350-701 practice questions 131–140

1. Question 131 · 654 in bank

   An organization wants to use Cisco FTD or Cisco ASA devices. Specific URLs must be blocked from being accessed via the firewall, which requires that the administrator input the bad URL categories that the organization wants blocked into the access policy. Which solution should be used to meet this requirement?

   • ACisco FTD because it enables URL filtering and blocks malicious URLs by default, whereas Cisco ASA does not.
   • BCisco ASA because it enables URL filtering and blocks malicious URLs by default, whereas Cisco FTD does not.
   • CCisco ASA because it includes URL filtering in the access control policy capabilities, whereas Cisco FTD does not.
   • DCisco FTD because it includes URL filtering in the access control policy capabilities, whereas Cisco ASA does not.

   Show answer

   Answer: D

   Explanation

   Agree with @janzeleny, correct answer is D, I noticed @john_thomas comments on a lot of the questions but normally gives wrong answers with no explanations. Be careful following his suggestions guys. Just a friendly PSA.

   Source: Adapted from community discussion — lurker8000

   References

   • Cisco documentation

   Next question

2. Question 132 · 654 in bank

   An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system's applications. Which vulnerability allows the attacker to see the passwords being transmitted in clear text?

   • Aunencrypted links for traffic
   • Bweak passwords for authentication
   • Cimproper file security
   • Dsoftware bugs on applications

   Show answer

   Answer: A

   Next question

3. Question 133 · 654 in bank

   Which component of Cisco Umbrella architecture increases reliability of the service?

   • ABGP route reflector
   • Banycast IP
   • CAMP Threat Grid
   • DCisco Talos

   Show answer

   Answer: B

   Explanation

   Anycast would increase the resiliency of the product. Reliability and resiliency are different. With Cisco Talos, the reliability of Cisco Umbrella threat detection is increased.

   Source: Adapted from community discussion — Rabyn

   References

   • cisco.com documentation

   Next question

4. Question 134 · 654 in bank

   A customer has various external HTTP resources available including Intranet, Extranet, and Internet, with a proxy configuration running in explicit mode. Which method allows the client desktop browsers to be configured to select when to connect direct or when to use proxy?

   • ABridge mode
   • BTransparent mode
   • C.PAC file
   • DForward file

   Show answer

   Answer: C

   Explanation

   Answer is C A Proxy Auto-Configuration (PAC) file contains a set of rules coded in JavaScript which allows a web browser to determine whether to send web traffic direct to the Internet or be sent via a proxy server. PAC files can control how a web browser handles HTTP, HTTPS, and FTP traffic http://findproxyforurl.com/pac-file-introduction/

   Source: Adapted from community discussion — Jayde

   Next question

5. Question 135 · 654 in bank

   What is a benefit of using Cisco CWS compared to an on-premises Cisco WSA?

   • AContent scanning for SAAS cloud applications is available through Cisco CWS and not available through Cisco WSA.
   • BURL categories are updated more frequently on Cisco CWS than they are on Cisco WSA.
   • CCisco CWS minimizes the load on the internal network and security infrastructure as compared to Cisco WSA.
   • DCisco CWS eliminates the need to backhaul traffic through headquarters for remote workers whereas Cisco WSA does not.

   Show answer

   Answer: D

   Explanation

   Reference: https://www.cisco.com/c/en/us/products/collateral/security/web-security-appliance/guide-c07-742373.html

   Source: Adapted from community discussion — Rododendron2

   References

   • Cisco documentation

   Next question

6. Question 136 · 654 in bank

   An engineer needs to add protection for data in transit and have headers in the email message. Which configuration is needed to accomplish this goal?

   • ADeploy an encryption appliance.
   • BProvision the email appliance.
   • CMap sender IP addresses to a host interface.
   • DEnable flagged message handling.

   Show answer

   Answer: A

   Explanation

   B. Provision the email appliance Provisioning the email appliance, also known as an Email Security Gateway or Email Security Appliance, is a solution for protecting data in transit and adding headers to email messages. The email appliance acts as a security layer between the email servers and the Internet, and provides a range of security features such as encryption, anti-virus, anti-spam, and content filtering. These features help to ensure that emails are transmitted securely, and help to prevent unauthorized access to sensitive information. By provisioning the email appliance, the engineer can add protection for data in transit and have headers in the email message.

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 137 · 654 in bank

   Which Cisco platform processes behavior baselines, monitors for deviations, and reviews for malicious processes in data center traffic and servers while performing software vulnerability detection?

   • ACisco Tetration
   • BCisco ISE
   • CCisco AnyConnect
   • DCisco AMP for Network

   Show answer

   Answer: A

   Explanation

   Cisco Secure Workload (formerly Tetration) seamlessly delivers a zero-trust approach to securing your application workloads across any cloud and on-premises data center environments by reducing the attack surface, preventing lateral movement, identifying workload behavior anomalies, and remediating threats quickly.

   Source: Adapted from community discussion — Felice44

   References

   • Cisco documentation

   Next question

8. Question 138 · 654 in bank

   A network engineer must configure a Cisco ESA to prompt users to enter two forms of information before gaining access. The Cisco ESA must also join a cluster machine using preshared keys. What must be configured to meet these requirements?

   • AEnable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA GUI.
   • BEnable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA CLI.
   • CEnable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA GUI.
   • DEnable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA CLI.

   Show answer

   Answer: D

   Explanation

   Document Updated on March6, 2023 https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200885-ESA-Cluster-Requirements-and-Setup.html Cluster configuration options must be done via the CLI on the ESA and cannot be created or joined in the GUI. Note: If you run the PREPJOIN option, you need to commit your changes to the primary ESA before you run clusterconfig on the secondary ESA and join that appliance to your newly configured cluster. This is noted from the output throughout the operation: to join this appliance to a cluster with pre-shared keys, log in to the cluster machine, run the clusterconfig > prepjoin > new command , enter the next details, and commit your changes. So I believe it is D

   Source: Adapted from community discussion — Toni_Su91

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 139 · 654 in bank

   

   Refer to the exhibit. How does Cisco Umbrella manage traffic that is directed toward risky domains?

   • ATraffic is managed by the application settings, unhandled and allowed.
   • BTraffic is managed by the security settings and blocked.
   • CTraffic is proxied through the intelligent proxy.
   • DTraffic is allowed but logged.

   Show answer

   Answer: B

   Explanation

   Output clearly shows that risky domains (C&C, Malware, Phishing) will be blocked by "Security Settings". Intelligent Proxy (answer C) is configured under the "Advanced settings", which is not visible on the output.

   Source: Adapted from community discussion — PiX2

   Next question

10. Question 140 · 654 in bank

    An organization wants to improve its cybersecurity processes and to add intelligence to its data. The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA. What must be done to accomplish these objectives?

    • AConfigure the integrations with Talos intelligence to take advantage of the threat intelligence that it provides.
    • BDownload the threat intelligence feed from the IETF and import it into the Cisco FTD and Cisco WSA databases.
    • CCreate an automated download of the Internet Storm Center intelligence feed into the Cisco FTD and Cisco WSA databases to tie to the dynamic access control policies.
    • DCreate a Cisco pxGrid connection to NIST to import this information into the security products for policy use.

    Show answer

    Answer: A

    Explanation

    I also agree its A I think the point here is current intelligence that can be ingested into FTD and WSA we know that FMC can use talos AND/OR 3rd party feeds.. (and then push the data to FTD) I found a post somewhere (wish i could find it) that stated FDM can only use talos also if you read up on how WSA gets its intelligence data, it states talos and i cannot find anything that says it can get 3rd party feeds - if these are both true then answer is not B NOR C as they can only use talos..

    Source: Adapted from community discussion — iluvmicrosoft

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 131. 654 questions available.