What is the difference between a vulnerability and an exploit?

A vulnerability is a weakness that can be exploited by an attacker

A vulnerability is a hypothetical event for an attacker to exploit

A vulnerability is a weakness that can be exploited by an attacker

An exploit is a weakness that can cause a vulnerability in the network

An exploit is a hypothetical event that causes a vulnerability in the network

How is data sent out to the attacker during a DNS tunneling attack?

as part of the UDP/53 packet payload

as part of the TCP/53 packet header

as part of the DNS response packet

An engineer is adding a Cisco DUO solution to the current TACACS+ deployment using Cisco ISE. The engineer wants to authenticate users using their account when they log into network devices. Which action accomplishes this task?

Install and configure the Cisco DUO Authentication Proxy and configure the identity source sequence within Cisco ISE

Configure Cisco DUO with the external Active Directory connector and tie it to the policy set within Cisco ISE.

Install and configure the Cisco DUO Authentication Proxy and configure the identity source sequence within Cisco ISE

Create an identity policy within Cisco ISE to send all authentication requests to Cisco DUO.

Modify the current policy with the condition MFASourceSequence DUO=true in the authorization conditions within Cisco ISE

A Cisco AMP for Endpoints administrator configures a custom detection policy to add specific MD5 signatures The configuration is created in the simple detection policy section, but it does not work What is the reason for this failure?

Detections for MD5 signatures must be configured in the advanced custom detection policies

The administrator must upload the file instead of the hash for Cisco AMP to use.

The MD5 hash uploaded to the simple detection policy is in the incorrect format

The APK must be uploaded for the application that the detection is intended

Detections for MD5 signatures must be configured in the advanced custom detection policies

An organization is selecting a cloud architecture and does not want to be responsible for patch management of the operating systems. Why should the organization select either Platform as a Service or Infrastructure as a Service for this environment?

Platform as a Service because the service provider manages the operating system

Platform as a Service because the customer manages the operating system

Infrastructure as a Service because the customer manages the operating system

Platform as a Service because the service provider manages the operating system

Infrastructure as a Service because the service provider manages the operating system

An administrator is adding a new Cisco ISE node to an existing deployment. What must be done to ensure that the addition of the node will be successful when inputting the FQDN?

Add the DNS entry for the new Cisco ISE node into the DNS server

Change the IP address of the new Cisco ISE node to the same network as the others.

Make the new Cisco ISE node a secondary PAN before registering it with the primary.

Open port 8905 on the firewall between the Cisco ISE nodes

Add the DNS entry for the new Cisco ISE node into the DNS server

Refer to the exhibit. What will occur when this device tries to connect to the port?

802.1X will not work and the device will not be allowed network access

802.1X will not work, but MAB will start and allow the device on the network.

802.1X will not work and the device will not be allowed network access

802 1X will work and the device will be allowed on the network

802 1X and MAB will both be used and ISE can use policy to determine the access level

A network engineer must configure a Cisco ESA to prompt users to enter two forms of information before gaining access The Cisco ESA must also join a cluster machine using preshared keys What must be configured to meet these requirements?

Enable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA CLI.

Enable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA GUI

Enable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA GUI.

Enable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA CLI

Refer to the exhibit. An engineer is implementing a certificate based VPN. What is the result of the existing configuration?

The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.

Only an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully

The OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER

The OU of the IKEv2 peer certificate is set to MANGLER

What is a benefit of using Cisco CWS compared to an on-premises Cisco WSA?

Cisco CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Cisco WSA does not

Cisco CWS minimizes the load on the internal network and security infrastructure as compared to Cisco WSA.

URL categories are updated more frequently on Cisco CWS than they are on Cisco WSA

Content scanning for SAAS cloud applications is available through Cisco CWS and not available through Cisco WSA

An organization has a requirement to collect full metadata information about the traffic going through their AWS cloud services They want to use this information for behavior analytics and statistics Which two actions must be taken to implement this requirement? (Choose two.)

Configure Cisco Thousand Eyes to ingest AWS information.

Configure Cisco Stealthwatch Cloud to ingest AWS information

Configure Cisco ACI to ingest AWS information.

Configure Cisco Thousand Eyes to ingest AWS information.

Send syslog from AWS to Cisco Stealthwatch Cloud.

Send VPC Flow Logs to Cisco Stealthwatch Cloud.

Configure Cisco Stealthwatch Cloud to ingest AWS information

What is the function of the crypto is a kmp key cisc406397954 address 0.0.0.0 0.0.0.0 command when establishing an IPsec VPN tunnel?

lt configures the pre-shared authentication key

It defines what data is going to be encrypted via the VPN

lt configures the pre-shared authentication key

It prevents all IP addresses from connecting to the VPN server.

It configures the local address for the VPN server.

An organization wants to improve its cybersecurity processes and to add intelligence to its data The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA What must be done to accomplish these objectives?

Configure the integrations with Talos Intelligence to take advantage of the threat intelligence that it provides.

Create a Cisco pxGrid connection to NIST to import this information into the security products for policy use

Create an automated download of the Internet Storm Center intelligence feed into the Cisco FTD and Cisco WSA databases to tie to the dynamic access control policies.

Download the threat intelligence feed from the IETF and import it into the Cisco FTD and Cisco WSA databases

Configure the integrations with Talos Intelligence to take advantage of the threat intelligence that it provides.

Refer to the exhibit.ntp authentication-key 10 md.5 ciscol23 ntp trusted-key 10A network engineer is testing NTP authentication and realizes that any device synchronizes time with this router and that NTP authentication is not enforced What is the cause of this issue?

NTP authentication is not enabled.

The key was configured in plain text.

NTP authentication is not enabled.

The hashing algorithm that was used was MD5. which is unsupported.

The router was not rebooted after the NTP configuration updated.

Refer to the exhibit. How does Cisco Umbrella manage traffic that is directed toward risky domains?

Traffic is managed by the security settings and blocked.

Traffic is proximed through the intelligent proxy.

Traffic is managed by the security settings and blocked.

Traffic is managed by the application settings, unhandled and allowed.

An engineer needs to add protection for data in transit and have headers in the email message Which configuration is needed to accomplish this goal?

Enable flagged message handling

Deploy an encryption appliance.

Map sender !P addresses to a host interface.

Enable flagged message handling

How does a cloud access security broker function?

lt integrates with other cloud solutions via APIs and monitors and creates incidents based on events from the cloud solution

It is an authentication broker to enable single sign-on and multi-factor authentication for a cloud solution

lt integrates with other cloud solutions via APIs and monitors and creates incidents based on events from the cloud solution

It acts as a security information and event management solution and receives syslog from other cloud solutions.

It scans other cloud solutions being used within the network and identifies vulnerabilities

A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address Error! Hyperlink reference not valid.IP>/capure/CAPI/pcap/test.pcap, an error 403: Forbidden is given instead of the PCAP file. Which action must the engineer take to resolve this issue?

Enable the HTTPS server for the device platform policy

Disable the proxy setting on the browser

Disable the HTTPS server and use HTTP instead

Use the Cisco FTD IP address as the proxy server setting on the browser

Enable the HTTPS server for the device platform policy

What is a description of microsegmentation?

Environments apply a zero-trust model and specify how applications on different servers or containers can communicate

Environments deploy a container orchestration platform, such as Kubernetes, to manage the application delivery

Environments implement private VLAN segmentation to group servers with similar applications.

Environments deploy centrally managed host-based firewall rules on each server or container

What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.) The eDirectory client must be installed on each client workstation.

Create NTLM or Kerberos authentication realm and enable transparent user identification

Deploy a separate Active Directory agent such as Cisco Context Directory Agent.

Create NTLM or Kerberos authentication realm and enable transparent user identification

Deploy a separate Active Directory agent such as Cisco Context Directory Agent.

Create an LDAP authentication realm and disable transparent user identification.

Deploy a separate eDirectory server: the client IP address is recorded in this server

What are two functionalities of SDN Northbound APIs? (Choose two.)

Northbound APIs provide a programmable interface for applications to dynamically configure the network.

Northbound APIs form the interface between the SDN controller and business applications.

Northbound APIs provide a programmable interface for applications to dynamically configure the network.

Northbound APIs form the interface between the SDN controller and business applications.

OpenFlow is a standardized northbound API protocol.

Northbound APIs use the NETCONF protocol to communicate with applications.

Northbound APIs form the interface between the SDN controller and the network switches or routers.

What are two functions of TAXII in threat intelligence sharing? (Choose two.)

determines how threat intelligence information is relayed

determines the "what" of threat intelligence

allows users to describe threat motivations and abilities

exchanges trusted anomaly intelligence information

determines how threat intelligence information is relayed

A network engineer must migrate a Cisco WSA virtual appliance from one physical host to another physical host by using VMware vMotion. What is a requirement for both physical hosts?

The hosts must have access to the same defined network.

The hosts must run Cisco AsyncOS 10.0 or greater.

The hosts must run different versions of Cisco AsyncOS.

The hosts must have access to the same defined network.

The hosts must use a different datastore than the virtual appliance.

What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?

Cisco AMP for Endpoints prevents, detects, and responds to attacks before and against Internet threats.

Cisco AMP for Endpoints is a cloud-based service, and Cisco Umbrella is not.

Cisco AMP for Endpoints prevents connections to malicious destinations, and C malware.

Cisco AMP for Endpoints automatically researches indicators of compromise ..

Cisco AMP for Endpoints prevents, detects, and responds to attacks before and against Internet threats.

What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

lf four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.

After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL

After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL1

If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

What are two functionalities of northbound and southbound APIs within Cisco SDN architecture?(Choose two.)

Northbound APIs utilize RESTful API methods such as GET, POST, and DELETE.

Southbound APIs utilize CLI, SNMP, and RESTCONF.

Southbound APIs are used to define how SDN controllers integrate with applications.

Southbound interfaces utilize device configurations such as VLANs and IP addresses.

Northbound APIs utilize RESTful API methods such as GET, POST, and DELETE.

Southbound APIs utilize CLI, SNMP, and RESTCONF.

Northbound interfaces utilize OpenFlow and OpFlex to integrate with network devices.

Which configuration item makes it possible to have the AAA session on the network?

aaa authorization network default group ise

aaa authentication login console ise

aaa authentication enable default enable

aaa authorization network default group ise

aaa authorization exec default ise

Cisco 350-701 Practice Test 9 - Free Online Exam Prep & Questions

An organization wants to implement a cloud-delivered and SaaS-based solution to provide visibility and threat detection across the AWS network. The solution must be deployed without software agents and rely on AWS VPC flow logs instead. Which solution meets these requirements?

Become a Premium Member for full access

Unlock Premium Member

Cisco 350-701 Practice Test 9

Question

Cisco 350-701 Practice Tests

Practice Tests