Cisco 350-701 Online Practice Questions and Exam Preparation

Cisco 350-701 Online Questions & Answers

• Question 721:

  Refer to the exhibit.

  

  An engineer is implementing a certificate based VPN. What is the result of the existing configuration?

  A. The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.
  B. Only an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully
  C. The OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER
  D. The OU of the IKEv2 peer certificate is set to MANGLER
  A. The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.

  ---

  Explanation

  The "match identity certificate" command in the IKEv2 authorization policy is used to specify that the OU (Organizational Unit) attribute of the IKEv2 peer certificate should be used as the identity when matching the policy. The OU attribute is set to "MANGLER" in this case.

  So, when an IKEv2 peer with a certificate that has an OU attribute of "MANGLER" attempts to establish an IKEv2 SA, the router will use the OU attribute as the identity when matching the authorization policy. If the policy is a match, the SA will be established successfully.

• Question 722:

  Which direction do attackers encode data in DNS requests during exfiltration using DNS tunneling?

  A. inbound
  B. north-south
  C. east-west
  D. outbound
  D. outbound

  ---

  Explanation

• Question 723:

  An organization wants to secure users, data, and applications in the cloud. The solution must be API-based and operate as a cloud-native CASB. Which solution must be used for this implementation?

  A. Cisco Cloudlock
  B. Cisco Cloud Email Security
  C. Cisco Firepower Next-Generation Firewall
  D. Cisco Umbrella
  A. Cisco Cloudlock

  ---

  Explanation

  https://www.cisco.com/c/dam/en/us/products/collateral/security/cloud-web- security/at-a-glance-c45-738565.pdf

• Question 724:

  Which type of DNS abuse exchanges data between two computers even when there is no direct connection?

  A. Malware installation
  B. Command-and-control communication
  C. Network footprinting
  D. Data exfiltration
  D. Data exfiltration

  ---

  Explanation

  https://www.netsurion.com/articles/5-types-of-dns-attacks-and-how-to-detect- them

• Question 725:

  Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two)

  A. exploits
  B. ARP spoofing
  C. denial-of-service attacks
  D. malware
  E. eavesdropping
  A. exploits
  D. malware

  ---

  Explanation

  Malware means "malicious software", is any software intentionally designed to cause damage to a computer, server, client, or computer network. The most popular types of malware includes viruses, ransomware and spyware. Virus Possibly the most common type of malware, viruses attach their malicious code to clean code and wait to be run.

  Ransomware is malicious software that infects your computer and displays messages demanding a fee to be paid in order for your system to work again.Spyware is spying software that can secretly record everything you enter, upload, download, and store on your computers or mobile devices. Spyware always tries to keep itself hidden.An exploit is a code that takes advantage of a software vulnerability or security flaw.Exploits and malware are two risks for endpoints that are not up to date. ARP spoofing and eavesdropping are attacks against the network while denial-of-service attack is based on the flooding of IP packets.

• Question 726:

  An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively used by devices, using many of the default policy elements. What else must be done to accomplish this task?

  A. Add the specified addresses to the identities list and create a block action.
  B. Create a destination list for addresses to be allowed or blocked.
  C. Use content categories to block or allow specific addresses.
  D. Modify the application settings to allow only applications to connect to required addresses.
  B. Create a destination list for addresses to be allowed or blocked.

  ---

  Explanation

• Question 727:

  Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

  A. Nexus
  B. Stealthwatch
  C. Firepower
  D. Tetration
  D. Tetration

  ---

  Explanation

• Question 728:

  An organization is implementing AAA for their users. They need to ensure that authorization is verified for every command that is being entered by the network administrator. Which protocol must be configured in order to provide this capability?

  A. EAPOL
  B. SSH
  C. RADIUS
  D. TACACS+
  D. TACACS+

  ---

  Explanation

• Question 729:

  DRAG DROP

  Drag and drop the cryptographic algorithms for IPsec from the left onto the cryptographic processes on the right.

  Select and Place:

  

  

• Question 730:

  Which action controls the amount of URI text that is stored in Cisco WSA logs files?

  A. Configure the datasecurityconfig command
  B. Configure the advancedproxyconfig command with the HTTPS subcommand
  C. Configure a small log-entry size.
  D. Configure a maximum packet size.
  B. Configure the advancedproxyconfig command with the HTTPS subcommand

  ---

  Explanation