350-701 practice questions 261–270

1. Question 261 · 654 in bank

   Which VPN technology can support a multivendor environment and secure traffic between sites?

   • ASSL VPN
   • BGET VPN
   • CFlexVPN
   • DDMVPN

   Show answer

   Answer: C

   Explanation

   SSL VPN is a remote access VPN, not a S2S vpn. The question is specifically looking to connect sites. The below comes from the link that is supplied with the answer as well which should've made this very obvious. "Third-party compatibility: As the IT world transitions to cloud- and mobile-based computing, more and more VPN routers and VPN endpoints from different vendors are required. The Cisco IOS FlexVPN solution provides compatibility with any IKEv2-based third-party VPN vendors, including native VPN clients from Apple iOS and Android devices."

   Source: Adapted from community discussion — nomanlands

   References

   • Cisco documentation

   Next question

2. Question 262 · 654 in bank

   Which security product enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access?

   • ACisco Container Controller
   • BCisco Cloud Platform
   • CCisco Container Platform
   • DCisco Content Platform

   Show answer

   Answer: C

   Explanation

   C. Cisco Container Platform The Cisco Container Platform is a Kubernetes-based platform that enables administrators to deploy, manage, and scale containerized applications across hybrid cloud environments. It includes features such as automated deployment, multi-tenancy, and self-service capabilities. Additionally, it supports air-gapped environments where there is no Internet access by providing a mechanism to securely transfer images and other artifacts to and from the platform.

   Source: Adapted from community discussion — sull3y

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 263 · 654 in bank

   A network engineer must migrate a Cisco WSA virtual appliance from one physical host to another physical host by using VMware vMotion. What is a requirement for both physical hosts?

   • AThe hosts must run Cisco AsyncOS 10.0 or greater.
   • BThe hosts must run different versions of Cisco AsyncOS.
   • CThe hosts must have access to the same defined network.
   • DThe hosts must use a different datastore than the virtual appliance.

   Show answer

   Answer: C

   Explanation

   WSA VM is already running, and they are asking about the requirements needed for ESXi hosts. Both physical hosts must have the same network configuration. https://www.cisco.com/c/dam/en/us/td/docs/security/content_security/virtual_appliances/Cisco_Content_Security_Virtual_Appliance_Install_Guide.pdf

   Source: Adapted from community discussion — hous90

   References

   • Cisco documentation

   Next question

4. Question 264 · 654 in bank

   An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively used by devices, using many of the default policy elements. What else must be done to accomplish this task?

   • ACreate a destination list for addresses to be allowed or blocked
   • BUse content categories to block or allow specific addresses
   • CAdd the specified addresses to the identities list and create a block action
   • DModify the application settings to allow only applications to connect to required addresses

   Show answer

   Answer: A

   Explanation

   C make no sense, cause umbrella is used to enforce policies on identities not vice versa: https://docs.umbrella.com/umbrella-user-guide/docs/manage-identities Manage Identities An identity is an internet capable entity that Umbrella protects through policies and monitors through reports. An identity can be a high-level entity within your system—for example, a network—or very granular—for example, a single user logged into Active Directory. To protect your systems, you add identities to Umbrella, then create policies to which you add these identities. For more information about policies, see Manage DNS Policies and Manage the Web Policy.

   Source: Adapted from community discussion — Jessie45785

   Next question

5. Question 265 · 654 in bank

   What must be enabled to secure SaaS-based applications?

   • Atwo-factor authentication
   • Bend-to-end encryption
   • Capplication security gateway
   • Dmodular policy framework

   Show answer

   Answer: A

   Explanation

   C. Application security gateway. To secure SaaS-based applications, an application security gateway must be enabled. This is a security solution that sits between the user and the SaaS application, providing a secure connection and monitoring traffic to ensure that it meets security policies. Two-factor authentication (A) is a security measure that adds an extra layer of authentication to access a system or application, but it alone is not sufficient to secure SaaS-based applications. End-to-end encryption (B) can also be an important security measure for SaaS-based applications, but it is typically used to protect data in transit, rather than securing the SaaS application itself.

   Source: Adapted from community discussion — sull3y

   Next question

6. Question 266 · 654 in bank

   An engineer configures new features within the Cisco Umbrella dashboard and wants to identify and proxy traffic that is categorized as risky domains and may contain safe and malicious content. Which action accomplishes these objectives?

   • AUpload the threat intelligence database to Cisco Umbrella for the most current information on reputations and to have the destination lists block them
   • BConfigure URL filtering within Cisco Umbrella to track the URLs and proxy the requests for those categories and below
   • CCreate a new site within Cisco Umbrella to block requests from those categories so they can be sent to the proxy device
   • DConfigure intelligent proxy within Cisco Umbrella to intercept and proxy the requests for only those categories

   Show answer

   Answer: D

   Explanation

   I agree with D https://docs.umbrella.com/deployment-msp/docs/what-is-the-intelligent-proxy The intelligent proxy is the ability for Umbrella to intercept and proxy requests for malicious files embedded within certain so-called "grey" domains. Some websites, especially those with large user communities or the ability to upload and share files, have content that most users want to access while also posing a risk because of the possibility of hosting malware. Administrators wouldn't want to block access to the whole "grey" domain for everyone but they also don't want your users to access files that could harm their computers, compromise your company data or worse!

   Source: Adapted from community discussion — Anonymous983475

   Next question

7. Question 267 · 654 in bank

   An engineer is configuring Cisco Umbrella and has an identity that references two different policies. Which action ensures that the policy that the identity must use takes precedence over the second one?

   • APlace the policy with the most-specific configuration last in the policy order
   • BConfigure the default policy to redirect the requests to the correct policy
   • CMake the correct policy first in the policy order
   • DConfigure only the policy with the most recently changed timestamp

   Show answer

   Answer: C

   Explanation

   Reference: https://docs.umbrella.com/deployment-umbrella/docs/policy-precedence

   Next question

8. Question 268 · 654 in bank

   A Cisco ISE engineer configures Central Web Authentication (CWA) for wireless guest access and must have the guest endpoints redirect to the guest portal for authentication and authorization. While testing the policy, the engineer notices that the device is not redirected and instead gets full guest access. What must be done for the redirect to work?

   • ATag the guest portal in the CWA part of the Common Tasks section of the authorization profile for the authorization policy line that the unauthenticated devices hit.
   • BCreate an advanced attribute setting of Cisco:cisco-gateway-id=guest within the authorization profile for the authorization policy line that the unauthenticated devices hit.
   • CAdd the DACL name for the Airespace ACL configured on the WLC in the Common Tasks section of the authorization profile for the authorization policy line that the unauthenticated devices hit.
   • DUse the track movement option within the authorization profile for the authorization policy line that the unauthenticated devices hit.

   Show answer

   Answer: A

   Explanation

   Not to muddy the waters here, But C can't be it because it references a DACL (Downloadable ACL). Which if it is referencing an ACL that is already created on the WLC, it would use a DACL. It would just reference the already created ACL. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/216330-ise-self-registered-guest-portal-configu.html

   Source: Adapted from community discussion — unclemonkeyboy

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 269 · 654 in bank

   What is the intent of a basic SYN flood attack?

   • Ato solicit DNS responses
   • Bto flush the register stack to re-initiate the buffers
   • Cto exceed the threshold limit of the connection queue
   • Dto cause the buffer to overflow

   Show answer

   Answer: C

   Explanation

   C. to exceed the threshold limit of the connection queue. The intent of a basic SYN flood attack is to exceed the threshold limit of the connection queue. This is achieved by flooding the target system with a large number of SYN packets, which are used to initiate a TCP connection. The target system will allocate resources to process each incoming SYN packet, and if the number of incoming SYN packets exceeds the threshold limit of the connection queue, the system will be unable to establish new connections. This can cause the system to become slow or unresponsive to legitimate traffic. The other options mentioned in the question are not related to the intent of a SYN flood attack.

   Source: Adapted from community discussion — sull3y

   Next question

10. Question 270 · 654 in bank

    What is an advantage of network telemetry over SNMP pulls?

    • Asecurity
    • Bscalability
    • Caccuracy
    • Dencapsulation

    Show answer

    Answer: B

    Explanation

    Accuracy? Telemetry provides detection capabilities up to microseconds accuracy which can report micro changes in the network. SNMP is poll based with set amount of time. Anything in between polls may be missed. https://info.support.huawei.com/info-finder/encyclopedia/en/Telemetry.html I vote for Accuracy.

    Source: Adapted from community discussion — smartcarter

    References

    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 261. 654 questions available.