350-701 practice questions 201–210

1. Question 201 · 654 in bank

   Which compliance status is shown when a configured posture policy requirement is not met?

   • Aauthorized
   • Bcompliant
   • Cunknown
   • Dnoncompliant

   Show answer

   Answer: D

   Explanation

   Unknown Profile If no matching posture policy is defined for an endpoint, then the posture compliance status of the endpoint may be set to unknown. A posture compliance status of unknown can also apply to an endpoint where a matching posture policy is enabled but posture assessment has not yet occurred for that endpoint and, therefore no compliance report has been provided by the client agent. Noncompliant Profile The posture compliance status of an endpoint is set to noncompliant when a matching posture policy is defined for that endpoint but it fails to meet all the mandatory requirements during posture assessment. An endpoint that is postured noncompliant matches a posture requirement with a remediation action, and it should be granted limited network access to remediation resources in order to remediate itself.

   Source: Adapted from community discussion — Amedeou

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 202 · 654 in bank

   An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?

   • ACisco Stealthwatch
   • BCisco Tetration
   • CCisco AMP
   • DCisco Umbrella

   Show answer

   Answer: B

   Explanation

   The solution to meet the requirements of an organization trying to implement micro-segmentation and gain visibility on applications within the network while maintaining and enforcing compliance is Cisco Tetration. Cisco Tetration is a data center security and application management solution that provides end-to-end visibility and control across multi-cloud and multi-segmented environments. It uses machine learning and big data analytics to gain real-time visibility into application behavior, and it provides micro-segmentation to enforce security policies on the network. This helps organizations to maintain and enforce compliance, protect their sensitive data, and reduce risk of security breaches.

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 203 · 654 in bank

   An organization has a Cisco Stealthwatch Cloud deployment in their environment. Cloud logging is working as expected, but logs are not being received from the on-premise network. What action will resolve this issue?

   • ADeploy a Cisco FTD sensor to send events to Cisco Stealthwatch Cloud.
   • BDeploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud.
   • CConfigure security appliances to send syslogs to Cisco Stealthwatch Cloud.
   • DConfigure security appliances to send NetFlow to Cisco Stealthwatch Cloud.

   Show answer

   Answer: B

   Explanation

   The answer is B. Check this out: https://www.cisco.com/c/dam/en/us/products/collateral/security/stealthwatch-cloud/sw-cloud-sensor-performance-wp.pdf "Cisco Stealthwatch Cloud Private Network...is the perfect solution for organizations that want better awareness and security within their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying a lightweight appliance, referred to as the Stealthwatch Cloud Sensor, in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network."

   Source: Adapted from community discussion — Stevens0103

   References

   • Cisco documentation

   Next question

4. Question 204 · 654 in bank

   A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available. What must be done in order to securely connect this device to the network?

   • AUse 802.1X with posture assessment.
   • BUse MAB with profiling.
   • CUse 802.1X with profiling.
   • DUse MAB with posture assessment.

   Show answer

   Answer: B

   Explanation

   MAB, or MAC Authentication Bypass, is a method of authentication that uses the MAC address of the device to grant access to the network. It is often used for devices that do not support 802.1X authentication, such as printers, scanners, and medical devices.

   Source: Adapted from community discussion — achille5

   Next question

5. Question 205 · 654 in bank

   Drag and drop the solutions from the left onto the solution's benefits on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

6. Question 206 · 654 in bank

   A network engineer must monitor user and device behavior within the on-premises network. This data must be sent to the Cisco Stealthwatch Cloud analytics platform for analysis. What must be done to meet this requirement, using the Ubuntu-based VM appliance deployed in a VMware-based hypervisor?

   • ADeploy a Cisco FTD sensor to send network events to Cisco Stealthwatch Cloud.
   • BConfigure a Cisco FMC to send syslogs to Cisco Stealthwatch Cloud.
   • CDeploy the Cisco Stealthwatch Cloud PNM sensor that sends data to Cisco Stealthwatch Cloud.
   • DConfigure a Cisco FMC to send NetFlow to Cisco Stealthwatch Cloud.

   Show answer

   Answer: C

   Explanation

   I agree this looks like answer C The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. – VMware, VirtualBox). https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/5eU6DfQV/LTRSEC-2240-LG2.pdf

   Source: Adapted from community discussion — birdman6709

   Next question

7. Question 207 · 654 in bank

   An organization wants to provide visibility and to identify active threats in its network using a VM. The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network. Which solution meets these requirements?

   • ACisco Umbrella Cloud
   • BCisco Stealthwatch Cloud PNM
   • CCisco Stealthwatch Cloud PCM
   • DCisco Umbrella On-Premises

   Show answer

   Answer: B

   Explanation

   “PNM” = Private Network Monitoring “PCM” = Public Cloud Monitoring https://www.cisco.com/c/dam/en_us/about/doing_business/legal/msla_direct/swatch.pdf Secure Cloud Analytics formerly known as Stealthwatch Cloud PNM provides visibility and security monitoring for on-premises infrastructure. The solution detects advanced threats and early indicators of compromise by identifying all the entities in the network, modeling network behavior and alerting on behavioral anomalies that are security relevant and should be investigated. This includes a virtual appliance(s) that is installed locally in the network to collect IP metadata, such as Netflow, generated by your switches, routers and firewalls, additionally it can generate flow records by attaching to network ports. The virtual appliance transmits the locally collected data to the service where an advanced model is kept for every entity. https://azuremarketplace.microsoft.com/en/marketplace/apps/cisco.stealthwatch_private_network_monitoring_contract?tab=Overview

   Source: Adapted from community discussion — NikoNiko

   References

   • Cisco documentation

   Next question

8. Question 208 · 654 in bank

   What is a benefit of performing device compliance?

   • Aproviding multi-factor authentication
   • Bverification of the latest OS patches
   • Cproviding attribute-driven policies
   • Ddevice classification and authorization

   Show answer

   Answer: B

   Explanation

   I believe B is Correct: Performing device compliance checks offers the benefit of verifying the latest operating system (OS) patches on devices. Device compliance ensures that devices within an organization's network adhere to the required security standards and policies, including patch management. By checking the compliance status of devices, organizations can identify if the devices have the latest OS patches installed. This is crucial for maintaining a secure network environment, as OS patches often address known vulnerabilities and security weaknesses. Regularly verifying the latest patches helps mitigate the risk of exploitation and potential security breaches. Option C, providing attribute-driven policies, refers to the capability of tailoring security policies based on specific attributes of the devices or users, but it is not a specific benefit of device compliance.

   Source: Adapted from community discussion — ums008

   References

   • Cisco documentation

   Next question

9. Question 209 · 654 in bank

   DRAG DROP - Drag and drop the capabilities from the left onto the correct technologies on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Key word: prevention = Next generation intrusion prevention system Protect = Advanced Malware Protection Application Layer = Application control and URL filtering Combined integrated = Cisco web security Appliance

   Source: Adapted from community discussion — pohqinan

   

   Next question

10. Question 210 · 654 in bank

    Which type of DNS abuse exchanges data between two computers even when there is no direct connection?

    • Amalware installation
    • Bnetwork footprinting
    • Ccommand-and-control communication
    • Ddata exfiltration

    Show answer

    Answer: C

    Explanation

    I believe Answer is C: Command-and-control (C2) communication refers to a type of DNS abuse where malware-infected devices establish communication with a command-and-control server. This communication occurs even when there is no direct connection between the infected device and the command-and-control server. Option D, data exfiltration, refers to the unauthorized transfer of data from a compromised network or device to an external location. While data exfiltration can occur using various methods, such as DNS tunnels, it does not specifically refer to the exchange of data between two computers without a direct connection.

    Source: Adapted from community discussion — ums008

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 201. 654 questions available.