Cisco CCNP Enterprise 350-401 Questions & Answers

• Question 1051:

  Which component of the Cisco Cyber Threat Defense solution provides user and flow context analysis?

  A. Cisco Firepower and FireSIGHT

  B. Cisco Stealthwatch system

  C. Advanced Malware Protection

  D. Cisco Web Security Appliance

  Correct Answer: B

  The goal of the Cyber Threat Defense solution is to introduce a design and architecture that can help facilitate the discovery, containment, and remediation of threats once they have penetrated into the network interior. Cisco Cyber Threat Defense version 2.0 makes use of several solutions to accomplish its objectives:

  * NetFlow and the Lancope StealthWatch System

  1.

  Broad visibility

  2.

  User and flow context analysis

  3.

  Network behavior and anomaly detection

  4.

  Incident response and network forensics

  * Cisco FirePOWER and FireSIGHT

  1.

  Real-time threat management

  2.

  Deeper contextual visibility for threats bypassing the perimeters ?URL control

  * Advanced Malware Protection (AMP)

  1.

  Endpoint control with AMP for Endpoints

  2.

  Malware control with AMP for networks and content

  * Content Security Appliances and Services

  1.

  Cisco Web Security Appliance (WSA) and Cloud Web Security (CWS)

  2.

  Dynamic threat control for web traffic

  3.

  Outbound URL analysis and data transfer controls

  4.

  Detection of suspicious web activity

  5.

  Cisco Email Security Appliance (ESA)

  6.

  Dynamic threat control for email traffic

  7.

  Detection of suspicious email activity

  * Cisco Identity Services Engine (ISE)

  1.

  User and device identity integration with Lancope StealthWatch

  2.

  Remediation policy actions using pxGrid

  Reference: https://www.cisco.com/c/dam/en/us/td/docs/security/network_security/ctd/ctd2-0/design_guides/ctd_2-0_cvd_guide_jul15.pdf

• Question 1052:

  Which LISP component is required for a LISP site to communicate with a non-LISP site?

  A. ETR

  B. ITR

  C. Proxy ETR

  D. Proxy ITR

  Correct Answer: C

  ETR, (Egress) from internal to External ITR, (Internal) from External to Internal

• Question 1053:

  Which two operational models enable an AP to scan one or more wireless channels for rouge access points and at the same time provide wireless services to clients? (Choose two.)

  A. Rouge detector

  B. Sniffer

  C. FlexConnect

  D. Local

  E. Monitor

  Correct Answer: CD

  Rogue Detection is performed by Local and Flex-Connect (in connected mode) mode APs and utilizes a time-slicing technique which allows client service and channel scanning with the usage of the same radio. With the move to off channel for a period of 50ms every 16 seconds, the AP, by default, only spends a small percentage of its time to not serve clients.

  Monitor mode serves only to scan, not to serve clients.

  Monitor mode APs are also far superior at the detection of rogue clients as they have a more comprehensive view of the activity that occurs in each channel.

  Just as @YTAKE, @Adrenalina73, @xziomal9, @wifishark and others say.

  https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#anc8

• Question 1054:

  What is the recommended MTU size for a Cisco SD-Access Fabric?

  A. 1500

  B. 9100

  C. 4464

  D. 17914

  Correct Answer: B

  VXLAN adds 50 bytes to the original packet. The common denominator and recommended MTU value available on devices operating in a fabric role is 9100. Network should have a minimum starting MTU of at least 1550 bytes to support the fabric overlay. MTU values between 1550 and 9100 are supported along with MTU values larger than 9100 though there may be additional configuration and limitations based on the original packet size. MTU 9100 is provisioned as part of LAN Automation. Devices in the same routing domain and Layer 2 domain should be configured with a consistent MTU size to support routing protocol adjacencies and packet forwarding without fragmentation.

• Question 1055:

  How is MSDP used to interconnect multiple PIM-SM domains?

  A. MSDP depends on BGP or multiprotocol BGP for interdomain operation.

  B. MSDP SA request messages are used to request a list of active sources for a specific group.

  C. MSDP allows a rendezvous point to dynamically discover active sources outside of its domain.

  D. MSDP messages are used to advertise active sources in a domain.

  Correct Answer: C

  Allows a rendezvous point (RP) to dynamically discover active sources outside of its domain.

  https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipmulti_pim/configuration/xe-16/imc-pim-xe-16-book/imc-msdp-im-pim-sim.html

• Question 1056:

  What is a benefit of data modeling languages like YANG?

  A. They enable programmers to change or write their own application within the device operating system.

  B. They create more secure and efficient SNMP OIDs.

  C. They make the CLI simpler and more efficient.

  D. They provide a standardized data structure, which results in configuration scalability and consistency.

  Correct Answer: D

  Yet Another Next Generation (YANG) is a language which is only used to describe data models (structure). It is not XML or JSON.

• Question 1057:

  Which two mechanisms are available to secure NTP? (Choose two.)

  A. IP prefix list-based

  B. IPsec

  C. TACACS-based authentication

  D. IP access list-based

  E. Encrypted authentication

  Correct Answer: DE

  The time kept on a machine is a critical resource and it is strongly recommend that you use the security features of NTP to avoid the accidental or malicious setting of incorrect time. The two security features available are an access list-based restriction scheme and an encrypted authentication mechanism.

  Reference: https://www.cisco.com/c/dam/en/us/td/docs/ios-xml/ios/bsm/configuration/xe-3se/3650/bsm-xe-3se-3650-book.html

• Question 1058:

  Which method of account authentication does OAuth 2.0 within REST APIs?

  A. username/role combination

  B. access tokens

  C. cookie authentication

  D. basic signature workflow

  Correct Answer: B

  The most common implementations of OAuth (OAuth 2.0) use one or both of these tokens:

  + access token: sent like an API key, it allows the application to access a user's data; optionally, access tokens can expire. + refresh token: optionally part of an OAuth flow, refresh tokens retrieve a new access token if they have expired. OAuth2 combines Authentication and Authorization to allow more sophisticated scope and validity control.

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/ftd-api/guide/ftd-rest-api/auth-ftd-rest-api.pdf

• Question 1059:

  In cisco SD_WAN, which protocol is used to measure link quality?

  A. OMP

  B. BFD

  C. RSVP

  D. IPsec

  Correct Answer: B

  The BFD (Bidirectional Forwarding Detection) is a protocol that detects link failures as part of the Cisco SD-WAN (Viptela) high availability solution, is enabled by default on all vEdge routers, and you cannot disable it.

• Question 1060:

  Which JSON syntax is valid?

  A. {"switch": "name": "dist1", "interfaces": ["gig1", "gig2", "gig3"]}

  B. {/"switch/": {/"name/": "dist1", /"interfaces/": ["gig1", "gig2", "gig3"]}}

  C. {"switch": {"name": "dist1", "interfaces": ["gig1", "gig2", "gig3"]}}

  D. {`switch': (`name': `dist1', `interfaces': [`gig1', `gig2', `gig3'])}

  Correct Answer: C

  This JSON can be written as follows:

  {

  'switch': {

  'name': 'dist1',

  'interfaces': ['gig1', 'gig2', 'gig3']

  }

  }