350-701 practice questions 171–180

1. Question 171 · 654 in bank

   What does Cisco AMP for Endpoints use to help an organization detect different families of malware?

   • ATetra Engine to detect malware when the endpoint is connected to the cloud
   • BClamAV Engine to perform email scanning
   • CSpero Engine with machine learning to perform dynamic analysis
   • DEthos Engine to perform fuzzy fingerprinting

   Show answer

   Answer: D

   Explanation

   It should be Ethos Spero: A machine-learning based technology that proactively identifies threats that were previously unknown. Uses active heuristics to gather execution attributes Needs good data in large sets to tune Built to identify new malware Ethos: A generic signature capability, again ostensibly similar to the generic detection capabilities that some vendors provide. Directed at families of malware Can have more false-positives than 1-to-1 signatures

   Source: Adapted from community discussion — Ampersand

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 172 · 654 in bank

   What is a benefit of conducting device compliance checks?

   • AIt validates if anti-virus software is installed.
   • BIt scans endpoints to determine if malicious activity is taking place.
   • CIt indicates what type of operating system is connecting to the network.
   • DIt detects email phishing attacks.

   Show answer

   Answer: A

   Explanation

   Based on https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_compliance.html?bookSearch=true#id_17065 It helps AnyConnect agent to support newer additions. Once the AnyConnect agents retrieve this support information, they check the latest definition information from the periodically updated se-checks.xml file (which is published along with the se-rules.xml file in the se-templates.tar.gz archive), and determine whether clients are compliant with the posture policies. Depending upon what is supported by the library for a particular antivirus, antispyware, antimalware, disk encryption, or patch management product, the appropriate requirements will be sent to the AnyConnect agents for validating their existence, and the status of the particular products on the clients during posture validation.

   Source: Adapted from community discussion — jccastiyo

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 173 · 654 in bank

   A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?

   • AContext Visibility
   • BAccounting Reports
   • CAdaptive Network Control Policy List
   • DRADIUS Live Logs

   Show answer

   Answer: D

   References

   • cisco.com documentation

   Next question

4. Question 174 · 654 in bank

   What is the role of an endpoint in protecting a user from a phishing attack?

   • AEnsure that antivirus and antimalware software is up-to-date.
   • BUse machine learning models to help identify anomalies and determine expected sending behavior.
   • CUse Cisco Stealthwatch and Cisco ISE Integration.
   • DUtilize 802.1X network security to ensure unauthorized access to resources.

   Show answer

   Answer: B

   Explanation

   It is B: Cisco Advanced Phishing Protection provides unprecedented insight into the email coming in to your organization, flowing out of your organization, and within your organization. Powered by Cisco Identity Intelligence – Cisco's unique machine learning techniques based on historical email traffic to your organization – Advanced Phishing Protection models the unique behavior of all legitimate email senders and allows you to quickly distinguish good messages from potentially bad messages. Coupled with Identity Intelligence, Cisco's platform of data – built from analyzing billions of email messages worldwide – provides you a risk overview of all messages in your organization and senders who send email into your organization.

   Source: Adapted from community discussion — coentror

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 175 · 654 in bank

   Why is it important to implement MFA inside of an organization?

   • ATo prevent brute force attacks from being successful.
   • BTo prevent phishing attacks from being successful.
   • CTo prevent DoS attacks from being successful.
   • DTo prevent man-in-the-middle attacks from being successful.

   Show answer

   Answer: A

   Explanation

   It looks A. https://www.cisco.com/c/en/us/solutions/collateral/enterprise/design-zone-security/breach-defense-design-guide.html Cisco Breach Defense Design Guide Multi-Factor Authentication (MFA) and Posture Assessment Integrating MFA (M1032) as part of *organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs. If a password is hacked, guessed, or even phished, that’s no longer enough to give an intruder access. Without approval at the second factor, a password alone is useless. Secure Access by Duo provides modern, effective MFA that helps eliminate the problem of *brute force attacks (T1110)

   Source: Adapted from community discussion — semi1750

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

6. Question 176 · 654 in bank

   Select 2

   Which two capabilities does TAXII support? (Choose two.)

   • Aexchange
   • Bpull messaging
   • Cbinding
   • Dcorrelation
   • Emitigating

   Show answer

   Answer: AB

   Explanation

   https://docs.oasis-open.org/cti/taxii/v1.1.1/taxii-v1.1.1-part1-overview.html "There are three Capabilities that the current version of TAXII supports: push messaging, pull messaging, and discovery." "Discovery does, however, allow for the automated exchange of information..." The correct answer is A and B

   Source: Adapted from community discussion — statikd

   Next question

7. Question 177 · 654 in bank

   Which posture assessment requirement provides options to the client for remediation within a certain timeframe?

   • Aaudit
   • Bmandatory
   • Cvisibility
   • Doptional

   Show answer

   Answer: B

   Explanation

   The question is specifically asking "remediation within a certain timeframe?" And as per the mentioned Link https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010111.html#ID155:~:text=Policy%20Requirement%20Types-,Mandatory%20Requirements,-During%20policy%20evaluation It is clearly stating: "During policy evaluation, the agent provides remediation options to clients who fail to meet the mandatory requirements defined in the posture policy. End users must remediate to meet the requirements within the time specified in the remediation timer settings."

   Source: Adapted from community discussion — ffaiz

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 178 · 654 in bank

   An organization configures Cisco Umbrella to be used for its DNS services. The organization must be able to block traffic based on the subnet that the endpoint is on, but sees only the requests from its public IP addresses instead of each internal IP address. What must be done to resolve this issue?

   • AInstall the Microsoft Active Directory Connector to give IP address information stitched to the requests in the Cisco Umbrella dashboard.
   • BUse the tenant control features to identify each subnet being used and track the connections within the Cisco Umbrella dashboard.
   • CConfigure an internal domain within Cisco Umbrella to help identify each address and create policy from the domains.
   • DSet up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address.

   Show answer

   Answer: D

   Explanation

   D. Set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address. When using Cisco Umbrella for DNS services, it can be challenging to track traffic based on subnets because the public IP addresses of the endpoint are seen instead of the internal IP addresses. To resolve this issue, an organization can set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address. This will allow the organization to track traffic based on the subnet that the endpoint is on and implement policies to block traffic as needed. The virtual appliance acts as a proxy that fields the requests, enabling visibility into the internal IP addresses and allowing the organization to see the full picture of its network traffic.

   Source: Adapted from community discussion — sull3y

   Next question

9. Question 179 · 654 in bank

   An engineer adds a custom detection policy to a Cisco AMP deployment and encounters issues with the configuration. The simple detection mechanism is configured, but the dashboard indicates that the hash is not 64 characters and is non-zero. What is the issue?

   • AThe hash being uploaded is part of a set in an incorrect format.
   • BThe engineer is attempting to upload a file instead of a hash.
   • CThe file being uploaded is incompatible with simple detections and must use advanced detections.
   • DThe engineer is attempting to upload a hash created using MD5 instead of SHA-256.

   Show answer

   Answer: D

   Explanation

   D. The engineer is attempting to upload a hash created using MD5 instead of SHA-256. When adding a custom detection policy to a Cisco AMP deployment, the hash being uploaded must be in the correct format. If the dashboard indicates that the hash is not 64 characters and is non-zero, it likely means that the engineer is attempting to upload a hash created using MD5 instead of SHA-256. Cisco AMP requires the use of SHA-256 hashes for custom detection policies, as this provides a higher level of security compared to other hash algorithms. If the engineer is attempting to upload a hash created using MD5, the configuration will not be accepted and the dashboard will indicate that the hash is not in the correct format.

   Source: Adapted from community discussion — sull3y

   Next question

10. Question 180 · 654 in bank

    What is the benefit of integrating Cisco ISE with a MDM solution?

    • AIt provides compliance checks for access to the network.
    • BIt provides the ability to update other applications on the mobile device.
    • CIt provides the ability to add applications to the mobile device through Cisco ISE.
    • DIt provides network device administration access.

    Show answer

    Answer: A

    Explanation

    A. It provides compliance checks for access to the network. The benefit of integrating Cisco ISE with a Mobile Device Management (MDM) solution is that it provides compliance checks for access to the network. This integration allows for the enforcement of security policies for mobile devices accessing the network. The MDM solution provides information about the device, such as its operating system version, security patch level, and any other security-related information. Cisco ISE can then use this information to determine if the device meets the organization's security policies, and either grant or deny access to the network based on the results of this compliance check. This integration helps to ensure that only compliant and secure devices are allowed access to the network, enhancing the overall security posture of the organization.

    Source: Adapted from community discussion — sull3y

    References

    • Cisco documentation
    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 171. 654 questions available.