Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 631:

  Which parameter must be set for an invalid certificate handling on a Cisco Seucure Web Appliance with a policy for HTTPS traffic?

  A. Decrypt
  B. Reject
  C. Accept
  D. Scan
  A. Decrypt

  ---

  Explanation

• Question 632:

  Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat? (Choose two)

  A. westbound AP
  B. southbound API
  C. northbound API
  D. eastbound API
  C. northbound API

  ---

  Explanation

• Question 633:

  What is a characteristic of Firepower NGIPS inline deployment mode?

  A. ASA with Firepower module cannot be deployed.
  B. It cannot take actions such as blocking traffic.
  C. It is out-of-band from traffic.
  D. It must have inline interface pairs configured.
  D. It must have inline interface pairs configured.

  ---

  Explanation

  https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200924-configuring-firepower-threat-defense-int.html#anc2

• Question 634:

  Which two Cisco ISE components must be configured for BYOD? (Choose two.)

  A. local WebAuth
  B. central WebAuth
  C. null WebAuth
  D. guest
  E. dual
  B. central WebAuth
  D. guest

  ---

  Explanation

• Question 635:

  What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two)

  A. multiple factor auth
  B. local web auth
  C. single sign-on
  D. central web auth
  E. TACACS+
  B. local web auth
  D. central web auth

  ---

  Explanation

  https://community.cisco.com/t5/security-knowledge-base/collection-of-ise-auth-and-service-flows/ta-p/3641835

• Question 636:

  

  Refer to the exhibit When configuring this access control rule in Cisco FMC, what happens with the traffic destined to the DMZjnside zone once the configuration is deployed?

  A. All traffic from any zone to the DMZ_inside zone will be permitted with no further inspection
  B. No traffic will be allowed through to the DMZ_inside zone regardless of if it's trusted or not
  C. All traffic from any zone will be allowed to the DMZ_inside zone only after inspection
  D. No traffic will be allowed through to the DMZ_inside zone unless it's already trusted
  A. All traffic from any zone to the DMZ_inside zone will be permitted with no further inspection

  ---

  Explanation

• Question 637:

  Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two.)

  A. Assignments to endpoint groups are made dynamically, based on endpoint attributes.
  B. Endpoint supplicant configuration is deployed.
  C. A centralized management solution is deployed.
  D. Patch management remediation is performed.
  E. The latest antivirus updates are applied before access is allowed.
  D. Patch management remediation is performed.
  E. The latest antivirus updates are applied before access is allowed.

  ---

  Explanation

  Patch management remediation is performed.

  Cisco ISE's posture module can detect missing patches on endpoints and trigger remediation actions, ensuring systems are updated before allowing full network access.

  The latest antivirus updates are applied before access is allowed.

  The posture module checks if antivirus software is installed and up to date. If not, it can block access or initiate remediation to enforce compliance.

• Question 638:

  Refer to the exhibit.

  

  A network engineer is testing NTP authentication and realizes that any device synchronizes time with this router and that NTP authentication is not enforced.

  What is the cause of this issue?

  A. The key was configured in plain text.
  B. NTP authentication is not enabled.
  C. The hashing algorithm that was used was MD5. which is unsupported.
  D. The router was not rebooted after the NTP configuration updated.
  B. NTP authentication is not enabled.

  ---

  Explanation

• Question 639:

  What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

  A. lf four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.
  B. After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL
  C. After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL1
  D. If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.
  D. If four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

  ---

  Explanation

  https://websistent.com/cisco-account-lockout-using-login-block-for/

• Question 640:

  In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?

  A. Smurf
  B. distributed denial of service
  C. cross-site scripting
  D. rootkit exploit
  C. cross-site scripting

  ---

  Explanation

  Cross site scripting (also known as XSS) occurs when a web application gathers malicious data from a user. The data is usually gathered in the form of a hyperlink which contains malicious content within it. The user will most likely click on this link from another website, instant message, or simply just reading a web board or email message.Usually the attacker will encode the malicious portion of the link to the site in HEX (or other encoding methods) so the request is less suspicious looking to the user when clicked on.For example the code below is written in hex:

  Click Hereis equivalent to:Click HereNote: In the format "and#xhhhh", hhhh is the code point in hexadecimal form.