350-701 practice questions 41–50

1. Question 41 · 654 in bank

   

   Refer to the exhibit. A network engineer is testing NTP authentication and realizes that any device synchronizes time with this router and that NTP authentication is not enforced. What is the cause of this issue?

   • AThe hashing algorithm that was used was MD5, which is unsupported.
   • BThe key was configured in plain text.
   • CNTP authentication is not enabled.
   • DThe router was not rebooted after the NTP configuration updated.

   Show answer

   Answer: C

   Explanation

   The following example shows how to configure the system to synchronize only to systems providing authentication keys 1 to 3 in their NTP packets: Router(config)# ntp authenticate Router(config)# ntp authentication-key 1 md5 key1 Router(config)# ntp authentication-key 2 md5 key2 Router(config)# ntp authentication-key 3 md5 key3 Router(config)# ntp trusted-key 1 - 3 https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/bsm/command/bsm-cr-book/bsm-cr-n1.html#wp2849112306 ntp authenticate - Enables NTP authentication.

   Source: Adapted from community discussion — Toni_Su91

   References

   • Cisco documentation

   Next question

2. Question 42 · 654 in bank

   An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?

   • AEnable traffic analysis in the Cisco FTD.
   • BImplement pre-filter policies for the CIP preprocessor.
   • CConfigure intrusion rules for the DNP3 preprocessor.
   • DModify the access control policy to trust the industrial traffic.

   Show answer

   Answer: C

   Explanation

   i would opt for C. DNP3 is a SCADA Protocol which in turn is widly used in the industrial network world. "The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields." https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/scada_preprocessors.html

   Source: Adapted from community discussion — zeroC00L

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 43 · 654 in bank

   An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed. What must be done to ensure that all devices can communicate together?

   • AChange the management port on Cisco FMC so that it pushes the change to all managed Cisco FTD devices.
   • BSet the sftunnel port to 8305.
   • CManually change the management port on Cisco FMC and all managed Cisco FTD devices.
   • DSet the sftunnel to go through the Cisco FTD.

   Show answer

   Answer: C

   Explanation

   Answer should be C https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Security__Internet_Access__and_Communication_Ports.html 8305/tcp Securely communicate between appliances in a deployment. " If you change this port, you must change it for all appliances in the deployment. We recommend you keep the default."

   Source: Adapted from community discussion — MoII

   References

   • Cisco documentation
   • Cisco documentation

   Next question

4. Question 44 · 654 in bank

   An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of 172.19.20.24. Which command on the hub will allow the administrator to accomplish this?

   • Acrypto isakmp identity address 172.19.20.24
   • Bcrypto ca identity 172.19.20.24
   • Ccrypto enrollment peer address 172.19.20.24
   • Dcrypto isakmp key Cisco0123456789 172.19.20.24

   Show answer

   Answer: D

   Next question

5. Question 45 · 654 in bank

   A Cisco FTD engineer is creating a newIKEv2 policy called s2s00123456789 for their organization to allow additional protocols to terminate network devices with. They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy. What should be done in order to support this?

   • AChange the encryption to AES* to support all AES algorithms in the primary policy.
   • BMake the priority for the primary policy 10 and the new policy 1.
   • CChange the integrity algorithms to SHA* to support all SHA algorithms in the primary policy.
   • DMake the priority for the new policy 5 and the primary policy 1.

   Show answer

   Answer: D

   Explanation

   Correct answer should be D The lower the number, the higher the priority. https://docs.defenseorchestrator.com/Configuration_Guides/Objects/Configuring_the_Global_IKE_Policy/Managing_FTD_IKEv2_Policies Priority— The relative priority of the IKE policy, from 1 to 65,535. The priority determines the order of the IKE policy compared by the two negotiating peers when attempting to find a common security association (SA). If the remote IPsec peer does not support the parameters selected in your highest priority policy, it tries to use the parameters defined in the next lowest priority. The lower the number, the higher the priority.

   Source: Adapted from community discussion — MoII

   References

   • Cisco documentation

   Next question

6. Question 46 · 654 in bank

   Select 2

   Which two kinds of attacks are prevented by multifactor authentication? (Choose two.)

   • Aphishing
   • Bbrute force
   • Cman-in-the-middle
   • DDDOS
   • Etear drop

   Show answer

   Answer: AB

   Explanation

   mfa does not prevent phishing. I've seen phishing attacks where people managed to get them to send the code from the mfa device. Basically one way is they send a marketing with a reply to unsubscribe, having already obtained the password, when someones texts stop or whatever they log in, and say please tell us the six digit code just messaged to your phone in order to unsubscribe. It helps prevent as the above is quite uncommon but it doesn't prevent it.

   Source: Adapted from community discussion — Benkelly18

   References

   • Cisco documentation
   • Cisco documentation

   Next question

7. Question 47 · 654 in bank

   What is a functional difference between a Cisco ASA and Cisco IOS router with Zone-Based Policy Firewall?

   • AThe Cisco ASA can be configured for high availability, whereas the Cisco IOS router with Zone-Based Policy Firewall cannot.
   • BThe Cisco IOS router with Zone-Based Policy Firewall can be configured for high availability, whereas the Cisco ASA cannot.
   • CThe Cisco ASA denies all traffic by default, whereas the Cisco IOS router with Zone-Based Policy Firewall starts out by allowing all traffic, even on untrusted interfaces.
   • DThe Cisco IOS router with Zone-Based Policy Firewall denies all traffic by default, whereas Cisco ASA starts out by allowing traffic until rules are added.

   Show answer

   Answer: D

   Explanation

   https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router. https://networklessons.com/cisco/asa-firewall/cisco-asa-access-list Without any access-lists, the ASA will allow traffic from a higher security level to a lower security level https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217679-asa-access-control-list-configuration-ex.html By default, traffic that passes from a lower security level interface to a higher security level interface is denied whereas traffic from a higher security level interface to a lower security level interface is allowed. This behavior can also be overridden with an ACL. D) is the closest answer.

   Source: Adapted from community discussion — Premium_Pils

   References

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation

   Next question

8. Question 48 · 654 in bank

   An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is required to complete the flow record?

   • Acache timeout active 60
   • Bdestination 1.1.1.1
   • Cmatch ipv4 ttl
   • Dtransport udp 2055

   Show answer

   Answer: C

   Explanation

   B Once the Flow Record has been created you would tie it to a Flow Exporter. Flow Exporter configuration defines the physical or virtual Flow Collector IP Address to which NetFlow data is sent. It also defines the source interface from which the Flow Exporter device will send NetFlow data, this can be a physical or logical address; it is also worth considering using a Loopback interface to source NetFlow data from as a Loopback typically will remain up even when other interfaces fail therefore enabling continuous transport (where routing permits) This is also where the transport protocol (TCP or UDP) and destination port is defined; the destination port is specific to the NetFlow Collector and in this case refers to the port used by the Stealthwatch Flow Collector. To define a Flow Exporter, follow these steps: flow exporter Stealthwatch_Exporter description Stealthwatch Export to Flow Collector destination [Collector_IP_Address] source [Physical_Interface | Logical_Interface] transport udp 2055 https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/config-trouble-netflow-stealth.pdf

   Source: Adapted from community discussion — Smileebloke

   References

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 49 · 654 in bank

   An engineer is adding a Cisco DUO solution to the current TACACS+ deployment using Cisco ISE. The engineer wants to authenticate users using their account when they log into network devices. Which action accomplishes this task?

   • AConfigure Cisco DUO with the external Active Directory connector and tie it to the policy set within Cisco ISE.
   • BInstall and configure the Cisco DUO Authentication Proxy and configure the identity source sequence within Cisco ISE.
   • CModify the current policy with the condition MFA: SourceSequence:DUO=true in the authorization conditions within Cisco ISE.
   • DCreate an identity policy within Cisco ISE to send all authentication requests to Cisco DUO.

   Show answer

   Answer: B

   Explanation

   Yes, B is correct. Scheme & explanation: https://community.cisco.com/t5/security-knowledge-base/duo-mfa-integration-with-ise-for-tacacs-device-administration/ta-p/3881767 DUO scheme: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214813-configure-duo-two-factor-authentication.html A - "configure DUO external Active Directory connector + tie it to the policy set within Cisco ISE" - DUO uses own Authentication Proxy server, which connects to AD (not called "AD connector") and more importantly - it is impossible to configure ISE policy with DUO AD connector. Nonsense. In policy can be used only "AD connector", which is ISE connection to AD (i. e. AD Join Point) but it has nothing to do with DUO. C - not existing condition in ISE https://www.cisco.com/c/en/us/td/docs/security/ise/3-0/admin_guide/b_ISE_admin_3_0/b_ISE_admin_30_segmentation.html#ID37 D - nonsense, ISE doesn't have any Identity Policy as I know (I also Googled it for sure)

   Source: Adapted from community discussion — NikoNiko

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation

   Next question

10. Question 50 · 654 in bank

    What is the function of the crypto isakmp key cisc406143794 address 0.0.0.0 0.0.0.0 command when establishing an IPsec VPN tunnel?

    • AIt prevents all IP addresses from connecting to the VPN server.
    • BIt configures the pre-shared authentication key.
    • CIt configures the local address for the VPN server.
    • DIt defines what data is going to be encrypted via the VPN.

    Show answer

    Answer: B

    Explanation

    This command is used to configure pre-shared-key for IPsec remote acess users on the Cisco router. Address is mentioned as 0.0.0.0 0.0.0.0 because the users will be connecting from random ip addresses and it is almost impossible to mention all the ip addresses. Hence, 0.0.0.0 0.0.0.0 is used to allow all public ip addresses.

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 41. 654 questions available.