Cisco CCNP 350-701 Questions & Answers

• Question 21:

  What provides total management for mobile and PC including managing inventory and device tracking, remote view, and live troubleshooting using the included native remote desktop support?

  A. mobile device management

  B. mobile content management

  C. mobile application management

  D. mobile access management

  Correct Answer: A

• Question 22:

  An organization wants to implement a cloud-delivered and SaaS-based solution to provide visibility and threat detection across the AWS network. The solution must be deployed without software agents and rely on AWS VPC flow logs instead. Which solution meets these requirements?

  A. Cisco Stealthwatch Cloud

  B. Cisco Umbrella

  C. NetFlow collectors

  D. Cisco Cloudlock

  Correct Answer: A

  https://www.cisco.com/c/en/us/products/security/stealthwatch-cloud/index.html

• Question 23:

  Refer to the exhibit.

  

  What does this Python script accomplish?

  A. It allows authentication with TLSv1 SSL protocol

  B. It authenticates to a Cisco ISE with an SSH connection.

  C. lt authenticates to a Cisco ISE server using the username of ersad

  D. It lists the LDAP users from the external identity store configured on Cisco ISE

  Correct Answer: C

• Question 24:

  Which posture assessment requirement provides options to the client for remediation and requires the remediation within a certain timeframe?

  A. Audit

  B. Mandatory

  C. Optional

  D. Visibility

  Correct Answer: B

  Explanation: https://www.cisco.com/c/en/us/td/docs/security/ise/2- 4/admin_guide/b_ISE_admin_guide_24/m_client_posture_policies.html#:~:text=Policy%20 Requirement%20Types- ,Mandatory%20Requirements,the%20requirements% 20within%20the%20time%20specifie d%20in%20the%20remediation%20timer%20settings.,-For%20example%2C%20you

  Mandatory Requirements During policy evaluation, the agent provides remediation options to clients who fail to meet the mandatory requirements defined in the posture policy. End users must remediate to meet the requirements within the time specified in the remediation timer settings

• Question 25:

  An organization is selecting a cloud architecture and does not want to be responsible for patch management of the operating systems. Why should the organization select either Platform as a Service or Infrastructure as a Service for this environment?

  A. Platform as a Service because the customer manages the operating system

  B. Infrastructure as a Service because the customer manages the operating system

  C. Platform as a Service because the service provider manages the operating system

  D. Infrastructure as a Service because the service provider manages the operating system

  Correct Answer: C

  https://www.cisco.com/c/en/us/solutions/cloud/what-is-cloud-computing.html#~cloud-computing-services

• Question 26:

  Which benefit does DMVPN provide over GETVPN?

  A. DMVPN supports QoS, multicast, and routing, and GETVPN supports only QoS.

  B. DMVPN is a tunnel-less VPN, and GETVPN is tunnel-based.

  C. DMVPN supports non-IP protocols, and GETVPN supports only IP protocols.

  D. DMVPN can be used over the public Internet, and GETVPN requires a private network.

  Correct Answer: D

• Question 27:

  Refer to the exhibit.

  

  What are two indications of the Cisco Firepower Services Module configuration? (Choose two.)

  A. The module is operating in IDS mode.

  B. The module fails to receive redirected traffic

  C. Traffic is blocked if the module fails.

  D. Traffic continues to flow if the module fails.

  E. The module is operating in IPS mode.

  Correct Answer: AD

  sfr {fail-open | fail-close [monitor-only]} <- There's a couple different options here. The first one is fail-open which means that if the Firepower software module is unavailable, the ASA will continue to forward traffic. fail-close means that if the Firepower module fails, the traffic will stop flowing. While this doesn't seem ideal, there might be a use case for it when securing highly regulated environments. The monitor-only switch can be used with both and basically puts the Firepower services into IDS-mode only. This might be useful for initial testing or setup.

• Question 28:

  Which two actions does the Cisco identity Services Engine posture module provide that ensures endpoint security?(Choose two.)

  A. The latest antivirus updates are applied before access is allowed.

  B. Assignments to endpoint groups are made dynamically, based on endpoint attributes.

  C. Patch management remediation is performed.

  D. A centralized management solution is deployed.

  E. Endpoint supplicant configuration is deployed.

  Correct Answer: AC

  ISE posture assessment includes a set of rules in a security policy that define a series of checks before an endpoint is granted access to the network. Posture assessment checks include the installation of OS patches, host based firewall, antivirus and anti-malware software, disk encryption and more

• Question 29:

  Refer to the exhibit.

  

  All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and all servers must communicate with default gateway multilayer switch. Which type of private VLAN ports should be configured to prevent communication between DNS servers and the file server?

  A. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as isolated port, and GigabitEthernet0/3 and GigabitEthernet0/4 as promiscuous ports.

  B. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as promiscuous port, Gigabit Ethernet0/3 and GigabitEthernet0/4 as isolated ports.

  C. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port and GigabitEthernet0/3 and GrgabitEthernet0/4 as community ports

  D. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as community port, and GigabitEthernet0/3 and GrgabitEthernet0/4 as isolated ports.

  Correct Answer: C

• Question 30:

  A company discovered an attack propagating through their network via a file. A custom file policy was created in order to track this in the future and ensure no other endpoints execute the infected file. In addition, it was discovered during testing that the scans are not detecting the file as an indicator of compromise. What must be done in order to ensure that the created is functioning as it should?

  A. Create an IP block list for the website from which the file was downloaded

  B. Block the application that the file was using to open

  C. Upload the hash for the file into the policy

  D. Send the file to Cisco Threat Grid for dynamic analysis

  Correct Answer: C

  https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/file_policies_and_advanced_malware_protection.html