350-701 practice questions 141–150

1. Question 141 · 654 in bank

   An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites but other sites are not accessible due to an error. Why is the error occurring?

   • AClient computers do not have an SSL certificate deployed from an internal CA server.
   • BClient computers do not have the Cisco Umbrella Root CA certificate installed.
   • CIP-Layer Enforcement is not configured.
   • DIntelligent proxy and SSL decryption is disabled in the policy.

   Show answer

   Answer: B

   Explanation

   Should be B. https://support.umbrella.com/hc/en-us/articles/115004564126-SSL-Decryption-in-the-Intelligent-Proxy Requirements and Implementation Although only SSL sites on our 'grey' list will be proxied, it's required that the root certificate be installed on the computers that are using SSL Decryption for the Intelligent Proxy in their policy. Without the root certificate, when your users go to that service, they will receive errors in the browser and the site will not be accessible. The browser, correctly, will believe the traffic is being intercepted (and proxied!) by a 'man in the middle', which is our service in this case. The traffic won't be decrypted and inspected; instead, the entire website won't be available.

   Source: Adapted from community discussion — screech

   Next question

2. Question 142 · 654 in bank

   Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

   • AFile Analysis
   • BSafeSearch
   • CSSL Decryption
   • DDestination Lists

   Show answer

   Answer: C

   Explanation

   Correct answer is C "As well, the intelligent proxy's SSL decryption feature is required in order to scan files on secure—HTTPS—sites." Source: https://docs.umbrella.com/umbrella-user-guide/docs/enable-file-analysis

   Source: Adapted from community discussion — idto

   Next question

3. Question 143 · 654 in bank

   A user has a device in the network that is receiving too many connection requests from multiple machines. Which type of attack is the device undergoing?

   • ASYN flood
   • Bslowloris
   • Cphishing
   • Dpharming

   Show answer

   Answer: A

   Explanation

   Answer is A Slowloris use a single machine to hold as many connections, The question is asking multi machine https://en.wikipedia.org/wiki/Slowloris_(computer_security)

   Source: Adapted from community discussion — pohqinan

   Next question

4. Question 144 · 654 in bank

   When web policies are configured in Cisco Umbrella, what provides the ability to ensure that domains are blocked when they host malware, command and control, phishing, and more threats?

   • AApplication Control
   • BSecurity Category Blocking
   • CContent Category Blocking
   • DFile Analysis

   Show answer

   Answer: B

   Explanation

   Reference: https://support.umbrella.com/hc/en-us/articles/115004563666-Understanding-Security-Categories

   Source: Adapted from community discussion — abdulmalik_mail

   Next question

5. Question 145 · 654 in bank

   How is Cisco Umbrella configured to log only security events?

   • Aper policy
   • Bin the Reporting settings
   • Cin the Security Settings section
   • Dper network in the Deployments section

   Show answer

   Answer: A

   Explanation

   Reference: https://docs.umbrella.com/deployment-umbrella/docs/log-management

   Next question

6. Question 146 · 654 in bank

   Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

   • ACisco AMP
   • BCisco AnyConnect
   • CCisco Dynamic DNS
   • DCisco Talos

   Show answer

   Answer: D

   Next question

7. Question 147 · 654 in bank

   Select 2

   What are two list types within Cisco AMP for Endpoints Outbreak Control? (Choose two.)

   • Ablocked ports
   • Bsimple custom detections
   • Ccommand and control
   • Dallowed applications
   • EURL

   Show answer

   Answer: BD

   Explanation

   Reference: https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf chapter 2

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 148 · 654 in bank

   Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

   • Acorrelation
   • Bintrusion
   • Caccess control
   • Dnetwork discovery

   Show answer

   Answer: D

   Next question

9. Question 149 · 654 in bank

   Select 2

   For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two.)

   • Acomputer identity
   • BWindows service
   • Cuser identity
   • DWindows firewall
   • Edefault browser

   Show answer

   Answer: BD

   Explanation

   Specifically: Table 2. Posture Assessment Options - Windows Service status/config can be assessed, Windows Firewall can be assessed by assessing the registry entry.

   Source: Adapted from community discussion — bigdadzzz

   References

   • Cisco documentation

   Next question

10. Question 150 · 654 in bank

    Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the deployment?

    • ANGFW
    • BAMP
    • CWSA
    • DESA

    Show answer

    Answer: B

    Explanation

    Cisco Advanced Malware Protection (AMP) for Endpoints is a cloud-managed endpoint security solution that provides advanced protection against viruses, malware, and other cyber-threats by detecting, preventing, and responding to threats.

    Source: Adapted from community discussion — Ferdaush

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 141. 654 questions available.