350-701 practice questions 441–450

1. Question 441 · 654 in bank

   Which algorithm is an NGE hash function?

   • AHMAC
   • BSHA-1
   • CMD5
   • DSHA-2

   Show answer

   Answer: D

   Explanation

   Aswer D https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/116055-technote-ios-crypto.html NGE algorithms are integrated into Internet Engineering Task Force (IETF), IEEE, and other international standards. As a result, NGE algorithms have been applied to the most recent and highly-secure protocols that protect user data, such as Internet Key Exchange Version 2 (IKEv2). Types of cryptographic algorithms include: Hash - Secure Hash Algorithms (SHA)-2 (SHA-256, SHA-384, and SHA-512)

   Source: Adapted from community discussion — Cokamaniako

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

2. Question 442 · 654 in bank

   An organization is implementing AAA for their users. They need to ensure that authorization is verified for every command that is being entered by the network administrator. Which protocol must be configured in order to provide this capability?

   • AEAPOL
   • BSSH
   • CRADIUS
   • DTACACS+

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

3. Question 443 · 654 in bank

   Select 2

   In which two ways does the Cisco Advanced Phishing Protection solution protect users? (Choose two.)

   • AIt prevents use of compromised accounts and social engineering.
   • BIt automatically removes malicious emails from users' inbox.
   • CIt secures all passwords that are shared in video conferences.
   • DIt prevents trojan horse malware using sensors.
   • EIt prevents all zero-day attacks coming from the Internet.

   Show answer

   Answer: AB

   Explanation

   The following are the benefits of deploying Cisco Advanced Phishing Protection on the email gateway: The Sensor-based solution can be rapidly deployed to ensure that your users are fully protected from damaging breaches. Provides another layer of defense to more effectively secure your email environment. Gain a real-time understanding of senders, learn, and authenticate email identities and behavioral relationships to protect against BEC attacks. Automatically remove malicious emails from the recipient’s inbox [[Answer B]] and calls out identity deception techniques to prevent wire fraud or other advanced attacks. Get detailed visibility into email attack activity, including total messages secured and attacks prevented. Prevents the following: Attacks that use compromised accounts and social engineering. (Answer A) Phishing, ransomware, zero-day attacks and spoofing. BEC with no malicious payload or URL.

   Source: Adapted from community discussion — ross123

   References

   • Cisco documentation

   Next question

4. Question 444 · 654 in bank

   Select 2

   In which two customer environments is the Cisco WSAv connector traffic direction method selected? (Choose two.)

   • ACustomer owns ASA Appliance and Virtual Form Factor is required.
   • BCustomer does not own Cisco hardware and needs Explicit Proxy.
   • CCustomer owns ASA Appliance and SSL Tunneling is required.
   • DCustomer needs to support roaming users.
   • ECustomer does not own Cisco hardware and needs Transparent Redirection (WCCP).

   Show answer

   Answer: AE

   Explanation

   AD the question specifically mentions the Cisco WSA connector and its traffic direction method. The options A and D are related to the WSA connector and its traffic direction method as they mention the use of ASA appliance and the need to support roaming users respectively. While option E is not related to the WSA connector as it is talking about a different method of transparent redirection using WCCP, which is not related to the WSA connector. So the best answer would be A and D, as they are the two environments where the Cisco WSA connector traffic direction method is selected and it is in line with the question.

   Source: Adapted from community discussion — sull3y

   Next question

5. Question 445 · 654 in bank

   Which capability is provided by application visibility and control?

   • Adata obfuscation
   • Bdeep packet inspection
   • Creputation filtering
   • Ddata encryption

   Show answer

   Answer: B

   Explanation

   Its B. https://www.cisco.com/c/en/us/products/routers/avc-control.html AVC uses stateful deep packet inspection (DPI) to classify more than 1400 applications. It can also combine DPI with techniques such as statistical classification, socket caching, service discovery, auto learning, and DNS-AS. Custom applications can detect native apps.

   Source: Adapted from community discussion — Moe1416

   References

   • Cisco documentation

   Next question

6. Question 446 · 654 in bank

   Which feature within Cisco ISE verifies the compliance of an endpoint before providing access to the network?

   • ApxGrid
   • BProfiling
   • CPosture
   • DMAB

   Show answer

   Answer: C

   Next question

7. Question 447 · 654 in bank

   Select 2

   Which two fields are defined in the NetFlow flow? (Choose two.)

   • Adestination port
   • BLayer 4 protocol type
   • Coutput logical interface
   • Dclass of service bits
   • Etype of service byte

   Show answer

   Answer: AE

   Explanation

   The Cisco definition is as below. In this list, there is no Layer 4 field: NetFlow is based on 7 key fields • Source IP address • Destination IP address • Source port number • Destination port number • Layer 3 protocol type (ex. TCP, UDP) • ToS (type of service) byte • Input logical interface If one field is different, a new flow is created in the flow cache.

   Source: Adapted from community discussion — alischajan

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 448 · 654 in bank

   

   Refer to the exhibit. What will happen when this Python script is run?

   • AThe list of computers, policies, and connector statuses will be received from Cisco AMP.
   • BThe list of computers and their current vulnerabilities will be received from Cisco AMP.
   • CThe compromised computers and malware trajectories will be received from Cisco AMP.
   • DThe compromised computers and what compromised them will be received from Cisco AMP.

   Show answer

   Answer: A

   References

   • cisco.com documentation

   Next question

9. Question 449 · 654 in bank

   

   Refer to the exhibit. Consider that any feature of DNS requests, such as the length of the domain name and the number of subdomains, can be used to construct models of expected behavior to which observed values can be compared. Which type of malicious attack are these values associated with?

   • AW32/AutoRun worm
   • BHeartBleed SSL Bug
   • CEternal Blue Windows
   • DSpectre Worm

   Show answer

   Answer: A

   Explanation

   Definitely A. W32/AutoRun worm: https://blog.talosintelligence.com/detecting-dns-data-exfiltration/ "These identify domains with similar patterns such as: 4-9-8-2-2-3-8-5-4-6-2-9-2-3-8-8---redacted---7-.0-0-0-0-0-0-0-0-0-0-0-0-0-49-0-0-0-0-0-0-0-0-0-0-0-0-0.info 5-2-4-6-3-2-2-7-4-8-3-6-7-1-2-3---redacted---0-.0-0-0-0-0-0-0-0-0-0-0-0-0-49-0-0-0-0-0-0-0-0-0-0-0-0-0.info 6-t-y-s-8-l-l-p-6-6-x-q-2-l-2-9-x-7---redacted---a-.0-0-0-0-0-0-0-0-0-0-0-0-0-45-0-0-0-0-0-0-0-0-0-0-0-0-0.info 7-8-5-4-1-2-7-2-7-8-4-5-1-5-0-7---redacted---0-.0-0-0-0-0-0-0-0-0-0-0-0-0-28-0-0-0-0-0-0-0-0-0-0-0-0-0.info which are known to be associated with the W32/AutoRun worm."

   Source: Adapted from community discussion — Arris9

   Next question

10. Question 450 · 654 in bank

    An engineer is adding a Cisco router to an existing environment. NTP authentication is configured on all devices in the environment with the command ntp authentication-key 1 md5 Cisc433392759. There are two routers on the network that are configured as NTP servers for redundancy, 192.168.1.110 and 192.168.1.111. 192.168.1.110 is configured as the authoritative time source. What command must be configured on the new router to use 192.168.1.110 as its primary time source without the new router attempting to offer time to existing devices?

    • Antp server 192.168.1.110 primary key 1
    • Bntp server 192.168.1.110 key 1 prefer
    • Cntp peer 192.168.1.110 prefer key 1
    • Dntp peer 192.168.1.110 key 1 primary

    Show answer

    Answer: B

    Explanation

    B is the correct answer A peer association—The device can either synchronize to another device or allow another device to synchronize to it. A server association—The device synchronizes to a server. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/system_management/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_System_Management_Configuration_Guide/sm_3ntp.html

    Source: Adapted from community discussion — unclemonkeyboy

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 441. 654 questions available.