2021 Realistic Verified 350-701 exam dumps Q&As - 350-701 Free Update
Use Real 350-701 Dumps - 100% Free 350-701 Exam Dumps
Understanding functional and technical aspects of Implementing and Operating Cisco Security Core Technologies (SCOR 350-701) Endpoint Protection and Detection
The following will be discussed in CISCO 350-701 dumps pdf:
- Describe justifications for endpoint-based security
- Explain antimalware, retrospective security, Indication of Compromise (IOC), antivirus, dynamic file analysis, and endpoint-sourced telemetry
- Explain the importance of an endpoint patching strategy
- Compare Endpoint Protection Platforms (EPP) and Endpoint Detection & Response (EDR) solutions
- Describe the uses and importance of a multifactor authentication (MFA) strategy
- Describe endpoint posture assessment solutions to ensure endpoint security
- Configure and verify outbreak control and quarantines to limit infection
- Describe the value of endpoint device management and asset inventory such as MDM
NEW QUESTION 200
An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?
- A. Access Control
- B. Packet Tracer
- C. Network Discovery
- D. NetFlow
Answer: C
Explanation:
NetFlow is a network protocol developed by Cisco for the collection and monitoring of network traffic flow data generated by NetFlow-enabled routers and switches. The flows do not contain actual packet data, but rather the metadata for communications. It is a standard form of session data that details who, what, when, and where of network traffic -> Answer A is not correct.
NetFlow is a network protocol developed by Cisco for the collection and monitoring of network traffic flow data generated by NetFlow-enabled routers and switches. The flows do not contain actual packet data, but rather the metadata for communications. It is a standard form of session data that details who, what, when, and where of network traffic -> Answer A is not correct.
Reference:
white-paper-c11-736595.html
NetFlow is a network protocol developed by Cisco for the collection and monitoring of network traffic flow data generated by NetFlow-enabled routers and switches. The flows do not contain actual packet data, but rather the metadata for communications. It is a standard form of session data that details who, what, when, and where of network traffic -> Answer A is not correct.
white-paper-c11-736595.html
NEW QUESTION 201
What is the purpose of the My Devices Portal in a Cisco ISE environment?
- A. to request a newly provisioned mobile device
- B. to register new laptops and mobile devices
- C. to provision userless and agentless systems
- D. to manage and deploy antivirus definitions and patches on systems owned by the end user
Answer: B
Explanation:
Explanation
NEW QUESTION 202
How is DNS tunneling used to exfiltrate data out of a corporate network?
- A. It leverages the DNS server by permitting recursive lookups to spread the attack to other DNS servers.
- B. It corrupts DNS servers by replacing the actual IP address with a rogue address to collect information or start other attacks.
- C. lt encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data.
- D. It redirects DNS requests to a malicious server used to steal user credentials, which allows further damage and theft on the network.
Answer: C
NEW QUESTION 203
Drag and drop the NetFlow export formats from the left onto the descriptions on the right.
Answer:
Explanation:
NEW QUESTION 204
Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)
- A. applications
- B. middleware
- C. virtualization
- D. data
- E. operating systems
Answer: A,D
Explanation:
Customers must manage applications and data in PaaS.
NEW QUESTION 205
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- A. Telemetry uses push and pull, which makes it more scalable than SNMP
- B. Telemetry uses a pull mehod, which makes it more reliable than SNMP
- C. Telemetry uses a push method which makes it faster than SNMP
- D. Telemetry uses push and pull which makes it more secure than SNMP
Answer: C
Explanation:
SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
SNMP polling can often be in the order of 5-10 minutes, CLIs are unstructured and prone to change which can often break scripts.
The traditional use of the pull model, where the client requests data from the network does not scale when what you want is near real-time data.
Moreover, in some use cases, there is the need to be notified only when some data changes, like interfaces status, protocol neighbors change etc.
Model-Driven Telemetry is a new approach for network monitoring in which data is streamed from network devices continuously using a push model and provides near real-time access to operational statistics. Referfence: https://developer.cisco.com/docs/ios-xe/#!streaming-telemetry-quick-start-guide/streaming telemetry
NEW QUESTION 206
What is the Cisco API-based broker that helps reduce compromises, application risks, and data breaches in an environment that is not on-premise?
- A. Cisco Cloudlock
- B. Cisco App Dynamics
- C. Cisco Umbrella
- D. Cisco AMP
Answer: A
Explanation:
Reference:
NEW QUESTION 207
Refer to the exhibit.
An engineer configured wired 802.1x on the network and is unable to get a laptop to authenticate. Which port configuration is missing?
- A. cisp enable
- B. dot1x pae authenticator
- C. authentication open
- D. dotlx reauthentication
Answer: B
NEW QUESTION 208
Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?
- A. device management policy
- B. platform service policy
- C. group policy
- D. access control policy
Answer: B
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/622/configuration/guide/fpmc-config- guide-v622/platform_settings_policies_for_managed_devices.pdf
NEW QUESTION 209
What is the function of the Context Directory Agent?
- A. accepts user authentication requests on behalf of Web Security Appliance for user identification
- B. reads the Active Directory logs to map IP addresses to usernames
- C. relays user authentication requests from Web Security Appliance to Active Directory
- D. maintains users' group memberships
Answer: B
Explanation:
Explanation Cisco Context Directory Agent (CDA) is a mechanism that maps IP Addresses to usernames in order to allow security gateways to understand which user is using which IP Address in the network, so those security gateways can now make decisions based on those users (or the groups to which the users belong to). CDA runs on a Cisco Linux machine; monitors in real time a collection of Active Directory domain controller (DC) machines for authentication-related events that generally indicate user logins; learns, analyzes, and caches mappings of IP Addresses and user identities in its database; and makes the latest mappings available to its consumer devices. Reference: https://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10/ cda_oveviw.html Cisco Context Directory Agent (CDA) is a mechanism that maps IP Addresses to usernames in order to allow security gateways to understand which user is using which IP Address in the network, so those security gateways can now make decisions based on those users (or the groups to which the users belong to).
CDA runs on a Cisco Linux machine; monitors in real time a collection of Active Directory domain controller (DC) machines for authentication-related events that generally indicate user logins; learns, analyzes, and caches mappings of IP Addresses and user identities in its database; and makes the latest mappings available to its consumer devices.
Reference:
Explanation Cisco Context Directory Agent (CDA) is a mechanism that maps IP Addresses to usernames in order to allow security gateways to understand which user is using which IP Address in the network, so those security gateways can now make decisions based on those users (or the groups to which the users belong to). CDA runs on a Cisco Linux machine; monitors in real time a collection of Active Directory domain controller (DC) machines for authentication-related events that generally indicate user logins; learns, analyzes, and caches mappings of IP Addresses and user identities in its database; and makes the latest mappings available to its consumer devices. Reference: https://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10/ cda_oveviw.html
NEW QUESTION 210
What is a commonality between DMVPN and FlexVPN technologies?
- A. FlexVPN and DMVPN use IS-IS routing protocol to communicate with spokes
- B. IOS routers run the same NHRP code for DMVPN and FlexVPN
- C. FlexVPN and DMVPN use the new key management protocol
- D. FlexVPN and DMVPN use the same hashing algorithms
Answer: B
Explanation:
Explanation In its essence, FlexVPN is the same as DMVPN. Connections between devices are still point-to-point GRE tunnels, spoke-to-spoke connectivity is still achieved with NHRP redirect message, IOS routers even run the same NHRP code for both DMVPN and FlexVPN, which also means that both are Cisco's proprietary technologies. Reference: https://packetpushers.net/cisco-flexvpn-dmvpn-high-level-design/ In its essence, FlexVPN is the same as DMVPN. Connections between devices are still point-to-point GRE tunnels, spoke-to-spoke connectivity is still achieved with NHRP redirect message, IOS routers even run the same NHRP code for both DMVPN and FlexVPN, which also means that both are Cisco's proprietary technologies.
Explanation In its essence, FlexVPN is the same as DMVPN. Connections between devices are still point-to-point GRE tunnels, spoke-to-spoke connectivity is still achieved with NHRP redirect message, IOS routers even run the same NHRP code for both DMVPN and FlexVPN, which also means that both are Cisco's proprietary technologies. Reference: https://packetpushers.net/cisco-flexvpn-dmvpn-high-level-design/
NEW QUESTION 211
An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransomware infection? (Choose two.)
- A. Configure a posture policy in Cisco Identity Services Engine to install the MS17-010 patch before allowing access on the network.
- B. Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network.
- C. Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.
- D. Set up a profiling policy in Cisco Identity Service Engine to check and endpoint patch level before allowing access on the network.
- E. Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.
Answer: A,B
NEW QUESTION 212 
Refer to the exhibit. Which command was used to display this output?
- A. show dot1x all summary
- B. show dot1x all
- C. show dot1x
- D. show dot1x interface gi1/0/12
Answer: B
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec- user-8021x-xe-3se-3850-book/config-ieee-802x-pba.html
NEW QUESTION 213
Which type of API is being used when a controller within a software-defined network architecture dynamically makes configuration changes on switches within the network?
- A. southbound API
- B. westbound AP
- C. eastbound API
- D. northbound API
Answer: A
Explanation:
Explanation
Explanation
Southbound APIs enable SDN controllers to dynamically make changes based on real-time demands and scalability needs.
NEW QUESTION 214
In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint Protection Platform?
- A. when there is a need for traditional anti-malware detection
- B. when there is a need to have more advanced detection capabilities
- C. when there is no need to have the solution centrally managed
- D. when there te no firewall on the network
Answer: B
NEW QUESTION 215
What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?
- A. It deletes any application that does not belong in the network.
- B. It allows the administrator to quarantine malicious files so that the application can function, just not maliciously.
- C. It discovers and controls cloud apps that are connected to a company's corporate environment.
- D. It sends the application information to an administrator to act on.
Answer: C
Explanation:
Explanation/Reference: https://www.cisco.com/c/en/us/products/security/cloudlock/index.html#~features
NEW QUESTION 216
......
For more info about Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)
Implementing and Operating Cisco Security Core Technologies (SCOR 350-701)
Pass 350-701 exam Updated 358 Questions: https://www.newpassleader.com/Cisco/350-701-exam-preparation-materials.html
350-701 Exam Dumps, Test Engine Practice Test Questions: https://drive.google.com/open?id=1SvnTQC1i7hNL1umIRsBTc_kGJS77z5ge