Steps Necessary To Pass The 350-701 Exam from Training Expert DumpsFree
Valid Way To Pass CCNP Security's 350-701 Exam
For more info about Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)
Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)
NEW QUESTION 33
Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)
- A. applications
- B. middleware
- C. virtualization
- D. data
- E. operating systems
Answer: A,D
Explanation:
Explanation
Explanation
Customers must manage applications and data in PaaS.
NEW QUESTION 34
What are two features of NetFlow flow monitoring? (Choose two.)
- A. Can be used to track multicast, MPLS, or bridged traffic.
- B. Include the flow record and the flow importer
- C. Copies all ingress flow information to an interface
- D. Does not required packet sampling on interfaces
- E. Can track ingress and egress information
Answer: A,E
NEW QUESTION 35
A customer has various external HTTP resources available including Intranet Extranet and Internet, with a proxy configuration running in explicit mode. Which method allows the client desktop browsers to be configured to select when to connect direct or when to use the proxy?
- A. Transport mode
- B. Forward file
- C. Bridge mode
- D. PAC file
Answer: D
Explanation:
Explanation
A Proxy Auto-Configuration (PAC) file is a JavaScript function definition that determines whether web browser requests (HTTP, HTTPS, and FTP) go direct to the destination or are forwarded to a web proxy server.
PAC files are used to support explicit proxy deployments in which client browsers are explicitly configured to send traffic to the web proxy. The big advantage of PAC files is that they are usually relatively easy to create and maintain.
NEW QUESTION 36
What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two.)
- A. The Cisco WSA is configured in a web browser only if it is running in transparent mode.
- B. The Cisco WSA responds with its own IP address only if it is running in transparent mode.
- C. The Cisco WSA responds with its own IP address only if it is running in explicit mode.
- D. The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.
- E. When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request destination.
Answer: C,E
NEW QUESTION 37
Which two mechanisms are used to control phishing attacks? (Choose two.)
- A. Revoke expired CRL of the websites.
- B. Implement email filtering techniques.
- C. Use antispyware software.
- D. Enable browser alerts for fraudulent websites.
- E. Define security group memberships.
Answer: B,D
NEW QUESTION 38
Drag and drop the descriptions from the left onto the correct protocol versions on the right.
Answer:
Explanation:
NEW QUESTION 39
Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.
Answer:
Explanation:
NEW QUESTION 40
When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key establishment?
- A. DH is a symmetric key establishment algorithm intended to output asymmetric keys
- B. RSA is a symmetric key establishment algorithm intended to output asymmetric keys
- C. DH is on asymmetric key establishment algorithm intended to output symmetric keys
- D. RSA is an asymmetric key establishment algorithm intended to output symmetric keys
Answer: C
Explanation:
Diffie Hellman (DH) uses a private-public key pair to establish a shared secret, typically a symmetric key. DH is not a symmetric algorithm - it is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm.
NEW QUESTION 41
An organization received a large amount of SPAM messages over a short time period. In order to take action on the messages, it must be determined how harmful the messages are and this needs to happen dynamically.
What must be configured to accomplish this?
- A. Configure the Cisco ESA to modify policies based on the traffic seen.
- B. Configure the Cisco WSA to modify policies based on the traffic seen.
- C. Configure the Cisco WSA to receive real-time updates from Talos.
- D. Configure the Cisco ESA to receive real-time updates from Talos
Answer: D
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/security/esa/esa120/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Adm
NEW QUESTION 42
What is the function of SDN southbound API protocols?
- A. to allow for the dynamic configuration of control plane applications
- B. to allow for the static configuration of control plane applications
- C. to enable the controller to make changes
- D. to enable the controller to use REST
Answer: C
Explanation:
Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs.
Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs.
Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs.
Reference:
Note: Southbound APIs helps us communicate with data plane (not control plane) applications
NEW QUESTION 43
Drag and drop the solutions from the left onto the solution's benefits on the right.
Answer:
Explanation:
Explanation:
Cisco Stealthwatch - rapidly collects and analyzes netflow and telementy data to deliver in-depth visibility and understanding of network traffic Cisco ISE - obtains contextual identity and profiles for all users and device Cisco TrustSec - software defined segmentation that uses SGTs Cisco Umbrella - secure internet gateway ion the cloud that provides a security solution
NEW QUESTION 44
What is the purpose of the My Devices Portal in a Cisco ISE environment?
- A. to request a newly provisioned mobile device
- B. to register new laptops and mobile devices
- C. to provision userless and agentless systems
- D. to manage and deploy antivirus definitions and patches on systems owned by the end user
Answer: B
Explanation:
Reference:
NEW QUESTION 45
Which command enables 802.1X globally on a Cisco switch?
- A. dot1x system-auth-control
- B. authentication port-control aut
- C. dot1x pae authenticator
- D. aaa new-model
Answer: A
NEW QUESTION 46
Drag and drop the descriptions from the left onto the encryption algorithms on the right.
Answer:
Explanation:
NEW QUESTION 47
Which license is required for Cisco Security Intelligence to work on the Cisco Next Generation Intrusion Prevention System?
- A. URL filtering
- B. protect
- C. matware
- D. control
Answer: B
NEW QUESTION 48
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- A. Telemetry uses push and pull, which makes it more scalable than SNMP
- B. Telemetry uses a pull mehod, which makes it more reliable than SNMP
- C. Telemetry uses a push method which makes it faster than SNMP
- D. Telemetry uses push and pull which makes it more secure than SNMP
Answer: C
Explanation:
Explanation SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts. The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data. Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc. Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Explanation SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts. The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data. Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc. Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry
NEW QUESTION 49
Which two deployment modes does the Cisco ASA FirePOWER module support? (Choose two.)
- A. routed mode
- B. passive monitor-only mode
- C. active mode
- D. inline mode
- E. transparent mode
Answer: B,D
NEW QUESTION 50
What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?
- A. It tracks flow-create, flow-teardown, and flow-denied events.
- B. Its events match all traffic classes in parallel.
- C. It provides stateless IP flow tracking that exports all records of a specific flow.
- D. It tracks the flow continuously and provides updates every 10 seconds.
Answer: A
NEW QUESTION 51
What is a characteristic of traffic storm control behavior?
- A. Traffic storm control cannot determine if the packet is unicast or broadcast.
- B. Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.
- C. Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.
- D. Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.
Answer: C
NEW QUESTION 52
Which type of attack is social engineering?
- A. phishing
- B. trojan
- C. MITM
- D. malware
Answer: A
NEW QUESTION 53
Which public cloud provider supports the Cisco Next Generation Firewall Virtual?
- A. Red Hat Enterprise Visualization
- B. Google Cloud Platform
- C. VMware ESXi
- D. Amazon Web Services
Answer: D
Explanation:
Cisco Firepower NGFW Virtual (NGFWv) is the virtualized version of Cisco's Firepower next generation firewall.
The Cisco NGFW virtual appliance is available in the AWS and Azure marketplaces. In AWS, it can be deployed in routed and passive modes. Passive mode design requires ERSPAN, the Encapsulated Remote Switched Port Analyzer, which is currently not available in Azure.
In passive mode, NGFWv inspects packets like an Intrusion Detection System (IDS) appliance, but no action can be taken on the packet.
In routed mode NGFWv acts as a next hop for workloads. It can inspect packets and also take action on the packet based on rule and policy definitions.
Cisco Firepower NGFW Virtual (NGFWv) is the virtualized version of Cisco's Firepower next generation firewall.
The Cisco NGFW virtual appliance is available in the AWS and Azure marketplaces. In AWS, it can be deployed in routed and passive modes. Passive mode design requires ERSPAN, the Encapsulated Remote Switched Port Analyzer, which is currently not available in Azure.
In passive mode, NGFWv inspects packets like an Intrusion Detection System (IDS) appliance, but no action can be taken on the packet.
In routed mode NGFWv acts as a next hop for workloads. It can inspect packets and also take action on the packet based on rule and policy definitions.
Reference:
Cisco Firepower NGFW Virtual (NGFWv) is the virtualized version of Cisco's Firepower next generation firewall.
The Cisco NGFW virtual appliance is available in the AWS and Azure marketplaces. In AWS, it can be deployed in routed and passive modes. Passive mode design requires ERSPAN, the Encapsulated Remote Switched Port Analyzer, which is currently not available in Azure.
In passive mode, NGFWv inspects packets like an Intrusion Detection System (IDS) appliance, but no action can be taken on the packet.
In routed mode NGFWv acts as a next hop for workloads. It can inspect packets and also take action on the packet based on rule and policy definitions.
NEW QUESTION 54
What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two)
- A. URL categorization
- B. intelligent proxy
- C. snort
- D. data exfiltration
- E. command and control communication
Answer: D,E
Explanation:
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
Reference:
Cisco Cognitive Threat Analytics helps you quickly detect and respond to sophisticated, clandestine attacks that are already under way or are attempting to establish a presence within your environment. The solution automatically identifies and investigates suspicious or malicious web-based traffic. It identifies both potential and confirmed threats, allowing you to quickly remediate the infection and reduce the scope and damage of an attack, whether it's a known threat campaign that has spread across multiple organizations or a unique threat you've never seen before.
Detection and analytics features provided in Cognitive Threat Analytics are shown below:
+ Data exfiltration: Cognitive Threat Analytics uses statistical modeling of an organization's network to identify anomalous web traffic and pinpoint the exfiltration of sensitive data. It recognizes data exfiltration even in HTTPS-encoded traffic, without any need for you to decrypt transferred content
+ Command-and-control (C2) communication: Cognitive Threat Analytics combines a wide range of data, ranging from statistics collected on an Internet-wide level to host-specific local anomaly scores. Combining these indicators inside the statistical detection algorithms allows us to distinguish C2 communication from benign traffic and from other malicious activities. Cognitive Threat Analytics recognizes C2 even in HTTPSencoded or anonymous traffic, including Tor, without any need to decrypt transferred content, detecting a broad range of threats
...
NEW QUESTION 55
What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?
- A. Multiple NetFlow collectors are supported.
- B. Flow-create events are delayed.
- C. Secure NetFlow connections are optimized for Cisco Prime Infrastructure
- D. Advanced NetFlow v9 templates and legacy v5 formatting are supported.
Answer: A
Explanation:
Explanation
NEW QUESTION 56
An engineer is configuring 802.1X authentication on Cisco switches in the network and is using CoA as a mechanism. Which port on the firewall must be opened to allow the CoA traffic to traverse the network?
- A. UDP 1700
- B. UDP 1812
- C. TCP 6514
- D. TCP 49
Answer: A
Explanation:
CoA Messages are sent on two different udp ports depending on the platform. Cisco standardizes on UDP port
1700, while the actual RFC calls out using UDP port 3799.
NEW QUESTION 57
What is a benefit of performing device compliance?
- A. providing multi-factor authentication
- B. providing attribute-driven policies
- C. verification of the latest OS patches
- D. device classification and authorization
Answer: A
Explanation:
Reference:
https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/data_sheet_c78-656174.html > Endpoint posture service
NEW QUESTION 58
......
All 350-701 Dumps and Implementing and Operating Cisco Security Core Technologies Training Courses: https://www.dumpsfree.com/350-701-valid-exam.html
Free Test Engine For Implementing and Operating Cisco Security Core Technologies Certification Exams: https://drive.google.com/open?id=1kiI55TQJRVK7hOmjmSHOAD_GpON8GXVi