Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 461:

  An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed. What must be done to ensure that all devices can communicate together?

  A. Manually change the management port on Cisco FMC and all managed Cisco FTD devices
  B. Set the tunnel to go through the Cisco FTD
  C. Change the management port on Cisco FMC so that it pushes the change to all managed Cisco FTD devices
  D. Set the tunnel port to 8305
  A. Manually change the management port on Cisco FMC and all managed Cisco FTD devices

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Security__Internet_Access__and_Communication_Ports.html

• Question 462:

  Which system facilitates deploying microsegmentation and multi-tenancy services with a policy-based container?

  A. SDLC
  B. Docker
  C. Lambda
  D. Contiv
  D. Contiv

  ---

  Explanation

  With Contiv, cloud architects and IT admin teams can create, manage and consistently enforce operational policies such as multi-tenant traffic isolation, microsegmentation, bandwidth prioritization, latency requirements, and policies

• Question 463:

  In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?

  A. man-in-the-middle
  B. cross-site scripting
  C. insecure API
  D. LDAP injection
  A. man-in-the-middle

  ---

  Explanation

• Question 464:

  DRAG DROP

  Drag and drop the security solutions from the left onto the benefits they provide on the right.

  Select and Place:

  

  

• Question 465:

  A network administrator is modifying a remote access VPN on an FTD managed by an FMC. The administrator wants to offload traffic to certain trusted domains. The administrator wants this traffic to go out of the client's local internet and send other internet- bound traffic over the VPN Which feature must the administrator configure?

  A. dynamic split tunneling
  B. local LAN access
  C. dynamic access policies
  D. reverse route injection
  A. dynamic split tunneling

  ---

  Explanation

  In a remote access VPN configuration, dynamic split tunneling allows traffic to certain trusted domains to bypass the VPN tunnel and exit through the client's local internet gateway. This feature selectively directs only the necessary traffic over the VPN, while allowing direct internet access for specific domains or traffic deemed safe or trusted, optimizing bandwidth and performance for remote users.

• Question 466:

  When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key establishment?

  A. RSA is an asymmetric key establishment algorithm intended to output symmetric keys
  B. RSA is a symmetric key establishment algorithm intended to output asymmetric keys
  C. DH is a symmetric key establishment algorithm intended to output asymmetric keys
  D. DH is an asymmetric key establishment algorithm intended to output symmetric keys
  D. DH is an asymmetric key establishment algorithm intended to output symmetric keys

  ---

  Explanation

  Diffie Hellman (DH) uses a private-public key pair to establish a shared secret, typically a symmetric key. DH is not a symmetric algorithm ?it is an asymmetric algorithm used to establish a shared secret for a symmetric key algorithm.

• Question 467:

  Which firewall deployment mode allows inspection of traffic between servers in the same IP subnet?

  A. routed
  B. multicontext
  C. virtual
  D. transparent
  D. transparent

  ---

  Explanation

• Question 468:

  Which two activities can be done using Cisco DNA Center? (Choose two)

  A. DHCP
  B. Design
  C. Accounting
  D. DNS
  E. Provision
  B. Design
  E. Provision

  ---

  Explanation

  https://www.cisco.com/c/en/us/products/collateral/cloud-systems- management/dna-center/nb-06- dna-center-so-cte-en.html

• Question 469:

  Which two Cisco ISE components enforce security policies on noncompliant endpoints by blocking network access? (Choose two.)

  A. Apex licensing
  B. TACACS+
  C. profiling
  D. DHCP and SNMP probes
  E. posture agents
  A. Apex licensing
  E. posture agents

  ---

  Explanation

• Question 470:

  Which benefit does endpoint security provide the overall security posture of an organization?

  A. It streamlines the incident response process to automatically perform digital forensics on the endpoint.
  B. It allows the organization to mitigate web-based attacks as long as the user is active in the domain.
  C. It allows the organization to detect and respond to threats at the edge of the network.
  D. It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.
  D. It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.

  ---

  Explanation