350-701 practice questions 21–30

1. Question 21 · 654 in bank

   A network engineer is deciding whether to use stateful or stateless failover when configuring two Cisco ASAs for high availability. What is the connection status in both cases?

   • Aneed to be reestablished with stateful failover and preserved with stateless failover
   • Bpreserved with both stateful and stateless failover
   • Cneed to be reestablished with both stateful and stateless failover
   • Dpreserved with stateful failover and need to be reestablished with stateless failover

   Show answer

   Answer: D

   Explanation

   D. preserved with stateful failover and need to be reestablished with stateless failover In stateful failover, the primary and secondary devices share state information, meaning that they have the same view of the current connections and the connection status is preserved. If the primary device fails, the secondary device takes over and continues to manage the existing connections without interruption. In contrast, In stateless failover, the primary and secondary devices do not share state information, meaning that they have different views of the connections. If the primary device fails, the secondary device takes over but the connection status need to be reestablished.

   Source: Adapted from community discussion — sull3y

   Next question

2. Question 22 · 654 in bank

   Which term describes when the Cisco Firepower downloads threat intelligence updates from Cisco Talos?

   • Aauthoring
   • Bconsumption
   • Csharing
   • Danalysis

   Show answer

   Answer: B

   Explanation

   we will showcase Cisco Threat Intelligence Director (CTID) an exciting feature on Cisco’s Firepower Management Center (FMC) product offering that automates the operationalization of threat intelligence. TID has the ability to consume threat intelligence via STIX over TAXII and allows uploads/downloads of STIX and simple blacklists. Reference: https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligencedirector - Answer B Consumption

   Source: Adapted from community discussion — dzef13

   References

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

3. Question 23 · 654 in bank

   An administrator is configuring a DHCP server to better secure their environment. They need to be able to rate-limit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?

   • ASet a trusted interface for the DHCP server.
   • BSet the DHCP snooping bit to 1.
   • CEnable ARP inspection for the required VLAN.
   • DAdd entries in the DHCP snooping database.

   Show answer

   Answer: A

   Explanation

   Folks, we have lots of wrong answers verified and provided by "experts", there's no need to supply wrong answers by ourselves here. You can't add entries to DHCP snooping database. It's wrong answer. The only case when you create mapping of IP to MAC and VLAN and port is configuring "ip source guard" but it is not the same as DHCP snooping. Unless you explicitly configure a rate limit on an interface, changing the trust state of the interface also changes its rate limit to the default value for that trust state. After you configure the rate limit, the interface retains the rate limit even when its trust state is changed https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/dam/en/us/td/docs/switches/lan/catalyst4500/XE35-0XO/configuration/guide/dhcp.fm/jcr:content/renditions/config_dhcp.html.xml

   Source: Adapted from community discussion — zheka

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 24 · 654 in bank

   Which attack is commonly associated with C and C++ programming languages?

   • Across-site scripting
   • Bwater holing
   • CDDoS
   • Dbuffer overflow

   Show answer

   Answer: D

   Explanation

   Reference: https://en.wikipedia.org/wiki/Buffer_overflow

   Source: Adapted from community discussion — sull3y

   Next question

5. Question 25 · 654 in bank

   What is a prerequisite when integrating a Cisco ISE server and an AD domain?

   • AConfigure a common administrator account.
   • BPlace the Cisco ISE server and the AD server in the same subnet.
   • CSynchronize the clocks of the Cisco ISE server and the AD server.
   • DConfigure a common DNS server.

   Show answer

   Answer: C

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215233-identity-service-engine-ise-and-active.html#anc1

   Source: Adapted from community discussion — sis_net_sec

   References

   • Cisco documentation

   Next question

6. Question 26 · 654 in bank

   When configuring ISAKMP for IKEv1 Phase 1 on a Cisco IOS router, an administrator needs to input the command crypto isakmp key cisco address 0.0.0.0. The administrator is not sure what the IP address in this command is used for. What would be the effect of changing the IP address from 0.0.0.0 to 1.2.3.4?

   • AThe key server that is managing the keys for the connection will be at 1.2.3.4.
   • BThe address that will be used as the crypto validation authority.
   • CAll IP addresses other than 1.2.3.4 will be allowed.
   • DThe remote connection will only be allowed from 1.2.3.4.

   Show answer

   Answer: D

   Explanation

   I think none of the answers are correct or the question itself is wrong. If you do not add a subnet mask at the end of the command the default class is assumed. The default class for 1.2.3.4 is class A, which has mask 255.0.0.0 or 8 bits. This means that all addresses from the 1.0.0.0/8 network will be accepted for authentication with that key.

   Source: Adapted from community discussion — Anonymous983475

   References

   • Cisco documentation

   Next question

7. Question 27 · 654 in bank

   A network administrator is configuring SNMPv3 on a new router. The users have already been created, however an additional configuration is needed to facilitate access to the SNMP views. What must the administrator do to accomplish this?

   • Adefine the encryption algorithm to be used by SNMPv3
   • Bset the password to be used for SNMPv3 authentication
   • Cmap SNMPv3 users to SNMP views
   • Dspecify the UDP port used by SNMP

   Show answer

   Answer: C

   Explanation

   Agree with B Configuring SNMP Version 3 When you configure SNMPv3 and you want to use the SNMPv3 security mechanism for handling SNMP packets, you must establish SNMP groups and users with passwords. SNMPv3 is a security model. A security model is an authentication strategy that is set up for a user and the group in which the user resides. No default values exist for authentication or privacy algorithms when you configure the snmp-server group command. Also, no default passwords exist. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/12-4t/snmp-12-4t-book/nm-snmp-cfg-snmp-support.html

   Source: Adapted from community discussion — MoII

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 28 · 654 in bank

   DRAG DROP - Drag and drop the NetFlow export formats from the left onto the descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2015/pdf/BRKNMS-3132.pdf

   Source: Adapted from community discussion — Laryoul

   References

   • Cisco documentation

   

   Next question

9. Question 29 · 654 in bank

   

   Refer to the exhibit. When configuring a remote access VPN solution terminating on the Cisco ASA, an administrator would like to utilize an external token authentication mechanism in conjunction with AAA authentication using machine certificates. Which configuration item must be modified to allow this?

   • AMethod
   • BSAML Server
   • CAAA Server Group
   • DGroup Policy

   Show answer

   Answer: A

   Explanation

   AAA server group is correct. It's looking for what to use in conjunction with AAA. The method is already selected. Most likely you will change the "local" under server group to "ldap" to use AD for authentication rather than local creds defined on the ASA.

   Source: Adapted from community discussion — Reece_S

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

10. Question 30 · 654 in bank

    An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?

    • ANetwork Discovery
    • BAccess Control
    • CPacket Tracer
    • DNetFlow

    Show answer

    Answer: A

    Explanation

    Opt for A. Cisco doc says Applications can be discovered by "non-NetFlow discovery rules" without Option D You can disable detection of application protocols in discovery rules configured to monitor NetFlow exporters, but not in discovery rules configured to monitor Firepower System managed devices. If you enable host or user discovery in non-NetFlow discovery rules, applications are automatically discovered. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/working_with_discovery_events.html

    Source: Adapted from community discussion — semi1750

    References

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 21. 654 questions available.