350-901 practice questions 61–70

1. Question 61 · 385 in bank

   Select 2

   Which two actions must be taken when an observable microservice application is developed? (Choose two.)

   • AKnow the state of a single instance of a single service.
   • BPlace ג€try/exceptג€ statement in code.
   • CPlace log statements in the code.
   • DUse distributed tracing techniques.
   • EDeploy microservice to multiple datacenters.

   Show answer

   Answer: CD

   Explanation

   C and D are correct: Observability has three pillars (Logging, Metrics, and Tracing) or telemetry types that you, as application developer or designer, need to take into consideration: Logging: Logging tracks events and their timestamps. Logs and log types are also important. Metrics or time-series metrics: These metrics can simply be defined as system performance parameters (or application health measures) and are usually measured within a unit in time. As mentioned in “Latency and Rate Limiting in Application Design and Performance,” response time, sessions per second, transactions per second—all are examples of metrics. Tracing: Tracing is the ability to track multiple events or a series of distributed events through a system.

   Source: Adapted from community discussion — designated

   Next question

2. Question 62 · 385 in bank

   Select 2

   Which two countermeasures help reduce the risk of playback attacks? (Choose two.)

   • AStore data in a NoSQL database.
   • BImplement message authentication (HMAC).
   • CEnable end-to-end encryption.
   • DRemove stack traces from errors.
   • EUse short-lived access tokens.

   Show answer

   Answer: BE

   Explanation

   I like C & E. HMAC or encryption by itself do not provide playback protection. You need a timestamp in the data (see JWT). Usually encryption as in HTTPS instead of HTTP handles palyback protection as well.

   Source: Adapted from community discussion — kayleen

   Next question

3. Question 63 · 385 in bank

   Which type of file is created from issued intermediate, root, and primary certificates for SSL installation on a server?

   • ADER
   • BCSR
   • CPEM
   • DCRT

   Show answer

   Answer: C

   Explanation

   ‘C. PEM’ is correct SSL .pem files (concatenated certificate container files), are frequently required for certificate installations when multiple certificates are being imported as one file.

   Source: Adapted from community discussion — FR99

   Next question

4. Question 64 · 385 in bank

   DRAG DROP -

   

   Refer to the exhibit. Drag and drop the code snippets from the left onto the item numbers on the right that match the missing sections in the curl exhibit to complete the cURL request to FirePower Device Manager API to create objects. Not all code snippets are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • cisco.com documentation

   

   Next question

5. Question 65 · 385 in bank

   Select 2

   Which two statements describe advantages of static code analysis over unit tests? (Choose two.)

   • AIt checks for potential tainted data where input is not checked.
   • BIt enforces proper coding standards and style.
   • CIt performs a quick analysis of whether tests will pass or fail when run.
   • DIt checks for race conditions in threaded applications.
   • EIt estimates the performance of the code when run.

   Show answer

   Answer: AB

   Explanation

   It's A and B. "Taint sources are locations in the program where data is being read from a potentially risky source, and include things like environment variables, data, files, file metadata" This is something that we look at during static code analysis along with proper coding style and standards.

   Source: Adapted from community discussion — Bloody_sausage

   Next question

6. Question 66 · 385 in bank

   

   Refer to the exhibit. Which additional line results in the output of Test 1 upon execution of the docker run --rm devnet 1 command in a Dockerfile with this content?

   • ACMD [ג€/bin/echoג€, ג€Test1ג€]
   • BRUN [ג€/bin/echoג€, ג€Test1ג€]
   • CENTRYPOINT [ג€/bin/echoג€, ג€Test1ג€]
   • DCMD [ג€/bin/echo Test1ג€]

   Show answer

   Answer: C

   Explanation

   C is correct since the last line will disable the bash: Command line arguments to docker run will be appended after all elements in an exec form ENTRYPOINT, and will override all elements specified using CMD. This allows arguments to be passed to the entry point, i.e., docker run -d will pass the -d argument to the entry point. You can override the ENTRYPOINT instruction using the docker run --entrypoint flag. The shell form prevents any CMD or run command line arguments from being used, but has the disadvantage that your ENTRYPOINT will be started as a subcommand of /bin/sh -c, which does not pass signals. This means that the executable will not be the container’s PID 1 - and will not receive Unix signals - so your executable will not receive a SIGTERM from docker stop . Only the last ENTRYPOINT instruction in the Dockerfile will have an effect. https://docs.docker.com/engine/reference/builder/#entrypoint

   Source: Adapted from community discussion — designated

   Next question

7. Question 67 · 385 in bank

   Select 2

   Which two techniques protect against injection attacks? (Choose two.)

   • Ainput validation
   • Btrim whitespace
   • Climit text areas to 255 characters
   • Dstring escaping of user free text and data entry
   • Eonly use dropdown, checkbox, and radio button fields

   Show answer

   Answer: AD

   Explanation

   A and D Elimination: B. Trim whitespace > whitespace is not the issue with injection attacks C. limit text areas to 255 characters > You could perform an injection with less than 255 characters. E. only use dropdown, checkbox, and radio button fields > This is client side code that prevents users to inject via a browser, but does not prevent a scripted attack.

   Source: Adapted from community discussion — psyborg

   Next question

8. Question 68 · 385 in bank

   

   Refer to the exhibit. A kubeconfig file to manage access to clusters is provided. How many clusters are defined and which of them are accessed using username/password authentication versus certificate?

   • Atwo clusters; scratch
   • Bthree clusters; scratch
   • Cthree clusters; development
   • Dtwo clusters; development

   Show answer

   Answer: A

   Explanation

   I agree. Answer is A. Two Clusters are defined: Development and Scratch. The Scratch Cluster is set to use a username and password.

   Source: Adapted from community discussion — blezzzo

   References

   • Kubernetes documentation

   Next question

9. Question 69 · 385 in bank

   DRAG DROP - Drag and drop the characteristics from the left onto the correct data processing techniques on the right, in the context of GDPR. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Data anonymization: - cannot be re-identified - data stripped of sufficient.... Data pseudonymization: - can be re-identified - process of personal data in such....

   Source: Adapted from community discussion — duracell

   

   Next question

10. Question 70 · 385 in bank

    Select 2

    Which two strategies are used to protect personally identifiable information? (Choose two.)

    • AEncrypt data in transit.
    • BEncrypt hash values of data.
    • CEncrypt data at rest.
    • DOnly hash usernames and passwords for efficient lookup.
    • EOnly encrypt usernames and passwords for efficient lookup.

    Show answer

    Answer: AC

    Explanation

    GDPR demands that stored data undergo either an anonymization or a pseudonymization (deidentification) process. In both cases, PII data is removed; however, anonymization irreversibly destroys any way of identifying the data subject, whereas pseudonymization substitutes the identity of the data subject in such a way that with some additional information it is possible to re-identify the data subject. In other words, with pseudonymization, some unique ID is still present, but it’s not personally identifiable. Pseudonymization is less secure, as it allows re-identification either as a result of some authority’s request or due to advanced analytics (for example, from knowing that same person went to certain places, it is possible to deduce who he/she is). Encryption, integrity, and nonrepudiation technologies are used to protect data confidentiality and reliability. Data protection can be divided into data-at-rest and data-in-transit protection. Source: Cisco DEVCOR 350-901 Study Guide

    Source: Adapted from community discussion — ferock

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-901 practice, question 61. 385 questions available.