Prepare for the Actual CCNP Security 350-701 Exam Practice Materials Collection
CCNP Security Certified Official Practice Test 350-701 - Mar-2023
Cisco 350-701 Exam Topics:
| Section | Weight | Objectives |
|---|---|---|
| Security Concepts | 25% | 1.Explain common threats against on-premises and cloud environments
2.Compare common security vulnerabilities such as software bugs, weak and/or hardcoded passwords, SQL injection, missing encryption, buffer overflow, path traversal, cross-site scripting/forgery |
| Content Security | 15% | 1.Implement traffic redirection and capture methods 2.Describe web proxy identity and authentication including transparent user identification 3.Compare the components, capabilities, and benefits of local and cloud-based email and web solutions (ESA, CES, WSA) 4.Configure and verify web and email security deployment methods to protect on-premises and remote users (inbound and outbound controls and policy management) 5.Configure and verify email security features such as SPAM filtering, antimalware filtering, DLP, blacklisting, and email encryption 6.Configure and verify secure internet gateway and web security features such as blacklisting, URL filtering, malware scanning, URL categorization, web application filtering, and TLS decryption 7.Describe the components, capabilities, and benefits of Cisco Umbrella 8.Configure and verify web security controls on Cisco Umbrella (identities, URL content settings, destination lists, and reporting) |
| Endpoint Protection and Detection | 10% | 1.Compare Endpoint Protection Platforms (EPP) and Endpoint Detection & Response (EDR) solutions 2.Explain antimalware, retrospective security, Indication of Compromise (IOC), antivirus, dynamic file analysis, and endpoint-sourced telemetry 3.Configure and verify outbreak control and quarantines to limit infection 4.Describe justifications for endpoint-based security 5.Describe the value of endpoint device management and asset inventory such as MDM 6.Describe the uses and importance of a multifactor authentication (MFA) strategy 7.Describe endpoint posture assessment solutions to ensure endpoint security 8.Explain the importance of an endpoint patching strategy |
Certification Path for Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)
This exam helps you prepare to take the 350-701 Implementing Cisco Enterprise Network Core Technologies (ENCOR) exam, which is part of four new certifications:
- CCIE Enterprise Wireless
- CCNP® Enterprise
- CCIE® Enterprise Infrastructure
- Cisco Certified Specialist - Enterprise Core
NEW QUESTION 243
Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?
- A. Network Discovery
- B. Intrusion
- C. Access Control
- D. Correlation
Answer: A
Explanation:
The Firepower System uses network discovery and identity policies to collect host, application, and user data for traffic on your network. You can use certain types of discovery and identity data to build a comprehensive map of your network assets, perform forensic analysis, behavioral profiling, access control, and mitigate and respond to the vulnerabilities and exploits to which your organization is susceptible. You can configure your network discovery policy to perform host and application detection. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/introduction_to_network_discovery_and_identity.html for traffic on your network. You can use certain types of discovery and identity data to build a comprehensive map of your network assets, perform forensic analysis, behavioral profiling, access control, and mitigate and respond to the vulnerabilities and exploits to which your organization is susceptible.
You can configure your network discovery policy to perform host and application detection.
The Firepower System uses network discovery and identity policies to collect host, application, and user data for traffic on your network. You can use certain types of discovery and identity data to build a comprehensive map of your network assets, perform forensic analysis, behavioral profiling, access control, and mitigate and respond to the vulnerabilities and exploits to which your organization is susceptible. You can configure your network discovery policy to perform host and application detection. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/introduction_to_network_discovery_and_identity.html
NEW QUESTION 244
What is the function of SDN southbound API protocols?
- A. to allow for the static configuration of control plane applications
- B. to allow for the dynamic configuration of control plane applications
- C. to enable the controller to make changes
- D. to enable the controller to use REST
Answer: C
Explanation:
NEW QUESTION 245
Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two)
- A. encryption
- B. automation
- C. assurance
- D. authentication
- E. accounting
Answer: B,C
Explanation:
What Cisco DNA Center enables you to do Automate: Save time by using a single dashboard to manage and automate your network. Quickly scale your business with intuitive workflows and reusable templates. Configure and provision thousands of network devices across your enterprise in minutes, not hours. Secure policy: Deploy group-based secure access and network segmentation based on business needs. With Cisco DNA Center, you apply policy to users and applications instead of to your network devices. Automation reduces manual operations and the costs associated with human errors, resulting in more uptime and improved security. Assurance then assesses the network and uses context to turn data into intelligence, making sure that changes in the network device policies achieve your intent. Assurance: Monitor, identify, and react in real time to changing network and wireless conditions. Cisco DNA Center uses your network's wired and wireless devices to create sensors everywhere, providing real-time feedback based on actual network conditions. The Cisco DNA Assurance engine correlates network sensor insights with streaming telemetry and compares this with the current context of these data sources. With a quick check of the health scores on the Cisco DNA Center dashboard, you can see where there is a performance issue and identify the most likely cause in minutes. Extend ecosystem: With the new Cisco DNA Center platform, IT can now integrate Cisco solutions and thirdparty technologies into a single network operation for streamlining IT workflows and increasing business value and innovation. Cisco DNA Center allows you to run the network with open interfaces with IT and business applications, integrates across IT operations and technology domains, and can manage heterogeneous network devices. Reference: https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/dna-center/nb-06- cisco-dna-center-aag-cte-en.html Automate: Save time by using a single dashboard to manage and automate your network. Quickly scale your business with intuitive workflows and reusable templates. Configure and provision thousands of network devices across your enterprise in minutes, not hours.
Secure policy: Deploy group-based secure access and network segmentation based on business needs. With Cisco DNA Center, you apply policy to users and applications instead of to your network devices. Automation reduces manual operations and the costs associated with human errors, resulting in more uptime and improved security. Assurance then assesses the network and uses context to turn data into intelligence, making sure that changes in the network device policies achieve your intent.
Assurance: Monitor, identify, and react in real time to changing network and wireless conditions. Cisco DNA Center uses your network's wired and wireless devices to create sensors everywhere, providing real-time feedback based on actual network conditions. The Cisco DNA Assurance engine correlates network sensor insights with streaming telemetry and compares this with the current context of these data sources. With a quick check of the health scores on the Cisco DNA Center dashboard, you can see where there is a performance issue and identify the most likely cause in minutes.
Extend ecosystem: With the new Cisco DNA Center platform, IT can now integrate Cisco solutions and thirdparty technologies into a single network operation for streamlining IT workflows and increasing business value and innovation. Cisco DNA Center allows you to run the network with open interfaces with IT and business applications, integrates across IT operations and technology domains, and can manage heterogeneous network devices.
What Cisco DNA Center enables you to do Automate: Save time by using a single dashboard to manage and automate your network. Quickly scale your business with intuitive workflows and reusable templates. Configure and provision thousands of network devices across your enterprise in minutes, not hours. Secure policy: Deploy group-based secure access and network segmentation based on business needs. With Cisco DNA Center, you apply policy to users and applications instead of to your network devices. Automation reduces manual operations and the costs associated with human errors, resulting in more uptime and improved security. Assurance then assesses the network and uses context to turn data into intelligence, making sure that changes in the network device policies achieve your intent. Assurance: Monitor, identify, and react in real time to changing network and wireless conditions. Cisco DNA Center uses your network's wired and wireless devices to create sensors everywhere, providing real-time feedback based on actual network conditions. The Cisco DNA Assurance engine correlates network sensor insights with streaming telemetry and compares this with the current context of these data sources. With a quick check of the health scores on the Cisco DNA Center dashboard, you can see where there is a performance issue and identify the most likely cause in minutes. Extend ecosystem: With the new Cisco DNA Center platform, IT can now integrate Cisco solutions and thirdparty technologies into a single network operation for streamlining IT workflows and increasing business value and innovation. Cisco DNA Center allows you to run the network with open interfaces with IT and business applications, integrates across IT operations and technology domains, and can manage heterogeneous network devices. Reference: https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/dna-center/nb-06- cisco-dna-center-aag-cte-en.html
NEW QUESTION 246
Which cloud service offering allows customers to access a web application that is being hosted, managed, and maintained by a cloud service provider?
- A. IaC
- B. PaaS
- C. SaaS
- D. IaaS
Answer: C
NEW QUESTION 247
What is the benefit of integrating Cisco ISE with a MDM solution?
- A. It provides network device administration access
- B. It provides the ability to add applications to the mobile device through Cisco ISE
- C. It provides compliance checks for access to the network
- D. It provides the ability to update other applications on the mobile device
Answer: C
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/ m_ise_interoperability_mdm.html
https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/ m_ise_interoperability_mdm.html
NEW QUESTION 248
What is a benefit of using Cisco FMC over Cisco ASDM?
- A. Cisco FMC supports all firewall products whereas Cisco ASDM only supports Cisco ASA devices
- B. Cisco FMC provides centralized management while Cisco ASDM does not.
- C. Cisco FMC uses Java while Cisco ASDM uses HTML5.
- D. Cisco FMC supports pushing configurations to devices while Cisco ASDM does not.
Answer: A
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html
NEW QUESTION 249
How does Cisco Advanced Phishing Protection protect users?
- A. It uses machine learning and real-time behavior analytics.
- B. It determines which identities are perceived by the sender
- C. It validates the sender by using DKIM.
- D. It utilizes sensors that send messages securely.
Answer: A
Explanation:
Explanation Explanation Cisco Advanced Phishing Protection provides sender authentication and BEC detection capabilities. It uses advanced machine learning techniques, real-time behavior analytics, relationship modeling, and telemetry to protect against identity deception-based threats. Reference: https://docs.ces.cisco.com/docs/advanced-phishing-protection Explanation Cisco Advanced Phishing Protection provides sender authentication and BEC detection capabilities. It uses advanced machine learning techniques, real-time behavior analytics, relationship modeling, and telemetry to protect against identity deception-based threats.
Explanation Explanation Cisco Advanced Phishing Protection provides sender authentication and BEC detection capabilities. It uses advanced machine learning techniques, real-time behavior analytics, relationship modeling, and telemetry to protect against identity deception-based threats. Reference: https://docs.ces.cisco.com/docs/advanced-phishing-protection
NEW QUESTION 250
What is an attribute of the DevSecOps process?
- A. mandated security controls and check lists
- B. isolated security team
- C. security scanning and theoretical vulnerabilities
- D. development security
Answer: D
Explanation:
Explanation
Explanation
DevSecOps (development, security, and operations) is a concept used in recent years to describe how to move security activities to the start of the development life cycle and have built-in security practices in the continuous integration/continuous deployment (CI/CD) pipeline. Thus minimizing vulnerabilities and bringing security closer to IT and business objectives.
Three key things make a real DevSecOps environment:
+ Security testing is done by the development team.
+ Issues found during that testing is managed by the development team.
+ Fixing those issues stays within the development team.
NEW QUESTION 251
In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint Protection Platform?
- A. when there is a need for traditional anti-malware detection
- B. when there te no firewall on the network
- C. when there is a need to have more advanced detection capabilities
- D. when there is no need to have the solution centrally managed
Answer: A
NEW QUESTION 252
Drag and drop the Firepower Next Generation Intrustion Prevention System detectors from the left onto the correct definitions on the right.
Answer:
Explanation:
Explanation
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/detecti
NEW QUESTION 253
What is a benefit of performing device compliance?
- A. Providing multi-factor authentication
- B. Device classification and authorization
- C. Providing attribute-driven policies
- D. Verification of the latest OS patches
Answer: D
NEW QUESTION 254
A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose two)
- A. allow
- B. monitor
- C. permit
- D. reset
- E. trust
Answer: B,E
Explanation:
Explanation
Explanation
Each rule also has an action, which determines whether you monitor, trust, block, or allow matching traffic.
Note: With action "trust", Firepower does not do any more inspection on the traffic. There will be no intrusion protection and also no file-policy on this traffic.
NEW QUESTION 255
What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?
- A. Cisco Umbrella
- B. External Threat Feeds
- C. Cisco Threat Grid
- D. Cisco Stealthwatch
Answer: C
Explanation:
Cisco Threat Intelligence Director (CTID) can be integrated with existing Threat Intelligence Platforms deployed by your organization to ingest threat intelligence automatically. Reference: https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligencedirector Cisco Threat Intelligence Director (CTID) can be integrated with existing Threat Intelligence Platforms deployed by your organization to ingest threat intelligence automatically. Reference: https://blogs.cisco.com/developer/automate-threat-intelligence-using-cisco-threat-intelligencedirector
NEW QUESTION 256
What are the two most commonly used authentication factors in multifactor authentication? (Choose two.)
- A. encryption factor
- B. biometric factor
- C. time factor
- D. knowledge factor
- E. confidentiality factor
Answer: B,D
NEW QUESTION 257
How is DNS tunneling used to exfiltrate data out of a corporate network?
- A. It corrupts DNS servers by replacing the actual IP address with a rogue address to collect information or start other attacks.
- B. It redirects DNS requests to a malicious server used to steal user credentials, which allows further damage and theft on the network.
- C. It leverages the DNS server by permitting recursive lookups to spread the attack to other DNS servers.
- D. It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.
Answer: D
Explanation:
Domain name system (DNS) is the protocol that translates human-friendly URLs, such as securitytut.com, into IP addresses, such as 183.33.24.13. Because DNS messages are only used as the beginning of each communication and they are not intended for data transfer, many organizations do not monitor their DNS traffic for malicious activity. As a result, DNS-based attacks can be effective if launched against their networks. DNS tunneling is one such attack.
An example of DNS Tunneling is shown below:
The attacker incorporates one of many open-source DNS tunneling kits into an authoritative DNS nameserver (NS) and malicious payload.
2. An IP address (e.g. 1.2.3.4) is allocated from the attacker's infrastructure and a domain name (e.g. attackerdomain.com) is registered or reused. The registrar informs the top-level domain (.com) nameservers to refer requests for attackerdomain.com to ns.attackerdomain.com, which has a DNS record mapped to 1.2.3.4
3. The attacker compromises a system with the malicious payload. Once the desired data is obtained, the payload encodes the data as a series of 32 characters (0-9, A-Z) broken into short strings (3KJ242AIE9, P028X977W,...).
4. The payload initiates thousands of unique DNS record requests to the attacker's domain with each string as a part of the domain name (e.g. 3KJ242AIE9.attackerdomain.com). Depending on the attacker's patience and stealth, requests can be spaced out over days or months to avoid suspicious network activity. 5. The requests are forwarded to a recursive DNS resolver. During resolution, the requests are sent to the attacker's authoritative DNS nameserver, 6. The tunneling kit parses the encoded strings and rebuilds the exfiltrated data. Reference: https://learn-umbrella.cisco.com/i/775902-dns-tunneling/0
5. The requests are forwarded to a recursive DNS resolver. During resolution, the requests are sent to the attacker's authoritative DNS nameserver,
6. The tunneling kit parses the encoded strings and rebuilds the exfiltrated data.
a part of the domain name (e.g. 3KJ242AIE9.attackerdomain.com). Depending on the attacker's patience and stealth, requests can be spaced out over days or months to avoid suspicious network activity. 5. The requests are forwarded to a recursive DNS resolver. During resolution, the requests are sent to the attacker's authoritative DNS nameserver, 6. The tunneling kit parses the encoded strings and rebuilds the exfiltrated data. Reference: https://learn-umbrella.cisco.com/i/775902-dns-tunneling/0
NEW QUESTION 258
An organization wants to secure data in a cloud environment. Its security model requires that all users be authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and dat a. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these requirements?
- A. Virtual routing and forwarding
- B. Microsegmentation
- C. Access control policy
- D. Virtual LAN
Answer: B
Explanation:
Explanation
Zero Trust is a security framework requiring all users, whether in or outside the organization's network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data. Zero Trust assumes that there is no traditional network edge; networks can be local, in the cloud, or a combination or hybrid with resources anywhere as well as workers in any location.
The Zero Trust model uses microsegmentation - a security technique that involves dividing perimeters into small zones to maintain separate access to every part of the network - to contain attacks.
NEW QUESTION 259
Due to a traffic storm on the network, two interfaces were error-disabled, and both interfaces sent SNMP traps.
Which two actions must be taken to ensure that interfaces are put back into service? (Choose two)
- A. Ensure that interfaces are configured with the error-disable detection and recovery feature Explanation
- B. Enter the shutdown and no shutdown commands on the interfaces.
- C. Use EEM to have the ports return to service automatically in less than 300 seconds.
- D. Enable the snmp-server enable traps command and wait 300 seconds
- E. Have Cisco Prime Infrastructure issue an SNMP set command to re-enable the ports after the pre configured interval.
Answer: A,B
Explanation:
Explanation
You can also bring up the port by using these commands:
+ The "shutdown" interface configuration command followed by the "no shutdown" interface configuration command restarts the disabled port.
+ The "errdisable recovery cause ..." global configuration command enables the timer to automatically recover error-disabled state, and the "errdisable recovery interval interval" global configuration command specifies the time to recover error-disabled state.
NEW QUESTION 260
......
Ace Cisco 350-701 Certification with Actual Questions Mar 27, 2023 Updated: https://torrentvce.exam4free.com/350-701-valid-dumps.html
