350-401 practice questions 261–270

1. Question 261 · 1003 in bank

   Which deployment option of Cisco NGFW provides scalability?

   • Ainline tap
   • Bhigh availability
   • Cclustering
   • Dtap

   Show answer

   Answer: C

   Explanation

   Clustering lets you group multiple Firepower Threat Defense (FTD) units together as a single logical device. Clustering is only supported for the FTD device on the Firepower 9300 and the Firepower 4100 series. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices.

   Source: Adapted from community discussion — baid

   Next question

2. Question 262 · 1003 in bank

   In a three-tier hierarchical campus network design, which action is a design best-practice for the core layer?

   • Aprovide QoS prioritization services such as marking, queueing, and classification for critical network traffic
   • Bprovide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence
   • Cprovide advanced network security features such as 802.1X, DHCP snooping, VACLs, and port security
   • Dprovide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP

   Show answer

   Answer: B

   Explanation

   A. provide QoS prioritization services such as marking, queueing, and classification for critical network traffic. Distribution layer. B. provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence. Core Layer. C. provide advanced network security features such as 802.1X, DHCP snooping, VACLs, and port security. Access Layer. D. provide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP. Distribution layer. https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html

   Source: Adapted from community discussion — SandyIndia

   References

   • Cisco documentation

   Next question

3. Question 263 · 1003 in bank

   DRAG DROP - Drag and drop the REST API authentication methods from the left onto their descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   you are wrong, OAuth needs an identity provider to get the interchange of Tokens and then the user access without the use of user/pass. OAuth is not an application, its a protocol. Two different things. Answer is correct.

   Source: Adapted from community discussion — Johnconnor2021

   

   Next question

4. Question 264 · 1003 in bank

   In a Cisco SD-Access solution, what is the role of the Identity Services Engine?

   • AIt is leveraged for dynamic endpoint to group mapping and policy definition.
   • BIt provides GUI management and abstraction via apps that share context.
   • CIt is used to analyze endpoint to app flows and monitor fabric status.
   • DIt manages the LISP EID database.

   Show answer

   Answer: A

   Explanation

   Cisco Identity Services Engine (ISE) enables a dynamic and automated approach to policy enforcement that simplifies the delivery of highly secure network access control.

   Source: Adapted from community discussion — Hamzaaa

   Next question

5. Question 265 · 1003 in bank

   DRAG DROP - Drag and drop the solutions that compromise Cisco Cyber Threat Defense from the left onto the objectives they accomplish on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I am pretty sure this is about solutions that COMPRISE Cisco Cyber Threat Defense, not COMPROMISE it :) . Nevertheless, the answer seems correct.

   Source: Adapted from community discussion — bogd

   

   Next question

6. Question 266 · 1003 in bank

   DRAG DROP - An engineer creates the configuration below. Drag and drop the authentication methods from the left into the order of priority on the right. Not all options are used. R1#sh run | i aaa - aaa new-model aaa authentication login default group ACE group AAA_RADIUS local-case aaa session-id common R1# Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The correct answer is: priority 1: AAA servers of ACE group priority 2: AAA servers of AAA_RADIUS group priority 3: local configured username in case-sensitive format priority 4: If no method works, then deny login

   Source: Adapted from community discussion — xziomal9

   References

   • cisco.com documentation
   • Cisco documentation

   

   Next question

7. Question 267 · 1003 in bank

   What is provided by the Stealthwatch component of the Cisco Cyber Threat Defense solution?

   • Areal-time threat management to stop DDoS attacks to the core and access networks
   • Breal-time awareness of users, devices, and traffic on the network
   • Cmalware control
   • Ddynamic threat control for web traffic

   Show answer

   Answer: B

   Explanation

   B is correct "Cisco Stealthwatch collects and analyzes massive amounts of data to give even the largest, most dynamic networks comprehensive internal visibility and protection. It helps security operations teams gain real-time situational awareness of all users, devices, and traffic on the extended network so they can quickly and effectively respond to threats" Page 1 https://media.zones.com/images/pdf/cisco-stealthwatch-solution-overview.pdf

   Source: Adapted from community discussion — LM77

   Next question

8. Question 268 · 1003 in bank

   An engineer must configure an ACL that permits packets which include an ACK in the TCP header. Which entry must be included in the ACL?

   • Aaccess-list 110 permit tcp any any eq 21 tcp-ack
   • Baccess-list 10 permit tcp any any eq 21 established
   • Caccess-list 110 permit tcp any any eq 21 established
   • Daccess-list 10 permit ip any any eq 21 tcp-ack

   Show answer

   Answer: C

   Explanation

   i think: B is ACL 10, so standard acl. Standard acl makes decisions only by ip. C is ACL 110 (Range 100-199 & 2000-2699 is extended acl) so it makes deciscions by ip, protocol etc.

   Source: Adapted from community discussion — chris110

   Next question

9. Question 269 · 1003 in bank

   A client with IP address 209.165.201.25 must access a web server on port 80 at 209.165.200.225. To allow this traffic, an engineer must add a statement to an access control list that is applied in the inbound direction on the port connecting to the web server. Which statement allows this traffic?

   • Apermit tcp host 209.165.200.225 lt 80 host 209.165.201.25
   • Bpermit tcp host 209.165.201.25 host 209.165.200.225 eq 80
   • Cpermit tcp host 209.165.200.225 eq 80 host 209.165.201.25
   • Dpermit tcp host 209.165.200.225 host 209.165.201.25 eq 80

   Show answer

   Answer: C

   Explanation

   The correct answer here is C: Remember that the the interface with the ACL applied is the server interface. so the flow at first will be client ==> server Here there is not any acl applied inbound and outbound. Then the traffic flow must return like this: server ==> client In the server port the acl is applied, so in this case because is return traffic the source ip address and tcp port will be of the server and the destination will be the client. So the statement of the ACL is: permit tcp host 209.165.200.225 eq 80 host 209.165.201.25 (permit the traffic sourced by the server to reach the destination) So the answer is for sure C

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

10. Question 270 · 1003 in bank

    Which standard access control entry permits traffic from odd-numbered hosts in the 10.0.0.0/24 subnet?

    • Apermit 10.0.0.0 0.0.0.1
    • Bpermit 10.0.0.1 0.0.0.254
    • Cpermit 10.0.0.1 0.0.0.0
    • Dpermit 10.0.0.0 255.255.255.254

    Show answer

    Answer: B

    Explanation

    Option "B". https://en.wikipedia.org/wiki/Wildcard_mask Any wildcard bit-pattern can be masked for examination. For example, a wildcard mask of 0.0.0.254 (binary equivalent = 00000000.00000000.00000000.11111110) applied to IP address 10.10.10.2 (00001010.00001010.00001010.00000010) will match even-numbered IP addresses 10.10.10.0, 10.10.10.2, 10.10.10.4, 10.10.10.6 etc. Same mask applied to 10.10.10.1 (00001010.00001010.00001010.00000001) will match odd-numbered IP addresses 10.10.10.1, 10.10.10.3, 10.10.10.5 etc

    Source: Adapted from community discussion — edg

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-401 practice, question 261. 1003 questions available.