350-701 practice questions 461–470

1. Question 461 · 654 in bank

   Select 2

   Which two configurations must be made on Cisco ISE and on Cisco TrustSec devices to force a session to be adjusted after a policy change is made? (Choose two.)

   • Aposture assessment
   • Baaa authorization exec default local
   • Ctacacs-server host 10.1.1.250 key password
   • Daaa server radius dynamic-author
   • ECoA

   Show answer

   Answer: DE

   Explanation

   DE:To force a session to be adjusted after a policy change on Cisco ISE (Identity Services Engine) and Cisco TrustSec devices, the following two configurations need to be made: E. CoA (Change of Authorization) CoA, or Change of Authorization, is a feature that allows network devices to dynamically update the policies applied to an authenticated session. By using CoA, Cisco ISE can send a message to the TrustSec devices instructing them to reevaluate and adjust the session based on the updated policy. This ensures that the session reflects the latest policy changes made in Cisco ISE. D. aaa server radius dynamic-author This configuration enables the TrustSec devices to act as a RADIUS dynamic authorization server. With this setting, Cisco ISE can send CoA messages to the TrustSec devices, triggering the session adjustments after a policy change. The TrustSec devices, acting as dynamic authorization servers, will receive the CoA messages from Cisco ISE and update the session accordingly.

   Source: Adapted from community discussion — sull3y

   Next question

2. Question 462 · 654 in bank

   Which Cisco network security device supports contextual awareness?

   • AISE
   • BCisco IOS
   • CCisco ASA
   • DFirepower

   Show answer

   Answer: D

   Explanation

   I say D - Firepower. "Provides highly effective threat prevention and full contextual awareness of users, infrastructure, applications, and content to detect multivector threats and automate defense response." page 11: https://www.cisco.com/c/dam/m/en_sg/cisco-start/assets/pdfs/Cisco_Start_Catalog_1612AP_p08-13Security_LDSL_1211.pdf

   Source: Adapted from community discussion — jku2cya

   References

   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 463 · 654 in bank

   Select 2

   When a next-generation endpoint security solution is selected for a company, what are two key deliverables that help justify the implementation? (Choose two.)

   • Asignature-based endpoint protection on company endpoints
   • Bemail integration to protect endpoints from malicious content that is located in email
   • Creal-time feeds from global threat intelligence centers
   • Dmacro-based protection to keep connected endpoints safe
   • Econtinuous monitoring of all files that are located on connected endpoints

   Show answer

   Answer: CE

   Explanation

   An endpoint security solution includes continuous monitoring, rapid time to detection, and architectural integrations. With threats continually increasing in sophistication and frequency, it is more important than ever to deploy an effective endpoint protection solution. Endpoint security solutions take a cloud-based approach to instantly access the latest threat intelligence without requiring manual updates from security admins. This allows for faster and more automated responses. They continuously monitor all files and applications that enter your network and have the ability to scale and integrate into your existing environment. Cloud-based solutions offer scalability and flexibility and are easy to install, integrate, and manage. There is also less overhead since there is no infrastructure to maintain. https://www.cisco.com/c/en/us/products/security/endpoint-security/index.html

   Source: Adapted from community discussion — reinaldopazsandoval

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 464 · 654 in bank

   A company recently discovered an attack propagating throughout their Windows network via a file named abc123456789xyz.exe. The malicious file was uploaded to a Simple Custom Detection list in the AMP for Endpoints Portal and the currently applied policy for the Windows clients was updated to reference the detection list. Verification testing scans on known infected systems shows that AMP for Endpoints is not detecting the presence of this file as an indicator of compromise. What must be performed to ensure detection of the malicious file?

   • ACheck the box in the policy configuration to send the file to Cisco Threat Grid for dynamic analysis.
   • BUpload the malicious file to the Blocked Application Control List.
   • CUpload the SHA-256 hash for the file to the Simple Custom Detection List.
   • DUse an Advanced Custom Detection List instead of a Simple Custom Detection List.

   Show answer

   Answer: B

   Explanation

   The answer cannot be C, since the question states "The malicious file was uploaded to a Simple Custom Detection list in the AMP for Endpoints Portal", so the AMP already calculated the SHA-256 hash, you don't need to do it again. Since the file is a .exe file, which means it is executable, you should block it from the application control list. Sorry for not posting a link, this was learned from practice.

   Source: Adapted from community discussion — DWizard

   References

   • Cisco documentation

   Next question

5. Question 465 · 654 in bank

   An engineer must set up 200 new laptops on a network and wants to prevent the users from moving their laptops around to simplify administration. Which switch port MAC address security setting must be used?

   • Aaging
   • Bstatic
   • Csticky
   • Dmaximum

   Show answer

   Answer: C

   Next question

6. Question 466 · 654 in bank

   Which service allows a user export application usage and performance statistics with Cisco Application Visibility and Control?

   • ANetFlow
   • BSNORT
   • CSNMP
   • D802.1X

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

7. Question 467 · 654 in bank

   Which solution allows an administrator to provision, monitor, and secure mobile devices on Windows and Mac computers from a centralized dashboard?

   • ACisco Stealthwatch
   • BCisco Umbrella
   • CCisco AMP for Endpoints
   • DCisco ISE

   Show answer

   Answer: D

   Explanation

   I vote for D: Configure Client Provisioning in Cisco ISE Enable client provisioning to allow users to download client provisioning resources and configure agent profiles. You can configure agent profiles for Windows clients, Mac OS X clients, and native supplicant profiles for personal devices. If you disable client provisioning, users attempting to access the network will receive a warning message indicating that they are not able to download client provisioning resources. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010110.html#task_3E2FCAEDD6BF4AD7B05A7AABB8AADCFE

   Source: Adapted from community discussion — Jessie45785

   References

   • Cisco documentation
   • cisco.com documentation

   Next question

8. Question 468 · 654 in bank

   Which parameter is required when configuring a NetFlow exporter on a Cisco router?

   • Aexporter name
   • Bexporter description
   • Csource interface
   • DDSCP value

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

9. Question 469 · 654 in bank

   Which type of encryption uses a public key and a private key?

   • Anonlinear
   • Bsymmetric
   • Clinear
   • Dasymmetric

   Show answer

   Answer: D

   Next question

10. Question 470 · 654 in bank

    With which components does a southbound API within a software-defined network architecture communicate?

    • Aapplications
    • Bcontrollers within the network
    • Cappliances
    • Ddevices such as routers and switches

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 461. 654 questions available.