350-701 practice questions 391–400

1. Question 391 · 654 in bank

   What is a functional difference between Cisco AMP for Endpoints and Cisco Umbrella Roaming Client?

   • AAMP for Endpoints authenticates users and provides segmentation, and the Umbrella Roaming Client allows only for VPN connectivity.
   • BAMP for Endpoints stops and tracks malicious activity on hosts, and the Umbrella Roaming Client tracks only URL-based threats.
   • CThe Umbrella Roaming Client authenticates users and provides segmentation, and AMP for Endpoints allows only for VPN connectivity.
   • DThe Umbrella Roaming client stops and tracks malicious activity on hosts, and AMP for Endpoints tracks only URL-based threats.

   Show answer

   Answer: B

   Next question

2. Question 392 · 654 in bank

   Which Cisco ISE feature helps to detect missing patches and helps with remediation?

   • Aenabling probes
   • Bprofiling policy
   • Cauthentication policy
   • Dposture assessment

   Show answer

   Answer: D

   Explanation

   D. Posture assessment is a feature of Cisco Identity Services Engine (ISE) that helps to detect missing patches and helps with remediation. It assesses the security posture of endpoint devices connecting to the network by checking for compliance with security policies and identifying any vulnerabilities, such as missing patches. Once non-compliant devices are identified, ISE can take appropriate actions, such as quarantining the device or providing instructions for remediation.

   Source: Adapted from community discussion — sull3y

   Next question

3. Question 393 · 654 in bank

   What is the function of SDN southbound API protocols?

   • Ato allow for the static configuration of control plane applications
   • Bto enable the controller to use REST
   • Cto enable the controller to make changes
   • Dto allow for the dynamic configuration of control plane applications

   Show answer

   Answer: C

   Explanation

   Official Cert Guide: "Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs." But... the Northbound APIs communicates with the control plane applications, not the Southbound APIs. So technically C is still correct, even though Southbound APIs make dynamic changes it still makes changes, hence does not have to say it makes the changes dynamically. This is one of them questions to catch you off guard. The key is the control plane applications. Northbound also uses the REST.

   Source: Adapted from community discussion — statikd

   Next question

4. Question 394 · 654 in bank

   Which feature requires that network telemetry be enabled?

   • ALayer 2 device discovery
   • Bper-interface stats
   • Ccentral syslog system
   • DSNMP trap notification

   Show answer

   Answer: B

   Explanation

   What an interesting question indeed lol.... Would have to vote B for this one though. Reason being is because per-interface stats typically requires network telemetry to be enabled so that detailed information about traffic flows, interface utilization, errors, and other performance metrics can be gathered from network devices. Also, from the link pasted by jienBoq: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-2-2/user_guide/b_cisco_dna_center_ug_2_2_2/b_cisco_dna_center_ug_2_2_2_chapter_01010.pdf " The NetFlow configuration on the device INTERFACES is completed ONLY when you enable application telemetry on the device."

   Source: Adapted from community discussion — Tthurston1

   References

   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 395 · 654 in bank

   What is provided by the Secure Hash Algorithm in a VPN?

   • Aauthentication
   • Bencryption
   • Cintegrity
   • Dkey exchange

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

6. Question 396 · 654 in bank

   

   Refer to the exhibit. When configuring this access control rule in Cisco FMC, what happens with the traffic destined to the DMZ_inside zone once the configuration is deployed?

   • ANo traffic will be allowed through to the DMZ_inside zone regardless of if it’s trusted or not.
   • BAll traffic from any zone will be allowed to the DMZ_inside zone only after inspection.
   • CAll traffic from any zone to the DMZ_inside zone will be permitted with no further inspection.
   • DNo traffic will be allowed through to the DMZ_inside zone unless it's already trusted.

   Show answer

   Answer: C

   Next question

7. Question 397 · 654 in bank

   Select 2

   A company identified a phishing vulnerability during a pentest. What are two ways the company can protect employees from the attack? (Choose two.)

   • Ausing an inline IPS/IDS in the network
   • Busing Cisco Umbrella
   • Cusing Cisco ESA
   • Dusing Cisco ISE
   • Eusing Cisco FTD

   Show answer

   Answer: BC

   Explanation

   The answer is B & C The following are the benefits of deploying Cisco Advanced Phishing Protection on the Cisco Email Security Gateway (ESA): Prevents the following: + Attacks that use compromised accounts and social engineering. + Phishing, ransomware, zero-day attacks and spoofing. + BEC with no malicious payload or URL. Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5/user_guide/b_ESA_Admin_Guide_13-5/m_advanced_phishing_protection.html Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations – before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent.

   Source: Adapted from community discussion — Directly_Connected

   References

   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 398 · 654 in bank

   What is the process in DevSecOps where all changes in the central code repository are merged and synchronized?

   • AEP
   • BCD
   • CCI
   • DQA

   Show answer

   Answer: C

   Explanation

   CI, short for Continuous Integration, is a software development practice in which all developers merge code changes in a central repository multiple times daily. CD stands for Continuous Delivery, which on top of Continuous Integration, adds the practice of automating the entire software release process. According to that, C is the right answer.

   Source: Adapted from community discussion — alischajan

   References

   • Cisco documentation

   Next question

9. Question 399 · 654 in bank

   What is a function of Cisco AMP for Endpoints?

   • AIt protects against web-based attacks.
   • BIt automates threat responses of an infected host.
   • CIt detects DNS attacks.
   • DIt blocks email-based attacks.

   Show answer

   Answer: B

   Next question

10. Question 400 · 654 in bank

    What does endpoint isolation in Cisco AMP for Endpoints security protect from?

    • Aan infection spreading across the LDAP or Active Directory domain from a user account
    • Ba malware spreading across the user device
    • Can infection spreading across the network
    • Da malware spreading across the LDAP or Active Directory domain from a user account

    Show answer

    Answer: C

    Explanation

    It is an easy one. C. If an endpoint is infected, you isolate it from the rest of the network to avoid propagation, the endpoint itself is already infected so B is not correct. You also can check this out: https://www.cisco.com/c/en/us/support/docs/security/secure-endpoint/218064-troubleshoot-secure-endpoint-stuck-in-is.html#:~:text=Endpoint%20isolation%20is%20a%20feature,data%20exfiltration%20and%20malware%20propagation.

    Source: Adapted from community discussion — DWizard

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 391. 654 questions available.