350-701 practice questions 151–160

1. Question 151 · 654 in bank

   Select 2

   Which two endpoint measures are used to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two.)

   • APatch for cross-site scripting.
   • BPerform backups to the private cloud.
   • CProtect against input validation and character escapes in the endpoint.
   • DInstall a spam and virus email filter.
   • EProtect systems with an up-to-date antimalware program.

   Show answer

   Answer: DE

   Explanation

   https://us-cert.cisa.gov/ncas/tips/ST04-014 How do you avoid being a victim? "Install and maintain anti-virus software, firewalls, and email filters to reduce some of this traffic. (See Understanding Firewalls for Home and Small Office Use, Protecting Against Malicious Code, and Reducing Spam for more information.) " "Less correct" answers than D/E A - Indirectly, yes. B - Defence against Ransomware C - Defence against SQLi

   Source: Adapted from community discussion — bigdadzzz

   Next question

2. Question 152 · 654 in bank

   Select 2

   An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransomware infection? (Choose two.)

   • AConfigure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.
   • BSet up a profiling policy in Cisco Identity Services Engine to check an endpoint patch level before allowing access on the network.
   • CConfigure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network.
   • DConfigure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.
   • ESet up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.

   Show answer

   Answer: AC

   Explanation

   I'm struggling to find a good link on this, but seems to me that ISE will not patch an endpoint by himself, instead it relies on WSUS for this. So, A is probably incorect, and the right answer is CE. Anyone else?

   Source: Adapted from community discussion — Sorel

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

3. Question 153 · 654 in bank

   What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

   • AEPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.
   • BEDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter defenses.
   • CEPP focuses on network security, and EDR focuses on device security.
   • DEDR focuses on network security, and EPP focuses on device security.

   Show answer

   Answer: A

   References

   • cisco.com documentation

   Next question

4. Question 154 · 654 in bank

   An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak control method is used to accomplish this task?

   • Adevice flow correlation
   • Bsimple detections
   • Capplication blocking list
   • Dadvanced custom detections

   Show answer

   Answer: C

   Explanation

   I thought it's B like some guys said, but it's C for sure... From AMP for Endpoints User Guide, chapter 2: Outbreak Control: An application blocking list is composed of files that you do not want to allow users to execute but do not want to quarantine. You may want to use this for files you are not sure are malware, unauthorized applications, or you may want to use this to stop applications with vulnerabilities from executing until a patch has been released. B also is incorrect, because it says "simple detections" but actually it's called simple custom detections (like in answer D, but it's another function which allows the customer to write his own antivirus definitions...). I am 100% sure it's an answer C here :)

   Source: Adapted from community discussion — klu16

   Next question

5. Question 155 · 654 in bank

   Select 2

   Which two preventive measures are used to control cross-site scripting? (Choose two.)

   • AEnable client-side scripts on a per-domain basis.
   • BIncorporate contextual output encoding/escaping.
   • CDisable cookie inspection in the HTML inspection engine.
   • DRun untrusted HTML input through an HTML sanitization engine.
   • ESameSite cookie attribute should not be used.

   Show answer

   Answer: BD

   Explanation

   ABD are all valid options. They request only two, so if we need to pick only the better options, we should choose BD: While disabling scripts in general and enabling them on a per-doman basis, it does have some drawbacks for functionality. Users would be forced to enable scripting to have the site fully functional, which would make the user vulnerable to XXS attack again. Selectively disabling scripts is a good alternative, but is not in the question list of answers. That makes BD the better answer. From https://en.wikipedia.org/wiki/Cross-site_scripting: -The most significant problem with blocking all scripts on all websites by default is substantial reduction in functionality andresponsiveness . Another problem with script blocking is that many users do not understand it, and do not know how to properly secure their browsers. Yet another drawback is that many sites do not work without client-side scripting, forcing users to disable protection for that site and opening their systems to vulnerabilities.

   Source: Adapted from community discussion — Dinges

   Next question

6. Question 156 · 654 in bank

   An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE. Which CoA type achieves this goal?

   • APort Bounce
   • BCoA Terminate
   • CCoA Reauth
   • DCoA Session Query

   Show answer

   Answer: C

   Explanation

   C is correct: "CoA Session Reauthenticate Command To initiate session authentication, the AAA server sends a standard CoA-Request message containing the following VSAs: Cisco:Avpair=“subscriber:command=reauthenticate” ... The following rules apply: • “subscriber:command=reauthenticate” must be present to trigger a reauthentication. • If “subscriber:reauthenticate-type” is not specified, the default behavior is to rerun the last successful authentication method for the session. If the method reauthenticates successfully, all old authorization data is replaced with the new reauthenticated authorization data" A - Bounce = session disrupted by disabling & enabling port B - Terminate = session discarded D - Session Query = ISE getting info about auth. session "CoA Session Query Command The CoA session query command requests service information about a subscriber session" Source: https://www.cisco.com/en/US/docs/ios-xml/ios/san/configuration/xe-3se/3850/san-coa-supp.pdf

   Source: Adapted from community discussion — NikoNiko

   References

   • Cisco documentation

   Next question

7. Question 157 · 654 in bank

   Select 2

   Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two.)

   • Amalware
   • Bdenial-of-service attacks
   • CARP spoofing
   • Dexploits
   • Eeavesdropping

   Show answer

   Answer: AD

   Explanation

   D (Exploits) for sure. B (DDoS) would be suitable if the questions was about servers but since it is about endpoints, I would go with A&D.

   Source: Adapted from community discussion — dr4gn00t

   Next question

8. Question 158 · 654 in bank

   Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

   • AIt adds endpoints to identity groups dynamically
   • BIt allows the endpoint to authenticate with 802.1x or MAB
   • CIt allows CoA to be applied if the endpoint status is compliant
   • DIt verifies that the endpoint has the latest Microsoft security patches installed

   Show answer

   Answer: D

   Explanation

   Answer should be C https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html step 3. Posture assessment happens. step 4. Session marked as Compliant. step 5. Change of Authorization (COA) triggered by posture status change leads to re-authentication of the endpoint to apply the next access level.

   Source: Adapted from community discussion — MoII

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 159 · 654 in bank

   An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which probe must be enabled for this type of profiling to work?

   • ASNMP
   • BNMAP
   • CDHCP
   • DNetFlow

   Show answer

   Answer: C

   Explanation

   The answer is C, through DHCP Profiling. The OUI is part of the MAC address, which can be learned from the dhcp-client-identifier option 61.

   Source: Adapted from community discussion — Jeeves69

   References

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

10. Question 160 · 654 in bank

    What is the benefit of installing Cisco AMP for Endpoints on a network?

    • AIt enables behavioral analysis to be used for the endpoints
    • BIt provides flow-based visibility for the endpoints' network connections.
    • CIt protects endpoint systems through application control and real-time scanning.
    • DIt provides operating system patches on the endpoints for security.

    Show answer

    Answer: A

    Explanation

    I use AMP for many years Like partner. But now I have this questions Obviously its A Or C. A Behavioral analysis its an amazing plus which this EDR doing. C Real time and App block : This is something which all the antivirus or EPP use. Im confused here because AMP can do the both but which answer is the more accurate answer. How I hate this CISCO EXAMS, never have a good sense to make a real question and not a stupid tricky question like this... let me know guys what you think about it

    Source: Adapted from community discussion — jaciro11

    References

    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 151. 654 questions available.