350-701 practice questions 121–130

1. Question 121 · 654 in bank

   How does DNS Tunneling exfiltrate data?

   • AAn attacker registers a domain that a client connects to based on DNS records and sends malware through that connection.
   • BAn attacker opens a reverse DNS shell to get into the client's system and install malware on it.
   • CAn attacker sends an email to the target with hidden DNS resolvers in it to redirect them to a malicious domain.
   • DAn attacker uses a non-standard DNS port to gain access to the organization's DNS servers in order to poison the resolutions.

   Show answer

   Answer: A

   Explanation

   Correct Answer A The attacker registers a domain, such as badsite.com. The domain’s name server points to the attacker’s server, where a tunneling malware program is installed. The attacker infects a computer, which often sits behind a company’s firewall, with malware. Because DNS requests are always allowed to move in and out of the firewall, the infected computer is allowed to send a query to the DNS resolver. The DNS resolver is a server that relays requests for IP addresses to root and top-level domain servers. The DNS resolver routes the query to the attacker’s command-and-control server, where the tunneling program is installed. A connection is now established between the victim and the attacker through the DNS resolver. This tunnel can be used to exfiltrate data or for other malicious purposes. Because there is no direct connection between the attacker and victim, it is more difficult to trace the attacker’s computer.

   Source: Adapted from community discussion — Alee86

   Next question

2. Question 122 · 654 in bank

   A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?

   • AThe policy was created to send a message to quarantine instead of drop.
   • BThe file has a reputation score that is below the threshold.
   • CThe file has a reputation score that is above the threshold.
   • DThe policy was created to disable file analysis.

   Show answer

   Answer: B

   Explanation

   I found B a possibility Quarantine is only for unrecognised files. When file is undetermined, reputation score is checked. Reputation 1-59: Deliver file / Reputation 60-100: Block file So B looks correct. Look at - Figure 1. Advanced Malware Protection Workflow for Public-Cloud File Analysis Deployments https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010000.html

   Source: Adapted from community discussion — Dinges

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 123 · 654 in bank

   An organization has a Cisco ESA set up with DLP policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation. Which actions must be performed in order to provide this capability?

   • Adeliver and add disclaimer text
   • Bquarantine and send a DLP violation notification
   • Cquarantine and alter the subject header with a DLP violation
   • Ddeliver and send copies to other recipients

   Show answer

   Answer: A

   Explanation

   as per https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/216086-best-practice-guide-for-data-loss-preven.html Primary actions include: Deliver Drop Quarantine For a read-only state where DLP violations are logged and reported but the messages are not stopped/quarantined or encrypted, the Deliver action is most often used. Secondary actions include: Sending a copy to any custom quarantine or the ‘Policy’ quarantine. Encrypt the message. The appliance only encrypts the message body. It does not encrypt the message headers. Altering the Subject header. Adding disclaimer text/HTML to the message. Sending the message to an alternate destination mailhost. Sending bcc copies of the message. Sending DLP violation notification to the sender and/or other contacts.

   Source: Adapted from community discussion — jienBoq

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 124 · 654 in bank

   Select 2

   A Cisco ESA administrator has been tasked with configuring the Cisco ESA to ensure there are no viruses before quarantined emails are delivered. In addition, delivery of mail from known bad mail servers must be prevented. Which two actions must be taken in order to meet these requirements? (Choose two.)

   • ADeploy the Cisco ESA in the DMZ.
   • BUse outbreak filters from SenderBase.
   • CConfigure a recipient access table.
   • DEnable a message tracking service.
   • EScan quarantined emails using AntiVirus signatures.

   Show answer

   Answer: BE

   Explanation

   Cisco ESA uses a multilayer approach to fight viruses and malware: • The first layer of defense consists of outbreak filters, which the appliance downloads from Cisco SenderBase. They contain a list of known bad mail servers. These filters are generated by watching global email traffic patterns and looking for anomalies associated with an outbreak. When an email is received from a server on this list, it is kept in quarantine until the antivirus signatures are updated to counter the current threat. • The second layer of defense is using antivirus signatures to scan quarantined emails, to ensure that they do not carry viruses into the network. • Cisco ESA also scans outbound emails to provide antivirus protection.

   Source: Adapted from community discussion — ff001

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 125 · 654 in bank

   An organization has noticed an increase in malicious content downloads and wants to use Cisco Umbrella to prevent this activity for suspicious domains while allowing normal web traffic. Which action will accomplish this task?

   • AUse destination block lists.
   • BConfigure application block lists.
   • CConfigure the intelligent proxy.
   • DSet content settings to High.

   Show answer

   Answer: C

   Explanation

   C. Configure the intelligent proxy. Cisco Umbrella's intelligent proxy allows you to enforce security policies for web traffic based on various criteria, such as destination domain, IP address, or URL category. To prevent malicious content downloads, the organization can configure the intelligent proxy to block access to suspicious domains, while allowing normal web traffic. This can be done by creating a security policy that specifies which domains should be blocked and which should be allowed. Note: The intelligent proxy is a feature in Cisco Umbrella that can be used to enforce security policies for web traffic. Other Umbrella features, such as destination block lists and application block lists, can also be used to prevent malicious activity. However, the intelligent proxy is the best option for this specific task, as it allows you to enforce security policies based on domain, IP, or URL category

   Source: Adapted from community discussion — sull3y

   Next question

6. Question 126 · 654 in bank

   Which attack is preventable by Cisco ESA but not by the Cisco WSA?

   • ASQL injection
   • Bphishing
   • Cbuffer overflow
   • DDoS

   Show answer

   Answer: B

   Explanation

   but also B. Phishing Cisco ESA (Email Security Appliance) and Cisco WSA (Web Security Appliance) are both security products that provide protection against a variety of network-based threats. However, ESA is designed specifically to protect against email-based threats such as spam, phishing and malware, while WSA is designed to protect against web-based threats such as SQL injection, buffer overflow, and DoS attacks. So, Cisco ESA can prevent phishing but Cisco WSA can't.

   Source: Adapted from community discussion — ddev3737

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 127 · 654 in bank

   An organization recently installed a Cisco WSA and would like to take advantage of the AVC engine to allow the organization to create a policy to control application specific activity. After enabling the AVC engine, what must be done to implement this?

   • AUse security services to configure the traffic monitor.
   • BUse URL categorization to prevent the application traffic.
   • CUse an access policy group to configure application control settings.
   • DUse web security reporting to validate engine functionality.

   Show answer

   Answer: C

   Explanation

   C. Use an access policy group to configure application control settings. The Application Visibility and Control (AVC) engine in Cisco Web Security Appliance (WSA) allows you to control application specific activity by creating policies based on the type of traffic. To implement this, you must use an access policy group to configure the application control settings. An access policy group defines the set of security rules that the WSA applies to incoming web traffic. The AVC engine in the WSA allows you to categorize applications based on the type of traffic they generate, and then create policies that control how that traffic is handled. This can include allowing or blocking specific applications, controlling the bandwidth used by applications, and setting limits on the amount of data that can be downloaded.

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation

   Next question

8. Question 128 · 654 in bank

   What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?

   • Ato establish secure VPN connectivity to the corporate network
   • Bto enforce posture compliance and mandatory software
   • Cto ensure that assets are secure from malicious links on and off the corporate network
   • Dto protect the endpoint against malicious file transfers

   Show answer

   Answer: C

   Explanation

   C Umbrella Roaming is a cloud-delivered security service for Cisco's next-generation firewall. It protects your employees even when they are off the VPN. No additional agents are required. Simply enable the Umbrella functionality in the Cisco AnyConnect client. You’ll get seamless protection against malware, phishing, and command-and-control callbacks wherever your users go.

   Source: Adapted from community discussion — Steve122

   Next question

9. Question 129 · 654 in bank

   An administrator configures a Cisco WSA to receive redirected traffic over ports 80 and 443. The organization requires that a network device with specific WSA integration capabilities be configured to send the traffic to the WSA to proxy the requests and increase visibility, while making this invisible to the users. What must be done on the Cisco WSA to support these requirements?

   • AUse PAC keys to allow only the required network devices to send the traffic to the Cisco WSA.
   • BConfigure transparent traffic redirection using WCCP in the Cisco WSA and on the network device.
   • CConfigure active traffic redirection using WPAD in the Cisco WSA and on the network device.
   • DUse the Layer 4 setting in the Cisco WSA to receive explicit forward requests from the network device.

   Show answer

   Answer: B

   Next question

10. Question 130 · 654 in bank

    An administrator configures a new destination list in Cisco Umbrella so that the organization can block specific domains for its devices. What should be done to ensure that all subdomains of domain.com are blocked?

    • AConfigure the domain.com address in the block list.
    • BConfigure the *.domain.com address in the block list.
    • CConfigure the *.com address in the block list.
    • DConfigure the *domain.com address in the block list.

    Show answer

    Answer: A

    Explanation

    it is actually A -> https://docs.umbrella.com/deployment-umbrella/docs/wild-cards "Every domain in a block or allow destination list has an implied left side and right side wildcard"

    Source: Adapted from community discussion — zeroC00L

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 121. 654 questions available.