my cards 7 Flashcards
my cards 7
Refer to the exhibit. An administrator is configuring a VPN tunnel on a Cisco router. The information provided by the administrator of the remote end of the VPN tunnel was that IKEv1 is the tunnel protocol with a preshared key of C1$c0463835440!. The encryption for both phases is AES and the hash for both phases is SHA-256. The source subnet is 10.10.10.x/24 and the destination subnet is 10.10.20.x/24. The local device cannot establish a VPN tunnel and the debug message shown here is seen in the log file. What must be verified to correct the configuration?
ISAKMP: ipsec policy invlidated proposal ISAKMP: sa not acceptable QM rejected
A. Ensure that the IKE version is identical on both ends
B. Ensure that the ISAKMP policy configuration is identical on both ends
C. Ensure that the preshared key is identical on both ends
D. Ensure that the ACLs that define interesting traffic are symmetrical on both ends
B. Ensure that the ISAKMP policy configuration is identical on both ends
Which attack gives unauthorized access to files on the web server?
A. DHCP snooping
B. path traversal
C. broadcast storm
D. distributed DoS
B. path traversal
Which feature does the IaaS model provide?
A. software-defined network segmentation
B. granular control of data
C. automatic updates and patching of software
D. dedicated, restricted workstations
A. software-defined network segmentation
A network administrator needs a solution to match traffic and allow or deny the traffic based on the type of application, not just the source or destination address and port used. Which kind of security product must the network administrator implement to meet this requirement?
A. nextgeneration firewall
B. web application firewall
C. next generation intrusion prevention system
D. intrusion detection system
A. nextgeneration firewall
What is a benefit of using Cisco CWS compared to an on-premises Cisco Secure Web Appliance?
A. CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Secure Web Appliance does not.
B. Content scanning for SAAS cloud applications is available through CWS and not available through Secure Web Appliance.
C. CWS minimizes the load on the internal network and security infrastructure as compared to Secure Web Appliance.
D. URL categories are updated more frequently on CWS than they are on Secure Web Appliance.
A. CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Secure Web Appliance does not.
Which key feature of Cisco ZFW is unique among other Cisco IOS firewall solutions?
A. SSL inspection
B. security levels
C. stateless inspection
D. security zones
D. security zones
Which Cisco solution secures the cloud users, data and applications with the cloud-native CASB and cloud cybersecurity platform?
A. Cisco Appdynamics
B. Cisco Umbrella
C. Cisco CloudLock
D. Cisco Secure Network Analytics
C. Cisco CloudLock
What are the components of endpoint protection against social engineering attacks?
A. Cisco Secure Email Gateway
B. IPsec
C. firewall
D. IDS
A. Cisco Secure Email Gateway
Which feature is used to restrict communication between interfaces on a Cisco ASA?
A. VLAN subinterfaces
B. traffic zones
C. VxLAN interfaces
D. security levels
D. security levels
A network administrator is modifying a remote access VPN on an FTD managed by an FMC. The administrator wants to offload traffic to certain trusted domains. The administrator wants this traffic to go out of the client’s local internet and send other internet-bound traffic over the VPN. Which feature must the administrator configure?
A. reverse route injection
B. dynamic access policies
C. local LAN access
D. dynamic split tunneling
D. dynamic split tunneling
Refer to the exhibit. Logins from internal users to a Cisco Adaptive Security Appliance firewall must be performed by using a TACACS server. The firewall is already configured. Which additional configuration must be performed to configure the TACACS+ server group with a key of Cisco4512!?
INTERFACE NAME EXERNAL, ANSWER IS
aaa-server SERVERGROUP (external) host 4.4.4.2
key Cisco 4512!
INTERFACE NAME EXERNAL, ANSWER IS
aaa-server SERVERGROUP (external) host 4.4.4.2
key Cisco 4512!
A network engineer must create a workflow to detect when a device joins a network and send the onboarding configuration to the device by using the Cisco DNA Center API. Which two method and endpoint pairs must be used to implement the workflow? (Choose two.)
A. POST /dna/intent/api/v1/onboarding/pnp-device/site- claim
B. POST /dna/intent/api/v1/onboarding/pnp-device/import
C. GET /dna/intent/api/v1/discovery/{discovery_id}/network-device
D. GET /dna/intent/api/v1/topology/site-topology
E. POST /dna/intent/api/v1/discovery
A. POST /dna/intent/api/v1/onboarding/pnp-device/site- claim
B. POST /dna/intent/api/v1/onboarding/pnp-device/import
Which IPsec mode must be used when encrypting data over a public network between two servers with RFC1918 IP addresses?
A. main mode
B. aggressive mode
C. transport mode
D. tunnel mode
D. tunnel mode
Which platform uses Cyber Threat Intelligence as its main source of information?
A. EPP
B. EDR
C. Cisco ASA
D. Cisco Secure Endpoint
D. Cisco Secure Endpoint
Refer to the exhibit. Which task is the Python script performing by using the Umbrella Enforcement API?
import requests
from datetime import datetime import json
custkey "daw79ad8v9a7"
eventurl="https://s-platform.api.opendns.com/1.0/events"
time = datetime.now().isoformat()
domain= "maliciouswebsite.com"
UrlPost eventurl+'?customerKey='+custkey
data = {
"alertTime": time + "Z",
"deviceId": "flq802v6-1d92-1824-ba42-sf7sfk927c81",
"deviceVersion": "13.7a",
"dstDomain": domain,
"dstUrl": "http://" + domain + "/",
"eventTime": time + "Z",
"protocolVersion": "1.0a",
"providerName": "Security Platform"
}
req = requests.post (Url Post, data=json.dumps (data), headers = {'Content-type': 'application/json', 'Accept': 'application/json'})
if (req.status_code == 202):
print("SUCCESS: domain ( (domain) s) was accepted, HTTP response: 202, timestamp: (time) s" % ('domain': domain, 'time': time))
else:
print ("An error has occurred with the following code % (error)s, please consult the following link: https://enforcement-api.readme.io/"
{'error': req.status_code})
A. importing malicious domains to Cisco Umbrella Enforcement for additional processing
B. importing malicious domains to Cisco Umbrella Enforcement for blocking
C. editing malicious domains in Cisco Umbrella Enforcement that have changed status
D. editing malicious domains in Cisco Umbrella Enforcement that have changed IP address
B. importing malicious domains to Cisco Umbrella Enforcement for blocking
Which security mechanism is designed to protect against “offline brute-force” attacks?
A. Token
B. MFA
C. Salt
D. CAPTCHA
C. Salt
What is the default action before identifying the URL during HTTPS inspection in Cisco Secure Firewall Threat Defense software?
A. reset
B. buffer
C. drop
D. pass
D. pass
Which method is used on a Cisco IOS router to redirect traffic to the Cisco Secure Web Appliance for URL inspection?
A. WCCP
B. route map
C. PAC file
D. WPAD
A. WCCP
Which two global commands must the network administrator implement to limit the attack surface of an internet-facing Cisco router? (Choose two.)
A. service tcp-keepalives-in
B. no service password-recovery
C. no cdp run
D. no ip http server
E. ip ssh version 2
D. no ip http server
E. ip ssh version 2
Refer to the exhibit. An engineer created a policy named usera1 on a Cisco Secure Email Gateway to enable the antispam feature for an email address of usera1@cisco.com. Which configuration step must be performed next to apply the policy only to the usera1@cisco.com email address?
A. Specify the user in Mail Policies > Mail Policies Settings
B. Click the Policy Name usera1 Policy, and then click Add User.
C. Set the user in Mail Policies > Exception Table.
D. Click IronPort Anti-Spam, and then click Add User.
B. Click the Policy Name usera1 Policy, and then click Add User.
Which Cisco firewall solution supports configuration via Cisco Policy Language?
A. NGFW
B. CBAC
C. IPS
D. ZFW
D. ZFW
A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address 04:66:96:79:0:AB received an IP address from an unauthorized DHCP server. Which configuration step must the network administrator take to accomplish the requirement?
A. Apply DHCP option 82 to identify the trusted DHCP server.
B. Configure each device on the network to use authorize DHCP server manually.
C. Configure an access control list to only allow DHCP traffic from trusted DHCP server.
D. Implement DHCP option 82 to relay DHCP requests to the trusted DHCP server.
D. Implement DHCP option 82 to relay DHCP requests to the trusted DHCP server.
What are two examples of code injection vulnerabilities? (Choose two.)
A. XML external entity injection
B. cross-site scripting
C. session hijacking
D. SQL injection
E. arbitrary command injection
B. cross-site scripting
D. SQL injection
What is the purpose of the certificate signing request when adding a new certificate for a server?
A. It provides the certificate client information so the server can authenticate against it when installing.
B. It provides the server information so a certificate can be created and signed.
C. It is the password for the certificate that is needed to install it with.
D. It is the certificate that will be loaded onto the server.
B. It provides the server information so a certificate can be created and signed.
Which Secure Email Gateway implementation method segregates inbound and outbound email?
A. pair of logical listeners on a single physical interface with two unique logical IPv4 addresses and one IPv6 address
B. pair of logical IPv4 listeners and a pair of IPv6 listeners on two physically separate interfaces
C. one listener on one logical IPv4 address on a single logical interface
D. one listener on a single physical interface
B. pair of logical IPv4 listeners and a pair of IPv6 listeners on two physically separate interfaces
What is a feature of an endpoint detection and response solution?
A. ensuring the security of network devices by choosing which devices are allowed to reach the network
B. capturing and clarifying data on email, endpoints, and servers to mitigate threats
C. rapidly and consistently observing and examining data to mitigate threats
D. preventing attacks by identifying harmful events with machine learning and conduct-based defense
C. rapidly and consistently observing and examining data to mitigate threats
An engineer is deploying a Cisco Secure Email Gateway and must ensure it reaches the Cisco update servers to retrieve new rules. The engineer must now manually configure the Outbreak Filter rules on an AsyncOS for Cisco Secure Email Gateway. Only outdated rules must be replaced. Up-to-date rules must be retained. Which action must the engineer take next to complete the configuration?
A. Use the outbreakconfig command in CLI.
B. Select Outbreak Filters.
C. Perform a backup/restore of the database.
D. Click Update Rules Now.
A. Use the outbreakconfig command in CLI.
A website administrator wants to prevent SQL injection attacks against the company’s customer database, which is referenced by the web server. Which two methods help prevent SQL injection attacks? (Choose two.)
A. using load balancers with NAT
B. performing input validation
C. enforcing TLS 1.3 only
D. using SSL certificates
E. using web application firewalls
B. performing input validation
E. using web application firewalls
An engineer is configuring DHCP on a Cisco switch and wants to ensure that a DHCP packet will be dropped. Under which condition will this occur?
A. A packet from a DHCP server is received from inside the network or firewall.
B. All packets are dropped until the administrator manually enters the approved servers into the DHCP snooping database.
C. A packet is received on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match.
D. A DHCP relay agent forwards a DHCP packet that includes a relay-agent IP address that is 0.0.0.0.
C. A packet is received on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match.
An engineer is configuring guest WLAN access using Cisco ISE and the Cisco WLC. Which action temporarily gives guest endpoints access dynamically while maintaining visibility into who or what connecting?
A. Configure ISE and the WLC for quest redirection and services using a self-registered portal.
B. Modify the WLC configuration to allow any endpoint to access an internet-only VLAN.
C. Configure ISE and the WLC for guest redirection and services using a hotspot portal.
D. Modify the WLC configuration to require local WLC logins for the authentication prompts.
A. Configure ISE and the WLC for quest redirection and services using a self-registered portal.
An engineer needs to configure cloud logging on Cisco ASA with SAL (secure analytics, stealthwatch) integration. Which parameter must be considered for this configuration?
A. Events can be viewed only from one regional cloud.
B. All CSM versions are supported.
C. Onboard Cisco ASA device to CDO is needed.
D. Required storage size can be allocated dynamically.
C. Onboard Cisco ASA device to CDO is needed.
Which Cisco platform processes behavior baselines, monitors for deviations, and reviews for malicious processes in data center traffic and servers while performing software vulnerability detection?
A. Cisco Secure Client
B. Cisco ISE
C. Cisco Secure Workload
D. Cisco AMP for Network
C. Cisco Secure Workload
A network administrator has installed Secure Endpoint in the network. During setup it was noticed an endpoint has been exhibiting unusual behavior, including slow performance and unexpected network activity. Administrator discovers a suspicious file named abc0467145535.exe running in the background. Which step must the network administrator take to investigate and remediate the potential malware?
A. Isolate the endpoint from the network.
B. Reset the endpoint password and enable multi-factor authentication.
C. Format and reinstall the operating system on the endpoint.
D. Disable all non-essential processes running on the endpoint.
A. Isolate the endpoint from the network.
What are two targets in cross-site scripting attacks? (Choose two.)
A. footer
B. cookie
C. input
D. header
E. image
C. input
E. image
Which component performs the resolution between the tunnel address and mGRE address in DMVPN?
A. GDOI
B. NBMA
C. NHRP
D. NHS
C. NHRP
Refer to the exhibit. A network engineer must retrieve the interface configuration on a Cisco router by using the NETCONF API. The engineer uses a Python script to automate the activity. Which code snippet completes the script?
1 GET/api/running/interfaces? deep HTTP/1.1 2 Host: 10.22.52.246:8008 3 Authorization: Basic YWRtaW46YWRtaw4= 4 5 Accept: application/vnd.yang.data+json 6 Cache-Control: no-cache 7 Postman-Token: 93bfbd7d-c25b-993b-2ed2-b464e7d926de
A. Content-Type: applications/json/vnd.yang.data
B. Content-Type: application/vnd.yang.data+json
C. Content-Type: application/vnd.yang.data
D. Content-Type: application/vnd.yang.data+api
B. Content-Type: application/vnd.yang.data+json
What is a difference between encrypted passwords and hardcoded passwords?
A. Encrypted passwords are easier to obtain, and hardcoded passwords are known only to developers.
B. Encrypted passwords are generated by an application user, and hardcoded passwords are generated randomly.
C. Encrypted passwords are used for frontend applications, and hardcoded passwords are used for backend applications.
D. Encrypted passwords are stored in a database, and hardcoded passwords are embedded in the source code.
D. Encrypted passwords are stored in a database, and hardcoded passwords are embedded in the source code
Which action adds IOCs to customize detections for a new attack?
A. Use the initiate Endpoint IOCs scan feature to gather the IOC information and push it to clients.
B. Upload the IOCs into the Installed Endpoint IOC feature within Cisco Secure Endpoint.
C. Add a custom advanced detection to include the IOCs needed within Cisco Secure Endpoint.
D. Modify the base policy within Cisco Secure Endpoint to include simple custom detections.
B. Upload the IOCs into the Installed Endpoint IOC feature within Cisco Secure Endpoint.
A network administrator received a critical message alert from a Cisco Secure Web Appliance stating that the log partition is at 107% capacity. How does a Cisco Secure Web Appliance respond when its logging partition is full?
A. It overwrites the oldest log files.
B. It suspends logging and reporting functions.
C. It deletes logs older than a configurable age.
D. It archives older logs in a compressed file to free space.
B. It suspends logging and reporting functions.
What limits communication between applications or containers on the same node?
A. container orchestration
B. microservicing
C. software-define access
D. microsegmentation
D. microsegmentation
A network administrator has configured TACACS on a network device using the key Cisc0466974274 for authentication purposes. However, users are unable to authenticate. TACACS server is reachable, but authentication is falling. Which configuration step must the administrator complete?
A. Configure the TACACS key on the server to match with the network device.
B. Install a compatible operating system version on the TACACS server.
C. Implement synchronized system clock on TACACS server that matches the network device.
D. Apply an access control list on TACACS server to allow communication with the network device.
A. Configure the TACACS key on the server to match with the network device.
