350-701 practice questions 491–500

1. Question 491 · 654 in bank

   Select 2

   What are two characteristics of Cisco DNA Center APIs? (Choose two.)

   • AThey are Cisco proprietary.
   • BThey do not support Python scripts.
   • CThey view the overall health of the network.
   • DThey quickly provision new devices.
   • EPostman is required to utilize Cisco DNA Center API calls.

   Show answer

   Answer: CD

   Explanation

   C and D are correct -Use the Know Your Network REST methods to GET information about clients, sites, topology, devices, and issues: Retrieve network health information and site and network physical, Layer 2, Layer 3, and VLAN information. -Configuration Templates with the Template Programmer/Editior is a centralized CLI-management tool that facilitates design and provisioning of workflows in Cisco DNA Center. https://developer.cisco.com/docs/dna-center/#!cisco-dna-center-platform-overview/intent-api-northbound Postman is not required: Python, SDK and postman can be used. https://robertcsapo.medium.com/3-simple-ways-to-use-cisco-dna-center-platform-apis-7eee49b76287 These APIs can be open or proprietary. https://www.ciscopress.com/articles/article.asp?p=3004581&seqNum=2

   Source: Adapted from community discussion — Dinges

   References

   • cisco.com documentation

   Next question

2. Question 492 · 654 in bank

   An engineer is implementing DHCP security mechanisms and needs the ability to add additional attributes to profiles that are created within Cisco ISE. Which action accomplishes this task?

   • AUse DHCP option 82 to ensure that the request is from a legitimate endpoint and send the information to Cisco ISE.
   • BDefine MAC-to-IP address mappings in the switch to ensure that rogue devices cannot get an IP address.
   • CModify the DHCP relay and point the IP address to Cisco ISE.
   • DConfigure DHCP snooping on the switch VLANs and trust the necessary interfaces.

   Show answer

   Answer: C

   Explanation

   C is correct: Under the same interfaces, another ip helper-address command is configured to point to the ISE PSN interface enabled with the DHCP probe. The ISE Policy Service node will not reply to these packets, but the goal is simply to send a copy of the requests to ISE for parsing of DHCP attributes. It is possible to configure multiple IP Helper targets on Cisco devices to allow multiple ISE Policy Service nodes to receive copies of the DHCP requests. https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId-826550277

   Source: Adapted from community discussion — ums008

   References

   • cisco.com documentation

   Next question

3. Question 493 · 654 in bank

   Refer to the exhibit.

   

   The DHCP snooping database resides on router R1, and dynamic ARP inspection is configured only on switch SW2. Which ports must be configured as untrusted so that dynamic ARP inspection operates normally?

   • AP2 and P3 only
   • BP5, P6, and P7 only
   • CP1, P2, P3, and P4 only
   • DP2, P3, and P6 only

   Show answer

   Answer: D

   Explanation

   D - is correct: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/dynarp.html#:~:text=Dynamic%20ARP%20Inspection%20%28DAI%29%20is%20a%20security%20feature,capability%20protects%20the%20network%20from%20certain%20%E2%80%9Cman-in-the-middle%E2%80%9D%20attacks. To handle cases in which some switches in a VLAN run DAI and other switches do not, the interfaces connecting such switches should be configured as untrusted. To validate the bindings of packets from non-DAI switches, however, the switch running DAI should be configured with ARP ACLs. When it is not feasible to determine such bindings, switches running DAI should be isolated from non-DAI switches at Layer 3.

   Source: Adapted from community discussion — Jessie45785

   References

   • Cisco documentation

   Next question

4. Question 494 · 654 in bank

   Which solution operates as a cloud-native CASB?

   • ACisco Stealthwatch Cloud
   • BCisco Umbrella
   • CCisco pxGrid
   • DCisco CloudLock

   Show answer

   Answer: D

   Explanation

   I vote for D: Cisco Umbrella is a CASB but there is no statement on the web that it is cloud-native CASB, but this is typical Cisco R&D moronic question https://www.cisco.com/c/en/us/products/security/cloudlock/index.html Cisco Cloudlock is a cloud-native cloud access security broker (CASB) that helps you move to the cloud safely. It protects your cloud users, data, and apps. Cloudlock's simple, open, and automated approach uses APIs to manage the risks in your cloud app ecosystem. With Cloudlock you can more easily combat data breaches while meeting compliance regulations. (nothing like that can be found regarding Umbrella, the closest it get is here but again it does not state that umbrella is cloud native CASB https://www.cisco.com/c/dam/en/us/products/collateral/security/aag-cisco-umbrella.pdf )

   Source: Adapted from community discussion — Jessie45785

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

5. Question 495 · 654 in bank

   Which entity is responsible for encrypting data in transit using an IaaS model versus a SaaS model?

   • ACloud Application Developer for IaaS and Cloud SLA Manager for SaaS
   • BCloud SLA Manager for IaaS and Cloud Application Developer for SaaS
   • CCloud Service Provider for IaaS and Cloud Service Customer for SaaS
   • DCloud Service Customer for IaaS and Cloud Service Provider for SaaS

   Show answer

   Answer: D

   Explanation

   The answer is D In an IaaS (Infrastructure as a Service) model, the customer is responsible for encrypting data in transit. This is because the customer has control over the underlying infrastructure, including the servers, storage, and networking components. The customer can choose to use a variety of encryption methods, such as TLS/SSL, IPsec, or VPN. In a SaaS (Software as a Service) model, the cloud provider is responsible for encrypting data in transit. This is because the cloud provider has control over the underlying infrastructure and the software application. The cloud provider will typically use TLS/SSL to encrypt data in transit. https://bard.google.com/chat/73d702485234cc30

   Source: Adapted from community discussion — Mulema

   Next question

6. Question 496 · 654 in bank

   Select 2

   Which two aspects of the IaaS cloud service model are managed by the service provider? (Choose two.)

   • Avirtual machines
   • Bphysical network
   • Capplications
   • Dhypervisors
   • Evirtual network

   Show answer

   Answer: BD

   Explanation

   B and D - I meant B and D! https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-azure/azure-iaas/#faq This is the most basic category of cloud computing services. With IaaS, you rent IT infrastructure—servers and virtual machines (VMs), storage, networks, and operating systems—from a cloud provider on a pay-as-you-go basis. Difference between virtualization and virtual machine: https://www.vmware.com/solutions/virtualization.html Virtual Machines are not Virtualization - https://medium.com/chenjd-xyz/azure-fundamental-iaas-paas-saas-973e0c406de7 Hypervisor is Virtualization

   Source: Adapted from community discussion — Jessie45785

   References

   • azure.microsoft.com documentation

   Next question

7. Question 497 · 654 in bank

   For a given policy in Cisco Umbrella, how should a customer block websites based on a custom list?

   • Aby adding the website IP addresses to the Cisco Umbrella blocklist
   • Bby adding the websites to a blocked type destination list
   • Cby specifying blocked domains in the policy settings
   • Dby specifying the websites in a custom blocked category

   Show answer

   Answer: B

   Explanation

   B To block a URL, simply enter it into a blocked destination list, or create a new blocked destination list just for URLs. To do this, navigate to Policies > Destination Lists, expand a Destination list, add a URL and then click Save. https://support.umbrella.com/hc/en-us/articles/115004518146-Umbrella-Dashboard-New-Features-Custom-blocked-URLs#:~:text=To%20block%20a%20URL%2C%20simply,URL%20and%20then%20click%20Save.

   Source: Adapted from community discussion — cyberwhizzy0

   Next question

8. Question 498 · 654 in bank

   Which solution provides end-to-end visibility of applications and insights about application performance?

   • ACisco AppDynamics
   • BCisco Tetration
   • CCisco Secure Cloud Analytics
   • DCisco Cloudlock

   Show answer

   Answer: A

   Explanation

   AppDynamics was another company acquired by Cisco. AppDynamics (or AppD for short) provides end-to-end visibility of applications and can provide insights about application performance.

   Source: Adapted from community discussion — Mocix

   References

   • Cisco documentation

   Next question

9. Question 499 · 654 in bank

   Which algorithm does ISAKMP use to securely derive encryption and integrity keys?

   • ARSA
   • BAES
   • C3DES
   • DDiffie-Hellman

   Show answer

   Answer: D

   Next question

10. Question 500 · 654 in bank

    A company discovered an attack propagating through their network via a file. A custom file detection policy was created in order to track this in the future and ensure no other endpoints execute to infected file. In addition, it was discovered during testing that the scans are not detecting the file as an indicator of compromise. What must be done in order to ensure that the policy created is functioning as it should?

    • ACreate an IP block list for the website from which the file was downloaded.
    • BBlock the application that the file was using to open.
    • CUpload the hash for the file into the policy.
    • DSend the file to Cisco Threat Grid for dynamic analysis.

    Show answer

    Answer: C

    Explanation

    i would go with C here because it looks like they are refering to the "custom detection list" from FMC(Firepower) which is part of the File Policy. With this you can do the following: Override File Disposition Using Custom Lists If a file has a disposition in the AMP cloud that you know to be incorrect, you can add the file’s SHA-256 value to a file list that overrides the disposition from the cloud: To treat a file as if the AMP cloud assigned a clean disposition, add the file to the clean list. To treat a file as if the AMP cloud assigned a malware disposition, add the file to the custom detection list. On subsequent detection, the device either allows or blocks the file without reevaluating the file's disposition. You can use the clean list or custom detection list per file policy. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/file_policies_and_advanced_malware_protection.html

    Source: Adapted from community discussion — zeroC00L

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 491. 654 questions available.