350-701 practice questions 211–220

1. Question 211 · 654 in bank

   How is data sent out to the attacker during a DNS tunneling attack?

   • Aas part of the domain name
   • Bas part of the UDP/53 packet payload
   • Cas part of the TCP/53 packet header
   • Das part of the DNS response packet

   Show answer

   Answer: A

   Explanation

   This is a tricky question. Communication on port 53 (both TCP and UDP) is used by DNS but usage of port 53 itself does NOT mean that we are using DNS encapsulation. For DNS tunneling to be successful, we need to use real DNS protocol (i. e. DNS headers) and payload, where exfiltrated data are placed as part of domain in question. With no DNS encapsulation, traffic would NOT reach attackers destination server (resolution of queries by DNS server is needed here and forwarding them to the attacker's domain's authoritative DNS server). So correct answer is "part of the domain name", which means we are talking about real DNS communication where domain name is used to exfiltrate data (not just any L4 protocol with port 53).

   Source: Adapted from community discussion — NikoNiko

   Next question

2. Question 212 · 654 in bank

   

   Refer to the exhibit. A Cisco ISE administrator adds a new switch to an 802. 1X deployment and has difficulty with some endpoints gaining access. Most PCs and IP phones can connect and authenticate using their machine certificate credentials; however, printers and video cameras cannot. Based on the interface configuration provided, what must be done to get these devices onto the network using Cisco ISE for authentication and authorization while maintaining security controls?

   • AConfigure authentication event fail retry 2 action authorize vlan 41 on the interface.
   • BAdd mab to the interface configuration.
   • CEnable insecure protocols within Cisco ISE in the allowed protocols configuration.
   • DChange the default policy in Cisco ISE to allow all devices not using machine authentication.

   Show answer

   Answer: B

   Explanation

   B is correct - MAB. Printers, cameras, video conference devices, etc.. either don't have 802.1X supplicant or if they have it, it could be difficult to manage. So these devices are usually authenticated and authorized by Mac Authentication Bypass (MAB) + Profiling on ISE (profiling is classification of the devices by type, function, etc... ISE recognizes devices like cameras / Cisco Phones / printers / ... and these attributes can be used in the ISE policy to apply desired authorization to the endpoints)

   Source: Adapted from community discussion — NikoNiko

   References

   • cisco.com documentation

   Next question

3. Question 213 · 654 in bank

   Cisco SensorBase gathers threat information from a variety of Cisco products and services and performs analytics to find pattern on threats. Which term describes this process?

   • Aauthoring
   • Bconsumption
   • Cdeployment
   • Dsharing

   Show answer

   Answer: D

   Explanation

   "Sharing telemetry data with the SensorBase Network to improve visibility of alerts and sensor actions on a global scale" https://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/419/user/guide/CSMUserGuide/ipsglobe.html "Participating in the Cisco SensorBase Network means that Cisco collects data and shares that information with the SensorBase threat management database. This data includes information about request attributes and how the appliance handles requests." https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa_14-1/User-Guide/b_WSA_UserGuide_14_01/b_WSA_UserGuide_11_7_chapter_00.html

   Source: Adapted from community discussion — NikoNiko

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 214 · 654 in bank

   

   Refer to the exhibit. What will occur when this device tries to connect to the port?

   • A802. 1X will not work, but MAB will start and allow the device on the network.
   • B802. 1X will work and the device will be allowed on the network.
   • C802. 1X will not work and the device will not be allowed network access.
   • D802. 1X and MAB will both be used and ISE can use policy to determine the access level.

   Show answer

   Answer: B

   Explanation

   There is no MAB in the config. So any question with MAB working is false. D is fasle. Dot1x config is correct. As there is no info that the client is misconfigured it is B

   Source: Adapted from community discussion — Tuxzinator

   References

   • Cisco documentation

   Next question

5. Question 215 · 654 in bank

   Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

   • Aflow insight variation
   • Bsoftware package variation
   • Cinterpacket variation
   • Dprocess details variation

   Show answer

   Answer: C

   Explanation

   Flow insight variation is not a real cisco feature. The answer listed is correct. Flow information: This information contains details about endpoints, protocols, ports, when the flow started, how long the flow was active, etc. Interpacket variation: This information captures any interpacket variations within the flow. Examples include variation in Time To Live (TTL), IP and TCP flags, payload length, etc. Context details: Context information is derived outside the packet header. It includes details about variation in buffer utilization, packet drops within a flow, association with tunnel endpoints, etc. https://www.cisco.com/c/dam/global/en_uk/products/switches/cisco_nexus_9300_ex_platform_switches_white_paper_uki.pdf

   Source: Adapted from community discussion — thefiresays

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

6. Question 216 · 654 in bank

   Which network monitoring solution uses streams and pushes operational data to provide a near real-time view of activity?

   • ASNMP
   • BSMTP
   • Csyslog
   • Dmodel-driven telemetry

   Show answer

   Answer: D

   Explanation

   Reference: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide

   References

   • cisco.com documentation

   Next question

7. Question 217 · 654 in bank

   Select 2

   What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two.)

   • ATACACS+
   • Bcentral web auth
   • Csingle sign-on
   • Dmultiple factor auth
   • Elocal web auth

   Show answer

   Answer: BE

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01110.html

   References

   • cisco.com documentation

   Next question

8. Question 218 · 654 in bank

   Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

   • ARSA SecureID
   • BInternal Database
   • CActive Directory
   • DLDAP

   Show answer

   Answer: A

   Explanation

   The correct answer is A. In Cisco ISE, you can authenticate administrators via an external identity store such as Active Directory, LDAP, or RSA SecureID. There are two models you can use to provide authentication via an external identity store: External Authentication and Authorization: There are no credentials that are specified in the local Cisco ISE database for the administrator, and authorization is based on external identity store group membership only. This model is used for Active Directory and LDAP authentication. External Authentication and Internal Authorization: The administrator’s authentication credentials come from the external identity source, and authorization and administrator role assignment take place using the local Cisco ISE database. This model is used for RSA SecurID authentication. This method requires you to configure the same username in both the external identity store and the local Cisco ISE database. Source: https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_011010.html Scroll down to: "Administrative Access to Cisco ISE Using an External Identity Store"

   Source: Adapted from community discussion — Jeeves69

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

9. Question 219 · 654 in bank

   An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10. What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

   • ACisco Identity Services Engine and AnyConnect Posture module
   • BCisco Stealthwatch and Cisco Identity Services Engine integration
   • CCisco ASA firewall with Dynamic Access Policies configured
   • DCisco Identity Services Engine with PxGrid services enabled

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect46/administration/guide/b_AnyConnect_Administrator_Guide_4-6/ configure-posture.html

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation

   Next question

10. Question 220 · 654 in bank

    The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

    • ASDN controller and the cloud
    • Bmanagement console and the SDN controller
    • Cmanagement console and the cloud
    • DSDN controller and the management solution

    Show answer

    Answer: D

    Explanation

    Correct answer is D: SDN Controller and the management solution How Do Northbound APIs Work? Northbound APIs are the link between the applications and the SDN controller. The applications can tell the network what they need (data, storage, bandwidth, and so on) and the network can deliver those resources, or communicate what it has.

    Source: Adapted from community discussion — Alee86

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 211. 654 questions available.