Verified 350-701 Exam Dumps PDF [2023] Access using TestkingPDF
Try Best 350-701 Exam Questions from Training Expert TestkingPDF
Cisco 350-701 exam is a computer-based test that consists of 90-110 questions. 350-701 exam format includes multiple-choice questions, drag-and-drop questions, and simulation-based questions. The candidate needs to complete the exam within 120 minutes, and the passing score is 825 out of 1000 points.
NEW QUESTION # 350
What is a characteristic of traffic storm control behavior?
- A. Traffic storm control uses the Individual/Group bit in the packet source address to determine if the packet is unicast or broadcast.
- B. Traffic storm control monitors incoming traffic levels over a 10-second traffic storm control interval.
- C. Traffic storm control cannot determine if the packet is unicast or broadcast.
- D. Traffic storm control drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.
Answer: D
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-1E/configuration/guide/storm.html
NEW QUESTION # 351
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- A. Telemetry uses push and pull which makes it more secure than SNMP
- B. Telemetry uses a push method which makes it faster than SNMP
- C. Telemetry uses push and pull, which makes it more scalable than SNMP
- D. Telemetry uses a pull mehod, which makes it more reliable than SNMP
Answer: B
Explanation:
SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry
NEW QUESTION # 352
Which two key and block sizes are valid for AES? (Choose two.)
- A. 64-bit block size, 112-bit key length
- B. 192-bit block size, 256-bit key length
- C. 128-bit block size, 256-bit key length
- D. 64-bit block size, 168-bit key length
- E. 128-bit block size, 192-bit key length
Answer: C,E
NEW QUESTION # 353
When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?
- A. dynamic analysis
- B. malware analysis
- C. Spero analysis
- D. sandbox analysis
Answer: A
Explanation:
Spero analysis examines structural characteristics such as metadata and header information in executable files. After generating a Spero signature based on this information, if the file is an eligible executable file, the device submits it to the Spero heuristic engine in the AMP cloud. Based on the Spero signature, the Spero engine determines whether the file is malware. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guidev60/Reference_a_wrapper_Chapter_topic_here.html -> Spero analysis only uploads the signature of the (executable) files to the AMP cloud. It does not upload the whole file. Dynamic analysis sends files to AMP ThreatGrid. Dynamic Analysis submits (the whole) files to Cisco Threat Grid (formerly AMP Threat Grid). Cisco Threat Grid runs the file in a sandbox environment, analyzes the file's behavior to determine whether the file is malicious, and returns a threat score that indicates the likelihood that a file contains malware. From the threat score, you can view a dynamic analysis summary report with the reasons for the assigned threat score. You can also look in Cisco Threat Grid to view detailed reports for files that your organization submitted, as well as scrubbed reports with limited data for files that your organization did not submit. Local malware analysis allows a managed device to locally inspect executables, PDFs, office documents, and other types of files for the most common types of malware, using a detection rule set provided by the Cisco Talos Security Intelligence and Research Group (Talos). Because local analysis does not query the AMP cloud, and does not run the file, local malware analysis saves time and system resources. -> Malware analysis does not upload files to anywhere, it only checks the files locally. There is no sandbox analysis feature, it is just a method of dynamic analysis that runs suspicious files in a virtual machine.
files. After generating a Spero signature based on this information, if the file is an eligible executable file, the device submits it to the Spero heuristic engine in the AMP cloud. Based on the Spero signature, the Spero engine determines whether the file is malware.
Reference:
-> Spero analysis only uploads the signature of the (executable) files to the AMP cloud. It does not upload the whole file. Dynamic analysis sends files to AMP ThreatGrid.
Dynamic Analysis submits (the whole) files to Cisco Threat Grid (formerly AMP Threat Grid). Cisco Threat Grid runs the file in a sandbox environment, analyzes the file's behavior to determine whether the file is malicious, and returns a threat score that indicates the likelihood that a file contains malware. From the threat score, you can view a dynamic analysis summary report with the reasons for the assigned threat score. You can also look in Cisco Threat Grid to view detailed reports for files that your organization submitted, as well as scrubbed reports with limited data for files that your organization did not submit.
Local malware analysis allows a managed device to locally inspect executables, PDFs, office documents, and other types of files for the most common types of malware, using a detection rule set provided by the Cisco Talos Security Intelligence and Research Group (Talos). Because local analysis does not query the AMP cloud, and does not run the file, local malware analysis saves time and system resources. -> Malware analysis does not upload files to anywhere, it only checks the files locally.
There is no sandbox analysis feature, it is just a method of dynamic analysis that runs suspicious files in a Spero analysis examines structural characteristics such as metadata and header information in executable files. After generating a Spero signature based on this information, if the file is an eligible executable file, the device submits it to the Spero heuristic engine in the AMP cloud. Based on the Spero signature, the Spero engine determines whether the file is malware. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guidev60/Reference_a_wrapper_Chapter_topic_here.html -> Spero analysis only uploads the signature of the (executable) files to the AMP cloud. It does not upload the whole file. Dynamic analysis sends files to AMP ThreatGrid. Dynamic Analysis submits (the whole) files to Cisco Threat Grid (formerly AMP Threat Grid). Cisco Threat Grid runs the file in a sandbox environment, analyzes the file's behavior to determine whether the file is malicious, and returns a threat score that indicates the likelihood that a file contains malware. From the threat score, you can view a dynamic analysis summary report with the reasons for the assigned threat score. You can also look in Cisco Threat Grid to view detailed reports for files that your organization submitted, as well as scrubbed reports with limited data for files that your organization did not submit. Local malware analysis allows a managed device to locally inspect executables, PDFs, office documents, and other types of files for the most common types of malware, using a detection rule set provided by the Cisco Talos Security Intelligence and Research Group (Talos). Because local analysis does not query the AMP cloud, and does not run the file, local malware analysis saves time and system resources. -> Malware analysis does not upload files to anywhere, it only checks the files locally. There is no sandbox analysis feature, it is just a method of dynamic analysis that runs suspicious files in a virtual machine.
NEW QUESTION # 354
An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which probe must be enabled for this type of profiling to work?
- A. NMAP
- B. SNMP
- C. NetFlow
- D. DHCP
Answer: A
Explanation:
Cisco ISE can determine the type of device or endpoint connecting to the network by performing "profiling." Profiling is done by using DHCP, SNMP, Span, NetFlow, HTTP, RADIUS, DNS, or NMAP scans to collect as much metadata as possible to learn the device fingerprint.
NMAP ("Network Mapper") is a popular network scanner which provides a lot of features. One of them is the OUI (Organizationally Unique Identifier) information. OUI is the first 24 bit or 6 hexadecimal value of the MAC address.
Note: DHCP probe cannot collect OUIs of endpoints. NMAP scan probe can collect these endpoint attributes:
+ EndPointPolicy
+ LastNmapScanCount
+ NmapScanCount
+ OUI
+ Operating-system
NEW QUESTION # 355
Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two.)
- A. Block SQL code execution in the web application database login.
- B. Secure the connection between the web and the app tier.
- C. Check integer, float, or Boolean string parameters to ensure accurate values.
- D. Write SQL code instead of using object-relational mapping libraries.
- E. Use prepared statements and parameterized queries.
Answer: C,E
NEW QUESTION # 356
Which solution is made from a collection of secure development practices and guidelines that developers must follow to build secure applications?
- A. Radamsa
- B. Fuzzing Framework
- C. OWASP
- D. AFL
Answer: C
NEW QUESTION # 357
Which group within Cisco writes and publishes a weekly newsletter to help cybersecurity professionals remain aware of the ongoing and most prevalent threats?
- A. DEVNET
- B. Talos
- C. PSIRT
- D. CSIRT
Answer: B
Explanation:
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Reference:
Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
NEW QUESTION # 358
What is the difference between deceptive phishing and spear phishing?
- A. Deceptive phishing hijacks and manipulates the DNS server of the victim and redirects the user to a false webpage.
- B. Spear phishing is when the attack is aimed at the C-level executives of an organization.
- C. Deceptive phishing is an attacked aimed at a specific user in the organization who holds a C-level role.
- D. A spear phishing campaign is aimed at a specific person versus a group of people.
Answer: D
NEW QUESTION # 359
What are two functions of secret key cryptography? (Choose two.)
- A. utilization of large prime number iterations
- B. key selection without integer factorization
- C. provides the capability to only know the key on one side
- D. utilization of different keys for encryption and decryption
- E. utilization of less memory
Answer: C,D
NEW QUESTION # 360
Which command enables 802.1X globally on a Cisco switch?
- A. authentication port-control auto
- B. dot1x pae authenticator
- C. dot1x system-auth-control
- D. aaa new-model
Answer: C
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/routers/nfvis/switch_command/b-nfvis-switch-command- reference/802_1x_commands.html
NEW QUESTION # 361
Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?
- A. Cisco WiSM
- B. Cisco Prime Infrastructure
- C. Cisco ESA
- D. Cisco ISE
Answer: D
Explanation:
https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118188-qanda-esa-00.html
NEW QUESTION # 362
Refer to the exhibit. All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and all servers must communicate with default gateway multilayer switch. Which type of private VLAN ports should be configured to prevent communication between DNS servers and the file server?
- A. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as isolated port, and GigabitEthernet0/3 and GigabitEthernet0/4 as promiscuous ports.
- B. Configure GigabitEthernet0/1 as community port, GigabitEthernet0/2 as promiscuous port, Gigabit Ethernet0/3 and GigabitEthernet0/4 as isolated ports
- C. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as community port, and GigabitEthernet0/3 and GrgabitEthernet0/4 as isolated ports.
- D. Configure GigabitEthernet0/1 as promiscuous port, GigabitEthernet0/2 as isolated port and GigabitEthernet0/3 and GrgabitEthernet0/4 as community ports
Answer: D
NEW QUESTION # 363
Refer to the exhibit.
Refer to the exhibit. A Cisco ISE administrator adds a new switch to an 802.1X deployment and has difficulty with some endpoints gaining access.
Most PCs and IP phones can connect and authenticate using their machine certificate credentials. However printer and video cameras cannot base d on the interface configuration provided, what must be to get these devices on to the network using Cisco ISE for authentication and authorization while maintaining security controls?
- A. Enable insecure protocols within Cisco ISE in the allowed protocols configuration.
- B. Configure authentication event fail retry 2 action authorize vlan 41 on the interface
- C. Change the default policy in Cisco ISE to allow all devices not using machine authentication .
- D. Add mab to the interface configuration.
Answer: C
NEW QUESTION # 364
What are two list types within AMP for Endpoints Outbreak Control? (Choose two)
- A. URL
- B. command and control
- C. blocked ports
- D. simple custom detections
- E. allowed applications
Answer: D,E
Explanation:
Advanced Malware Protection (AMP) for Endpoints offers a variety of lists, referred to as Outbreak Control, that allow you to customize it to your needs. The main lists are: Simple Custom Detections, Blocked Applications, Allowed Applications, Advanced Custom Detections, and IP Blocked and Allowed Lists.
A Simple Custom Detection list is similar to a blocked list. These are files that you want to detect and quarantine.
Allowed applications lists are for files you never want to convict. Some examples are a custom application that is detected by a generic engine or a standard image that you use throughout the company Reference: https://docs.amp.cisco.com/AMP%20for%20Endpoints%20User%20Guide.pdf
NEW QUESTION # 365
Which type of API is being used when a controller within a software-defined network architecture dynamically makes configuration changes on switches within the network?
- A. eastbound API
- B. southbound API
- C. westbound AP
- D. northbound API
Answer: B
Explanation:
Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs.
NEW QUESTION # 366
A user has a device in the network that is receiving too many connection requests from multiple machines. Which type of attack is the device undergoing?
- A. pharming
- B. phishing
- C. slowloris
- D. SYN flood
Answer: D
Explanation:
https://www.cisco.com/c/en/us/products/security/what-is-a-ddos-attack.html#~types-of-ddos-attacks
NEW QUESTION # 367
What is a feature of container orchestration?
- A. ability to deploy Amazon ECS clusters by using the Cisco Container Platform data plane
- B. ability to deploy Kubernetes clusters in air-gapped sites
- C. ability to deploy Amazon EKS clusters by using the Cisco Container Platform data plane
- D. automated daily updates
Answer: B
NEW QUESTION # 368
......
Latest 100% Passing Guarantee - Brilliant 350-701 Exam Questions PDF: https://www.testkingpdf.com/350-701-testking-pdf-torrent.html
Practice Examples and Dumps & Tips for 2023 Latest 350-701 Valid Tests Dumps: https://drive.google.com/open?id=1nPepY_Sn_vUrih9ZRfcITvm1R1DGjQRa
