Latest Cisco 350-701 Exam questions and answers
PassReview 350-701 Exam Practice Test Questions (Updated 358 Questions)
What Are the Tested Skills in 350-701 SCOR Certification Exam?
Candidates who want to get the passing score in the Cisco 350-701 SCOR exam should be ready to demonstrate that they have skills in the following domains:
- Security concepts
During preparation for this topic, the candidate will learn how to explain common threats against cloud and on-premises environments. Also, they will become skilled in comparing common security vulnerabilities and will no longer have any surprises when it comes to software bugs, weak passwords, or missing encryption. Another subtopic included here covers cryptography components functions as well as hashing, encryption, SSL, and IPsec functions. Besides, applicants will become proficient in interpreting basic Python scripts and explaining North and South Bound as well as DNAC APIs for network provisioning.
- Network security
Within this domain, examinees will show their ability to compare network security solutions and deployment models related to different network security solutions and architectures. They should also understand how NetFlow and Flexible NetFlow records, components, and capabilities work. During the training classes, they will learn how to properly implement segmentation, access control policies, and management options for security solutions. Also, they will discover how to configure AAA for network and device access. Another subtopic included here will be the configuration of secure network management and site-to-site VPN.
- Securing the Cloud
The candidates will learn how to identify security solutions that contribute to cloud environment performance. Also, the comparison between the customer and provider security responsibility is also handled in this section. Another subtopic is related to DevSecOps description and application implementation. Candidates will have to demonstrate that they know how to identify security capabilities and deployment models and also understand how to configure logging and monitoring methodology. Finally, the training courses focusing on this topic will teach them essential workload and application security concepts.
- Content security
Within this topic, examinees will become experienced in implementing capture methods and traffic redirection. Also, they will know how more about web proxy identity and authentication by utilizing the user identification tools. Components like ESA, CES, or WSA will be also described in this section. Another subtopic is dedicated to web and email security verification and configuration. Secure internet gateway and web security features configuration and verification are also handled here. Candidates will learn more about how Cisco Umbrella works and what are its benefits. Finally, they will configure and verify web security controls with the help of Cisco Umbrella features.
- Endpoint protection and detection
The fifth topic will take the candidates in the area of understanding how Endpoint Protection Platforms and Endpoint Detection and Response solutions work. Also, they will become skilled in handling antimalware solutions, antivirus, dynamic file analysis, and endpoint-sourced telemetry features configuration. Another subtopic included in this section talks about endpoint device management, multifactor authentication strategy, posture assessment solutions, and endpoint patching.
- Secure network access, visibility, and enforcement
Last but not least, candidates need to be proficient in using guest services, profiling, BYOD, and posture assessment tools. They need to understand what's involved in the network access with CoA, what are the device compliance benefits, and different exfiltration techniques. It is essential that examinees demonstrate that they know the benefits of network telemetry and different Cisco components and capabilities.
NEW QUESTION 127
Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based?
(Choose two.)
- A. URLs
- B. MAC addresses
- C. IP addresses
- D. protocol IDs
- E. port numbers
Answer: A,C
Explanation:
Explanation
NEW QUESTION 128
An organization wants to secure data in a cloud environment. Its security model requires that all users be authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and dat a. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these requirements?
- A. Virtual LAN
- B. Microsegmentation
- C. Virtual routing and forwarding
- D. Access control policy
Answer: B
Explanation:
Explanation
Zero Trust is a security framework requiring all users, whether in or outside the organization's network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data. Zero Trust assumes that there is no traditional network edge; networks can be local, in the cloud, or a combination or hybrid with resources anywhere as well as workers in any location.
The Zero Trust model uses microsegmentation - a security technique that involves dividing perimeters into small zones to maintain separate access to every part of the network - to contain attacks.
NEW QUESTION 129
A network administrator is configuring a rule in an access control policy to block certain URLs and selects the "Chat and Instant Messaging" category. Which reputation score should be selected to accomplish this goal?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
Reference:
https://www.cisco.com/c/en/us/td/docs/security/esa/esa111/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01111.html
NEW QUESTION 130
Drag and drop the descriptions from the left onto the correct protocol versions on the right.
Answer:
Explanation:
Explanation
NEW QUESTION 131
Which Cisco product is open, scalable, and built on IETF standards to allow multiple security products from Cisco and other vendors to share data and interoperate with each other?
- A. Platform Exchange Grid
- B. Advanced Malware Protection
- C. Multifactor Platform Integration
- D. Firepower Threat Defense
Answer: A
Explanation:
With Cisco pxGrid (Platform Exchange Grid), your multiple security products can now share data and work together. This open, scalable, and IETF standards-driven platform helps you automate security to get answers and contain threats faster.
NEW QUESTION 132
An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system's applications. Which vulnerability allows the attacker to see the passwords being transmitted in clear text?
- A. software bugs on applications
- B. unencrypted links for traffic
- C. improper file security
- D. weak passwords for authentication
Answer: B
Explanation:
https://www.cisco.com/ELearning/bulk/public/celc/CRS/media/targets/resources_mod07/7_3_5_improving_security.pdf
NEW QUESTION 133
Due to a traffic storm on the network, two interfaces were error-disabled, and both interfaces sent SNMP traps.
Which two actions must be taken to ensure that interfaces are put back into service? (Choose two)
- A. Enable the snmp-server enable traps command and wait 300 seconds
- B. Enter the shutdown and no shutdown commands on the interfaces.
- C. Have Cisco Prime Infrastructure issue an SNMP set command to re-enable the ports after the pre configured interval.
- D. Use EEM to have the ports return to service automatically in less than 300 seconds.
- E. Ensure that interfaces are configured with the error-disable detection and recovery feature
Answer: B,E
Explanation:
You can also bring up the port by using these commands:
+ The "shutdown" interface configuration command followed by the "no shutdown" interface configuration command restarts the disabled port.
+ The "errdisable recovery cause ..." global configuration command enables the timer to automatically recover error-disabled state, and the "errdisable recovery interval interval" global configuration command specifies the time to recover error-disabled state.
NEW QUESTION 134
What is a prerequisite when integrating a Cisco ISE server and an AD domain?
- A. Synchronize the clocks of the Cisco ISE server and the AD server
The following are the prerequisites to integrate Active Directory with Cisco ISE.
+ Use the Network Time Protocol (NTP) server settings to synchronize the time between the Cisco ISE server and Active Directory. You can configure NTP settings from Cisco ISE CLI.
+ If your Active Directory structure has multidomain forest or is divided into multiple forests, ensure that trust relationships exist between the domain to which Cisco ISE is connected and the other domains that have user and machine information to which you need access. For more information on establishing trust relationships, refer to Microsoft Active Directory documentation.
+ You must have at least one global catalog server operational and accessible by Cisco ISE, in the domain to which you are joining Cisco ISE. - B. Place the Cisco ISE server and the AD server in the same subnet
- C. Configure a common administrator account
- D. Configure a common DNS server
Answer: A
Explanation:
Reference:
/b_ISE_AD_integration_2x.html#reference_8DC463597A644A5C9CF5D582B77BB24F
NEW QUESTION 135
Which algorithm provides encryption and authentication for data plane communication?
- A. AES-256
- B. SHA-384
- C. SHA-96
- D. AES-GCM
Answer: D
Explanation:
The data plane of any network is responsible for handling data packets that are transported across the network.
(The data plane is also sometimes called the forwarding plane.)
Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?).
In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates.
The data plane of any network is responsible for handling data packets that are transported across the network.
(The data plane is also sometimes called the forwarding plane.)
Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?).
In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates.
Reference:
The data plane of any network is responsible for handling data packets that are transported across the network.
(The data plane is also sometimes called the forwarding plane.)
Maybe this Qwants to ask about the encryption and authentication in the data plane of a SD-WAN network (but SD-WAN is not a topic of the SCOR 350-701 exam?).
In the Cisco SD-WAN network for unicast traffic, data plane encryption is done by AES-256-GCM, a symmetrickey algorithm that uses the same key to encrypt outgoing packets and to decrypt incoming packets. Each router periodically generates an AES key for its data path (specifically, one key per TLOC) and transmits this key to the vSmart controller in OMP route packets, which are similar to IP route updates.
NEW QUESTION 136
What is the primary role of the Cisco Email Security Appliance?
- A. Mail Transfer Agent
- B. Mail User Agent
- C. Mail Delivery Agent
- D. Mail Submission Agent
Answer: A
Explanation:
Explanation Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay. Reference: https://www.cisco.com/c/dam/en/us/td/docs/solutions/SBA/February2013/ Cisco_SBA_BN_EmailSecurityUsingCiscoESADeploymentGuide-Feb2013.pdf Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay.
Reference:
Explanation Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay. Reference: https://www.cisco.com/c/dam/en/us/td/docs/solutions/SBA/February2013/ Cisco_SBA_BN_EmailSecurityUsingCiscoESADeploymentGuide-Feb2013.pdf
NEW QUESTION 137
Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.
Answer:
Explanation:
https://www.cisco.com/c/en/us/products/collateral/security/ngips/datasheet-c78-742472.html
https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.html
https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/solution-overview-c22-734228.html
NEW QUESTION 138
Refer to the exhibit.
An engineer is implementing a certificate based VPN. What is the result of the existing configuration?
- A. The OU of the IKEv2 peer certificate is set to MANGLER
- B. Only an IKEv2 peer that has an OU certificate attribute set to MANGLER establishes an IKEv2 SA successfully
- C. The OU of the IKEv2 peer certificate is encrypted when the OU is set to MANGLER
- D. The OU of the IKEv2 peer certificate is used as the identity when matching an IKEv2 authorization policy.
Answer: D
NEW QUESTION 139
Which two cryptographic algorithms are used with IPsec? {Choose two.)
- A. HMAC-SHA1/SHA2
- B. AES-BAC
- C. AES-CBC
- D. AES-ABC
- E. Triple AMC-CBC
Answer: A,C
Explanation:
Explanation
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-mt/sec-sec-for-vpns-w-ips
NEW QUESTION 140
Which type of attack is social engineering?
- A. phishing
- B. trojan
- C. MITM
- D. malware
Answer: A
NEW QUESTION 141
An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of
172.19.20.24. Which command on the hub will allow the administrator to accomplish this?
- A. crypto ca identity 172.19.20.24
- B. crypto isakmp key Cisco0123456789 172.19.20.24
- C. crypto isakmp identity address 172.19.20.24
- D. crypto enrollment peer address 172.19.20.24
Answer: B
Explanation:
Explanation The command "crypto isakmp identity address 172.19.20.24" is not valid. We can only use "crypto isakmp identity {address | hostname}. The following example uses preshared keys at two peers and sets both their ISAKMP identities to the IP address. At the local peer (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified: crypto isakmp identity address crypto isakmp key sharedkeystring address 192.168.1.33 At the remote peer (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified: crypto isakmp identity address crypto isakmp key sharedkeystring address 10.0.0.1 Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-crc4.html#wp3880782430 The command "crypto enrollment peer address" is not valid either. The command "crypto ca identity ..." is only used to declare a trusted CA for the router and puts you in the caidentity configuration mode. Also it should be followed by a name, not an IP address. For example: "crypto ca identity CA-Server" -> Answer A is not correct. Only answer B is the best choice left.
The command "crypto isakmp identity address 172.19.20.24" is not valid. We can only use "crypto isakmp identity {address | hostname}. The following example uses preshared keys at two peers and sets both their ISAKMP identities to the IP address.
At the local peer (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified:
crypto isakmp identity address
crypto isakmp key sharedkeystring address 192.168.1.33
At the remote peer (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified:
crypto isakmp identity address
crypto isakmp key sharedkeystring address 10.0.0.1
Reference:
The command "crypto enrollment peer address" is not valid either.
The command "crypto ca identity ..." is only used to declare a trusted CA for the router and puts you in the caidentity configuration mode. Also it should be followed by a name, not an IP address. For example: "crypto ca identity CA-Server" -> Answer A is not correct.
Explanation The command "crypto isakmp identity address 172.19.20.24" is not valid. We can only use "crypto isakmp identity {address | hostname}. The following example uses preshared keys at two peers and sets both their ISAKMP identities to the IP address. At the local peer (at 10.0.0.1) the ISAKMP identity is set and the preshared key is specified: crypto isakmp identity address crypto isakmp key sharedkeystring address 192.168.1.33 At the remote peer (at 192.168.1.33) the ISAKMP identity is set and the same preshared key is specified: crypto isakmp identity address crypto isakmp key sharedkeystring address 10.0.0.1 Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-crc4.html#wp3880782430 The command "crypto enrollment peer address" is not valid either. The command "crypto ca identity ..." is only used to declare a trusted CA for the router and puts you in the caidentity configuration mode. Also it should be followed by a name, not an IP address. For example: "crypto ca identity CA-Server" -> Answer A is not correct. Only answer B is the best choice left.
NEW QUESTION 142
An organization has a Cisco Stealthwatch Cloud deployment in their environment. Cloud logging is working as expected, but logs are not being received from the on-premise network, what action will resolve this issue?
- A. Deploy a Cisco Stealthwatch Cloud sensor on the network to send data to Cisco Stealthwatch Cloud
- B. Configure security appliances to send syslogs to Cisco Stealthwatch Cloud
- C. Deploy a Cisco FTD sensor to send events to Cisco Stealthwatch Cloud
- D. Configure security appliances to send NetFlow to Cisco Stealthwatch Cloud
Answer: A
Explanation:
You can also monitor on-premises networks in your organizations using Cisco Stealthwatch Cloud. In order to do so, you need to deploy at least one Cisco Stealthwatch Cloud Sensor appliance (virtual or physical appliance).
NEW QUESTION 143
An organization has a Cisco ESA set up with policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation. Which actions must be performed in order to provide this capability?
- A. quarantine and alter the subject header with a DLP violation
- B. deliver and send copies to other recipients
- C. deliver and add disclaimer text
- D. quarantine and send a DLP violation notification
Answer: A
NEW QUESTION 144
What is a feature of the open platform capabilities of Cisco DNA Center?
- A. automation adapters
- B. domain integration
- C. application adapters
- D. intent-based APIs
Answer: D
NEW QUESTION 145
An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?
- A. Implement pre-filter policies for the CIP preprocessor
- B. Modify the access control policy to trust the industrial traffic
- C. Enable traffic analysis in the Cisco FTD
- D. Configure intrusion rules for the DNP3 preprocessor
Answer: A
Explanation:
The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct.
The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields.
The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine.
You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic.
The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct.
The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields.
The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine.
You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic.
Reference:
Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications.
Note:
+ An intrusion rule is a specified set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities in your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule, and triggers the rule if the data packet meets all the conditions specified in the rule. + Preprocessor rules, which are rules associated with preprocessors and packet decoder detection options in the network analysis policy. Most preprocessor rules are disabled by default.
The Modbus, DNP3, and CIP SCADA preprocessors detect traffic anomalies and provide data to intrusion rules. Therefore in this question only answer A or answer C is correct.
The DNP3 preprocessor detects anomalies in DNP3 traffic and decodes the DNP3 protocol for processing by the rules engine, which uses DNP3 keywords to access certain protocol fields.
The Common Industrial Protocol (CIP) is a widely used application protocol that supports industrial automation applications. EtherNet/IP is an implementation of CIP that is used on Ethernet-based networks.The CIP preprocessor detects CIP and ENIP traffic running on TCP or UDP and sends it to the intrusion rules engine.
You can use CIP and ENIP keywords in custom intrusion rules to detect attacks in CIP and ENIP traffic.
Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications.
Note:
Both DNP3 and CIP preprocessors can be used to detect traffic anomalies but we choose CIP as it is widely used in industrial applications.
Note:
+ An intrusion rule is a specified set of keywords and arguments that the system uses to detect attempts to exploit vulnerabilities in your network. As the system analyzes network traffic, it compares packets against the conditions specified in each rule, and triggers the rule if the data packet meets all the conditions specified in the rule. + Preprocessor rules, which are rules associated with preprocessors and packet decoder detection options in the network analysis policy. Most preprocessor rules are disabled by default.
NEW QUESTION 146
How does Cisco Advanced Phishing Protection protect users?
- A. It utilizes sensors that send messages securely.
- B. It validates the sender by using DKIM.
- C. It determines which identities are perceived by the sender
- D. It uses machine learning and real-time behavior analytics.
Answer: D
Explanation:
Reference:
https://www.cisco.com/c/dam/en/us/products/collateral/security/cloud-email-security/at-a-glance-c45-740894.pdf
NEW QUESTION 147
Refer to the exhibit. How does Cisco Umbrella manage traffic that is directed toward risky domains?
- A. Traffic is managed by the security settings and blocked.
- B. Traffic is managed by the application settings, unhandled and allowed
- C. Traffic is allowed but logged
- D. Traffic is proxied through the intelligent proxy
Answer: A
NEW QUESTION 148
Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?
- A. URL filtering
- B. impact flags
- C. security intelligence
- D. health monitoring
Answer: B
Explanation:
https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/introduction_to_network_discovery_and_identity.html?bookSearch=true
NEW QUESTION 149
Refer to the exhibit.
What is a result of the configuration?
- A. Traffic from the inside network is redirected
- B. Traffic from the inside and DMZ networks is redirected
- C. All TCP traffic is redirected
- D. Traffic from the DMZ network is redirected
Answer: B
NEW QUESTION 150
......
Cisco 350-701 SCOR: Job Roles and Salaries
When you complete the Cisco 350-701 exam and get the CCIE Security or CCNP Security certifications, you will be positioned to benefit from vast employment opportunities that are available worldwide. Some of the job roles you can apply for with these certificates include:
- Network Designer
- Security Engineer
- Network Administrator
- Network Manager
- Technical Solutions Architect
- Consulting Systems Engineer
- Systems Engineer
- Network Engineer
With any of these certifications, you will also be able to get decent pay. For instance, according to PayScale, the average salary that a certified individual with CCIE Security can earn is $126,896 per year, while the average remuneration of the CCNP Security certificate holder amounts to $112,674 per annum.
Secure Network Visibility, Access, and Enforcement – 15%
- Describing the exfiltration methods, including HTTPS, IRC, DNS tunneling, email, Messenger, and others;
- Describing the network telemetry benefits;
- Configuring and verifying the function of network access device, such as 802.1X, WebAuth, and MAB;
- Explaining the capacity, benefits, and components of the security products & solutions, such as Cisco Stealthwatch, Cisco Umbrella Investigate, Cisco Stealthwatch Cloud, Cisco pxGrid, and others.
- Explaining network access with the use of CoA;
- Explaining identity management & secure network access concepts, such as profiling, posture assessment, guest services, as well as BYOD;
- Explaining the device compliance & application control benefits;
Pass Your Cisco Exam with 350-701 Exam Dumps: https://www.passreview.com/350-701_exam-braindumps.html
Pass 350-701 Exam Info and Free Practice Test : https://drive.google.com/open?id=1jsCGEz2hslaKmj9hwsJX5D7NMEqDVfbi