Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 501:

  Which Cisco security solution stops exfiltration using HTTPS?

  A. Cisco FTD
  B. Cisco AnyConnect
  C. Cisco CTA
  D. Cisco ASA
  C. Cisco CTA

  ---

  Explanation

  https://www.cisco.com/c/dam/en/us/products/collateral/security/cognitive- threat-analytics/at-a-glance-c45-736555.pdf

• Question 502:

  Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent? (Choose two)

  A. Outgoing traffic is allowed so users can communicate with outside organizations.
  B. Malware infects the messenger application on the user endpoint to send company data.
  C. Traffic is encrypted, which prevents visibility on firewalls and IPS systems.
  D. An exposed API for the messaging platform is used to send large amounts of data.
  E. Messenger applications cannot be segmented with standard network controls
  A. Outgoing traffic is allowed so users can communicate with outside organizations.
  C. Traffic is encrypted, which prevents visibility on firewalls and IPS systems.

  ---

  Explanation

• Question 503:

  An engineer is deploying a Cisco Secure Email Gateway and must ensure it reaches the Cisco update servers to retrieve new rules. The engineer must now manually configure the Outbreak Filter rules on an AsyncOS for Cisco Secure Email Gateway. Only outdated rules must be replaced. Up-to-date rules must be retained. Which action must the engineer take next to complete the configuration?

  A. Use the outbreakconfig command in CLI.
  B. Select Outbreak Filters.
  C. Perform a backup/restore of the database.
  D. Click Update Rules Now.
  A. Use the outbreakconfig command in CLI.

  ---

  Explanation

• Question 504:

  Which Talos reputation center allows for tracking the reputation of IP addresses for email and web traffic?

  A. IP and Domain Reputation Center
  B. File Reputation Center
  C. IP Slock List Center
  D. AMP Reputation Center
  A. IP and Domain Reputation Center

  ---

  Explanation

• Question 505:

  For a given policy in Cisco Umbrella, how should a customer block website based on a custom list?

  A. by specifying blocked domains in me policy settings
  B. by specifying the websites in a custom blocked category
  C. by adding the websites to a blocked type destination list
  D. by adding the website IP addresses to the Cisco Umbrella blocklist
  C. by adding the websites to a blocked type destination list

  ---

  Explanation

• Question 506:

  An engineer is configuring Cisco WSA and needs to enable a separated email transfer flow from the Internet and from the LAN. Which deployment mode must be used to accomplish this goal?

  A. single interface
  B. multi-context
  C. transparent
  D. two-interface
  D. two-interface

  ---

  Explanation

• Question 507:

  What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?

  A. Telemetry uses a pull mehod, which makes it more reliable than SNMP
  B. Telemetry uses push and pull, which makes it more scalable than SNMP
  C. Telemetry uses push and pull which makes it more secure than SNMP
  D. Telemetry uses a push method which makes it faster than SNMP
  D. Telemetry uses a push method which makes it faster than SNMP

  ---

  Explanation

  SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real- time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios- xe/#!streaming-telemetry-quick-start- guide/streaming telemetry

• Question 508:

  Which type of attack is MFA an effective deterrent for?

  A. ping of death
  B. phishing
  C. teardrop
  D. syn flood
  B. phishing

  ---

  Explanation

• Question 509:

  What is the process of performing automated static and dynamic analysis of files against preloaded behavioral indicators for threat analysis?

  A. deep visibility scan
  B. point-in-time checks
  C. advanced sandboxing
  D. advanced scanning
  C. advanced sandboxing

  ---

  Explanation

• Question 510:

  What are two functions of IKEv1 but not IKEv2? (Choose two.)

  A. IKEv1 conversations are initiated by the IKE_SA_INIT message.
  B. With IKEv1, aggressive mode negotiates faster than main mode.
  C. IKEv1 uses EAP for authentication.
  D. NAT-T is supported in IKEv1 but not in IKEv2.
  E. With IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext.
  B. With IKEv1, aggressive mode negotiates faster than main mode.
  E. With IKEv1, when using aggressive mode, the initiator and responder identities are passed in cleartext.

  ---

  Explanation

  https://community.cisco.com/t5/routing/internet-key-exchange-ike-aggressive-mode/td-p/2081283