350-701 PDF Pass Leader, 350-701 Latest Real Test
Valid 350-701 Test Answers & 350-701 Exam PDF
NEW QUESTION 120
Refer to the exhibit.
Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance. What is causing this issue?
- A. Site-to-site VPN preshared keys are mismatched.
- B. The access control policy is not allowing VPN traffic in.
- C. Site-to-site VPN peers are using different encryption algorithms.
- D. No split-tunnel policy is defined on the Firepower Threat Defense appliance.
Answer: D
NEW QUESTION 121
What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two)
- A. When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request destination.
- B. The Cisco WSA responds with its own IP address only if it is running in transparent mode.
- C. The Cisco WSA responds with its own IP address only if it is running in explicit mode.
- D. The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.
- E. The Cisco WSA is configured in a web browser only if it is running in transparent mode.
Answer: B,D
Explanation:
The Cisco Web Security Appliance (WSA) includes a web proxy, a threat analytics engine, antimalware engine, policy management, and reporting in a single physical or virtual appliance. The main use of the Cisco WSA is to protect users from accessing malicious websites and being infected by malware.
You can deploy the Cisco WSA in two different modes:
- Explicit forward mode
- Transparent mode
In explicit forward mode, the client is configured to explicitly use the proxy, subsequently sending all web traffic to the proxy. Because the client knows there is a proxy and sends all traffic to the proxy in explicit forward mode, the client does not perform a DNS lookup of the domain before requesting the URL. The Cisco WSA is responsible for DNS resolution, as well.
When you configure the Cisco WSA in explicit mode, you do not need to configure any other network infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA. -> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct. When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches. The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers. Reference: https://www.cisco.com/c/en/us/tech/content-networking/web-cache-communications-protocol-wccp/index.html ->Therefore answer D is correct as redirection can be done on Layer 3 device only. In transparent mode, the client is unaware its traffic is being sent to a proxy (Cisco WSA) and, as a result, the client uses DNS to resolve the domain name in the URL and send the web request destined for the web server (not the proxy). When you configure the Cisco WSA in transparent mode, you need to identify a network choke point with a redirection device (a Cisco ASA) to redirect traffic to the proxy.
infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA.
-> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct.
When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches.
The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers.
Reference:
->Therefore answer D is correct as redirection can be done on Layer 3 device only.
When you configure the Cisco WSA in explicit mode, you do not need to configure any other network infrastructure devices to redirect client requests to the Cisco WSA. However, you must configure each client to send traffic to the Cisco WSA. -> Therefore in explicit mode, WSA only checks the traffic between client & web server. WSA does not use its own IP address to request -> Answer B is not correct. When the Cisco WSA is in transparent mode, clients do not know there is a proxy deployed. Network infrastructure devices are configured to forward traffic to the Cisco WSA. In transparent mode deployments, network infrastructure devices redirect web traffic to the proxy. Web traffic redirection can be done using policybased routing (PBR)-available on many routers -or using Cisco's Web Cache Communication Protocol (WCCP) on Cisco ASA, Cisco routers, or switches. The Web Cache Communication Protocol (WCCP), developed by Cisco Systems, specifies interactions between one or more switches) and one or more web-caches. The purpose of the interaction is to establish and maintain the transparent redirectio of traffic flowing through a group of routers. Reference: https://www.cisco.com/c/en/us/tech/content-networking/web-cache-communications-protocol-wccp/index.html ->Therefore answer D is correct as redirection can be done on Layer 3 device only. In transparent mode, the client is unaware its traffic is being sent to a proxy (Cisco WSA) and, as a result, the client uses DNS to resolve the domain name in the URL and send the web request destined for the web server (not the proxy). When you configure the Cisco WSA in transparent mode, you need to identify a network choke point with a redirection device (a Cisco ASA) to redirect traffic to the proxy.
WSA in Transparent mode
-> Therefore in Transparent mode, WSA uses its own IP address to initiate a new connection the Web Server (in step 4 above) -> Answer E is correct.
Answer C is surely not correct as WSA cannot be configured in a web browser in either mode.
Answer A seems to be correct but it is not. This answer is correct if it states "When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request source" (not destination).
NEW QUESTION 122
Drag and drop the Firepower Next Generation Intrustion Prevention System detectors from the left onto the correct definitions on the right.
Answer:
Explanation:
Explanation
Reference:
https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-configguide-v64/detecti
NEW QUESTION 123
What is the purpose of CA in a PKI?
- A. To certify the ownership of a public key by the named subject
- B. To create the private key for a digital certificate
- C. To validate the authenticity of a digital certificate
- D. To issue and revoke digital certificates
Answer: D
Explanation:
A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues.
A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues.
Reference:
A trusted CA is the only entity that can issue trusted digital certificates. This is extremely important because while PKI manages more of the encryption side of these certificates, authentication is vital to understanding which entities own what keys. Without a trusted CA, anyone can issue their own keys, authentication goes out the window and chaos ensues.
NEW QUESTION 124
An engineer has enabled LDAP accept queries on a listener. Malicious actors must be prevented from quickly identifying all valid recipients. What must be done on the Cisco ESA to accomplish this goal?
- A. Configure Directory Harvest Attack Prevention
- B. Bypass LDAP access queries in the recipient access table.
- C. Configure incoming content filters.
- D. Use Bounce Verification
Answer: A
Explanation:
Explanation
NEW QUESTION 125
A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?
- A. Accounting Reports
- B. Adaptive Network Control Policy List
- C. Context Visibility
- D. RADIUS Live Logs
Answer: D
Explanation:
How To Troubleshoot ISE Failed Authentications & Authorizations
Check the ISE Live Logs
Login to the primary ISE Policy Administration Node (PAN).
Go to Operations > RADIUS > Live Logs
(Optional) If the event is not present in the RADIUS Live Logs, go to Operations > Reports > Reports > Endpoints and Users > RADIUS Authentications Check for Any Failed Authentication Attempts in the Log
NEW QUESTION 126
Which two aspects of the cloud PaaS model are managed by the customer but not the provider? {Choose two.)
- A. operating systems
- B. middleware
- C. applications
- D. data
- E. virtualization
Answer: A,E
Explanation:
Explanation
https://apprenda.com/library/paas/iaas-paas-saas-explained-compared/
NEW QUESTION 127
Refer to the exhibit.
What are two indications of the Cisco Firepower Services Module configuration?
(Choose two.)
- A. The module fails to receive redirected traffic
- B. Traffic is blocked if the module fails.
- C. Traffic continues to flow if the module fails.
- D. The module is operating in IDS mode.
- E. The module is operating in IPS mode.
Answer: C,D
NEW QUESTION 128
A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose two)
- A. permit
- B. monitor
- C. reset
- D. trust
- E. allow
Answer: B,D
Explanation:
Explanation
Explanation
Each rule also has an action, which determines whether you monitor, trust, block, or allow matching traffic.
Note: With action "trust", Firepower does not do any more inspection on the traffic. There will be no intrusion protection and also no file-policy on this traffic.
NEW QUESTION 129
An organization wants to provide visibility and to identify active threats in its network using a VM. The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network. Which solution meets these requirements?
- A. Cisco Umbrella Cloud
- B. Cisco Stealthwatch Cloud PNM
- C. Cisco Stealthwatch Cloud PCM
- D. Cisco Umbrella On-Premises
Answer: B
Explanation:
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
Reference:
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
NEW QUESTION 130
Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?
- A. DTLSv1
- B. TLSv1.2
- C. BJTLSvl
- D. TLSv1.1
Answer: C
NEW QUESTION 131
In which two ways does the Cisco Advanced Phishing Protection solution protect users? (Choose two.)
- A. It automatically removes malicious emails from users' inbox.
- B. It prevents trojan horse malware using sensors.
- C. It prevents use of compromised accounts and social engineering.
- D. It secures all passwords that are shared in video conferences.
- E. It prevents all zero-day attacks coming from the Internet.
Answer: A,E
NEW QUESTION 132
An engineer notices traffic interruption on the network. Upon further investigation, it is learned that broadcast packets have been flooding the network. What must be configured, based on a predefined threshold, to address this issue?
- A. access control lists
- B. storm control
- C. Bridge Protocol Data Unit guard
- D. embedded event monitoring
Answer: B
Explanation:
Explanation
Explanation
Storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the physical interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configurations, or users issuing a denial-of-service attack can cause a storm.
By using the "storm-control broadcast level [falling-threshold]" we can limit the broadcast traffic on the switch.
NEW QUESTION 133
Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two.)
- A. Cisco FTDv with one management interface and two traffic interfaces configured
- B. Cisco FTDv with two management interfaces and one traffic interface configured
- C. Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS
- D. Cisco FTDv configured in routed mode and IPv6 configured
- E. . Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises
Answer: C,E
NEW QUESTION 134
Which Cisco DNA Center RESTful PNP API adds and claims a device into a workflow?
- A. api/v1/onboarding/workflow
- B. api/v1/fie/config
- C. api/v1/onboarding/pnp-device
- D. api/v1/onboarding/pnp-device/import
Answer: B
NEW QUESTION 135
Drag and drop the common security threats from the left onto the definitions on the right.
Answer:
Explanation:
NEW QUESTION 136
A hacker initiated a social engineering attack and stole username and passwords of some users within a company. Which product should be used as a solution to this problem?
- A. Cisco NGFW
- B. Cisco Duo
- C. Cisco AMP for Endpoints
- D. Cisco AnyConnect
Answer: B
NEW QUESTION 137
Drag and drop the cloud security assessment components from the left onto the definitions on the right.
Answer:
Explanation:
Steps:
NEW QUESTION 138
Why is it important to have a patching strategy for endpoints?
- A. so that patching strategies can assist with disabling nonsecure protocols in applications
- B. so that known vulnerabilities are targeted and having a regular patch cycle reduces risks
- C. so that functionality is increased on a faster scale when it is used
- D. to take advantage of new features released with patches
Answer: B
NEW QUESTION 139
......
What Career Opportunities Will a Certified Specialist for Security Core Have?
A successful candidate who manages to pass 350-701 exam will have better opportunities to land a job in the following positions:
- Network manager
- Security engineer
- Security analyst
- System engineer
- Network engineer
Payscale.com has done a thorough investigation on how much such specialists can win and they reached the conclusion that a certified security engineer can get about $92k on average per year. Also, if you decide to work as a network engineer, then you should expect to receive an offer of $74k in one year while the compensation for security analysts and security architects is $76k and $124k, respectively.
350-701 Dumps Ensure Your Passing: https://www.prep4king.com/350-701-exam-prep-material.html
350-701 exam dumps and online Test Engine: https://drive.google.com/open?id=1Rcz__UpyuE1lupE-DFLKqM6EcEzLy1xb
