350-701 practice questions 191–200

1. Question 191 · 654 in bank

   Which Cisco security solution protects remote users against phishing attacks when they are not connected to the VPN?

   • ACisco Umbrella
   • BCisco Firepower NGIPS
   • CCisco Stealthwatch
   • DCisco Firepower

   Show answer

   Answer: A

   Explanation

   Cloud-delivered security service for Cisco’s next-generation firewall Umbrella Roaming protects employees when they are off the VPN by blocking malicious domain requests and IP responses as DNS queries are resolved. By enforcing security at the DNS-layer, connections are never established and files are never downloaded. Malware will not infect laptops and command & control (C2) callbacks or phishing will not exfiltrate data over any port. Plus, you gain real-time visibility of infected laptops with C2 activity. https://www.cisco.com/c/dam/en/us/products/collateral/security/firewalls/umbrella-roaming-package.pdf

   Source: Adapted from community discussion — Kyle1776

   References

   • Cisco documentation

   Next question

2. Question 192 · 654 in bank

   What must be used to share data between multiple security products?

   • ACisco Platform Exchange Grid
   • BCisco Rapid Threat Containment
   • CCisco Stealthwatch Cloud
   • DCisco Advanced Malware Protection

   Show answer

   Answer: A

   Next question

3. Question 193 · 654 in bank

   Select 2

   Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent? (Choose two.)

   • AMessenger applications cannot be segmented with standard network controls
   • BMalware infects the messenger application on the user endpoint to send company data
   • CTraffic is encrypted, which prevents visibility on firewalls and IPS systems
   • DAn exposed API for the messaging platform is used to send large amounts of data
   • EOutgoing traffic is allowed so users can communicate with outside organizations

   Show answer

   Answer: CE

   Explanation

   Messenger protocols often use encryption to protect communication between endpoints, which makes it difficult for firewalls and IPS systems to detect and prevent data exfiltration. Additionally, since messenger applications are designed to allow outgoing traffic so users can communicate with outside organizations, it can be difficult to distinguish legitimate communications from unauthorized data exfiltration attempts.

   Source: Adapted from community discussion — achille5

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 194 · 654 in bank

   Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other third-party management tools, and prioritize application traffic?

   • ACisco Security Intelligence
   • BCisco Application Visibility and Control
   • CCisco Model Driven Telemetry
   • DCisco DNA Center

   Show answer

   Answer: B

   Explanation

   AVC Is correct https://www.cisco.com/c/en/us/products/routers/avc-control.html --- Set up an application-aware network Now you can detect every application in your network and optimize bandwidth with application-aware policies. Cisco AVC monitors application performance and troubleshoots issues that arise. It helps you deliver business-intent policies across the entire network. And it does all this without additional appliances in a simple and powerful way.

   Source: Adapted from community discussion — Anonymous983475

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

5. Question 195 · 654 in bank

   What provides visibility and awareness into what is currently occurring on the network?

   • ACMX
   • BWMI
   • CCisco Prime Infrastructure
   • DTelemetry

   Show answer

   Answer: D

   Explanation

   This is a tricky questions as there are multiple answers to it. CMX provides visibility and intelligence into wireless network. PI provides wired-wireless client visibility but PI is more for network device management and provides least amount of visibility as compared to CMX and Telemetry. If I had to pick one I would go with Telemetry. Network devices for example can push the telemetry data to a receiver and provides visibility. An example of this is Cisco Stealthwatch where the network devices sends telemetry data to Steathwatch receiver and stealthwacth can tell us from this data what IP are talking to each other, what ports are being used. How much data is being transferred etc.

   Source: Adapted from community discussion — Farman

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 196 · 654 in bank

   How is ICMP used as an exfiltration technique?

   • Aby flooding the destination host with unreachable packets
   • Bby sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address
   • Cby encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host
   • Dby overwhelming a targeted host with ICMP echo-request packets

   Show answer

   Answer: C

   Explanation

   Using ICMP packets to carry out command and control tasks on a compromised host is a common technique used in malware attacks. Malware can embed commands within the payload of ICMP packets, which are then sent to a command and control server controlled by the attacker. The server can then send responses back to the compromised host using ICMP packets, allowing the attacker to execute commands remotely without being detected. C:To make it more difficult for security personnel to detect the malicious traffic, attackers can encrypt the payload of the ICMP packets using various encryption algorithms. This makes it harder for network security devices to detect and identify the malicious traffic as it passes through the network.

   Source: Adapted from community discussion — sull3y

   Next question

7. Question 197 · 654 in bank

   

   Refer to the exhibit. An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?

   • Adot1x reauthentication
   • Bcisp enable
   • Cdot1x pae authenticator
   • Dauthentication open

   Show answer

   Answer: C

   Explanation

   How to Configure IEEE 802.1X Port-Based Authentication Enabling IEEE 802.1X Authentication and Authorization SUMMARY STEPS 1. enable 2. configure terminal 3. aaa new-model 4. aaa authentication dot1x {default | listname} method1 [method2...] 5. dot1x system-auth-control 6. identity profile default 7. interface type slot/port 8. access-session port-control {auto | force-authorized | force-unauthorized} 9. dot1x pae [supplicant | authenticator | both] ***Answer*** 10. end 11. show dot1x https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/config-ieee-802x-pba.html

   Source: Adapted from community discussion — Kyle1776

   References

   • Cisco documentation

   Next question

8. Question 198 · 654 in bank

   An engineer is configuring 802.1X authentication on Cisco switches in the network and is using CoA as a mechanism. Which port on the firewall must be opened to allow the CoA traffic to traverse the network?

   • AUDP 1700
   • BTCP 6514
   • CUDP 1812
   • DTCP 49

   Show answer

   Answer: A

   Explanation

   Session for: • RADIUS Authentication: UDP/1645, 1812 • RADIUS Accounting: UDP/1646, 1813 • RADIUS DTLS Authentication/Accounting: UDP/2083. • RADIUS Change of Authorization (CoA) Send: UDP/1700 • RADIUS Change of Authorization (CoA) Listen/Relay: UDP/1700, 3799 For CoA is UDP 1700 "A" is correct.

   Source: Adapted from community discussion — surforlife

   Next question

9. Question 199 · 654 in bank

   Which algorithm provides encryption and authentication for data plane communication?

   • AAES-GCM
   • BSHA-96
   • CAES-256
   • DSHA-384

   Show answer

   Answer: A

   Explanation

   It is A, AES-GCM can do encryption like all other AES and has an authentication tag, rest of the options can be used for encryption or authentication, but not both. In cryptography, Galois/Counter Mode (GCM) is a mode of operation for symmetric-key cryptographic block ciphers which is widely adopted for its performance. GCM throughput rates for state-of-the-art, high-speed communication channels can be achieved with inexpensive hardware resources.[1] The operation is an authenticated encryption algorithm designed to provide both data authenticity (integrity) and confidentiality. https://en.wikipedia.org/wiki/Galois/Counter_Mode

   Source: Adapted from community discussion — Kris92

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

10. Question 200 · 654 in bank

    Select 2

    What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two.)

    • Adata exfiltration
    • Bcommand and control communication
    • Cintelligent proxy
    • Dsnort
    • EURL categorization

    Show answer

    Answer: AB

    Explanation

    Reference: https://www.cisco.com/c/dam/en/us/products/collateral/security/cognitive-threat-analytics/at-a-glance-c45-736555.pdf

    Source: Adapted from community discussion — sis_net_sec

    References

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 191. 654 questions available.