350-701 practice questions 401–410

1. Question 401 · 654 in bank

   An engineer recently completed the system setup on a Cisco WSA. Which URL information does the system send to SensorBase Network servers?

   • Acomplete URL, without obfuscating the path segments
   • BURL information collected from clients that connect to the Cisco WSA using Cisco AnyConnect
   • Cnone because SensorBase Network Participation is disabled by default
   • Dsummarized server-name information and MD5-hashed path information

   Show answer

   Answer: A

   Explanation

   A is correct - SensorBase is turned on and set to “standard” by default: Limited. Basic participation summarizes server name information and sends MD5-hashed path segments to the SensorBase Network servers. Standard. Enhanced participation sends the entire URL with unobfuscated path segments to the SensorBase Network servers. This option assists in providing a more robust database, and continually improves the integrity of Web Reputation Scores.

   Source: Adapted from community discussion — Mevijil

   References

   • Cisco documentation

   Next question

2. Question 402 · 654 in bank

   Which Cisco DNA Center RESTful PNP API adds and claims a device into a workflow?

   • Aapi/v1/onboarding/workflow
   • Bapi/v1/onboarding/pnp-device/import
   • Capi/v1/onboarding/pnp-device
   • Dapi/v1/file/config

   Show answer

   Answer: B

   Explanation

   POST /dna/intent/api/v1/onboarding/pnp-device/import Onboarding (PnP) API The Device Onboarding API supports the PnP process, giving the developer the option to create a workflow that detects when a device joins the network and communicates with Cisco DNA Center, and then sending the onboarding configuration to the device. https://developer.cisco.com/docs/dna-center/#!device-onboarding/onboarding-pnp-api

   Source: Adapted from community discussion — Toni_Su91

   References

   • cisco.com documentation

   Next question

3. Question 403 · 654 in bank

   Which solution should be leveraged for secure access of a CI/CD pipeline?

   • ADuo Network Gateway
   • BCisco FTD network gateway
   • CSSL WebVPN
   • Dremote access client

   Show answer

   Answer: A

   Explanation

   "....Duo Network Gateway provides granular user and endpoint access control to CI/CD applications and infrastructure over HTTPS, SSH and RDP." https://blogs.cisco.com/developer/cloudnativesecurity01?dtid=osscdc000283

   Source: Adapted from community discussion — batbout

   References

   • cisco.com documentation

   Next question

4. Question 404 · 654 in bank

   DRAG DROP - Drag and drop the threats from the left onto examples of that threat on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

5. Question 405 · 654 in bank

   What is the purpose of CA in a PKI?

   • Ato validate the authenticity of a digital certificate
   • Bto issue and revoke digital certificates
   • Cto certify the ownership of a public key by the named subject
   • Dto create the private key for a digital certificate

   Show answer

   Answer: B

   Explanation

   I would argue here, it could be A) as well. I as user or scripts are able to "issue" or "revoke" certificates, but only CA can grant authenticity...

   Source: Adapted from community discussion — mazimir

   References

   • cisco.com documentation

   Next question

6. Question 406 · 654 in bank

   Which solution detects threats across a private network, public clouds, and encrypted traffic?

   • ACisco Encrypted Traffic Analytics
   • BCisco Stealthwatch
   • CCisco CTA
   • DCisco Umbrella

   Show answer

   Answer: B

   Explanation

   It's actually the other way around.... "Our latest version of Stealthwatch includes new apps, one of which allows you to easily audit your network for cryptographic compliance. This app helps to analyze encrypted traffic for cryptographic compliance, using the Encrypted Traffic Analytics (ETA) technology. It provides an assessment of the “quality” of encryption being used, which is helpful to audit cryptographic compliance, for example, using SSL or early TLS violates PCI compliance. It also helps to understand trends and changes in the amount and type of encryption." You can clearly see here from this statement that ETA is an app that is COMPLEMENTARY to Cisco Stealthwatch. https://blogs.cisco.com/security/cisco-stealthwatch-becomes-the-only-security-analytics-product-to-detect-threats-across-private-networks-public-clouds-and-encrypted-traffic

   Source: Adapted from community discussion — Tthurston1

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 407 · 654 in bank

   What is a benefit of using Cisco Tetration?

   • AIt collects policy compliance data and process details.
   • BIt collects near-real time data from servers and inventories the software packages that exist on servers.
   • CIt collects enforcement data from servers and collects interpacket variation.
   • DIt collects telemetry data from servers and then uses software sensors to analyze flow information.

   Show answer

   Answer: B

   Explanation

   Neither B nor D are accurately correct. The Cisco Tetration Analytics engine in the platform analyzes telemetry data gathered from host and network sensors using advanced machine-learning techniques to identify application dependencies. The platform delivers behavior-based application insight with deep forensics, providing real-time visibility into traffic across all Cisco data centers and a better understanding of dependencies among applications. https://www.cisco.com/c/en/us/solutions/collateral/enterprise/cisco-on-cisco/itb-aci-12192016_tetration-analytics-initial-implementation.html

   Source: Adapted from community discussion — kvothe86

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 408 · 654 in bank

   Which attack type attempts to shut down a machine or network so that users are not able to access it?

   • Abluesnarfing
   • BMAC spoofing
   • Csmurf
   • DIP spoofing

   Show answer

   Answer: C

   Explanation

   Not a fan of the question wording "shut down a machine or network" - didn't know you could click start > shut down for a network! @Cisco - please describe a DDoS attack better! Answer can't be A, B or D which all relate to MITM / access related attack, rather than a DDoS

   Source: Adapted from community discussion — jku2cya

   Next question

9. Question 409 · 654 in bank

   Which Cisco solution integrates Encrypted Traffic Analytics to perform enhanced visibility, promote compliance, shorten response times, and provide administrators with the information needed to provide educated and automated decisions to secure the environment?

   • ACisco ISE
   • BCisco SDN
   • CCisco Security Compliance Solution
   • DCisco DNA Center

   Show answer

   Answer: D

   Explanation

   https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/eta-sda-fabric-deployment-guide-2019sep.pdf Prior to DNA Center 1.3.1, templates were used within Cisco DNA Center to provision, both ETA and FNF on the Cisco Catalyst 9300 and 9400 Series Switches. In this guide, the new Cisco Stealthwatch Security Analytics (SSA) service within Cisco DNA Center v 1.3.1 is used exclusively for provisioning ETA and FNF. The SSA service can also be used to remove ETA and FNF configuration from a previously provisioned device. Note that although the Cisco SSA application is the preferred method for provisioning ETA and FNF in Cisco DNA Center1.3.1 and later, it is still possible to use templates as documented in the previous guides and contained in the appendix of the new ETA for Cisco SD-Access Deployment Guide. However, when using Design 12 templates, there is no support for provisioning border routers in the Cisco SD-Access fabric. Manual configuration of ETA and FNF via CLI is not supported..

   Source: Adapted from community discussion — Jessie45785

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

10. Question 410 · 654 in bank

    Select 2

    Which two components do southbound APIs use to communicate with downstream devices? (Choose two.)

    • AOpFlex
    • Bapplications running over the network
    • COpenFlow
    • Dservices running over the network
    • Eexternal application APIs

    Show answer

    Answer: AC

    Explanation

    A & C are correct: Like OpenFlow, OpFlex is designed for communications between a central controller and network devices but has a different way of distributing the message. While OpenFlow centralizes the network control plane on a controller and can push commands down to OpenFlow enabled network devices. OpFlex centralizes policy control and relies on traditional and distributed network control protocols to push commands down. https://www.sdxcentral.com/networking/sdn/definitions/what-the-definition-of-software-defined-networking-sdn/what-is-openflow/cisco-openflow/

    Source: Adapted from community discussion — Totosos1

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 401. 654 questions available.