Valid 350-701 SCOR Exam Dumps - Make Sure You Pass - Free Latest Dumps for IT Certification Exams

Valid 350-701 SCOR Exam Dumps – Make Sure You Pass

dumps2024-03-28T10:25:14+08:00

Cisco 350-701 SCOR exam is a core test of CCNP Security certification. Passing Cisco certification 350-701 SCOR exam is not difficult now. The actual 350-701 SCOR exam dumps are the best material, which are valid in the preparation. The candidates have 120 minutes to complete all the questions. The available languages are English and Japanese. Free Cisco 350-701 SCOR exam dumps are available below.

Page 1 of 19

1. In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?

Smurf

distributed denial of service

cross-site scripting

rootkit exploit

2. Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?

user input validation in a web page or web application

Linux and Windows operating systems

database

web page images

3. Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two)

Check integer, float, or Boolean string parameters to ensure accurate values.

Use prepared statements and parameterized queries.

Secure the connection between the web and the app tier.

Write SQL code instead of using object-relational mapping libraries.

Block SQL code execution in the web application database login.

4. Which two endpoint measures are used to minimize the chances of falling victim to phishing and social

engineering attacks? (Choose two)

Patch for cross-site scripting.

Perform backups to the private cloud.

Protect against input validation and character escapes in the endpoint.

Install a spam and virus email filter.

Protect systems with an up-to-date antimalware program

5. Which two mechanisms are used to control phishing attacks? (Choose two)

Enable browser alerts for fraudulent websites.

Define security group memberships.

Revoke expired CRL of the websites.

Use antispyware software.

Implement email filtering techniques.

6. Which two behavioral patterns characterize a ping of death attack? (Choose two)

The attack is fragmented into groups of 16 octets before transmission.

The attack is fragmented into groups of 8 octets before transmission.

Short synchronized bursts of traffic are used to disrupt TCP connections.

Malformed packets are used to crash systems.

Publicly accessible DNS servers are typically used to execute the attack.

7. Which two preventive measures are used to control cross-site scripting? (Choose two)

Enable client-side scripts on a per-domain basis.

Incorporate contextual output encoding/escaping.

Disable cookie inspection in the HTML inspection engine.

Run untrusted HTML input through an HTML sanitization engine.

Same Site cookie attribute should not be used.

8. What is the difference between deceptive phishing and spear phishing?

Deceptive phishing is an attacked aimed at a specific user in the organization who holds a C-level role.

A spear phishing campaign is aimed at a specific person versus a group of people.

Spear phishing is when the attack is aimed at the C-level executives of an organization.

Deceptive phishing hijacks and manipulates the DNS server of the victim and redirects the user to a false webpage.

9. Which attack is commonly associated with C and C++ programming languages?

cross-site scripting

water holing

DDoS

buffer overflow

10. What is a language format designed to exchange threat intelligence that can be transported over the

TAXII protocol?

STIX

XMPP

pxGrid

SMTP

Page 2 of 19

11. Which two capabilities does TAXII support? (Choose two)

Exchange

Pull messaging

Binding

Correlation

Mitigating

12. Which two risks is a company vulnerable to if it does not have a well-established patching solution for

endpoints? (Choose two)

exploits

ARP spoofing

denial-of-service attacks

malware

eavesdropping

13. Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server?

url

terminal

profile

selfsigned

14. What are two rootkit types? (Choose two)

registry

virtual

bootloader

user mode

buffer mode

15. Which form of attack is launched using botnets?

EIDDOS

virus

DDOS

TCP flood

16. Which threat involves software being used to gain unauthorized access to a computer system?

virus

NTP amplification

ping of death

HTTP flood

17. Which type of attack is social engineering?

trojan

phishing

malware

MITM

18. Which two key and block sizes are valid for AES? (Choose two)

64-bit block size, 112-bit key length

64-bit block size, 168-bit key length

128-bit block size, 192-bit key length

128-bit block size, 256-bit key length

192-bit block size, 256-bit key length

19. Which two descriptions of AES encryption are true? (Choose two)

AES is less secure than 3DE

AES is more secure than 3DE

AES can use a 168-bit key for encryption.

AES can use a 256-bit key for encryption.

AES encrypts and decrypts a key three times in sequence.

20. Which algorithm provides encryption and authentication for data plane communication?

AES-GCM

SHA-96

AES-256

SHA-384

Page 3 of 19

21. Elliptic curve cryptography is a stronger more efficient cryptography method meant to replace which current encryption technology?

3DES

RSA

DES

AES

22. What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX

authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX

authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX

secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

23. Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

DMVPN

FlexVPN

IPsec DVTI

GET VPN

24. Which two conditions are prerequisites for stateful failover for IPsec? (Choose two)

Only the IKE configuration that is set up on the active device must be duplicated on the standby device; the IPsec configuration is copied automatically

The active and standby devices can run different versions of the Cisco IOS software but must be the same type of device.

The IPsec configuration that is set up on the active device must be duplicated on the standby device

Only the IPsec configuration that is set up on the active device must be duplicated on the standby device; the IKE configuration is copied automatically.

The active and standby devices must run the same version of the Cisco IOS software and must be the same type of device

25. Which VPN technology can support a multivendor environment and secure traffic between sites?

SSL VPN

GET VPN

FlexVPN

DMVPN

26. A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0380739941 address 0.0.0.0 command on host A. The tunnel is not being established to host B.

What action is needed to authenticate the VPN?

Change isakmp to ikev2 in the command on host

Enter the command with a different password on host

Enter the same command on host

Change the password on hostA to the default password.

27. Refer to the exhibit.

A network administrator configured a site-to-site VPN tunnel between two Cisco IOS routers, and hosts are unable to communicate between two sites of VPN. The network administrator runs the debug crypto isakmp sa command to track VPN status.

What is the problem according to this command output?

hashing algorithm mismatch

encryption algorithm mismatch

authentication key mismatch

interesting traffic was not applied

28. What is a difference between FlexVPN and DMVPN?

DMVPN uses IKEv1 or IKEv2, FlexVPN only uses IKEv1

DMVPN uses only IKEv1 FlexVPN uses only IKEv2

FlexVPN uses IKEv2, DMVPN uses IKEv1 or IKEv2

FlexVPN uses IKEv1 or IKEv2, DMVPN uses only IKEv2

29. Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?

TLSv1.2

TLSv1.1

BJTLSv1

DTLSv1

30. What is a commonality between DMVPN and FlexVPN technologies?

FlexVPN and DMVPN use IS-IS routing protocol to communicate with spokes

FlexVPN and DMVPN use the new key management protocol

FlexVPN and DMVPN use the same hashing algorithms

IOS routers run the same NHRP code for DMVPN and FlexVPN

Page 4 of 19

31. The main function of northbound APIs in the SDN architecture is to enable communication between which two areas of a network?

SDN controller and the cloud

management console and the SDN controller

management console and the cloud

SDN controller and the management solution

32. Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two)

accounting

assurance

automation

authentication

encryption

33. Which functions of an SDN architecture require southbound APIs to enable communication?

SDN controller and the network elements

management console and the SDN controller

management console and the cloud

SDN controller and the cloud

34. Which API is used for Content Security?

NX-OS API

IOS XR API

OpenVuln API

AsyncOS API

35. Which two request of REST API are valid on the Cisco ASA Platform? (Choose two)

put

options

get

push

connect

36. Refer to the exhibit.

What is the result of this Python script of the Cisco DNA Center API?

adds authentication to a switch

adds a switch to Cisco DNA Center

receives information about a switch

deletes a switch from Cisco DNA Center

37. Refer to the exhibit.

What does the API do when connected to a Cisco security appliance?

get the process and PID information from the computers in the network

create an SNMP pull mechanism for managing AMP

gather network telemetry information from AMP for endpoints

gather the network interface information about the computers AMP sees

38. Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?

Security Intelligence

Impact Flags

Health Monitoring

URL Filtering

39. Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two)

Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS

Cisco FTDv with one management interface and two traffic interfaces configured

Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises

Cisco FTDv with two management interfaces and one traffic interface configured

Cisco FTDv configured in routed mode and IPv6 configured

40. Which option is the main function of Cisco Firepower impact flags?

They alert administrators when critical events occur.

They highlight known and suspected malicious IP addresses in reports.

They correlate data about intrusions and vulnerability.

They identify data that the ASA sends to the Firepower module.

Page 5 of 19

41. On Cisco Firepower Management Center, which policy is used to collect health modules alerts from Managed devices?

health policy

system policy

correlation policy

access control policy

health awareness policy

42. Which license is required for Cisco Security Intelligence to work on the Cisco Next Generation Intrusion Prevention System?

control

malware

URL filtering

protect

43. Which two are valid suppression types on a Cisco Next Generation Intrusion Prevention System? (Choose two)

Port

Rule

Source

Application

Protocol

44. Which feature is configured for managed devices in the device platform settings of the Firepower Management Center?

quality of service

time synchronization

network address translations

intrusion policy

45. Which information is required when adding a device to Firepower Management Center?

username and password

encryption method

device serial number

registration key

46. Which two deployment modes does the Cisco ASA FirePower module support? (Choose two)

transparent mode

routed mode

inline mode

active mode

passive monitor-only mode

47. The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic. Where must the ASA be added on the Cisco UC Manager platform?

Certificate Trust List

Endpoint Trust List

Enterprise Proxy Service

Secured Collaboration Proxy

48. Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

To view bandwidth usage for NetFlow records, the QoS feature must be enabled.

A sysopt command can be used to enable NSEL on a specific interface.

NSEL can be used without a collector configured.

A flow-export event type must be defined under a policy

49. Which feature is supported when deploying Cisco ASAv within AWS public cloud?

multiple context mode

user deployment of Layer 3 networks

IPv6

clustering

50. Which statement describes a traffic profile on a Cisco Next Generation Intrusion Prevention System?

It allows traffic if it does not meet the profile.

It defines a traffic baseline for traffic anomaly deduction.

It inspects hosts that meet the profile with more intrusion rules.

It blocks traffic if it does not meet the profile.

Page 6 of 19

51. Which statement about IOS zone-based firewalls is true?

An unassigned interface can communicate with assigned interfaces

Only one interface can be assigned to a zone.

An interface can be assigned to multiple zones.

An interface can be assigned only to one zone.

52. What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?

It tracks flow-create, flow-teardown, and flow-denied events.

It provides stateless IP flow tracking that exports all records of a specific flow.

It tracks the flow continuously and provides updates every 10 seconds.

Its events match all traffic classes in parallel.

53. Which CLI command is used to register a Cisco FirePower sensor to Firepower Management Center?

configure system add <host><key>

configure manager <key> add host

configure manager delete

configure manager add <host><key

54. Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

Correlation

Intrusion

Access Control

Network Discovery

55. Which ASA deployment mode can provide separation of management on a shared appliance?

DMZ multiple zone mode

transparent firewall mode

multiple context mode

routed mode

56. Refer to the exhibit.

What is a result of the configuration?

Traffic from the DMZ network is redirected

Traffic from the inside network is redirected

All TCP traffic is redirected

Traffic from the inside and DMZ networks is redirected

57. Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?

Group Policy

Access Control Policy

Device Management Policy

Platform Service Policy

58. Which two tasks allow NetFlow on a Cisco ASA 5500 Series firewall? (Choose two)

Enable NetFlow Version 9.

Create an ACL to allow UDP traffic on port 9996.

Apply NetFlow Exporter to the outside interface in the inbound direction.

Create a class map to match interesting traffic.

Define a NetFlow collector by using the flow-export command

59. A mall provides security services to customers with a shared appliance. The mall wants separation of management on the shared appliance.

Which ASA deployment mode meets these needs?

routed mode

transparent mode

multiple context mode

multiple zone mode

60. What is a characteristic of Firepower NGIPS inline deployment mode?

ASA with Firepower module cannot be deployed.

It cannot take actions such as blocking traffic.

It is out-of-band from traffic.

It must have inline interface pairs configured.

Page 7 of 19

61. An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA.

Which Cisco ASA command must be used?

flow-export destination inside 1.1.1.1 2055

ip flow monitor input

ip flow-export destination 1.1.1.1 2055

flow exporter

62. How many interfaces per bridge group does an ASA bridge group deployment support?

up to 2

up to 4

up to 8

up to 16

63. Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two)

packet decoder

SIP

modbus

inline normalization

SSL

64. Which two features of Cisco Email Security can protect your organization against email threats? (Choose two)

Time-based one-time passwords

Data loss prevention

Heuristic-based filtering

Geolocation-based filtering

NetFlow

65. Why would a user choose an on-premises ESA versus the CES solution?

Sensitive data must remain onsite.

Demand is unpredictable.

The server team wants to outsource this service.

ESA is deployed inline.

66. Which two features are used to configure Cisco ESA with a multilayer approach to fight viruses and malware? (Choose two)

Sophos engine

white list

RAT

outbreak filters

DLP

67. What is the purpose of the Decrypt for Application Detection feature within the WSA Decryption options?

It decrypts HTTPS application traffic for unauthenticated users.

It alerts users when the WSA decrypts their traffic.

It decrypts HTTPS application traffic for authenticated users.

It provides enhanced HTTPS application detection for AsyncO

68. Which two statements about a Cisco WSA configured in Transparent mode are true? (Choose two)

It can handle explicit HTTP requests.

It requires a PAC file for the client web browser.

It requires a proxy for the client web browser.

WCCP v2-enabled devices can automatically redirect traffic destined to port 80.

Layer 4 switches can automatically redirect traffic destined to port 80.

69. Which action controls the amount of URI text that is stored in Cisco WSA logs files?

Configure the datasecurityconfig command

Configure the advancedproxyconfig command with the HTTPS subcommand

Configure a small log-entry size.

Configure a maximum packet size.

70. An engineer is configuring a Cisco ESA and wants to control whether to accept or reject email messages to a recipient address.

Which list contains the allowed recipient addresses?

SAT

BAT

HAT

RAT

Page 8 of 19

71. Which two services must remain as on-premises equipment when a hybrid email solution is deployed? (Choose two)

DDoS

antispam

antivirus

encryption

DLP

72. Which Talos reputation center allows you to track the reputation of IP addresses for email and web

traffic?

IP Blacklist Center

File Reputation Center

AMP Reputation Center

IP and Domain Reputation Center

73. Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

transparent

redirection

forward

proxy gateway

74. After deploying a Cisco ESA on your network, you notice that some messages fail to reach their destinations.

Which task can you perform to determine where each message was lost?

Configure the trackingconfig command to enable message tracking.

Generate a system report.

Review the log files.

Perform a trace.

75. What is the primary benefit of deploying an ESA in hybrid mode?

You can fine-tune its settings to provide the optimum balance between security and performance for your environment

It provides the lowest total cost of ownership by reducing the need for physical appliances

It provides maximum protection and control of outbound messages

It provides email security while supporting the transition to the cloud

76. What is the primary role of the Cisco Email Security Appliance?

Mail Submission Agent

Mail Transfer Agent

Mail Delivery Agent

Mail User Agent

77. Which technology is used to improve web traffic performance by proxy caching?

WSA

Firepower

FireSIGHT

ASA

78. In which two ways does a system administrator send web traffic transparently to the Web Security

Appliance? (Choose two)

configure Active Directory Group Policies to push proxy settings

configure policy-based routing on the network infrastructure

reference a Proxy Auto Config file

configure the proxy IP address in the web-browser settings

use Web Cache Communication Protocol

79. Which technology reduces data loss by identifying sensitive information stored in public computing environments?

Cisco SDA

Cisco Firepower

Cisco HyperFlex

Cisco Cloudlock

80. Which deployment model is the most secure when considering risks to cloud adoption?

Public Cloud

Hybrid Cloud

Community Cloud

Private Cloud

Page 9 of 19

81. In which cloud services model is the tenant responsible for virtual machine OS patching?

IaaS

UCaaS

PaaS

SaaS

82. Which cloud service model offers an environment for cloud consumers to develop and deploy applications without needing to manage or maintain the underlying cloud infrastructure?

PaaS

XaaS

IaaS

SaaS

83. What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?

It allows the administrator to quarantine malicious files so that the application can function, just Not maliciously.

It discovers and controls cloud apps that are connected to a company’s corporate environment.

It deletes any application that does not belong in the network.

It sends the application information to an administrator to act on.

84. Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

Nexus

Stealthwatch

Firepower

Tetration

85. In a PaaS model, which layer is the tenant responsible for maintaining and patching?

hypervisor

virtual machine

network

application

86. On which part of the IT environment does DevSecOps focus?

application development

wireless network

data center

perimeter network

87. What is the function of Cisco Cloudlock for data security?

data loss prevention

controls malicious cloud apps

detects anomalies

user and entity behavior analytics

88. An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10.

What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

Cisco Identity Services Engine and AnyConnect Posture module

Cisco Stealthwatch and Cisco Identity Services Engine integration

Cisco ASA firewall with Dynamic Access Policies configured

Cisco Identity Services Engine with PxGrid services enabled

89. An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE.

Which CoA type achieves this goal?

Port Bounce

CoA Terminate

CoA Reauth

CoA Session Query

90. Which two probes are configured to gather attributes of connected endpoints using Cisco Identity Services Engine? (Choose two)

RADIUS

TACACS+

DHCP

sFlow

SMTP

Page 10 of 19

91. Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

RSA SecureID

Internal Database

Active Directory

LDAP

92. An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware.

Which two solutions mitigate the risk of this ransom ware infection? (Choose two)

Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.

Set up a profiling policy in Cisco Identity Service Engine to check and endpoint patch level before allowing access on the network.

Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network.

Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.

Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.

93. Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an

Inline posture node?

RADIUS Change of Authorization

device tracking

DHCP snooping

VLAN hopping

94. What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two)

multiple factor auth

local web auth

single sign-on

central web auth

TACACS+

95. For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two)

Windows service

computer identity

user identity

Windows firewall

default browser

96. Which compliance status is shown when a configured posture policy requirement is not met?

compliant

unknown

authorized

noncompliant

97. Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

It allows the endpoint to authenticate with 802.1x or MA

It verifies that the endpoint has the latest Microsoft security patches installed.

It adds endpoints to identity groups dynamically.

It allows CoA to be applied if the endpoint status is compliant.

98. Which IPS engine detects ARP spoofing?

Atomic ARP Engine

Service Generic Engine

ARP Inspection Engine

AIC Engine

99. What is a characteristic of Dynamic ARP Inspection?

DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.

In a typical network, make all ports as trusted except for the ports connecting to switches, which Are untrusted

DAI associates a trust state with each switch.

DAI intercepts all ARP requests and responses on trusted ports only.

100. What is a characteristic of traffic storm control behavior?

Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.

Traffic storm control cannot determine if the packet is unicast or broadcast.

Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.

Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.

Page 11 of 19

101. A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports at the same time.

What two catalyst switch security features will prevent further violations? (Choose two)

DHCP Snooping

802.1AE MacSec

Port security

IP Device track

Dynamic ARP inspection

Private VLANs

102. Which command enables 802.1X globally on a Cisco switch?

dot1x system-auth-control

dot1x pae authenticator

authentication port-control aut

aaa new-model

103. Which RADIUS attribute can you use to filter MAB requests in an 802.1 x deployment?

104. A network administrator configures Dynamic ARP Inspection on a switch. After Dynamic ARP Inspection is applied, all users on that switch are unable to communicate with any destination. The network administrator checks the interface status of all interfaces, and there is no err-disabled interface.

What is causing this problem?

DHCP snooping has not been enabled on all VLANs.

The ip arp inspection limit command is applied on all interfaces and is blocking the traffic of all users.

Dynamic ARP Inspection has not been enabled on all VLANs

The no ip arp inspection trust command is applied on all user host interfaces

105. Refer to the exhibit.

An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate.

Which port configuration is missing?

authentication open

dotlx reauthentication

cisp enable

dot1x pae authenticator

106. Which SNMPv3 configuration must be used to support the strongest security possible?

asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmp-server group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmpserver group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv 3des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy

107. Refer to the exhibit.

Which command was used to generate this output and to show which ports are authenticating with dot1x or mab?

show authentication registrations

show authentication method

show dot1x all

show authentication sessions

108. What Cisco command shows you the status of an 802.1X connection on interface gi0/1?

show authorization status

show authen sess int gi0/1

show connection status gi0/1

show ver gi0/1

109. Refer to the exhibit.

What does the number 15 represent in this configuration?

privilege level for an authorized user to this router

access list that identifies the SNMP devices that can access the router

interval in seconds between SNMPv3 authentication attempts

number of possible failed attempts until the SNMPv3 user is locked out

110. Under which two circumstances is a CoA issued? (Choose two)

A new authentication rule was added to the policy on the Policy Service node.

An endpoint is deleted on the Identity Service Engine server.

A new Identity Source Sequence is created and referenced in the authentication policy.

An endpoint is profiled for the first time.

A new Identity Service Engine server is added to the deployment with the Administration persona

Page 12 of 19

111. Refer to the exhibit.

A network administrator configures command authorization for the admin5 user.

What is the admin5 user able to do on HQ_Router after this configuration?

set the IP address of an interface

complete no configurations

complete all configurations

add subinterfaces

112. A network engineer has entered the snmp-server user andy myv3 auth sha cisco priv aes 256 cisc0380739941 command and needs to send SNMP information to a host at 10.255.254.1.

Which command achieves this goal?

snmp-server host inside 10.255.254.1 version 3 andy

snmp-server host inside 10.255.254.1 version 3 myv3

snmp-server host inside 10.255.254.1 snmpv3 andy

snmp-server host inside 10.255.254.1 snmpv3 myv3

113. Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

interpacket variation

software package variation

flow insight variation

process details variation

114. How is ICMP used an exfiltration technique?

by flooding the destination host with unreachable packets

by sending large numbers of ICMP packets with a targeted hosts source IP address using an IP broadcast address

by encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host

by overwhelming a targeted host with ICMP echo-request packets

115. Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?

DNS tunneling

DNS Crypt

DNS security

DNSSEC

116. How is DNS tunneling used to exfiltrate data out of a corporate network?

It corrupts DNS servers by replacing the actual IP address with a rogue address to collect information or start other attacks.

It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.

It redirects DNS requests to a malicious server used to steal user credentials, which allows further damage and theft on the network.

It leverages the DNS server by permitting recursive lookups to spread the attack to other DNS servers.

117. Which two characteristics of messenger protocols make data exfiltration difficult to detect and

prevent? (Choose two)

Outgoing traffic is allowed so users can communicate with outside organizations.

Malware infects the messenger application on the user endpoint to send company data.

Traffic is encrypted, which prevents visibility on firewalls and IPS systems.

An exposed API for the messaging platform is used to send large amounts of data.

Messenger applications cannot be segmented with standard network controls

118. Which Cisco AMP file disposition valid?

pristine

malware

dirty

non malicious

119. When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?

Spero analysis

dynamic analysis

sandbox analysis

malware analysis

120. Which Cisco Advanced Malware protection for Endpoints deployment architecture is designed to keep data within a network perimeter?

cloud web services

network AMP

private cloud

public cloud

Page 13 of 19

121. Which capability is exclusive to a Cisco AMP public cloud instance as compared to a private cloud instance?

RBAC

ETHOS detection engine

SPERO detection engine

TETRA detection engine

122. An engineer is configuring AMP for endpoints and wants to block certain files from executing.

Which outbreak control method is used to accomplish this task?

device flow correlation

simple detections

application blocking list

advanced custom detections

123. Which function is the primary function of Cisco AMP threat Grid?

automated email encryption

applying a real-time URI blacklist

automated malware analysis

monitoring network traffic

124. What are two list types within AMP for Endpoints Outbreak Control? (Choose two)

blocked ports

simple custom detections

command and control

allowed applications

URL

125. What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?

Enable IP Layer enforcement.

Activate the Advanced Malware Protection license

Activate SSL decryption.

Enable Intelligent Proxy.

126. When wired 802.1X authentication is implemented, which two components are required? (Choose two)

authentication server: Cisco Identity Service Engine

supplicant: Cisco AnyConnect ISE Posture module

authenticator: Cisco Catalyst switch

authenticator: Cisco Identity Services Engine

authentication server: Cisco Prime Infrastructure

127. Refer to the exhibit.

Which command was used to display this output?

show dot1x all

show dot1x

show dot1x all summary

show dot1x interface gi1/0/12

128. Refer to the exhibit.

Which statement about the authentication protocol used in the configuration is true?

The authentication request contains only a password

The authentication request contains only a username

The authentication and authorization requests are grouped in a single packet

There are separate authentication and authorization request packets

129. An engineer needs a solution for TACACS+ authentication and authorization for device administration.

The engineer also wants to enhance wired and wireless network security by requiring users and endpoints to use 802.1X, MAB, or WebAuth.

Which product meets all of these requirements?

Cisco Prime Infrastructure

Cisco Identity Services Engine

Cisco Stealthwatch

Cisco AMP for Endpoints

130. Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?

aaa server radius dynamic-author

aaa new-model

auth-type all

ip device-tracking

Page 14 of 19

131. An MDM provides which two advantages to an organization with regards to device management? (Choose two)

asset inventory management

allowed application management

Active Directory group policy management

network device management

critical device management

132. Which Cisco product provides proactive endpoint protection and allows administrators to centrally

manage the deployment?

NGFW

AMP

WSA

ESA

133. Which benefit does endpoint security provide the overall security posture of an organization?

It streamlines the incident response process to automatically perform digital forensics on the endpoint.

It allows the organization to mitigate web-based attacks as long as the user is active in the domain.

It allows the organization to detect and respond to threats at the edge of the network.

It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.

134. What are the two most commonly used authentication factors in multifactor authentication? (Choose two)

biometric factor

time factor

confidentiality factor

knowledge factor

encryption factor

135. Which two kinds of attacks are prevented by multifactor authentication? (Choose two)

phishing

brute force

man-in-the-middle

DDOS

teardrop

136. What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?

EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.

EDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter defenses.

EPP focuses on network security, and EDR focuses on device security.

EDR focuses on network security, and EPP focuses on device security.

137. An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group.

Which probe must be enabled for this type of profiling to work?

NetFlow

NMAP

SNMP

DHCP

138. What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two)

flexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications

single sign-on access to on-premises and cloud applications

integration with 802.1x security using native Microsoft Windows supplicant

secure access to on-premises and cloud applications

identification and correction of application vulnerabilities before allowing access to resources

139. An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network.

Which action tests the routing?

Ensure that the client computers are pointing to the on-premises DNS servers.

Enable the Intelligent Proxy to validate that traffic is being routed correctly.

Add the public IP address that the client computers are behind to a Core Identity.

Browse to http://welcome.umbrella.com/to validate that the new identity is working.

140. Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

File Analysis

SafeSearch

SSL Decryption

Destination Lists

Page 15 of 19

141. How is Cisco Umbrella configured to log only security events?

per policy

in the Reporting settings

in the Security Settings section

per network in the Deployments section

142. How does Cisco Umbrella archive logs to an enterprise owned storage?

by using the Application Programming Interface to fetch the logs

by sending logs via syslog to an on-premises or cloud-based syslog server

by the system administrator downloading the logs from the Cisco Umbrella web portal

by being configured to send logs to a self-managed AWS S3 bucket

143. When web policies are configured in Cisco Umbrella, what provides the ability to ensure that domains are blocked when they host malware, command and control, phishing, and more threats?

Application Control

Security Category Blocking

Content Category Blocking

File Analysis

144. Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?

AMP

AnyConnect

DynDNS

Talos

145. Where are individual sites specified to be blacklisted in Cisco Umbrella?

application settings

content categories

security settings

destination lists

146. Which Cisco security solution protects remote users against phishing attacks when they are not

connected to the VPN?

Cisco Stealthwatch

Cisco Umbrella

Cisco Firepower

NGIPS

147. How does Cisco Stealthwatch Cloud provide security for cloud environments?

It delivers visibility and threat detection.

It prevents exfiltration of sensitive data.

It assigns Internet-based DNS protection for clients and servers.

It facilitates secure connectivity between public and private networks.

148. What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two)

data exfiltration

command and control communication

intelligent proxy

snort

URL categorization

149. Which network monitoring solution uses streams and pushes operational data to provide a near real-

time view of activity?

SNMP

SMTP

syslog

model-driven telemetry

150. What provides visibility and awareness into what is currently occurring on the network?

CMX

WMI

Prime Infrastructure

Telemetry

Page 16 of 19

151. What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?

Cisco Umbrella

External Threat Feeds

Cisco Threat Grid

Cisco Stealthwatch

152. Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other third-party management tools, and prioritize application traffic?

Cisco Security Intelligence

Cisco Application Visibility and Control

Cisco Model Driven Telemetry

Cisco DNA Center

153. Which two activities can be done using Cisco DNA Center? (Choose two)

DHCP

Design

Accounting

DNS

Provision

154. What must be used to share data between multiple security products?

Cisco Rapid Threat Containment

Cisco Platform Exchange Grid

Cisco Advanced Malware Protection

Cisco Stealthwatch Cloud

155. Which Cisco product is open, scalable, and built on IETF standards to allow multiple security products from Cisco and other vendors to share data and interoperate with each other?

Advanced Malware Protection

Platform Exchange Grid

Multifactor Platform Integration

Firepower Threat Defense

156. What is a feature of the open platform capabilities of Cisco DNA Center?

intent-based APIs

automation adapters

domain integration

application adapters

157. What is the function of the Context Directory Agent?

maintains users’ group memberships

relays user authentication requests from Web Security Appliance to Active Directory

reads the Active Directory logs to map IP addresses to usernames

accepts user authentication requests on behalf of Web Security Appliance for user identification

158. What is a characteristic of a bridge group in ASA Firewall transparent mode?

It includes multiple interfaces and access rules between interfaces are customizable

It is a Layer 3 segment and includes one port and customizable access rules

It allows ARP traffic with a single access rule

It has an IP address on its BVI interface and is used for management traffic

159. When Cisco and other industry organizations publish and inform users of known security findings and vulnerabilities, which name is used?

Common Security Exploits

Common Vulnerabilities and Exposures

Common Exploits and Vulnerabilities

Common Vulnerabilities, Exploits and Threats

160. Which two fields are defined in the NetFlow flow? (Choose two)

type of service byte

class of service bits

Layer 4 protocol type

destination port

output logical interface

Page 17 of 19

161. What provides the ability to program and monitor networks from somewhere other than the DNAC GUI?

NetFlow

desktop client

ASDM

API

162. An organization has two machines hosting web applications. Machine 1 is vulnerable to SQL injection while machine 2 is vulnerable to buffer overflows.

What action would allow the attacker to gain access to machine 1 but not machine 2?

sniffing the packets between the two hosts

sending continuous pings

overflowing the buffer’s memory

inserting malicious commands into the database

163. An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network.

Which product should be used to accomplish this goal?

Cisco Firepower

Cisco Umbrella

ISE

AMP

164. A company is experiencing exfiltration of credit card numbers that are not being stored on-premise. The company needs to be able to protect sensitive data throughout the full environment.

Which tool should be used to accomplish this goal?

Security Manager

Cloudlock

Web Security Appliance

Cisco ISE

165. An engineer is trying to securely connect to a router and wants to prevent insecure algorithms from being used.

However, the connection is failing.

Which action should be taken to accomplish this goal?

Disable telnet using the no ip telnet command.

Enable the SSH server using the ip ssh server command.

Configure the port using the ip ssh port 22 command.

Generate the RSA key using the crypto key generate rsa command.

166. A network administrator is using the Cisco ESA with AMP to upload files to the cloud for analysis. The network is congested and is affecting communication.

How will the Cisco ESA handle any files which need analysis?

AMP calculates the SHA-256 fingerprint, caches it, and periodically attempts the upload.

The file is queued for upload when connectivity is restored.

The file upload is abandoned.

The ESA immediately makes another attempt to upload the file.

167. Which type of algorithm provides the highest level of protection against brute-force attacks?

PFS

HMAC

MD5

SHA

168. What must be configured in Cisco ISE to enforce reauthentication of an endpoint session when an endpoint is deleted from an identity group?

posture assessment

CoA

external identity source

SNMP probe

169. A network administrator is configuring a rule in an access control policy to block certain URLs and selects the “Chat and Instant Messaging” category.

Which reputation score should be selected to accomplish this goal?

170. Which group within Cisco writes and publishes a weekly newsletter to help cybersecurity professionals remain aware of the ongoing and most prevalent threats?

PSIRT

Talos

CSIRT

DEVNET

Page 18 of 19

171. What are the two types of managed Intercloud Fabric deployment models? (Choose two.)

Public managed

Service Provider managed

Enterprise managed

User managed

Hybrid managed

172. What are two DDoS attack categories? (Choose two)

sequential

protocol

database

volume-based

screen-based

173. Refer to the exhibit.

Which type of authentication is in use?

LDAP authentication for Microsoft Outlook

POP3 authentication

SMTP relay server authentication

external user and relay mail authentication

174. An organization received a large amount of SPAM messages over a short time period. In order to take action on the messages, it must be determined how harmful the messages are and this needs to happen dynamically.

What must be configured to accomplish this?

Configure the Cisco WSA to modify policies based on the traffic seen

Configure the Cisco ESA to receive real-time updates from Talos

Configure the Cisco WSA to receive real-time updates from Talos

Configure the Cisco ESA to modify policies based on the traffic seen

175. Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?

Encrypted Traffic Analytics

Threat Intelligence Director

Cognitive Threat Analytics

Cisco Talos Intelligence

176. What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two)

The Cisco WSA responds with its own IP address only if it is running in explicit mode.

The Cisco WSA is configured in a web browser only if it is running in transparent mode.

The Cisco WSA responds with its own IP address only if it is running in transparent mode.

The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.

When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request destination.

177. After a recent breach, an organization determined that phishing was used to gain initial access to the network before regaining persistence. The information gained from the phishing attack was a result of users visiting known malicious websites.

What must be done in order to prevent this from happening in the future?

Modify an access policy

Modify identification profiles

Modify outbound malware scanning policies

Modify web proxy settings

178. What is the function of SDN southbound API protocols?

to allow for the dynamic configuration of control plane applications

to enable the controller to make changes

to enable the controller to use REST

to allow for the static configuration of control plane applications

179. Refer to the exhibit.

Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance.

What is causing this issue?

No split-tunnel policy is defined on the Firepower Threat Defense appliance.

The access control policy is not allowing VPN traffic in.

Site-to-site VPN peers are using different encryption algorithms.

Site-to-site VPN preshared keys are mismatched.

180. An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system’s applications.

Which vulnerability allows the attacker to see the passwords being transmitted in clear text?

weak passwords for authentication

unencrypted links for traffic

software bugs on applications

improper file security

Page 19 of 19

181. Using Cisco Firepower’s Security Intelligence policies, upon which two criteria is Firepower block

based? (Choose two)

URLs

protocol IDs

IP addresses

MAC addresses

port numbers

182. Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?

Cisco WiSM

Cisco ESA

Cisco ISE

Cisco Prime Infrastructure

183. What are two benefits of Flexible NetFlow records? (Choose two)

They allow the user to configure flow information to perform customized traffic identification

They provide attack prevention by dropping the traffic

They provide accounting and billing enhancements

They converge multiple accounting technologies into one accounting mechanism

They provide monitoring of a wider range of IP packet information from Layer 2 to 4

184. How does DNS Tunneling exfiltrate data?

An attacker registers a domain that a client connects to based on DNS records and sends malware through that connection.

An attacker opens a reverse DNS shell to get into the client’s system and install malware on it.

An attacker uses a non-standard DNS port to gain access to the organization’s DNS servers in order to poison the resolutions.

An attacker sends an email to the target with hidden DNS resolvers in it to redirect them to a malicious domain.

Valid 350-701 SCOR Exam Dumps – Make Sure You Pass

Valid 350-701 SCOR Exam Dumps – Make Sure You Pass

Share this post

Leave a Reply Cancel reply

Related Posts