350-701 practice questions 571–580

1. Question 571 · 654 in bank

   Which solution should a network administrator deploy to protect a webserver from SQL injection attacks?

   • AIDS
   • BSecure Web Appliance
   • CISE
   • DIPS

   Show answer

   Answer: D

   References

   • cisco.com documentation

   Next question

2. Question 572 · 654 in bank

   What is a capability of Cisco AVC?

   • Aapplication bandwidth enforcement on Cisco IOS platforms
   • Binteroperates by using GET VPN on tunnel interfaces
   • Ctraffic filtering by using a Security Intelligence policy
   • Ddeep packet inspection on IPsec encapsulated traffic

   Show answer

   Answer: A

   Next question

3. Question 573 · 654 in bank

   Which parameter must be set for an invalid certificate handling on a Cisco Seucure Web Appliance with a policy for HTTPS traffic?

   • ADecrypt
   • BReject
   • CAccept
   • DScan

   Show answer

   Answer: A

   References

   • Cisco documentation

   Next question

4. Question 574 · 654 in bank

   A networking team must harden an organization's network from VLAN hopping attacks. The team disables Dynamic Trunking Protocol and puts any unused ports in an unused VLAN. A trunk port is used as a trunk link. What must the team configure next to harden the network against VLAN hopping attacks?

   • Adedicated VLAN ID for all trunk ports
   • Bdisable STP on the network devices
   • CDHCP snooping on all the switches
   • Denable port-based network access control

   Show answer

   Answer: A

   Explanation

   The answers are badly worded. Most probably, it is about a unique vlan id for the native vlan (different from the default vlan 1) https://www.ciscopress.com/articles/article.asp?p=1681033&seqNum=3 https://learningnetwork.cisco.com/s/blogs/a0D3i000002SKPREA4/vlan1-and-vlan-hopping-attack https://learningnetwork.cisco.com/s/question/0D53i00000KssdaCAB/native-vlan-tagging Some chances are that they meant the native vlan tagging.

   Source: Adapted from community discussion — Premium_Pils

   References

   • cisco.com documentation
   • cisco.com documentation

   Next question

5. Question 575 · 654 in bank

   A network engineer configures a site-to-site VPN with a colleague. During testing, the engineer discovers that only phase 1 is up, and application traffic cannot pass. Which configuration parameter must be checked on each device?

   • Ahash algorithm
   • Bpeer IP address
   • Cencryption domain
   • Dpreshared key

   Show answer

   Answer: C

   Explanation

   I believe the answer is C. encryption domain - this is the "interesting traffic" that is meant to be encrypted. If I'm not mistaken, the other options are all performed in phase 1 and phase 1 is up.

   Source: Adapted from community discussion — devildog

   References

   • Cisco documentation

   Next question

6. Question 576 · 654 in bank

   An engineer is deploying a Cisco Email Security Appliance and must configure a sender group that decides which mail policy will process the mail. The configuration must accept incoming mails and relay the outgoing mails from the internal server. Which component must be configured to accept the connection to the listener and meet these requirements on a Cisco Secure Email Gateway?

   • Aaccess list
   • BHAT
   • CRAT
   • Dsender list

   Show answer

   Answer: B

   References

   • Cisco documentation
   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation

   Next question

7. Question 577 · 654 in bank

   

   Refer to the exhibit. An engineer is implementing a certificate based VPN. What is the result of the existing configuration?

   • AOnly an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully.
   • BThe OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.
   • CThe OU of the IKEv2 peer certificate is set to MANGLER.
   • DThe OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER.

   Show answer

   Answer: B

   Explanation

   B: Configuring the IKEv2 Name Mangler Perform this task to specify the IKEv2 name mangler, which is used to derive a name for authorization requests and obtain AAA preshared keys. The name is derived from specified portions of different forms of remote IKE identities or the EAP identity. enable configure terminal crypto ikev2 name-mangler mangler-name dn {common-name | country | domain | locality | organization | organization-unit | state} eap {all | dn {common-name | country | domain | locality | organization | organization-unit | state} | prefix | suffix {delimiter {. | @ | \}}} email {all | domain | username} fqdn {all | domain | hostname} end dn = Derives the name from any of the noted fields in the remote identity of type DN common-name country domain locality organization organization-unit state https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ike2vpn/configuration/xe-16-10/sec-flex-vpn-xe-16-10-book/sec-cfg-flex-serv.html=

   Source: Adapted from community discussion — Smileebloke

   References

   • Cisco documentation

   Next question

8. Question 578 · 654 in bank

   What is the definition of phishing?

   • Amalicious email spoofing attack that targets a specific organization or individual
   • Bimpersonation of an authorized website to deceive users into entering their credentials
   • Cany kind of unwanted, unsolicited digital communication that gets sent out in bulk
   • Dsending fraudulent communications that appear to come from a reputable source

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

9. Question 579 · 654 in bank

   What is capability of EPP compared to EDR?

   • AEPP protects against malware that has already entered the environment, and EDR focuses on protecting against botnets.
   • BEDR protects against email attacks, and EPP focuses on detecting and monitoring phishing and ransomware email attacks.
   • CEDR protects against malicious email attacks, and EPP focuses on suspicious website attacks including DoS and DDoS attempts.
   • DEDR protects against malware that has already entered the environment, and EPP focuses on preventing malware from entering.

   Show answer

   Answer: D

   Next question

10. Question 580 · 654 in bank

    What is considered a cloud data breach?

    • Acyber threats posing as authorized entities
    • Bexploitation of cloud application access
    • Cdeprivation of computing resources
    • Dleaked information that is private

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 571. 654 questions available.