Cisco CCNP 350-701 Questions & Answers

• Question 591:

  What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

  A. EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.

  B. EDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter defenses.

  C. EPP focuses on network security, and EDR focuses on device security.

  D. EDR focuses on network security, and EPP focuses on device security.

  Correct Answer: A

• Question 592:

  Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

  A. It allows the endpoint to authenticate with 802.1x or MAB.

  B. It verifies that the endpoint has the latest Microsoft security patches installed.

  C. It adds endpoints to identity groups dynamically.

  D. It allows CoA to be applied if the endpoint status is compliant.

  Correct Answer: B

• Question 593:

  Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

  A. interpacket variation

  B. software package variation

  C. flow insight variation

  D. process details variation

  Correct Answer: A

  Reference:

  https://www.cisco.com/c/dam/global/en_uk/products/switches/cisco_nexus_9300_ex_platfo rm_switches_white_paper_uki.pdf

• Question 594:

  What is the function of Cisco Cloudlock for data security?

  A. data loss prevention

  B. controls malicious cloud apps

  C. detects anomalies

  D. user and entity behavior analytics

  Correct Answer: A

  https://umbrella.cisco.com/products/casb

• Question 595:

  The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

  A. SDN controller and the cloud

  B. management console and the SDN controller

  C. management console and the cloud

  D. SDN controller and the management solution

  Correct Answer: D

  Northbound APIs are the link between the applications and the SDN controller. The applications can tell the network what they need (data, storage, bandwidth, and so on) and the network can deliver those resources, or communicate what it has.

• Question 596:

  After deploying a Cisco ESA on your network, you notice that some messages fail to reach their destinations.

  Which task can you perform to determine where each message was lost?

  A. Configure the trackingconfig command to enable message tracking.

  B. Generate a system report.

  C. Review the log files.

  D. Perform a trace.

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/esa/esa12- 0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_12_0_chapter_011110.ht ml

• Question 597:

  What are two rootkit types? (Choose two)

  A. registry

  B. virtual

  C. bootloader

  D. user mode

  E. buffer mode

  Correct Answer: CD

  The term `rootkit' originally comes from the Unix world, where the word `root' is used to describe a user with thehighest possible level of access privileges, similar to an `Administrator' in Windows. The word `kit' refers to thesoftware that grants root-level access to the machine. Put the two together and you get `rootkit', a program thatgives someone ?with legitimate or malicious intentions ?privileged access to a computer.There are four main types of rootkits: Kernel rootkits, User mode rootkits, Bootloader rootkits, Memory rootkits

• Question 598:

  Which Cisco security solution protects remote users against phishing attacks when they are not connected to the VPN?

  A. Cisco Stealthwatch

  B. Cisco Umbrella

  C. Cisco Firepower

  D. NGIPS

  Correct Answer: B

  Cisco Umbrella protects users from accessing malicious domains by proactively analyzing and blocking unsafe destinations ?before a connection is ever made. Thus it can protect from phishing attacks by blocking suspicious domains when users click on the given links that an attacker sent. Cisco Umbrella roaming protects your employees even when they are off the VPN.

• Question 599:

  Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

  A. Correlation

  B. Intrusion

  C. Access Control

  D. Network Discovery

  Correct Answer: D

  Reference:

  https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc- configguide-v64/introduction_to_network_discovery_and_identity.html

• Question 600:

  Which two descriptions of AES encryption are true? (Choose two)

  A. AES is less secure than 3DES.

  B. AES is more secure than 3DES.

  C. AES can use a 168-bit key for encryption.

  D. AES can use a 256-bit key for encryption.

  E. AES encrypts and decrypts a key three times in sequence.

  Correct Answer: BD

  https://gpdb.docs.pivotal.io/43190/admin_guide/topics/ipsec.html