Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 191:

  An administrator enables Cisco Threat Intelligence Director on a Cisco FMC. Which process uses STIX and allows uploads and downloads of block lists?

  A. consumption
  B. sharing
  C. editing
  D. authoring
  A. consumption

  ---

  Explanation

• Question 192:

  What are two benefits of adaptive multifactor authentication? (Choose two.)

  A. no need to remember passwords
  B. secure remote access
  C. contextual factor-based authentication
  D. improved access management
  E. managed encryption policies
  B. secure remote access
  C. contextual factor-based authentication

  ---

  Explanation

• Question 193:

  An organization configures Cisco Umbrella to be used for its DNS services. The organization must be able to block traffic based on the subnet that the endpoint is on but it sees only the requests from its public IP address instead of each internal IP address. What must be done to resolve this issue?

  A. Set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address
  B. Use the tenant control features to identify each subnet being used and track the connections within the Cisco Umbrella dashboard
  C. Install the Microsoft Active Directory Connector to give IP address information stitched to the requests in the Cisco Umbrella dashboard
  D. Configure an internal domain within Cisco Umbrella to help identify each address and create policy from the domains
  A. Set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address

  ---

  Explanation

• Question 194:

  Which algorithm does ISAKMP use to securely derive encryption and integrity keys?

  A. RSA
  B. AES
  C. 3DES
  D. Diffie-Hellman
  D. Diffie-Hellman

  ---

  Explanation

• Question 195:

  Which feature only implements on the Cisco ASA in the transparent mode?

  A. inspect application layer of the traffic sent between hosts
  B. stateful inspection
  C. inspect traffic between hosts in the same subnet
  D. inspect anycast traffic
  C. inspect traffic between hosts in the same subnet

  ---

  Explanation

• Question 196:

  When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?

  A. Spero analysis
  B. dynamic analysis
  C. sandbox analysis
  D. malware analysis
  B. dynamic analysis

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc- config-guidev60/Reference_a_wrapper_Chapter_topic_here.html -> Spero analysis only uploads the signature of the (executable) files to the AMP cloud. It does not upload thewhole file. Dynamic analysis sends files to AMP ThreatGrid.Dynamic Analysis submits (the whole) files to Cisco Threat Grid (formerly AMP Threat Grid). Cisco ThreatGrid runs the file in a sandbox environment, analyzes the file's behavior to determine whether the file ismalicious, and returns a threat score that indicates the likelihood that a file contains malware. From the threatscore, you can view a dynamic analysis summary report with the reasons for the assigned threat score. Youcan also look in Cisco Threat Grid to view detailed reports for files that your organization submitted, as well asscrubbed reports with limited data for files that your organization did not submit.Local malware analysis allows a managed device to locally inspect executables, PDFs, office documents, andother types of files for the most common types of malware, using a detection rule set provided by the CiscoTalos Security Intelligence and Research Group (Talos). Because local analysis does not query the AMP cloud,and does not run the file, local malware analysis saves time and system resources. -> Malware analysis doesnot upload files to anywhere, it only checks the files locally.There is no sandbox analysis feature, it is just a method of dynamic analysis that runs suspicious files in avirtual machine.

• Question 197:

  An engineer is configuring Cisco Secure Endpoint to enhance security by preventing the execution of certain files by users. The engineer needs to ensure that the specific executable file name Cisco_Software_0505446151.exe is blocked from running while never being quarantined. What must the engineer configure to meet the requirement?

  A. Create advanced custom detection list.
  B. Configure application control blocked applications list.
  C. Implement simple custom detection list.
  D. Enable scheduled scans to detect and block the executable files.
  B. Configure application control blocked applications list.

  ---

  Explanation

• Question 198:

  DRAG DROP

  Drag and drop the solutions from the left onto the solution’s benefits on the right.

  Select and Place:

  

  

• Question 199:

  What has driven an increase in the need for endpoint-based security?

  A. minimal endpoint-based security manual configuration and implementation
  B. increased data volumes and value in data center storage
  C. increased number of BYOD policies and hybrid remote worker
  D. stricter control mechanism requirements for enterprise access
  C. increased number of BYOD policies and hybrid remote worker

  ---

  Explanation

• Question 200:

  Which two authentication protocols are supported by the Cisco WSA? (Choose two.)

  A. WCCP
  B. NTLM
  C. TLS
  D. SSL
  E. LDAP
  B. NTLM
  E. LDAP

  ---

  Explanation