisco Umbrella.
D. Install the Cisco Umbrella root CA onto the user’s device.
D. Install the Cisco Umbrella root CA onto the user’s device.
What is the purpose of joining Cisco WSAs to an appliance group?
A. All WSAs in the group can view file analysis results.
B. The group supports improved redundancy
C. It supports cluster operations to expedite the malware analysis process.
D. It simplifies the task of patching multiple appliances.
B. The group supports improved redundancy
Why should organizations migrate to an MFA strategy for authentication?
A. Single methods of authentication can be compromised more easily than MFA.
B. Biometrics authentication leads to the need for MFA due to its ability to be hacked easily.
C. MFA methods of authentication are never compromised.
D. MFA does not require any piece of evidence for an authentication mechanism.
A. Single methods of authentication can be compromised more easily than MFA.
Which technology should be used to help prevent an attacker from stealing usernames and passwords of users within an organization?
A. RADIUS-based REAP
B. fingerprinting
C. Dynamic ARP Inspection
D. multifactor authentication
C. Dynamic ARP Inspection
Which type of attack is MFA an effective deterrent for?
A. ping of death
B. phishing
C. teardrop
D. syn flood
B. phishing
Which solution for remote workers enables protection, detection, and response on the endpoint against known and unknown threats?
A. Cisco AMP for Endpoints
B. Cisco AnyConnect
C. Cisco Umbrella
D. Cisco Duo
A. Cisco AMP for Endpoints
Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two.)
A. Assignments to endpoint groups are made dynamically, based on endpoint attributes.
B. Endpoint supplicant configuration is deployed.
C. A centralized management solution is deployed.
D. Patch management remediation is performed.
E. The latest antivirus updates are applied before access is allowed.
D. Patch management remediation is performed.
E. The latest antivirus updates are applied before access is allowed.
What is an advantage of the Cisco Umbrella roaming client?
A. the ability to see all traffic without requiring TLS decryption
B. visibility into IP-based threats by tunneling suspicious IP connections
C. the ability to dynamically categorize traffic to previously uncategorized sites
D. visibility into traffic that is destined to sites within the office environment
B. visibility into IP-based threats by tunneling suspicious IP connections
Which Cisco platform provides an agentless solution to provide visibility across the network including encrypted traffic analytics to detect malware in encrypted traffic without the need for decryption?
A. Cisco Advanced Malware Protection
B. Cisco Stealthwatch
C. Cisco Identity Services Engine
D. Cisco AnyConnect
B. Cisco Stealthwatch
Which two Cisco ISE components must be configured for BYOD? (Choose two.)
A. local WebAuth
B. central WebAuth
C. null WebAuth
D. guest
E. dual
B. central WebAuth
D. guest
Which system performs compliance checks and remote wiping?
A. MDM
B. ISE
C. AMP
D. OTP
A. MDM
An engineer is configuring Cisco WSA and needs to enable a separated email transfer flow from the Internet and from the LAN. Which deployment mode must be used to accomplish this goal?
A. single interface
B. multi-context
C. transparent
D. two-interface
D. two-interface
A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)
A. RADIUS communication must be permitted between the ISE server and the domain controller.
B. The ISE account must be a domain administrator in Active Directory to perform JOIN operations.
C. Active Directory only supports user authentication by using MSCHAPv2.
D. LDAP communication must be permitted between the ISE server and the domain controller.
E. Active Directory supports user and machine authentication by using MSCHAPv2.
D. LDAP communication must be permitted between the ISE server and the domain controller.
E. Active Directory supports user and machine authentication by using MSCHAPv2.
Which configuration method provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with Vmware VDS or Microsoft vSwitch?
A. inter-EPG isolation
B. inter-VLAN security
C. intra-EPG isolation
D. placement in separate EPGs
C. intra-EPG isolation
What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.)
A. Create an LDAP authentication realm and disable transparent user identification.
B. Create NTLM or Kerberos authentication realm and enable transparent user identification.
C. Deploy a separate Active Directory agent such as Cisco Context Directory Agent.
D. The eDirectory client must be installed on each client workstation.
E. Deploy a separate eDirectory server; the client IP address is recorded in this server.
B. Create NTLM or Kerberos authentication realm and enable transparent user identification.
C. Deploy a separate Active Directory agent such as Cisco Context Directory Agent.
Which baseline form of telemetry is recommended for network infrastructure devices?
A. SDNS
B. NetFlow
C. passive taps
D. SNMP
B. NetFlow
In which scenario is endpoint-based security the solution?
A. inspecting encrypted traffic
B. device profiling and authorization
C. performing signature-based application control
D. inspecting a password-protected archive
D. inspecting a password-protected archive
Refer to the exhibit. What is the result of the Python script?
import requests
from requests.auth import HTTPBasicAuth
def dnac_login(host, username, password):
url = f"https://{host}/api/system/v1/auth/token"
response = requests.request("POST",url, auth=HTTPBasicAuth(username, password), verify=False)
return response.json()["Token"]
A. It uses the POST HTTP method to obtain a username and password to be used for authentication.
B. It uses the POST HTTP method to obtain a token to be used for authentication.
C. It uses the GET HTTP method to obtain a token to be used for authentication.
D. It uses the GET HTTP method to obtain a username and password to be used for authentication
B. It uses the POST HTTP method to obtain a token to be used for authentication.
Why is it important to patch endpoints consistently?
A. Patching reduces the attack surface of the infrastructure.
B. Patching helps to mitigate vulnerabilities.
C. Patching is required per the vendor contract.
D. Patching allows for creating a honeypot.
B. Patching helps to mitigate vulnerabilities.
Which two parameters are used for device compliance checks? (Choose two.)
A. endpoint protection software version
B. Windows registry values
C. DHCP snooping checks
D. DNS integrity checks
E. device operating system version
B. Windows registry values
E. device operating system version
Which Cisco cloud security software centrally manages policies on multiple platforms such as Cisco ASA, Cisco Firepower, Cisco Meraki, and AWS?
A. Cisco Defense Orchestrator
B. Cisco Configuration Professional
C. Cisco Secureworks
D. Cisco DNAC
A. Cisco Defense Orchestrator
Which Cisco security solution determines if an endpoint has the latest OS updates and patches installed on the system?
A. Cisco Endpoint Security Analytics
B. Cisco AMP for Endpoints
C. Endpoint Compliance Scanner
D. Security Posture Assessment Service
D. Security Posture Assessment Service
Which open standard creates a framework for sharing threat intelligence in a machine-digestible format?
A. OpenIOC
B. OpenC2
C. CybOX
D. STIX
A. OpenIOC
What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?
A. Cisco AMP for Endpoints is a cloud-based service, and Cisco Umbrella is not
B. Cisco AMP for Endpoints automatically researches indicators of compromise and confirms threats and Cisco Umbrella does not
C. Cisco AMP for Endpoints prevents, detects, and responds to attacks before damage can be done, and Cisco Umbrella provides the first line of defense against Internet threats
D. Cisco AMP for Endpoints prevents connections to malicious destinations, and Cisco Umbrella works at the file level to prevent the initial execution of malware
C. Cisco AMP for Endpoints prevents, detects, and responds to attacks before damage can be done, and Cisco Umbrella provides the first line of defense against Internet threats
What are two functionalities of northbound and southbound APIs within Cisco SDN architecture? (Choose two.)
A. Northbound APIs utilize RESTful API methods such as GET, POST, and DELETE
B. Southbound APIs utilize CLI, SNMP, and RESTCONF
C. Southbound APIs are used to define how SDN controllers integrate with applications
D. Northbound interfaces utilize OpenFlow and OpFlex to integrate with network devices
E. Southbound interfaces utilize device configurations such as VLANs and IP addresses
A. Northbound APIs utilize RESTful API methods such as GET, POST, and DELETE
B. Southbound APIs utilize CLI, SNMP, and RESTCONF
Refer to the exhibit. What is the function of the Python script code snippet for the Cisco ASA REST API?
#{code snipped)
api_path="/api/access/global/rules"
url = server + api_path
f = None
post_data = {
"sourceService":{
"kind" serviceKind,
"value" sourceServiceValue
).
"destinationAddress": {
"kind": destinationAddressKind, "value" destinationAddress
).
"remarks" []. "destinationService":{ "kind": serviceKind,
"value" destinationServiceValue
).
"permit": trueORfalse,
"active" "true",
"position": "1", "sourceAddress":{
"kind": sourceAddressKind, "value" sourceAddress
}
req= urllib2 Request(url, json.dumps(post_data), headers)
base64string = base64.encodestring("%s %s' % (username, password)) replace("\n", ") req.add_header("Authorization", "Basic %s" % base6-4string)
try.
1= urllib2 urlopen(req)
status_code = fgetcode()
print "Status code is "+str(status_code)
if status_code == 201:
print "Operation successful"
except urllib2.HTTPError, err
print "Error received from server. HTTP Status code :"+str(err.code)
try.
A. changes the hostname of the Cisco ASA
B. adds a global rule into policies
C. deletes a global rule from policies
D. obtains the saved configuration of the Cisco ASA firewall
B. adds a global rule into policies
DRAG DROP -
Drag and drop the features of Cisco ASA with Firepower from the left onto the benefits on the right.
Select and Place:
Full Context Awareness
NGIPS
AMP
Collective Security Intelligence
detection, blocking and remediation to protect the enterprise against targeted malware attacks
policy enforcement based on complete visibility of users and communication between virtual machines
real-time threat intelligence and security protection
threat prevention and mitigation for known and unknown threats
AMP - detection, blocking and remediation to protect the enterprise against targeted malware attacks
Full Context Awareness - policy enforcement based on complete visibility of users and communication between virtual machines
Collective Security Intelligence - real-time threat intelligence and security protection
NGIPS - threat prevention and mitigation for known and unknown threats
What are two functions of secret key cryptography? (Choose two.)
A. utilization of less memory
B. utilization of large prime number iterations
C. utilization of different keys for encryption and decryption
D. key selection without integer factorization
E. provides the capability to only know the key on one side
A. utilization of less memory
D. key selection without integer factorization
Refer to the exhibit. When creating an access rule for URL filtering a network engineer adds certain categories and individual URLs to block. What is the result of the configuration?
https://www.examtopics.com/assets/media/exam-media/04313/0016900001.jpg
A. Only URLs for botnets with a reputation score of 3 will be allowed while the rest will be blocked.
B. Only URLs for botnets with reputation scores of 1-3 will be blocked.
C. Only URLs for botnets with reputation scores of 3-5 will be blocked.
D. Only URLs for botnets with a reputation score of 3 will be blocked.
B. Only URLs for botnets with reputation scores of 1-3 will be blocked.
Which security product enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access?
A. Cisco Container Controller
B. Cisco Cloud Platform
C. Cisco Container Platform
D. Cisco Content Platform
C. Cisco Container Platform
