Cisco 350-701 Practice Test - Questions Answers, Page 10
Question list
List of questions
Related questions
Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?
RSA SecureID
Internal Database
Active Directory
LDAP
An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17- 010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransom ware infection? (Choose two)
Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.
Set up a profiling policy in Cisco Identity Service Engine to check and endpoint patch level before allowing access on the network.
Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network.
Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.
Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.
Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node?
RADIUS Change of Authorization
device tracking
DHCP snooping
VLAN hopping
What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services?
(Choose two)
multiple factor auth
local web auth
single sign-on
central web auth
TACACS+
For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two)
Windows service
computer identity
user identity
Windows firewall
default browser
Which compliance status is shown when a configured posture policy requirement is not met?
compliant
unknown
authorized
noncompliant
Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?
It allows the endpoint to authenticate with 802.1x or MAB.
It verifies that the endpoint has the latest Microsoft security patches installed.
It adds endpoints to identity groups dynamically.
It allows CoA to be applied if the endpoint status is compliant.
Which IPS engine detects ARP spoofing?
Atomic ARP Engine
Service Generic Engine
ARP Inspection Engine
AIC Engine
What is a characteristic of Dynamic ARP Inspection?
DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.
In a typical network, make all ports as trusted except for the ports connecting to switches, which are untrusted
DAI associates a trust state with each switch.
DAI intercepts all ARP requests and responses on trusted ports only.
What is a characteristic of traffic storm control behavior?
Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.
Traffic storm control cannot determine if the packet is unicast or broadcast.
Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.
Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.
Question