350-701 practice questions 51–60

1. Question 51 · 654 in bank

   An administrator is adding a new switch onto the network and has configured AAA for network access control. When testing the configuration, the RADIUS authenticates to Cisco ISE but is being rejected. Why is the ip radius source-interface command needed for this configuration?

   • AOnly requests that originate from a configured NAS IP are accepted by a RADIUS server.
   • BThe RADIUS authentication key is transmitted only from the defined RADIUS source interface.
   • CRADIUS requests are generated only by a router if a RADIUS source interface is defined.
   • DEncrypted RADIUS authentication requires the RADIUS source interface be defined.

   Show answer

   Answer: A

   Explanation

   I would go with A When configuring AAA for network access control, the ip radius source-interface command is needed to specify the interface that the switch uses to send RADIUS requests to the server. The source interface is important because it determines the IP address that is used as the NAS-IP-Address attribute in the RADIUS packet. If the RADIUS server is configured to only accept requests that originate from a specific NAS IP address, then the switch must use that address as the source for its requests, or the authentication will fail. This is often the case in enterprise networks where strict access controls are in place. Therefore, the ip radius source-interface command is needed to ensure that the switch sends RADIUS requests from the correct IP address and that the RADIUS server will accept them. Without this command, the authentication may fail or be rejected by the RADIUS server.

   Source: Adapted from community discussion — loser4fun

   References

   • Cisco documentation

   Next question

2. Question 52 · 654 in bank

   Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

   • ATo view bandwidth usage for NetFlow records, the QoS feature must be enabled.
   • BA sysopt command can be used to enable NSEL on a specific interface.
   • CNSEL can be used without a collector configured.
   • DA flow-export event type must be defined under a policy.

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

3. Question 53 · 654 in bank

   Which feature requires a network discovery policy on the Cisco Firepower NGIPS?

   • Asecurity intelligence
   • Bimpact flags
   • Chealth monitoring
   • DURL filtering

   Show answer

   Answer: B

   Explanation

   B right answer as One of the most valuable analysis tools is the impact flag indicator. You will see impact flag calculated for your intrusion events. To help you evaluate the impact that an event has on your network, the Cisco FMC displays an impact level in the table view of intrusion events. For each event, the system adds an impact level icon, whose color indicates the correlation between intrusion data, network discovery data, and vulnerability information

   Source: Adapted from community discussion — yenp

   References

   • Cisco documentation

   Next question

4. Question 54 · 654 in bank

   What is a characteristic of traffic storm control behavior?

   • ATraffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.
   • BTraffic storm control cannot determine if the packet is unicast or broadcast.
   • CTraffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.
   • DTraffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-1E/configuration/guide/storm.html

   Source: Adapted from community discussion — NikoNiko

   References

   • Cisco documentation

   Next question

5. Question 55 · 654 in bank

   DRAG DROP - Drag and drop the Firepower Next Generation Intrusion Prevention System detectors from the left onto the correct definitions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/detecting_specific_threats.html

   References

   • Cisco documentation

   

   Next question

6. Question 56 · 654 in bank

   Select 2

   What are two rootkit types? (Choose two.)

   • Aregistry
   • Bbuffer mode
   • Cuser mode
   • Dbootloader
   • Evirtual

   Show answer

   Answer: CD

   Explanation

   1. Kernel rootkit 2. Hardware or firmware rootkit 3. Hyper-V rootkits 4. Bootloader rootkit or bootkit 5. Memory rootkit 6. User-mode or application rootkit

   Source: Adapted from community discussion — Iarn

   Next question

7. Question 57 · 654 in bank

   

   Refer to the exhibit. Which statement about the authentication protocol used in the configuration is true?

   • AThe authentication request contains only a password
   • BThe authentication request contains only a username
   • CThe authentication and authorization requests are grouped in a single packet.
   • DThere are separate authentication and authorization request packets.

   Show answer

   Answer: C

   Explanation

   C does seem to be the most correct. "RADIUS combines authentication and authorization. The access-accept packets sent by the RADIUS server to the client contain authorization information. This makes it difficult to decouple authentication and authorization." Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13838-10.html

   Source: Adapted from community discussion — testtaker42

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 58 · 654 in bank

   Which deployment model is the most secure when considering risks to cloud adoption?

   • Apublic cloud
   • Bhybrid cloud
   • Ccommunity cloud
   • Dprivate cloud

   Show answer

   Answer: D

   Next question

9. Question 59 · 654 in bank

   What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?

   • AIt allows the administrator to quarantine malicious files so that the application can function, just not maliciously.
   • BIt discovers and controls cloud apps that are connected to a company's corporate environment.
   • CIt deletes any application that does not belong in the network.
   • DIt sends the application information to an administrator to act on.

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/products/security/cloudlock/index.html#~features

   References

   • Cisco documentation

   Next question

10. Question 60 · 654 in bank

    Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?

    • ADNS tunneling
    • BDNSCrypt
    • CDNS security
    • DDNSSEC

    Show answer

    Answer: A

    Explanation

    Reference: https://learn-umbrella.cisco.com/cloud-security/dns-tunneling

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 51. 654 questions available.