350-701 practice questions 241–250

1. Question 241 · 654 in bank

   Select 2

   Which two Cisco ISE components must be configured for BYOD? (Choose two.)

   • Alocal WebAuth
   • Bcentral WebAuth
   • Cnull WebAuth
   • Dguest
   • Edual

   Show answer

   Answer: BD

   Explanation

   Correct is BD. Here you can see that A and C are not correct: https://www.ciscopress.com/articles/article.asp?p=3100059&seqNum=2 And I assume that "dual" is used to refer to dual SSID, and here you can see that it's not necessary: https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId--1179912982 And also there you can see the section "configure Guest portal" where it is necessary for the onboarding... So it's BD

   Source: Adapted from community discussion — DWizard

   References

   • cisco.com documentation

   Next question

2. Question 242 · 654 in bank

   Which system performs compliance checks and remote wiping?

   • AMDM
   • BISE
   • CAMP
   • DOTP

   Show answer

   Answer: A

   Explanation

   From the link you provided, Cisco ISE is also being coupled along with MDM (see previous section entitled: Set Up Mobile Device Management Servers with Cisco ISE). Also, from the same paragraph you're basing your reference from "Cisco ISE allows you to wipe or enable a pin lock for a lost device".....Step 3 also indicates "...From the MDM ACTIONS drop-down list, choose one of the following options: Full Wipe, Corporate Wipe, or Pin Lock."

   Source: Adapted from community discussion — Tthurston1

   Next question

3. Question 243 · 654 in bank

   An engineer is configuring Cisco WSA and needs to enable a separated email transfer flow from the Internet and from the LAN. Which deployment mode must be used to accomplish this goal?

   • Asingle interface
   • Bmulti-context
   • Ctransparent
   • Dtwo-interface

   Show answer

   Answer: D

   Explanation

   D - Two interface Cisco ESA can be deployed with a single physical interface in order to filter email to and from an organization's mail server. The second deployment option is a two-interface configuration, one interface for email transfers to and from the internet and the other for email transfers to and from the internal servers.

   Source: Adapted from community discussion — appfw

   References

   • Cisco documentation

   Next question

4. Question 244 · 654 in bank

   Select 2

   A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)

   • ARADIUS communication must be permitted between the ISE server and the domain controller.
   • BThe ISE account must be a domain administrator in Active Directory to perform JOIN operations.
   • CActive Directory only supports user authentication by using MSCHAPv2.
   • DLDAP communication must be permitted between the ISE server and the domain controller.
   • EActive Directory supports user and machine authentication by using MSCHAPv2.

   Show answer

   Answer: DE

   Explanation

   I would go for D,E as well according to this doc: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html#wp1079999 "MS-CHAPv2—Cisco ISE supports user and machine authentication against Active Directory using EAP-MSCHAPv2." "If there is a firewall between Cisco ISE and Active Directory, certain ports need to be opened to allow Cisco ISE to communicate with Active Directory. Ensure that the following default ports are open: LDAP 389 UDP (...amongst others)"

   Source: Adapted from community discussion — PiX2

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 245 · 654 in bank

   Which configuration method provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with Vmware VDS or Microsoft vSwitch?

   • Ainter-EPG isolation
   • Binter-VLAN security
   • Cintra-EPG isolation
   • Dplacement in separate EPGs

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/virtualization/Cisco-ACI-Virtualization-Guide-42x/Cisco-ACI-Virtualization- Guide-421_chapter_0101.pdf

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation

   Next question

6. Question 246 · 654 in bank

   Select 2

   What are two ways a network administrator transparently identifies users using Active Directory on the Cisco WSA? (Choose two.)

   • ACreate an LDAP authentication realm and disable transparent user identification.
   • BCreate NTLM or Kerberos authentication realm and enable transparent user identification.
   • CDeploy a separate Active Directory agent such as Cisco Context Directory Agent.
   • DThe eDirectory client must be installed on each client workstation.
   • EDeploy a separate eDirectory server; the client IP address is recorded in this server.

   Show answer

   Answer: BC

   Explanation

   Transparently identify users with authentication realms – This option is available when one or more authentication realms are configured to support transparent identification using one of the following authentication servers: Active Directory – Create an NTLM or Kerberos authentication realm and enable transparent user identification. In addition, you must deploy a separate Active Directory agent such as Cisco’s Context Directory Agent. For more information, see Transparent User Identification with Active Directory. LDAP – Create an LDAP authentication realm configured as an eDirectory, and enable transparent user identification. For more information, see Transparent User Identification with LDAP. https://www.cisco.com/c/en/us/td/docs/security/wsa/wsa11-0/user_guide/b_WSA_UserGuide/b_WSA_UserGuide_chapter_01001.html#con_1442362

   Source: Adapted from community discussion — testtaker13

   References

   • Cisco documentation

   Next question

7. Question 247 · 654 in bank

   Which baseline form of telemetry is recommended for network infrastructure devices?

   • ASDNS
   • BNetFlow
   • Cpassive taps
   • DSNMP

   Show answer

   Answer: B

   Explanation

   "One important piece of telemetry that can be instrumented on infrastructure devices is NetFlow." and "In addition to flow information, telemetry can often include network taps or captures." https://sec.cloudapps.cisco.com/security/center/resources/network_integrity_monitoring.html

   Source: Adapted from community discussion — jku2cya

   References

   • cisco.com documentation

   Next question

8. Question 248 · 654 in bank

   In which scenario is endpoint-based security the solution?

   • Ainspecting encrypted traffic
   • Bdevice profiling and authorization
   • Cperforming signature-based application control
   • Dinspecting a password-protected archive

   Show answer

   Answer: D

   Explanation

   A, B and C can be done at the network level. Only for password-protected (=encrypted?) archive, there is not enough information on the network level, so it needs to be done on the end point.

   Source: Adapted from community discussion — bigblob

   Next question

9. Question 249 · 654 in bank

   

   Refer to the exhibit. What is the result of the Python script?

   • AIt uses the POST HTTP method to obtain a username and password to be used for authentication.
   • BIt uses the POST HTTP method to obtain a token to be used for authentication.
   • CIt uses the GET HTTP method to obtain a token to be used for authentication.
   • DIt uses the GET HTTP method to obtain a username and password to be used for authentication

   Show answer

   Answer: B

   Explanation

   Once the user authenticates, it receives a token from the API endpoint, which needs to be included in every request as part of the X-Auth-Token header. Auth

   Source: Adapted from community discussion — amtf8888

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

10. Question 250 · 654 in bank

    DRAG DROP - Drag and drop the descriptions from the left onto the correct protocol versions on the right. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 241. 654 questions available.