Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 471:

  Which two protocols must be configured to authenticate end users to the Web Security Appliance? (Choose two.)

  A. NTLMSSP
  B. Kerberos
  C. CHAP
  D. TACACS+
  E. RADIUS
  A. NTLMSSP
  B. Kerberos

  ---

  Explanation

  Neither RADIUS or TACACS+ authenticates the user. They facilitate communication to the authentication server. Kerberos and NTLMSSP do authenticate the user.

• Question 472:

  How is DNS tunneling used to exfiltrate data out of a corporate network?

  A. It corrupts DNS servers by replacing the actual IP address with a rogue address to collect information or start other attacks.
  B. It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.
  C. It redirects DNS requests to a malicious server used to steal user credentials, which allows further damage and theft on the network.
  D. It leverages the DNS server by permitting recursive lookups to spread the attack to other DNS servers.
  B. It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.

  ---

  Explanation

  Domain name system (DNS) is the protocol that translates human-friendly URLs, such as securitytut.com, into IP addresses, such as 183.33.24.13. Because DNS messages are only used as the beginning of each communication and they are not intended for data transfer, many organizations do not monitor their DNS traffic for malicious activity. As a result, DNS-based attacks can be effective if launched against their networks. DNS tunneling is one such attack.An example of DNS Tunneling is shown below:

  

  The attacker incorporates one of many open-source DNS tunneling kits into an authoritative DNSnameserver (NS) and malicious payload.2. An IP address (e.g. 1.2.3.4) is allocated from the attacker's infrastructure and a domain name (e.g. attackerdomain.com) is registered or reused. The registrar informs the top-level domain (.com) nameservers to refer requests for attackerdomain.com to ns.attackerdomain.com, which has a DNS record mapped to 1.2.3.43. The attacker compromises a system with the malicious payload. Once the desired data is obtained, the payload encodes the data as a series of 32 characters (0-9, A-Z) broken into short strings (3KJ242AIE9, P028X977W,...).4. The payload initiates thousands of unique DNS record requests to the attacker's domain with each string as Reference: https://learn-umbrella.cisco.com/i/775902-dns-tunneling/0

• Question 473:

  Which type of protection encrypts RSA keys when they are exported and imported?

  A. file
  B. passphrase
  C. NGE
  D. nonexportable
  B. passphrase

  ---

  Explanation

• Question 474:

  An organization has two systems in their DMZ that have an unencrypted link between them for communication.

  The organization does not have a defined password policy and uses several default accounts on the systems.

  The application used on those systems also have not gone through stringent code reviews.

  Which vulnerability would help an attacker brute force their way into the systems?

  A. weak passwords
  B. lack of input validation
  C. missing encryption
  D. lack of file permission
  A. weak passwords

  ---

  Explanation

  https://tools.ietf.org/html/rfc3954

• Question 475:

  An engineer must set up 200 new laptops on a network and wants to prevent the users from moving their laptops around to simplify administration.

  Which switch port MAC address security setting must be used?

  A. sticky
  B. static
  C. aging
  D. maximum
  A. sticky

  ---

  Explanation

• Question 476:

  Which Cisco Umbrella package supports selective proxy for inspection of traffic from risky domains?

  A. DNS Security Advantage
  B. SIG Essentials
  C. DNS Security Essentials
  D. SIG Advantage
  A. DNS Security Advantage

  ---

  Explanation

• Question 477:

  Which technology limits communication between nodes on the same network segment to individual applications?

  A. serverless infrastructure
  B. microsegmentation
  C. SaaS deployment
  D. machine-to-machine firewalling
  B. microsegmentation

  ---

  Explanation

• Question 478:

  What is a prerequisite when integrating a Cisco ISE server and an AD domain?

  A. Place the Cisco ISE server and the AD server in the same subnet
  B. Configure a common administrator account
  C. Configure a common DNS server
  D. Synchronize the clocks of the Cisco ISE server and the AD server
  D. Synchronize the clocks of the Cisco ISE server and the AD server

  ---

  Explanation

  https://www.cisco.com/c/en/us/td/docs/security/ise/2- 0/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_8DC463597A 644A5C9CF5D582B77BB24F

• Question 479:

  An engineer must modify an existing remote access VPN using a Cisco AnyConnect Secure Mobility client solution and a Cisco Secure Firewall. Currently, all the traffic generate by the user Is sent to the VPN tunnel and the engineer must now exclude some servers and access them directly instead. Which element must be modified to achieve this goat?

  A. NAT exemption
  B. encryption domain
  C. routing table
  D. group policy
  D. group policy

  ---

  Explanation

  To achieve the goal of excluding some servers from the VPN tunnel and accessing them directly, the engineer must modify the group policy that is applied to the remote access VPN users. The group policy contains the settings for split tunneling, which is a feature that allows the VPN client to route some traffic through the VPN tunnel and some traffic directly to the internet. Split tunneling can be configured based on the destination IP address, the application, or the domain name of the traffic. By modifying the group policy, the engineer can specify which servers or networks should be excluded from the VPN tunnel and accessed directly by the VPN client. This can improve the performance and efficiency of the VPN connection, as well as reduce the load on the VPN gateway and the corporate network. However, split tunneling also introduces some security risks, such as exposing the VPN client to internet threats, bypassing the corporate firewall and security policies, and leaking sensitive data. Therefore, the engineer must carefully evaluate the trade-offs and best practices of using split tunneling for remote access VPNs. References := Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 3: Secure Connectivity, Lesson 3.1: Implementing and Troubleshooting Remote Access VPN, Topic 3.1.4: Configure and Verify Remote Access VPN, Subtopic 3.1.4.2: Configure and Verify Split Tunneling VPN Split Tunneling: What It Is and Pros and Cons Cisco ASA - Enable Split Tunnel for Remote VPN Clients

• Question 480:

  A network engineer is deciding whether to use stateful or stateless failover when configuring two ASAs for high availability. What is the connection status in both cases?

  A. need to be reestablished with stateful failover and preserved with stateless failover
  B. preserved with stateful failover and need to be reestablished with stateless failover
  C. preserved with both stateful and stateless failover
  D. need to be reestablished with both stateful and stateless failover
  B. preserved with stateful failover and need to be reestablished with stateless failover

  ---

  Explanation