350-701 practice questions 351–360

1. Question 351 · 654 in bank

   Select 2

   Which two activities can be done using Cisco DNA Center? (Choose two.)

   • ADHCP
   • Bdesign
   • Caccounting
   • DDNS
   • Eprovision

   Show answer

   Answer: BE

   Explanation

   B. design E. provision Cisco DNA Center is a network management platform that provides a centralized, programmable, and automated approach to managing and automating the network. The two activities that can be done using Cisco DNA Center are design and provision. Design: Cisco DNA Center provides an intuitive and visual interface for designing, modeling, and simulating the network. It allows network administrators to create and test network configurations before deploying them to the production network. This feature can help to improve the speed and efficiency of managing the network. Provision: Cisco DNA Center provides an automated approach to provisioning and configuring network devices. It allows network administrators to automate repetitive tasks such as configuring network devices, and reducing manual configuration errors can lead to increased network uptime, improved security, and better network performance.

   Source: Adapted from community discussion — sull3y

   Next question

2. Question 352 · 654 in bank

   Select 2

   During a recent security audit, a Cisco IOS router with a working IPSEC configuration using IKEv1 was flagged for using a wildcard mask with the crypto isakmp key command. The VPN peer is a SOHO router with a dynamically assigned IP address. Dynamic DNS has been configured on the SOHO router to map the dynamic IP address to the host name of vpn.sohoroutercompany.com. In addition to the command crypto isakmp key Cisc123456789 hostname vpn.sohoroutercompany.com, what other two commands are now required on the Cisco IOS router far the VPN to continue to function after the wildcard command is removed? (Choose two.)

   • Aip host vpn.sohoroutercompany.com <VPN Peer IP Address>
   • Bcrypto isakmp identity hostname
   • CAdd the dynamic keyword to the existing crypto map command
   • Dfqdn vpn.sohoroutercompany.com <VPN Peer IP Address>
   • Eip name-server <DNS Server IP Address>

   Show answer

   Answer: BE

   Explanation

   I have to correct myself - C is WRONG! - Agree with @SegaMasterSystemAdmin - dynamic is part of SET PEER not Crypto MAP -- B & E - is the correct answer

   Source: Adapted from community discussion — Jessie45785

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 353 · 654 in bank

   What does Cisco ISE use to collect endpoint attributes that are used in profiling?

   • Aprobes
   • Bposture assessment
   • CCisco AnyConnect Secure Mobility Client
   • DCisco pxGrid

   Show answer

   Answer: A

   Explanation

   Reference: https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/2-6/admin_guide/b_ise_admin_guide_26/ b_ise_admin_guide_26_chapter_010100.html.xml#:~:text=Network%20probe%20is%20a%20method,in%20the%20Cisco%20ISE%20database .

   Source: Adapted from community discussion — sull3y

   References

   • cisco.com documentation

   Next question

4. Question 354 · 654 in bank

   Select 2

   What are two functions of IKEv1 but not IKEv2? (Choose two.)

   • AIKEv1 conversations are initiated by the IKE_SA_INIT message.
   • BWith IKEv1, aggressive mode negotiates faster than main mode.
   • CIKEv1 uses EAP for authentication.
   • DNAT-T is supported in IKEv1 but not in IKEv2.
   • EWith IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext.

   Show answer

   Answer: BE

   Explanation

   B. With IKEv1, aggressive mode negotiates faster than main mode. E. With IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext. Explanation: B. In IKEv1, aggressive mode negotiates faster than main mode because it requires fewer messages to establish the IKE SA (Security Association). However, aggressive mode in IKEv1 has been identified as less secure than main mode because it is more susceptible to attacks. E. With IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext, which can potentially expose sensitive information. In IKEv2, the identities are protected by encryption, providing an additional layer of security.

   Source: Adapted from community discussion — sull3y

   Next question

5. Question 355 · 654 in bank

   Which action controls the amount of URI text that is stored in Cisco WSA log files?

   • AConfigure the advancedproxyconfig command with the HTTPS subcommand.
   • BConfigure a small log-entry size.
   • CConfigure the datasecurityconfig command.
   • DConfigure a maximum packet size.

   Show answer

   Answer: A

   Explanation

   Handle personally identifiable information with care: If you choose to decrypt an end-user’s HTTPS session, the Web Security appliance access logs and reports may contain personally identifiable information. The Administrator can configure how much URI text is stored in the logs using the advancedproxyconfig CLI command and the HTTPS subcommand. You can log the entire URI, or a partial form of the URI with the query portion removed. However, even when you choose to strip the query from the URI, personally identifiable information may still remain.

   Source: Adapted from community discussion — jienBoq

   References

   • Cisco documentation

   Next question

6. Question 356 · 654 in bank

   What is the most commonly used protocol for network telemetry?

   • ANetFlow
   • BSNMP
   • CTFTP
   • DSMTP

   Show answer

   Answer: A

   Explanation

   I think this is tricky. I vote for A (Netflow), because I think that SNMP is NOT considered a Network Telemetry element and Netflow is

   Source: Adapted from community discussion — fukumoto0925

   References

   • Cisco documentation

   Next question

7. Question 357 · 654 in bank

   Select 2

   Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)

   • AApex licensing
   • BTACACS+
   • Cprofiling
   • DDHCP and SNMP probes
   • Eposture agents

   Show answer

   Answer: AE

   Next question

8. Question 358 · 654 in bank

   What is a difference between DMVPN and sVTI?

   • ADMVPN provides interoperability with other vendors, whereas sVTI does not.
   • BDMVPN supports static tunnel establishment, whereas sVTI does not.
   • CDMVPN supports dynamic tunnel establishment, whereas sVTI does not.
   • DDMVPN supports tunnel encryption, whereas sVTI does not.

   Show answer

   Answer: C

   Next question

9. Question 359 · 654 in bank

   Which Cisco security solution gives the most complete view of the relationships and evolution of Internet domains, IPs, and files, and helps to pinpoint attackers' infrastructures and predict future threat?

   • ACisco Umbrella Investigate
   • BCisco Stealthwatch
   • CCisco pxGrid
   • DCisco Stealthwatch Cloud

   Show answer

   Answer: A

   Explanation

   A is correct: Umbrella Investigate gives the most complete view of the relationships and evolution of internet domains, IPs, and files — helping to pinpoint attackers’ infrastructures and predict future threats. No other vendor offers the same level of interactive threat intelligence — exposing current and developing threats. Umbrella delivers the context you need for faster incident investigation and response.

   Source: Adapted from community discussion — Totosos1

   Next question

10. Question 360 · 654 in bank

    Which type of data does the Cisco Stealthwatch system collect and analyze from routers, switches, and firewalls?

    • ANTP
    • BSNMP
    • Csyslog
    • DNetFlow

    Show answer

    Answer: D

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 351. 654 questions available.