[Jan-2022] 350-701 Exam Dumps Pass with Updated 2022 Implementing and Operating Cisco Security Core Technologies
Free 350-701 Exam Dumps to Pass Exam Easily
What Career Opportunities Will a Certified Specialist for Security Core Have?
A successful candidate who manages to pass 350-701 exam will have better opportunities to land a job in the following positions:
- System engineer
- Network engineer
- Security architect
Payscale.com has done a thorough investigation on how much such specialists can win and they reached the conclusion that a certified security engineer can get about $92k on average per year. Also, if you decide to work as a network engineer, then you should expect to receive an offer of $74k in one year while the compensation for security analysts and security architects is $76k and $124k, respectively.
Best Revision Book: Introducing Cisco 350-701 Official Certification Guide
The CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide (1st Edition) is one of the most comprehensive study materials you can use to pass 350-701 exam. Why? Because it features a lot of exciting resources that will cover everything about the final test. Written by Omar Santos, this book presents the best combination of tools to help you master all the exam concepts easily. It has quizzes at the beginning of every chapter to help you know what you will cover in every section. Besides, it also has chapter review tasks that will help you achieve much more than just drilling on the vital exam concepts. All in all, the official cert guide for the Cisco 350-701 exam is not only valuable because of the exciting study plans it provides but also for the video instruction from the author, a lot of questions and exercises, and unmatched detail on every test objective to ensure you get everything right at the first attempt.
NEW QUESTION 37
Which attack is preventable by Cisco ESA but not by the Cisco WSA?
- A. phishing
- B. SQL injection
- C. DoS
- D. buffer overflow
Answer: A
Explanation:
Explanation
The following are the benefits of deploying Cisco Advanced Phishing Protection on the Cisco Email Security Gateway:
Prevents the following:
+ Attacks that use compromised accounts and social engineering.
+ Phishing, ransomware, zero-day attacks and spoofing.
+ BEC with no malicious payload or URL.
Reference:
/b_ESA_Admin_Guide_13-5/m_advanced_phishing_protection.html
NEW QUESTION 38
A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available. What must be done in order to securely connect this device to the network?
- A. Use 802.1X with posture assessment.
- B. Use MAB with posture assessment.
- C. Use 802.1X with profiling.
- D. Use MAB with profiling
Answer: D
Explanation:
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
Reference:
As the new device does not have a supplicant, we cannot use 802.1X.
MAC Authentication Bypass (MAB) is a fallback option for devices that don't support 802.1x. It is virtually always used in deployments in some way shape or form. MAB works by having the authenticator take the connecting device's MAC address and send it to the authentication server as its username and password. The authentication server will check its policies and send back an Access-Accept or Access-Reject just like it would with 802.1x.
Cisco ISE Profiling Services provides dynamic detection and classification of endpoints connected to the network. Using MAC addresses as the unique identifier, ISE collects various attributes for each network endpoint to build an internal endpoint database. The classification process matches the collected attributes to prebuilt or user-defined conditions, which are then correlated to an extensive library of profiles. These profiles include a wide range of device types, including mobile clients (iPads, Android tablets, Chromebooks, and so on), desktop operating systems (for example, Windows, Mac OS X, Linux, and others), and numerous non-user systems such as printers, phones, cameras, and game consoles.
Once classified, endpoints can be authorized to the network and granted access based on their profile. For example, endpoints that match the IP phone profile can be placed into a voice VLAN using MAC Authentication Bypass (MAB) as the authentication method. Another example is to provide differentiated network access to users based on the device used. For example, employees can get full access when accessing the network from their corporate workstation but be granted limited network access when accessing the network from their personal iPhone.
NEW QUESTION 39
What is the Cisco API-based broker that helps reduce compromises, application risks, and data breaches in an environment that is not on-premise?
- A. Cisco AMP
- B. Cisco Umbrella
- C. Cisco Cloudlock
- D. Cisco App Dynamics
Answer: C
Explanation:
Explanation
NEW QUESTION 40
What is the primary role of the Cisco Email Security Appliance?
- A. Mail Submission Agent
- B. Mail Delivery Agent
- C. Mail User Agent
- D. Mail Transfer Agent
Answer: D
Explanation:
Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay.
Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay.
Reference:
Cisco_SBA_BN_EmailSecurityUsingCiscoESADeploymentGuide-Feb2013.pdf
Cisco Email Security Appliance (ESA) protects the email infrastructure and employees who use email at work by filtering unsolicited and malicious email before it reaches the user. Cisco ESA easily integrates into existing email infrastructures with a high degree of flexibility. It does this by acting as a Mail Transfer Agent (MTA) within the email-delivery chain. Another name for an MTA is a mail relay.
Cisco_SBA_BN_EmailSecurityUsingCiscoESADeploymentGuide-Feb2013.pdf
NEW QUESTION 41
An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA.
Which Cisco ASA command must be used?
- A. flow-export destination inside 1.1.1.1 2055
- B. ip flow-export destination 1.1.1.1 2055
- C. ip flow monitor<name> input
- D. flow exporter <name>
Answer: A
NEW QUESTION 42
Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based? (Choose two.)
- A. protocol IDs
- B. IP addresses
- C. MAC addresses
- D. URLs
- E. port numbers
Answer: B,D
Explanation:
NEW QUESTION 43
An administrator is configuring a DHCP server to better secure their environment. They need to be able to ratelimit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?
- A. Enable ARP inspection for the required VLAN
- B. Set the DHCP snooping bit to 1
- C. Add entries in the DHCP snooping database
- D. Set a trusted interface for the DHCP server
Answer: D
Explanation:
To understand DHCP snooping we need to learn about DHCP spoofing attack first.
DHCP spoofing is a type of attack in that the attacker listens for DHCP Requests from clients and answers them with fake DHCP Response before the authorized DHCP Response comes to the clients. The fake DHCP Response often gives its IP address as the client default gateway -> all the traffic sent from the client will go through the attacker computer, the attacker becomes a "man-in-the-middle".
The attacker can have some ways to make sure its fake DHCP Response arrives first. In fact, if the attacker is "closer" than the DHCP Server then he doesn't need to do anything. Or he can DoS the DHCP Server so that it can't send the DHCP Response.
DHCP snooping can prevent DHCP spoofing attacks. DHCP snooping is a Cisco Catalyst feature that determines which switch ports can respond to DHCP requests. Ports are identified as trusted and untrusted.
Only ports that connect to an authorized DHCP server are trusted, and allowed to send all types of DHCP messages. All other ports on the switch are untrusted and can send only DHCP requests. If a DHCP response is seen on an untrusted port, the port is shut down.
NEW QUESTION 44
A network administrator is configuring a rule in an access control policy to block certain URLs and selects the "Chat and Instant Messaging" category. Which reputation score should be selected to accomplish this goal?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
We choose "Chat and Instant Messaging" category in "URL Category":
To block certain URLs we need to choose URL Reputation from 6 to 10.
NEW QUESTION 45
What are two differences between a Cisco WSA that is running in transparent mode and one running in explicit mode? (Choose two.)
- A. The Cisco WSA responds with its own IP address only if it is running in transparent mode.
- B. When the Cisco WSA is running in transparent mode, it uses the WSA's own IP address as the HTTP request destination.
- C. The Cisco WSA responds with its own IP address only if it is running in explicit mode.
- D. The Cisco WSA uses a Layer 3 device to redirect traffic only if it is running in transparent mode.
- E. The Cisco WSA is configured in a web browser only if it is running in transparent mode.
Answer: A,B
NEW QUESTION 46
Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?
- A. TLSv1.2
- B. TLSv1.1
- C. BJTLSv1
- D. DTLSv1
Answer: D
Explanation:
Explanation
DTLS is used for delay sensitive applications (voice and video) as its UDP based while TLS is TCP based.
Therefore DTLS offers strongest throughput performance. The throughput of DTLS at the time of AnyConnect connection can be expected to have processing performance close to VPN throughput.
NEW QUESTION 47
Refer to the exhibit. What does this python script accomplish?
- A. It lists the LDAP users from the external identity store configured on Cisco ISE
- B. It authenticates to a Cisco ISE server using the username of ersad
- C. It authenticates to a Cisco ISE with an SSH connection
- D. It allows authentication with TLSv1 SSL protocol
Answer: D
NEW QUESTION 48
Which Cisco AMP file disposition valid?
- A. malware
- B. nonmalicios
- C. pristine
- D. dirty
Answer: A
NEW QUESTION 49
Refer to the exhibit.
What does the API do when connected to a Cisco security appliance?
- A. gather the network interface information about the computers AMP sees
- B. create an SNMP pull mechanism for managing AMP
- C. get the process and PID information from the computers in the network
- D. gather network telemetry information from AMP for endpoints
Answer: A
NEW QUESTION 50
Refer to the exhibit.
import requests
url = https://api.amp.cisco.com/v1/computers
headers = {
'accept' : application/json
'content-type' : application/json
'authorization' : Basic API Credentials
'cache-control' : "no cache"
}r
esponse = requests.request ("GET", url, headers = headers)
print (response.txt)
What will happen when this Python script is run?
- A. The list of computers and their current vulnerabilities will be received from Cisco AMP
- B. The compromised computers and malware trajectories will be received from Cisco AMP
- C. The compromised computers and what compromised them will be received from Cisco AMP
- D. The list of computers, policies, and connector statuses will be received from Cisco AMP The call to API of "https://api.amp.cisco.com/v1/computers" allows us to fetch list of computers across your organization that Advanced Malware Protection (AMP) sees
Answer: D
Explanation:
Reference:
api_host=api.apjc.amp.cisco.com&api_resource=Computer&api_version=v1
NEW QUESTION 51
Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two.)
- A. inline normalization
- B. SSL
- C. modbus
- D. packet decoder
- E. SIP
Answer: B,E
NEW QUESTION 52
Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System? (Choose two)
- A. inline normalization
- B. SSL
- C. modbus
- D. packet decoder
- E. SIP
Answer: B,E
Explanation:
Application layer protocols can represent the same data in a variety of ways. The Firepower System provides application layer protocol decoders that normalize specific types of packet data into formats that the intrusion rules engine can analyze. Normalizing application-layer protocol encodings allows the rules engine to effectively apply the same content-related rules to packets whose data is represented differently and obtain meaningful results.
Application layer protocols can represent the same data in a variety of ways. The Firepower System provides application layer protocol decoders that normalize specific types of packet data into formats that the intrusion rules engine can analyze. Normalizing application-layer protocol encodings allows the rules engine to effectively apply the same content-related rules to packets whose data is represented differently and obtain meaningful results.
Reference:
FirePower uses many preprocessors, including DNS, FTP/Telnet, SIP, SSL, SMTP, SSH preprocessors.
Application layer protocols can represent the same data in a variety of ways. The Firepower System provides application layer protocol decoders that normalize specific types of packet data into formats that the intrusion rules engine can analyze. Normalizing application-layer protocol encodings allows the rules engine to effectively apply the same content-related rules to packets whose data is represented differently and obtain meaningful results.
FirePower uses many preprocessors, including DNS, FTP/Telnet, SIP, SSL, SMTP, SSH preprocessors.
NEW QUESTION 53
An administrator configures a Cisco WSA to receive redirected traffic over ports 80 and 443. The organization requires that a network device with specific WSA integration capabilities be configured to send the traffic to the WSA to proxy the requests and increase visibility, while making this invisible to the users. What must be done on the Cisco WSA to support these requirements?
- A. Configure active traffic redirection using WPAD in the Cisco WSA and on the network device
- B. Use PAC keys to allow only the required network devices to send the traffic to the Cisco WSA
- C. Configure transparent traffic redirection using WCCP in the Cisco WSA and on the network device
- D. Use the Layer 4 setting in the Cisco WSA to receive explicit forward requests from the network device
Answer: C
NEW QUESTION 54
......
350-701 Exam Dumps, 350-701 Practice Test Questions: https://freetorrent.pdfdumps.com/350-701-valid-exam.html