CCNP Security 350-701 Real Exam Questions and Answers FREE Updated on Dec 29, 2025
350-701 Ultimate Study Guide - Dumps4PDF
NEW QUESTION # 129
In which two ways does a system administrator send web traffic transparently to the Web Security Appliance?
(Choose two)
- A. use Web Cache Communication Protocol
- B. configure policy-based routing on the network infrastructure
- C. reference a Proxy Auto Config file
- D. configure the proxy IP address in the web-browser settings
- E. configure Active Directory Group Policies to push proxy settings
Answer: A,B
NEW QUESTION # 130
An organization is receiving SPAM emails from a known malicious domain. What must be configured in order to prevent the session during the initial TCP communication?
- A. Configure the Cisco ESA to drop the malicious emails
- B. Configure policies to stop and reject communication
- C. Configure the Cisco ESA to reset the TCP connection
- D. Configure policies to quarantine malicious emails
Answer: B
Explanation:
The best way to prevent the session during the initial TCP communication is to configure policies to stop and reject communication from the known malicious domain. This will prevent the ESA from accepting any messages from that domain and send a negative SMTP response code back to the sender. This will also save the ESA's resources and bandwidth, as it will not have to process or store the malicious emails. This can be done by creating a sender group in the Host Access Table (HAT) that matches the malicious domain and setting the mail flow policy to "Reject" or "Throttle". Alternatively, a message filter can be created that checks the envelope sender against the malicious domain and applies the "stop_connection" or
"reject_connection" action12.
The other options are not as effective as stopping and rejecting the communication at the TCP level.
Configuring the Cisco ESA to drop the malicious emails (option A) will still allow the ESA to accept the messages and then silently discard them, which will consume the ESA's resources and bandwidth, and also not notify the sender of the rejection. Configuring policies to quarantine malicious emails (option B) will also require the ESA to accept and store the messages, which will take up disk space and require manual or automated management of the quarantine. Configuring the Cisco ESA to reset the TCP connection (option D) will abruptly terminate the connection without sending a proper SMTP response code, which may cause the sender to retry the delivery and generate more traffic. Resetting the TCP connection is also considered a less polite and less compliant way of rejecting messages than sending a negative SMTP response code34. References: 1: How to Block a Sender Domain on the Email Security Appliance 2: Message Filters on the Cisco Email Security Appliance 3: How to Configure the Cisco Email Security Appliance to Reject or Drop Messages 4: Cisco Email Security Appliance User Guide - Configuring Mail Policies
NEW QUESTION # 131
What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two.)
- A. secure access to on-premises and cloud applications
- B. integration with 802.1x security using native Microsoft Windows supplicant
- C. single sign-on access to on-premises and cloud applications
- D. identification and correction of application vulnerabilities before allowing access to resources
- E. flexibility of different methods of 2FA such as phone callbacks, SMS passcodes. and push notifications
Answer: C,E
NEW QUESTION # 132
An administrator is adding a new Cisco ISE node to an existing deployment. What must be done to ensure that the addition of the node will be successful when inputting the FQDN?
- A. Add the DNS entry for the new Cisco ISE node into the DNS server
- B. Make the new Cisco ISE node a secondary PAN before registering it with the primary.
- C. Open port 8905 on the firewall between the Cisco ISE nodes
- D. Change the IP address of the new Cisco ISE node to the same network as the others.
Answer: A
Explanation:
Add the DNS entry for the new Cisco ISE node into the DNS server. This is because the fully qualified domain name (FQDN) of the new Cisco ISE node, for example, ise1.cisco.com, must be DNS-resolvable from the primary Administration ISE node. Otherwise, node registration will fail. The DNS server must contain the IP addresses and FQDNs of the ISE nodes that are part of the distributed deployment1.
The other options are incorrect because:
* Changing the IP address of the new Cisco ISE node to the same network as the others is not necessary, as long as the nodes can communicate with each other over the network.
* Making the new Cisco ISE node a secondary PAN before registering it with the primary is not possible, as the node must be registered first before changing its persona or role.
* Opening port 8905 on the firewall between the Cisco ISE nodes is not required, as this port is used for communication between the primary and secondary Monitoring ISE nodes, not for node registration.
References:
* Setting Up Cisco ISE in a Distributed Environment
* ISE node registering after change domain-name
* FQDN IN ISE
NEW QUESTION # 133
How is Cisco Umbrella configured to log only security events?
- A. per policy
- B. per network in the Deployments section
- C. in the Security Settings section
- D. in the Reporting settings
Answer: A
Explanation:
Explanation The logging of your identities' activities is set per-policy when you first create a policy. By default, logging is on and set to log all requests an identity makes to reach destinations. At any time after you create a policy, you can change what level of identity activity Umbrella logs. From the Policy wizard, log settings are: Log All Requests-For full logging, whether for content, security or otherwise Log Only Security Events-For security logging only, which gives your users more privacy-a good setting for people with the roaming client installed on personal devices Don't Log Any Requests-Disables all logging. If you select this option, most reporting for identities with this policy will not be helpful as nothing is logged to report on. Reference: https://docs.umbrella.com/deployment-umbrella/docs/log-management The logging of your identities' activities is set per-policy when you first create a policy. By default, logging is on and set to log all requests an identity makes to reach destinations. At any time after you create a policy, you can change what level of identity activity Umbrella logs.
From the Policy wizard, log settings are:
Log All Requests-For full logging, whether for content, security or otherwise Log Only Security Events-For security logging only, which gives your users more privacy-a good setting for people with the roaming client installed on personal devices Don't Log Any Requests-Disables all logging. If you select this option, most reporting for identities with this policy will not be helpful as nothing is logged to report on.
Explanation The logging of your identities' activities is set per-policy when you first create a policy. By default, logging is on and set to log all requests an identity makes to reach destinations. At any time after you create a policy, you can change what level of identity activity Umbrella logs. From the Policy wizard, log settings are: Log All Requests-For full logging, whether for content, security or otherwise Log Only Security Events-For security logging only, which gives your users more privacy-a good setting for people with the roaming client installed on personal devices Don't Log Any Requests-Disables all logging. If you select this option, most reporting for identities with this policy will not be helpful as nothing is logged to report on. Reference: https://docs.umbrella.com/deployment-umbrella/docs/log-management
NEW QUESTION # 134
Which DevSecOps implementation process gives a weekly or daily update instead of monthly or quarterly in the applications?
- A. Container
- B. Orchestration
- C. Security
- D. CI/CD pipeline
Answer: D
Explanation:
Explanation Unlike the traditional software life cycle, the CI/CD implementation process gives a weekly or daily update instead of monthly or quarterly. The fun part is customers won't even realize the update is in their applications, as they happen on the fly. Reference: https://devops.com/how-to-implement-an-effective-ci-cd-pipeline/ Unlike the traditional software life cycle, the CI/CD implementation process gives a weekly or daily update instead of monthly or quarterly. The fun part is customers won't even realize the update is in their applications, as they happen on the fly.
Explanation Unlike the traditional software life cycle, the CI/CD implementation process gives a weekly or daily update instead of monthly or quarterly. The fun part is customers won't even realize the update is in their applications, as they happen on the fly. Reference: https://devops.com/how-to-implement-an-effective-ci-cd-pipeline/
NEW QUESTION # 135
What is the purpose of a NetFlow version 9 template record?
- A. lt defines the format of data records.
- B. It serves as a unique identification number to distinguish individual data records
- C. It provides a standardized set of information about an IP flow.
- D. It specifies the data format of NetFlow processes.
Answer: A
Explanation:
A NetFlow version 9 template record is a record that contains information about the fields that will be present in the data records that follow the template. A template record consists of a template ID, a field count, and a list of field types and lengths. A template record is sent periodically by the NetFlow exporter to the NetFlow collector, so that the collector can parse and interpret the data records correctly. A template record can also be requested by the collector using an options template record. The purpose of a template record is to define the format of data records, which contain the actual information about the IP flows1234.
A). It specifies the data format of NetFlow processes. - This is incorrect, because a template record does not specify the data format of NetFlow processes, but rather the data format of data records. NetFlow processes are the functions that perform flow creation, aggregation, export, and analysis on the NetFlow device or the collector.
B). It provides a standardized set of information about an IP flow. - This is incorrect, because a template record does not provide any information about an IP flow, but rather the information about the fields that will be present in the data records. The data records are the ones that provide the information about an IP flow, such as source and destination IP addresses, ports, protocols, bytes, packets, timestamps, and so on. C. It defines the format of data records. - This is correct, because a template record defines the format of data records by specifying the field types and lengths that will be present in the data records. A template record allows the NetFlow collector to parse and interpret the data records correctly, and also enables the NetFlow exporter to use different formats for different types of flows. D. It serves as a unique identification number to distinguish individual data records. - This is incorrect, because a template record does not serve as a unique identification number, but rather as a description of the fields. A template record has a template ID, which is a
16-bit value that identifies the template record uniquely within an export packet, but this ID is not used to distinguish individual data records. The data records are distinguished by their position within the export packet and their association with a template record.
References := 1: NetFlow Version 9 Flow-Record Format [IP Application Services] - Cisco ... 2: NetFlow V9 formats - IBM 3: Netflow :: Version 9 - Caligare 4: NetFlow Versions > NetFlow for Cybersecurity | Cisco Press
NEW QUESTION # 136
An organization recently installed a Cisco WSA and would like to take advantage of the AVC engine to allow the organization to create a policy to control application specific activity. After enabling the AVC engine, what must be done to implement this?
- A. Use URL categorization to prevent the application traffic.
- B. Use an access policy group to configure application control settings.
- C. Use security services to configure the traffic monitor, .
- D. Use web security reporting to validate engine functionality
Answer: B
Explanation:
ExplanationExplanationThe Application Visibility and Control (AVC) engine lets you create policies to control application activity on the network without having to fully understand the underlying technology of each application. You can configure application control settings in Access Policy groups. You can block or allow applications individually or according to application type. You can also apply controls to particular application types.
NEW QUESTION # 137
What is the purpose of the My Devices Portal in a Cisco ISE environment?
- A. to request a newly provisioned mobile device
- B. to provision userless and agentless systems
- C. to manage and deploy antivirus definitions and patches on systems owned by the end user
- D. to register new laptops and mobile devices
Answer: D
Explanation:
Depending on your company policy, you might be able to use your mobile phones, tablets, printers, Internet radios, and other network devices on your company's network. You can use the My Devices portal to register and manage these devices on your company's network.
Depending on your company policy, you might be able to use your mobile phones, tablets, printers, Internet radios, and other network devices on your company's network. You can use the My Devices portal to register and manage these devices on your company's network.
Reference:
Depending on your company policy, you might be able to use your mobile phones, tablets, printers, Internet radios, and other network devices on your company's network. You can use the My Devices portal to register and manage these devices on your company's network.
NEW QUESTION # 138
Drag and drop the suspicious patterns for the Cisco Tetration platform from the left onto the correct definitions on the right.
Answer:
Explanation:
NEW QUESTION # 139
An organization wants to secure users, data, and applications in the cloud The solution must be API-based and operate as a cloud-native CAS8 Much solution must be used for this implementation?
- A. Cisco Cloudlock
- B. Cisco Firepower Next-Generation Firewall
- C. Cisco Umbrella
- D. Cisco Cloud Email Security
Answer: A
NEW QUESTION # 140
Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two)
- A. ARP spoofing
- B. eavesdropping
- C. exploits
- D. denial-of-service attacks
- E. malware
Answer: C,E
Explanation:
Malware means "malicious software", is any software intentionally designed to cause damage to a computer, server, client, or computer network. The most popular types of malware includes viruses, ransomware and spyware. Virus Possibly the most common type of malware, viruses attach their malicious code to clean code and wait to be run.
Ransomware is malicious software that infects your computer and displays messages demanding a fee to be paid in order for your system to work again.
Spyware is spying software that can secretly record everything you enter, upload, download, and store on your computers or mobile devices. Spyware always tries to keep itself hidden.
An exploit is a code that takes advantage of a software vulnerability or security flaw.
Exploits and malware are two risks for endpoints that are not up to date. ARP spoofing and eavesdropping are attacks against the network while denial-of-service attack is based on the flooding of IP packets.
NEW QUESTION # 141
An engineer needs to configure an access control policy rule to always send traffic for inspection without using the default action. Which action should be configured for this rule?
- A. allow
- B. trust
- C. block
- D. monitor
Answer: A
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/acce the first three access control rules in the policy-Monitor, Trust, and Block-cannot inspect matching traffic. Monitor rules track and log but do not inspect network traffic, so the system continues to match traffic against additional rules to determine whether to permit or deny it
https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/acce
NEW QUESTION # 142
What is a feature of NetFlow Secure Event Logging?
- A. It exports only records that indicate significant events in a flow.
- B. It supports v5 and v8 templates.
- C. It filters NSEL events based on the traffic and event type through RSVP.
- D. It delivers data records to NSEL collectors through NetFlow over TCP only.
Answer: A
Explanation:
NetFlow Secure Event Logging (NSEL) is a security logging mechanism that is built on NetFlow Version 9 technology. It provides a stateful, IP flow tracking method that exports only those records that indicate significant events in a flow, such as flow-create, flow-teardown, and flow-denied. NSEL events are triggered by the event that caused the state change in the flow. This reduces the amount of data that is exported and provides more relevant information for security analysis. NSEL also supports periodic flow-update events, which provide byte counters over the duration of the flow. These events are usually time-driven, but may also be triggered by state changes in the flow. NSEL uses templates to describe the format of the data records that are exported through NetFlow. Each event has several record formats or templates associated with it. NSEL delivers templates and data records to configured NSEL collectors through NetFlow over UDP only. NSEL also allows filtering of NSEL events based on the traffic and event type through Modular Policy Framework, and then sends records to different collectors. The supported event types are flow-create, flow-denied, flow-teardown, flow-update, and all. References := Some possible references are:
* NetFlow Secure Event Logging (NSEL) - Cisco
* NetFlow Secure Event Logging (NSEL) - Cisco
* Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0 (source book)
NEW QUESTION # 143
What is the difference between Cross-site Scripting and SQL Injection, attacks?
- A. Cross-site Scripting is an attack where code is injected into a database, whereas SQL Injection is an attack where code is injected into a browser.
- B. Cross-site Scripting is when executives in a corporation are attacked, whereas SQL Injection is when adatabase is manipulated.
- C. Cross-site Scripting is a brute force attack targeting remote sites, whereas SQL Injection is a socialengineering attack.
- D. Cross-site Scripting is an attack where code is executed from the server side, whereas SQL Injection is an attack where code is executed from the client side.
Answer: A
Explanation:
Answer B is not correct because Cross-site Scripting (XSS) is not a brute force attack.
Answer C is not correct because the statement "Cross-site Scripting is when executives in a corporation are attacked" is not true. XSS is a client-side vulnerability that targets other application users.
Answer D is not correct because the statement "Cross-site Scripting is an attack where code is executed from the server side". In fact, XSS is a method that exploits website vulnerability by injecting scripts that will run at client's side.
Therefore only answer A is left. In XSS, an attacker will try to inject his malicious code (usually malicious links) into a database. When other users follow his links, their web browsers are redirected to websites where attackers can steal data from them. In a SQL Injection, an attacker will try to inject SQL code (via his browser) into forms, cookies, or HTTP headers that do not use data sanitizing or validation methods of GET
/POST
parameters.
Note: The main difference between a SQL and XSS injection attack is that SQL injection attacks are used to steal information from databases whereas XSS attacks are used to redirect users to websites where attackers can steal data from them.
NEW QUESTION # 144
What is the Cisco API-based broker that helps reduce compromises, application risks, and data breaches in an environment that is not on-premise?
- A. Cisco Cloudlock
- B. Cisco AMP
- C. Cisco App Dynamics
- D. Cisco Umbrella
Answer: A
Explanation:
Reference:
NEW QUESTION # 145
Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?
- A. database
- B. Linux and Windows operating systems
- C. web page images
- D. user input validation in a web page or web application
Answer: D
NEW QUESTION # 146
Drag and drop the threats from the left onto examples of that threat on the right
Answer:
Explanation:
Explanation
NEW QUESTION # 147
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- A. Telemetry uses push and pull, which makes it more scalable than SNMP
- B. Telemetry uses push and pull which makes it more secure than SNMP
- C. Telemetry uses a pull mehod, which makes it more reliable than SNMP
- D. Telemetry uses a push method which makes it faster than SNMP
Answer: D
Explanation:
SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics.
Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry
NEW QUESTION # 148
Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?
- A. Encrypted Traffic Analytics
- B. Cognitive Threat Analytics
- C. Cisco Talos Intelligence
- D. Threat Intelligence Director
Answer: D
Explanation:
https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html
NEW QUESTION # 149
......
Ultimate Guide to Prepare 350-701 Certification Exam for CCNP Security: https://pass4sure.dumps4pdf.com/350-701-valid-braindumps.html