Cisco CCNP 350-701 Questions & Answers

• Question 581:

  In which two ways does a system administrator send web traffic transparently to the Web Security Appliance? (Choose two)

  A. configure Active Directory Group Policies to push proxy settings

  B. configure policy-based routing on the network infrastructure

  C. reference a Proxy Auto Config file

  D. configure the proxy IP address in the web-browser settings

  E. use Web Cache Communication Protocol

  Correct Answer: BE

• Question 582:

  Refer to the exhibit.

  

  What does the API do when connected to a Cisco security appliance?

  A. get the process and PID information from the computers in the network

  B. create an SNMP pull mechanism for managing AMP

  C. gather network telemetry information from AMP for endpoints

  D. gather the network interface information about the computers AMP sees

  Correct Answer: D

  Reference: https://api-docs.amp.cisco.com/api_actions/details?api_action=GET+%2Fv1%2Fcomputersandapi_host =api.apjc.amp.cisco.comandapi_resource=Computerandapi_version=v1

• Question 583:

  Which two statements about a Cisco WSA configured in Transparent mode are true? (Choose two)

  A. It can handle explicit HTTP requests.

  B. It requires a PAC file for the client web browser.

  C. It requires a proxy for the client web browser.

  D. WCCP v2-enabled devices can automatically redirect traffic destined to port 80.

  E. Layer 4 switches can automatically redirect traffic destined to port 80.

  Correct Answer: DE

• Question 584:

  Which two endpoint measures are used to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two)

  A. Patch for cross-site scripting.

  B. Perform backups to the private cloud.

  C. Protect against input validation and character escapes in the endpoint.

  D. Install a spam and virus email filter.

  E. Protect systems with an up-to-date antimalware program

  Correct Answer: DE

  Phishing attacks are the practice of sending fraudulent communications that appear to come from a reputablesource. It is usually done through email. The goal is to steal sensitive data like credit card and login information,or to install malware on the victim's machine.

• Question 585:

  Which two key and block sizes are valid for AES? (Choose two)

  A. 64-bit block size, 112-bit key length

  B. 64-bit block size, 168-bit key length

  C. 128-bit block size, 192-bit key length

  D. 128-bit block size, 256-bit key length

  E. 192-bit block size, 256-bit key length

  Correct Answer: CD

  The AES encryption algorithm encrypts and decrypts data in blocks of 128 bits (block size). It can do this using 128-bit, 192-bit, or 256-bit keys

• Question 586:

  Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

  A. transparent

  B. redirection

  C. forward

  D. proxy gateway

  Correct Answer: A

  Reference:

  https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2013/CVDWebSecurityUsin gCiscoWSADesignGuide-AUG13.pdf

• Question 587:

  Which function is the primary function of Cisco AMP threat Grid?

  A. automated email encryption

  B. applying a real-time URI blacklist

  C. automated malware analysis

  D. monitoring network traffic

  Correct Answer: C

• Question 588:

  Which two probes are configured to gather attributes of connected endpoints using Cisco Identity Services Engine? (Choose two)

  A. RADIUS

  B. TACACS+

  C. DHCP

  D. sFlow

  E. SMTP

  Correct Answer: AC

• Question 589:

  Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two)

  A. Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS

  B. Cisco FTDv with one management interface and two traffic interfaces configured

  C. Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises

  D. Cisco FTDv with two management interfaces and one traffic interface configured

  E. Cisco FTDv configured in routed mode and IPv6 configured

  Correct Answer: AC

  https://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-virtual-appliance-asav/white-paper-c11-740505.html

• Question 590:

  When wired 802.1X authentication is implemented, which two components are required? (Choose two)

  A. authentication server: Cisco Identity Service Engine

  B. supplicant: Cisco AnyConnect ISE Posture module

  C. authenticator: Cisco Catalyst switch

  D. authenticator: Cisco Identity Services Engine

  E. authentication server: Cisco Prime Infrastructure

  Correct Answer: AC

  https://www.lookingpoint.com/blog/ise-series-802.1x