176 free Cisco 350-701 SCOR practice questions from the CertStash pack of 703, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 176 free here, all 703 in the pack, and each step includes the one before it.
Get all 703 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which two request methods of REST API are valid on the Cisco ASA Platform? (Choose two.)
Show answer and explanation
Correct answer: A, C. put; get
GET and PUT are standard HTTP/REST methods supported by the Cisco ASA REST API. GET retrieves resources and PUT updates existing resources. OPTIONS is also valid as it describes communication options, but it is less commonly used. PUSH and CONNECT are not standard REST API methods for ASA platform operations.
Why the other options are wrong
- B. OPTIONS is a valid HTTP method but not typically listed as a primary REST method for ASA operations in standard implementations.
- D. PUSH is not a standard HTTP or REST API method.
- E. CONNECT is an HTTP method used for tunneling but is not a standard REST API method for Cisco ASA.
Question 2
Which form of attack is launched using botnets?
Show answer and explanation
Correct answer: B. DDOS
Botnets are used to launch Distributed Denial of Service (DDoS) attacks. A botnet consists of compromised computers that can be coordinated to send traffic toward a target simultaneously, creating a distributed attack. While botnets can be used in various ways, DDoS is the most characteristic attack leveraging botnet infrastructure.
Why the other options are wrong
- A. TCP flood is a form of DoS attack but is not specifically leveraged by botnets as their primary attack vector.
- C. DOS (Denial of Service) is singular and refers to attacks from one source, whereas botnets inherently enable distributed attacks.
- D. Virus distribution is a use of botnets, but the primary attack function leveraging botnets is DDoS.
Question 3
In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?
Show answer and explanation
Correct answer: C. cross-site scripting
Cross-site scripting (XSS) attacks frequently use alternate encoding methods such as hexadecimal, Unicode, or HTML entity encoding to obfuscate malicious scripts and bypass input filters and security controls. Attackers use these encodings to hide the true nature of the injected code from both automated filters and human reviewers.
Why the other options are wrong
- A. Smurf attacks use ICMP echo requests and do not typically employ alternate encoding techniques.
- B. DDoS attacks rely on traffic volume rather than encoding obfuscation techniques.
- D. Rootkit exploits focus on privilege escalation and system access, not encoding-based evasion.
Question 4
Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?
Show answer and explanation
Correct answer: A. user input validation in a web page or web application
SQL injection vulnerabilities exist when web applications fail to properly validate and sanitize user input before using it in SQL queries. Attackers exploit this lack of input validation by injecting malicious SQL code through input fields, allowing them to manipulate database queries and access unauthorized data.
Why the other options are wrong
- B. Operating systems are not the flaw exploited in SQL injection attacks.
- C. While the database is affected by SQL injection, the vulnerability stems from improper input validation in the application layer, not from a flaw in the database itself.
- D. Web page images are not related to SQL injection vulnerabilities.
Question 5
What is the difference between deceptive phishing and spear phishing?
Show answer and explanation
Correct answer: B. A spear phishing campaign is aimed at a specific person versus a group of people.
Spear phishing is distinguished by targeting a specific individual or small group of people with personalized attacks, whereas deceptive phishing is a broad campaign sent to large groups of recipients. Spear phishing involves reconnaissance to make the attack more convincing to the target, making it more dangerous and targeted than generic deceptive phishing.
Why the other options are wrong
- A. Spear phishing targets specific individuals but is not limited to C-level roles; it can target any employee with valuable access or information.
- C. This describes spear phishing focused on executives but incorrectly limits the definition; spear phishing can target any specific individual.
- D. This describes DNS hijacking, which is a different attack type entirely, not a characteristic of deceptive phishing.
Question 6
Which two behavioral patterns characterize a ping of death attack? (Choose two.)
Show answer and explanation
Correct answer: B, D. The attack is fragmented into groups of 8 octets before transmission; Malformed packets are used to crash systems.
A ping of death attack has two key characteristics: it fragments oversized ICMP echo request packets into groups of 8 octets (not 16) before transmission, and it uses malformed packets designed to exceed the maximum IP packet size of 65,535 bytes, which causes systems to crash when reassembled. The attack exploits improper handling of fragmented packets in vulnerable systems.
Why the other options are wrong
- C. Short synchronized bursts describe SYN flood attacks targeting TCP, not ping of death.
- E. Ping of death does not involve DNS servers; it uses malformed ICMP echo requests directly.
Question 7
Which two mechanisms are used to control phishing attacks? (Choose two.)
Show answer and explanation
Correct answer: A, E. Enable browser alerts for fraudulent websites; Implement email filtering techniques.
The two most effective mechanisms to control phishing attacks are enabling browser alerts that warn users about fraudulent or suspicious websites, and implementing email filtering techniques that detect and block phishing emails before they reach user inboxes. These preventive measures address phishing at both the email delivery and user interaction levels.
Why the other options are wrong
- B. Security group memberships control network access permissions, not phishing attacks.
- C. CRL revocation relates to certificate validity, not phishing email or website detection.
- D. Antispyware targets spyware and malware, not phishing social engineering attacks.
Question 8
An administrator is configuring a DHCP server to better secure their environment. They need to be able to rate-limit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?
Show answer and explanation
Correct answer: A. Set a trusted interface for the DHCP server.
Setting a trusted interface for the DHCP server allows legitimate DHCP requests from that interface to bypass rate-limiting and access controls while untrusted interfaces can be rate-limited. This ensures legitimate requests are not dropped while still protecting against DHCP attacks.
Why the other options are wrong
- B. The DHCP snooping bit is set to track DHCP messages, not for rate-limiting legitimate requests.
- C. ARP inspection protects against ARP spoofing but does not specifically rate-limit DHCP traffic.
- D. DHCP snooping database entries track DHCP bindings but do not provide rate-limiting functionality.
Question 9
Which system performs compliance checks and remote wiping?
Show answer and explanation
Correct answer: A. MDM
Mobile Device Management (MDM) systems perform compliance checks on mobile devices and have the capability to remotely wipe devices if they fail compliance or are compromised, making it the primary solution for these functions.
Why the other options are wrong
- B. ISE is an access control and authentication platform, not primarily an MDM solution with remote wiping capabilities.
- C. AMP is an endpoint malware protection solution without MDM compliance checking or remote wiping features.
- D. OTP (One-Time Password) is an authentication method, not a system that performs compliance checks or remote device management.
Question 10
An organization has noticed an increase in malicious content downloads and wants to use Cisco Umbrella to prevent this activity for suspicious domains while allowing normal web traffic. Which action will accomplish this task?
Show answer and explanation
Correct answer: A. Use destination block lists.
Destination block lists in Cisco Umbrella are specifically designed to block access to suspicious domains while allowing normal web traffic. This directly addresses the requirement to prevent malicious content downloads from specific domains. Block lists contain domains that should be denied, making this the most direct solution for domain-based blocking.
Why the other options are wrong
- B. Application block lists control applications, not domains with malicious content.
- C. The intelligent proxy is used for advanced threat inspection and decryption, not specifically for blocking suspicious domains.
- D. Content settings at High level provide general content filtering but are not the primary mechanism for blocking specific suspicious domains.
What people say about the full 350-701 pack 5.0 from 5
I had passed my CISCO 350-701 exam Today and got 90% passing marks in it. I took practice test from Cert Stash and my experience with the platform was very amazing.
Passed the 350-701! Real questions in this dump. Some came out almost word for word in my exam. For the price this is a no brainer. Cleared it comfortably.
Passed with 828. Dump valid as of August 2026
Question 11
In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?
Show answer and explanation
Correct answer: A. man-in-the-middle
A man-in-the-middle (MITM) attack is defined by an attacker positioning themselves between two communicating hosts to intercept, eavesdrop on, or manipulate the communication. This is the textbook definition of the attack type described in the question.
Why the other options are wrong
- B. LDAP injection is an attack that exploits LDAP query syntax, not an attack involving positioning between two hosts.
- C. Insecure API refers to vulnerabilities in API endpoints, not an attack requiring the attacker to be positioned between communicating parties.
- D. Cross-site scripting (XSS) is a code injection attack that exploits web applications, not an attack involving interception between two hosts.
Question 12
Which PKI enrollment method allows the user to separate authentication and enrollment actions and also provides an option to specify HTTP/TFTP commands to perform file retrieval from the server?
Show answer and explanation
Correct answer: D. profile
The profile enrollment method in PKI allows users to separate authentication and enrollment actions, providing flexibility in the enrollment process. It also supports specifying HTTP/TFTP commands for file retrieval from the server, enabling dynamic certificate and configuration distribution to endpoints.
Why the other options are wrong
- A. Terminal enrollment is a manual, interactive method that does not separate authentication and enrollment or support automated file retrieval commands.
- B. Self-signed certificates are generated locally without PKI infrastructure involvement and do not involve server-based enrollment.
- C. URL-based enrollment typically involves direct web-based enrollment without the separation of authentication and enrollment phases that profile enrollment provides.
Question 13
What is a characteristic of Dynamic ARP Inspection?
Show answer and explanation
Correct answer: A. DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.
Dynamic ARP Inspection validates ARP packets by cross-referencing the sender's IP and MAC address against trusted bindings stored in the DHCP snooping binding database. This prevents ARP spoofing attacks by discarding invalid ARP packets.
Why the other options are wrong
- B. The correct trust configuration is the opposite: ports connecting to end devices should be untrusted, while ports connecting to switches are trusted.
- C. DAI associates a trust state with each switch port, not with entire switches.
- D. DAI intercepts all ARP requests and responses on both trusted and untrusted ports; it processes packets on all ports to validate them.
Question 14
Which configuration method provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with Vmware VDS or Microsoft vSwitch?
Show answer and explanation
Correct answer: C. intra-EPG isolation
Intra-EPG isolation is the configuration method that prevents physical and virtual endpoint devices within the same EPG (Endpoint Group) or uSeg (microsegmentation group) from communicating with each other. This is a critical security control in ACI (Application Centric Infrastructure) that restricts east-west traffic between devices that would normally be trusted peers within the same group.
Why the other options are wrong
- A. Inter-EPG isolation controls communication between different EPGs, not within the same EPG.
- B. Inter-VLAN security is a general term not specific to EPG or uSeg isolation mechanisms.
- D. While separation into different EPGs would prevent communication, this is not the configuration method being asked about, intra-EPG isolation is the explicit control.
Question 15
An organization deploys multiple Cisco FTD appliances and wants to manage them using one centralized solution. The organization does not have a local VM but does have existing Cisco ASA that must migrate over to Cisco FTDs. Which solution meets the needs of the organization?
Show answer and explanation
Correct answer: B. CDO
Cisco Defense Orchestrator (CDO) is a cloud-based centralized management solution that can manage multiple Cisco FTD appliances without requiring a local VM deployment. CDO also supports migration of existing Cisco ASA configurations to Cisco FTD, making it ideal for organizations without local VM infrastructure.
Why the other options are wrong
- A. Cisco FMC requires on-premises deployment and infrastructure, which the organization does not have.
- C. CSM is not a primary Cisco firewall management solution for FTD appliances.
- D. Cisco FDM is a device-level manager for individual FTD instances, not a centralized multi-device solution.
Question 16
Which type of DNS abuse exchanges data between two computers even when there is no direct connection?
Show answer and explanation
Correct answer: C. command-and-control communication
Command-and-control (C2) communication via DNS tunneling allows data exchange between two computers even when direct network connections are blocked or unavailable. Attackers use DNS queries and responses to tunnel commands and exfiltrate data through a legitimate protocol, establishing communication channels that bypass traditional network restrictions.
Why the other options are wrong
- A. Malware installation is the deployment of malicious code, not a DNS tunneling technique.
- B. Network footprinting is reconnaissance, not a data exchange mechanism.
- D. Data exfiltration is the goal/result of DNS tunneling, not the type of abuse itself.
Question 17
Which cloud model is a collaborative effort where infrastructure is shared and jointly accessed by several organizations from a specific group?
Show answer and explanation
Correct answer: A. community
A community cloud is a collaborative cloud infrastructure shared and jointly accessed by multiple organizations that have common interests, requirements, or concerns. It is managed either by the organizations or a third party and may be on-premises or off-premises.
Why the other options are wrong
- B. A private cloud is dedicated to a single organization and not shared with others.
- C. A public cloud is accessible to the general public and any organization, not limited to a specific group.
- D. A hybrid cloud combines multiple cloud models (public, private, or community) but is not itself a collaborative model for specific groups.
Question 18
Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?
Show answer and explanation
Correct answer: C. SSL Decryption
SSL Decryption is the feature within Cisco Umbrella that allows inspection of secure HTTP (HTTPS) traffic. This feature decrypts the SSL/TLS connection to examine the content and apply security policies to encrypted communications.
Why the other options are wrong
- A. File Analysis examines file content and metadata but is not specifically for inspecting HTTPS traffic.
- B. SafeSearch is a feature that enforces safe search results on search engines, not for inspecting HTTPS traffic.
- D. Destination Lists are used for URL categorization and blocking, not for inspecting the contents of HTTPS traffic.
Question 19
An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?
Show answer and explanation
Correct answer: C. Configure intrusion rules for the DNP3 preprocessor.
DNP3 (Distributed Network Protocol 3) is a SCADA/industrial protocol, and the DNP3 preprocessor is specifically designed to analyze protocol fields and detect anomalies in industrial control system traffic. Configuring intrusion rules for the DNP3 preprocessor allows the FTD to examine DNP3-specific protocol fields and identify suspicious patterns or deviations from normal industrial system behavior.
Why the other options are wrong
- A. General traffic analysis alone does not provide the protocol-specific field examination needed for industrial systems.
- B. CIP (Common Industrial Protocol) preprocessor and pre-filter policies are not the appropriate mechanism for detecting anomalies in protocol fields.
- D. Trusting industrial traffic would disable security monitoring rather than enable anomaly detection.
Question 20
Under which two circumstances is a CoA issued? (Choose two.)
Show answer and explanation
Correct answer: B, D. An endpoint is deleted on the Identity Service Engine server; An endpoint is profiled for the first time.
A Change of Authorization (CoA) is issued when an endpoint is profiled for the first time, as ISE needs to apply appropriate policies based on the discovered profile characteristics. CoA is also issued when an endpoint is deleted, as ISE must remove access and revoke any established sessions. New authentication rules or identity sources require policy pushes but don't automatically trigger CoA, and adding a new ISE server affects deployment but not individual endpoint CoA issuance.
Why the other options are wrong
- A. New authentication rules require policy updates but don't directly issue CoA to endpoints.
- C. New Identity Source Sequences require configuration updates but don't trigger CoA independently.
- E. Adding a new ISE server affects deployment topology but doesn't automatically issue CoA to endpoints.
Question 21
A network administrator is configuring a rule in an access control policy to block certain URLs and selects the `Chat and Instant Messaging` category. Which reputation score should be selected to accomplish this goal?
Show answer and explanation
Correct answer: D. 1
A reputation score of 1 represents the most dangerous or most restricted category in Cisco's reputation scoring system. To block URLs in the Chat and Instant Messaging category, the administrator should select score 1, which applies the strictest blocking policy to this content category.
Why the other options are wrong
- A. Score 5 represents a lower risk level and would not provide adequate blocking for unwanted categories.
- B. Score 10 typically represents benign or trusted content and would not block the category.
- C. Score 3 represents a moderate risk level but not the most restrictive needed for blocking this category.
Question 22
What are two DDoS attack categories? (Choose two.)
Show answer and explanation
Correct answer: A, E. protocol; volume-based
DDoS attacks are broadly categorized into two main types: protocol-based attacks (Layer 3-4) that exploit weaknesses in network protocols like SYN floods and DNS amplification, and volume-based attacks (Layer 3-7) that consume bandwidth through massive traffic floods like UDP floods and HTTP floods. These two categories represent the fundamental classification system used in cybersecurity.
Why the other options are wrong
- B. Source-based is not a standard DDoS attack category; attacks are classified by protocol layer or traffic volume, not by source characteristics.
- C. Database attacks are not a DDoS category; they refer to different attack vectors like SQL injection or database exploitation.
- D. Sequential is not a recognized DDoS attack classification in cybersecurity frameworks.
Question 23
Which two preventive measures are used to control cross-site scripting? (Choose two.)
Show answer and explanation
Correct answer: B, D. Incorporate contextual output encoding/escaping; Run untrusted HTML input through an HTML sanitization engine.
The two primary preventive measures against XSS are: (B) Incorporating contextual output encoding/escaping, which sanitizes user input before it is displayed to prevent script execution, and (D) Running untrusted HTML input through an HTML sanitization engine, which removes dangerous elements and attributes from user-supplied content. Both techniques ensure that malicious scripts cannot be injected into web pages.
Why the other options are wrong
- A. Enabling client-side scripts on a per-domain basis does not prevent XSS; in fact, allowing scripts can increase XSS risk if proper encoding is not in place.
- C. Disabling cookie inspection in the HTML inspection engine does not prevent XSS attacks; this would actually weaken security by not inspecting cookies for malicious content.
- E. The SameSite cookie attribute is an important security feature that helps prevent XSS and CSRF attacks; it should definitely be used, not avoided.
Question 24
An engineer is configuring Cisco Umbrella and has an identity that references two different policies. Which action ensures that the policy that the identity must use takes precedence over the second one?
Show answer and explanation
Correct answer: C. Make the correct policy first in the policy order
In Cisco Umbrella, policies are evaluated in order, and the first matching policy takes precedence. By placing the policy that should take precedence first in the policy order, you ensure it will be evaluated and applied before any secondary policies are considered, establishing clear policy hierarchy.
Why the other options are wrong
- A. Placing a policy last means it will be evaluated last, giving it lower precedence, not higher.
- B. The default policy acts as a catch-all and does not determine precedence between two specific policies.
- D. Timestamp configuration does not affect policy evaluation order in Cisco Umbrella.
Question 25
A network engineer needs to select a VPN type that provides the most stringent security, multiple security associations for the connections, and efficient VPN establishment with the least bandwidth consumption. Why should the engineer select either FlexVPN or DMVPN for this environment?
Show answer and explanation
Correct answer: C. FlexVPN because it supports IKEv2 and DMVPN does not.
FlexVPN supports IKEv2, which provides stringent security with multiple security associations and efficient establishment with minimal bandwidth overhead. DMVPN uses IKEv1 which lacks some of these advanced capabilities, making FlexVPN the superior choice for the stated requirements.
Why the other options are wrong
- A. DMVPN does support multiple SAs, but FlexVPN also does, and the key differentiator is IKEv2 support which DMVPN lacks.
- B. DMVPN does not support IKEv2; it is limited to IKEv1.
- D. Both FlexVPN and DMVPN support multiple SAs, so this is not an accurate differentiator.
Question 26
An engineer is configuring 802.1X authentication on Cisco switches in the network and is using CoA as a mechanism. Which port on the firewall must be opened to allow the CoA traffic to traverse the network?
Show answer and explanation
Correct answer: A. UDP 1700
Change of Authorization (CoA) traffic in 802.1X authentication uses UDP port 1700. This is the standard RADIUS CoA port used by network access servers and RADIUS servers to communicate CoA requests for dynamic policy changes on authenticated sessions.
Why the other options are wrong
- B. TCP 6514 is used for syslog over TLS, not CoA traffic.
- C. UDP 1812 is the standard RADIUS authentication port, not CoA.
- D. TCP 49 is a deprecated TACACS port and is not used for CoA.
Question 27
An organization is using Cisco Firepower and Cisco Meraki MX for network security and needs to centrally manage cloud policies across these platforms. Which software should be used to accomplish this goal?
Show answer and explanation
Correct answer: A. Cisco Defense Orchestrator
Cisco Defense Orchestrator (CDO) is the centralized management platform designed to manage cloud policies across multiple Cisco security platforms including Firepower, Meraki MX, and other cloud-native solutions. It provides unified policy management and orchestration across these diverse platforms.
Why the other options are wrong
- B. Cisco Configuration Professional is primarily for on-premises network device management, not cloud policy centralization.
- C. Cisco Secureworks is a managed security service provider, not a centralized management platform for Firepower and Meraki.
- D. Cisco DNA Center is designed for network access and management, not cloud security policy orchestration.
Question 28
Which public cloud provider supports the Cisco Next Generation Firewall Virtual?
Show answer and explanation
Correct answer: C. Amazon Web Services
Cisco Next Generation Firewall Virtual (NGFWv) is supported on Amazon Web Services (AWS) as one of the primary public cloud platforms. AWS provides the necessary virtualization infrastructure and compatibility for Cisco's virtual firewall appliances. Google Cloud Platform does not officially support NGFWv, Red Hat Enterprise Virtualization is a private virtualization platform not a public cloud provider, and VMware ESXi is a hypervisor platform rather than a public cloud provider.
Why the other options are wrong
- A. Google Cloud Platform does not support Cisco NGFWv.
- B. Red Hat Enterprise Virtualization is a private platform, not a public cloud provider.
- D. VMware ESXi is a hypervisor, not a public cloud provider.
Question 29
An engineer needs a cloud solution that will monitor traffic, create incidents based on events, and integrate with other cloud solutions via an API. Which solution should be used to accomplish this goal?
Show answer and explanation
Correct answer: D. SIEM
A SIEM (Security Information and Event Management) solution monitors traffic across the network and cloud, creates incidents/alerts based on security events, and integrates with other solutions via APIs. While Cloudlock is a CASB that can monitor, it is primarily focused on cloud application security rather than the broad event monitoring and incident creation across infrastructure that a SIEM provides.
Why the other options are wrong
- A. CASB focuses on cloud application access control and data protection, not comprehensive traffic monitoring and incident creation.
- B. Cloudlock is specifically a CASB for cloud app security, not a general monitoring and incident management platform.
- C. Adaptive MFA is an authentication mechanism, not a monitoring or incident management solution.
Question 30
Which portion of the network do EPP solutions solely focus on and EDR solutions do not?
Show answer and explanation
Correct answer: D. perimeter
Endpoint Protection Platform (EPP) solutions primarily focus on protecting the perimeter and preventing threats from reaching endpoints through signature-based detection, firewalls, and intrusion prevention. EDR solutions extend beyond this to focus on detection and response activities across the entire environment, including internal network movement.
Why the other options are wrong
- A. East-West gateways are internal network controls; both EPP and EDR can address this area.
- B. Server farms are part of the broader infrastructure; this is not the sole focus of EPP versus EDR.
- C. The core network is not the primary distinction between EPP and EDR focus areas.
Question 31
What is the difference between Cross-site Scripting and SQL Injection attacks?
Show answer and explanation
Correct answer: B. Cross-site Scripting is an attack where code is executed from the server side, whereas SQL Injection is an attack where code is executed from the client side.
Cross-site Scripting (XSS) injects malicious code that executes on the client side in the victim's browser, while SQL Injection injects commands that execute server-side in the database. This distinction in execution location is the fundamental difference between these two attacks.
Why the other options are wrong
- A. This incorrectly characterizes XSS as targeting executives and conflates attack scope with attack mechanism.
- C. XSS is not a brute force attack, and SQL Injection is not a social engineering attack; both are code injection vulnerabilities.
- D. This reverses the actual mechanisms, SQL Injection targets the database, not the browser, and XSS targets the browser, not the database.
Question 32
Which type of attack is social engineering?
Show answer and explanation
Correct answer: C. phishing
Phishing is a social engineering attack that manipulates users into divulging sensitive information or performing harmful actions by deceiving them through fraudulent emails, websites, or communications. It exploits human psychology and trust rather than technical vulnerabilities, making it the correct classification among the given options.
Why the other options are wrong
- A. Trojan is malware that deceives users into installing it, but it is classified as malware, not social engineering per se.
- B. Man-in-the-middle (MITM) is a network-based attack intercepting communications, not a social engineering technique.
- D. Malware is a broad category of malicious software; while phishing can deliver malware, phishing itself is specifically a social engineering attack.
Question 33
A network engineer has entered the snmp-server user andy myv3 auth sha cisco priv aes 256 cisc0383320506 command and needs to send SNMP information to a host at 10.255.254.1. Which command achieves this goal?
Show answer and explanation
Correct answer: D. snmp-server host inside 10.255.254.1 version 3 andy
The snmp-server host command must specify the username (andy) that was previously defined in the snmp-server user command, not the group name. The 'version 3' parameter identifies the SNMP version. The username 'andy' is the correct identifier because the user object contains the authentication and privacy parameters configured in the original user definition.
Why the other options are wrong
- A. Uses 'snmpv3' syntax which is incorrect; should use 'version 3', and specifies the user name correctly.
- B. Specifies 'myv3' which is the group name, not the username; the user 'andy' is required.
- C. Uses 'snmpv3' syntax which is incorrect; should use 'version 3', and specifies the group name instead of username.
Question 34
An administrator configures a new destination list in Cisco Umbrella so that the organization can block specific domains for its devices. What should be done to ensure that all subdomains of domain.com are blocked?
Show answer and explanation
Correct answer: A. Configure the domain.com address in the block list.
In Cisco Umbrella, when you add a domain (e.g., domain.com) to a destination block list, the system automatically blocks that domain and all of its subdomains. This is the default behavior of domain-based blocking in Umbrella, so only the parent domain needs to be configured.
Why the other options are wrong
- B. Using *.domain.com is unnecessary because adding the parent domain automatically includes all subdomains.
- C. Configuring *.com would block all subdomains of all .com domains, which is overly broad and not the intended solution.
- D. *domain.com is not valid wildcard syntax for Umbrella's destination list blocking.
Question 35
Which IETF attribute is supported for the RADIUS CoA feature?
Show answer and explanation
Correct answer: A. 24 State
IETF attribute 24 (State) is supported for RADIUS Change of Authorization (CoA) features in Cisco ISE. The State attribute is used to maintain session state information and is essential for CoA message processing and validation.
Why the other options are wrong
- B. Attribute 30 (Calling-Station-ID) is informational and not specifically required for CoA.
- C. Attribute 42 (Acct-Session-ID) is for accounting, not for CoA feature support.
- D. Attribute 81 (Message-Authenticator) is for message integrity but is not the primary CoA attribute.
Question 36
What does Cisco AMP for Endpoints use to help an organization detect different families of malware?
Show answer and explanation
Correct answer: C. Spero Engine with machine learning to perform dynamic analysis
Cisco AMP for Endpoints uses the Spero Engine with machine learning to perform dynamic analysis and detect different families of malware by analyzing behavioral patterns and file characteristics in real-time and through cloud-based intelligence.
Why the other options are wrong
- A. Tetra Engine is not a standard Cisco AMP detection engine for malware family detection.
- B. ClamAV is primarily an email scanning engine, not the primary malware family detection mechanism in AMP for Endpoints.
- D. Ethos Engine is not the primary engine used by AMP for Endpoints; Spero Engine with machine learning is the correct technology for dynamic malware analysis.
Question 37
Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?
Show answer and explanation
Correct answer: D. Tetration
Cisco Tetration is a solution specifically designed to protect hybrid cloud deployments by providing application visibility, workload segmentation, and micro-segmentation capabilities. It enables organizations to see and control application behavior across on-premises and cloud environments.
Why the other options are wrong
- A. Nexus is not a security solution focused on workload protection; it is related to network operating systems.
- B. Stealthwatch provides network visibility and threat detection but is not primarily focused on hybrid cloud workload protection and segmentation.
- C. Firepower is a threat defense solution focused on network-based protection rather than hybrid cloud workload segmentation.
Question 38
Which attribute has the ability to change during the RADIUS CoA?
Show answer and explanation
Correct answer: A. authorization
Authorization attributes are the primary attributes that can be changed during a RADIUS Change of Authorization (CoA) request. CoA allows dynamic modification of user authorization policies, QoS parameters, and access control attributes without requiring session re-authentication.
Why the other options are wrong
- B. NTP is a time synchronization protocol and cannot be changed via RADIUS CoA.
- C. Accessibility is not a standard RADIUS attribute that changes during CoA.
- D. Membership attributes are typically static and not modified through RADIUS CoA mechanisms.
Question 39
What must be enabled to secure SaaS-based applications?
Show answer and explanation
Correct answer: A. two-factor authentication
Two-factor authentication (2FA) is the essential security control that must be enabled to secure SaaS-based applications. It provides a critical layer of protection by requiring users to provide two different verification methods, significantly reducing the risk of unauthorized access even if credentials are compromised.
Why the other options are wrong
- B. While end-to-end encryption is valuable, it is not the primary requirement for SaaS application security and may not always be practical in SaaS environments.
- C. An application security gateway is a specialized tool not universally required for all SaaS applications.
- D. A modular policy framework is an architectural approach but not the core security requirement for protecting SaaS applications.
Question 40
What is a difference between GETVPN and IPsec?
Show answer and explanation
Correct answer: D. GETVPN reduces latency and provides encryption over MPLS without the use of a central hub.
GETVPN is specifically designed to provide encryption over MPLS networks without requiring a central hub (hub-and-spoke model), which reduces latency and simplifies architecture for service provider environments. Unlike IPsec which requires point-to-point tunnels, GETVPN uses a group-based approach where key servers distribute encryption keys to group members, eliminating the need for a central hub for traffic forwarding while maintaining full encryption.
Why the other options are wrong
- A. While GETVPN simplifies multi-site deployments, both GETVPN and IPsec can be configured without static device configurations using dynamic discovery mechanisms.
- B. GETVPN is not inherently based on IKEv2 and actually uses a different key management protocol (GDOI) distinct from IPsec's IKE.
- C. Key management and security association management are features of both GETVPN and IPsec, not a distinguishing difference between them.
Question 41
An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network. Which action tests the routing?
Show answer and explanation
Correct answer: D. Browse to http://welcome.umbrella.com/ to validate that the new identity is working.
Browsing to http://welcome.umbrella.com/ is the standard method to validate that a new Cisco Umbrella identity is working correctly. This page will display which identity and policy are being applied to the client, confirming that traffic is being properly routed through Cisco Umbrella's network.
Why the other options are wrong
- A. Pointing to on-premises DNS servers would bypass Cisco Umbrella entirely, defeating the purpose of the configuration.
- B. The Intelligent Proxy is not used to test routing; it serves a different function in traffic inspection.
- C. Adding public IP addresses to a Core Identity is a configuration step but does not test or verify routing.
Question 42
Which statement describes a serverless application?
Show answer and explanation
Correct answer: B. The application runs from an ephemeral, event-triggered, and stateless container that is fully managed by a cloud provider.
A serverless application runs from an ephemeral, event-triggered, and stateless container that is fully managed by a cloud provider. This definition captures the essential characteristics of serverless computing: automatic scaling, no server management required, and event-driven execution.
Why the other options are wrong
- A. An application delivery controller managing server selection describes load balancing, not serverless architecture.
- C. Installing applications on network equipment describes edge computing, not serverless.
- D. Containerized applications managed by Kubernetes or Docker Swarm describes container orchestration, which is different from serverless.
Question 43
What is a difference between FlexVPN and DMVPN?
Show answer and explanation
Correct answer: B. FlexVPN uses IKEv2. DMVPN uses IKEv1 or IKEv2
FlexVPN uses exclusively IKEv2, which is a modern, more efficient key exchange protocol. DMVPN, being older and more established, supports both IKEv1 and IKEv2 for backward compatibility. This is a key architectural difference between the two technologies.
Why the other options are wrong
- A. DMVPN supports both IKEv1 and IKEv2, not only IKEv1.
- C. FlexVPN uses only IKEv2, not IKEv1 or both.
- D. DMVPN does not use only IKEv2; it supports both versions.
Question 44
What provides visibility and awareness into what is currently occurring on the network?
Show answer and explanation
Correct answer: D. Telemetry
Telemetry provides real-time visibility and awareness into current network operations by collecting and streaming operational data about network devices, traffic, and performance. This streaming telemetry enables administrators to see what is happening on the network in real-time.
Why the other options are wrong
- A. CMX (Cisco Mobility eXperience) is focused on location services and mobile device management, not general network visibility.
- B. WMI (Windows Management Instrumentation) is a Windows-specific management tool, not a network-wide visibility solution.
- C. Cisco Prime Infrastructure is a management and monitoring platform, but telemetry is the more direct answer for current operational awareness.
Question 45
A Cisco AMP for Endpoints administrator configures a custom detection policy to add specific MD5 signatures. The configuration is created in the simple detection policy section, but it does not work. What is the reason for this failure?
Show answer and explanation
Correct answer: D. Detections for MD5 signatures must be configured in the advanced custom detection policies.
Cisco AMP's simple detection policy supports only SHA-256 hashes, not MD5 hashes. MD5 signatures must be configured in the advanced custom detection policies section instead. The administrator attempted to use MD5 in the wrong policy type, which is why the configuration failed.
Why the other options are wrong
- A. Simple detection policies specifically accept hashes, not files.
- B. APK files are not required for hash-based detection policies.
- C. The issue is not format but the hash algorithm type; MD5 simply cannot be used in simple detection policies regardless of format.
Question 46
Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?
Show answer and explanation
Correct answer: D. Simple Certificate Enrollment Protocol
Simple Certificate Enrollment Protocol (SCEP) is specifically designed to automate certificate deployment and configuration on mobile devices and endpoints. It enables supplicants to request and receive certificates along with network configuration, allowing secure network access on mobile devices.
Why the other options are wrong
- A. BYOD onboarding is a broader process that may incorporate certificate enrollment but is not the specific method for certificate deployment and supplicant configuration.
- B. MAC authentication bypass is a network access control method that does not involve certificate deployment or supplicant provisioning.
- C. Client provisioning is a general term that may involve multiple methods; SCEP is the specific protocol designed for automated certificate and configuration delivery.
Question 47
Which technology reduces data loss by identifying sensitive information stored in public computing environments?
Show answer and explanation
Correct answer: D. Cisco Cloudlock
Cisco Cloudlock is a cloud access security broker (CASB) that identifies and protects sensitive information in cloud environments by monitoring user activity, detecting data exfiltration, and controlling access to public cloud services. It specifically addresses data loss prevention in non-on-premise environments.
Why the other options are wrong
- A. Cisco SDA (Software-Defined Access) focuses on network segmentation and access control, not sensitive data identification in public cloud.
- B. Cisco Firepower is a threat defense platform for network security, not cloud data loss prevention.
- C. Cisco HyperFlex is a hyperconverged infrastructure solution for on-premise deployments, not cloud data protection.
Question 48
What is a difference between Cisco AMP for Endpoints and Cisco Umbrella?
Show answer and explanation
Correct answer: C. Cisco AMP for Endpoints prevents, detects, and responds to attacks before damage can be done, and Cisco Umbrella provides the first line of defense against Internet threats
Cisco AMP for Endpoints is designed to prevent, detect, and respond to attacks on endpoints before damage occurs, providing post-infection capabilities. Cisco Umbrella provides the first line of defense against internet threats at the DNS and network level, blocking malicious destinations before connections are established. This represents their fundamental architectural difference and layered defense approach.
Why the other options are wrong
- A. Both Cisco AMP for Endpoints and Cisco Umbrella are cloud-based services.
- B. This describes a capability of AMP but incorrectly suggests Umbrella lacks this type of functionality; Umbrella also researches and identifies threats.
- D. This reverses the actual functions, Umbrella prevents connections to malicious destinations, while AMP works at the file and endpoint level.
Question 49
Which solution for remote workers enables protection, detection, and response on the endpoint against known and unknown threats?
Show answer and explanation
Correct answer: A. Cisco AMP for Endpoints
Cisco AMP for Endpoints is specifically designed to provide protection, detection, and response capabilities against both known and unknown threats on endpoints. It uses a combination of file reputation, sandboxing, and behavioral analysis to identify and respond to threats in real-time.
Why the other options are wrong
- B. Cisco AnyConnect is a VPN and secure mobility solution, not an endpoint threat protection platform.
- C. Cisco Umbrella is a DNS and cloud security solution for web filtering and malware prevention, not endpoint-focused detection and response.
- D. Cisco Duo is primarily a multi-factor authentication solution, not an endpoint protection and response platform.
Question 50
How is data sent out to the attacker during a DNS tunneling attack?
Show answer and explanation
Correct answer: A. as part of the domain name
During DNS tunneling attacks, data is encoded and sent to the attacker as part of the domain name itself in DNS queries. For example, attackers encode exfiltrated data into subdomain labels (e.g., data.exfiltrated.attacker.com), which travels through DNS requests and allows data to be extracted while appearing as legitimate DNS traffic.
Why the other options are wrong
- B. UDP/53 payload refers to the entire DNS message, but the actual data encoding occurs specifically in the domain name portion.
- C. TCP/53 is rarely used for DNS, and packet headers do not carry the encoded data in DNS tunneling attacks.
- D. While DNS response packets may also contain encoded data, the primary exfiltration mechanism uses the query domain name itself.
Question 51
Which group within Cisco writes and publishes a weekly newsletter to help cybersecurity professionals remain aware of the ongoing and most prevalent threats?
Show answer and explanation
Correct answer: A. Talos
Cisco Talos is the group responsible for publishing weekly threat intelligence newsletters to keep cybersecurity professionals informed about current and prevalent threats. Talos is Cisco's threat intelligence and research organization.
Why the other options are wrong
- B. PSIRT (Product Security Incident Response Team) handles security vulnerabilities but does not publish weekly newsletters.
- C. SCIRT is not a recognized Cisco security group or newsletter publisher.
- D. DEVNET is Cisco's developer network community and does not focus on cybersecurity threat intelligence newsletters.
Question 52
Which Cisco security solution protects remote users against phishing attacks when they are not connected to the VPN?
Show answer and explanation
Correct answer: A. Cisco Umbrella
Cisco Umbrella provides DNS-level protection against phishing attacks for remote users regardless of their network location or VPN connection status. It blocks malicious domains and URLs at the DNS layer before the connection is even established, protecting users on any network.
Why the other options are wrong
- B. Cisco Firepower NGIPS is a network intrusion prevention system focused on network-level threats, not endpoint phishing protection.
- C. Cisco Stealthwatch is a threat detection and network monitoring tool, not a phishing prevention solution.
- D. Cisco Firepower is a firewall and threat defense platform, not specifically designed for remote user phishing protection.
Question 53
Which Cisco cloud security software centrally manages policies on multiple platforms such as Cisco ASA, Cisco Firepower, Cisco Meraki, and AWS?
Show answer and explanation
Correct answer: A. Cisco Defense Orchestrator
Cisco Defense Orchestrator (CDO) is the Cisco cloud security software solution that centrally manages policies across multiple platforms including Cisco ASA, Cisco Firepower, Cisco Meraki, and AWS, providing unified policy management and orchestration across hybrid and multi-cloud environments.
Why the other options are wrong
- B. Cisco Configuration Professional (CCP) is a device-specific management tool for individual Cisco routers, not a cloud-based multi-platform orchestrator.
- C. Cisco Secureworks is a managed security services provider, not a central policy orchestration platform.
- D. Cisco DNAC (DNA Center) is focused on network access control and automation, not multi-platform security policy management.
Question 54
Which Cisco solution does Cisco Umbrella integrate with to determine if a URL is malicious?
Show answer and explanation
Correct answer: D. Cisco Talos
Cisco Talos is Cisco's threat intelligence organization that provides real-time threat data and analysis. Cisco Umbrella integrates with Talos to access its extensive database of known malicious URLs and threats to determine if a URL is malicious.
Why the other options are wrong
- A. AMP is an endpoint protection product, not the primary URL threat intelligence source for Umbrella.
- B. AnyConnect is a VPN and secure access client, not a URL threat intelligence system.
- C. Dynamic DNS is for domain name resolution, not malicious URL identification.
Question 55
An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed. What must be done to ensure that all devices can communicate together?
Show answer and explanation
Correct answer: C. Manually change the management port on Cisco FMC and all managed Cisco FTD devices.
The management port change must be performed manually on both Cisco FMC and all managed Cisco FTD devices to ensure they can communicate together. Unlike configuration policies that push from FMC to devices, management port settings are local parameters that require direct configuration on each system. The sftunnel port operates at a different layer and port 8305 is not the standard management port solution.
Why the other options are wrong
- A. FMC cannot automatically push management port changes to FTD devices; management port configuration is not policy-distributable.
- B. Setting sftunnel port to 8305 does not address the fundamental management port conflict issue.
- D. Routing sftunnel through FTD would not resolve the management port conflict and creates unnecessary complexity.
Question 56
Which Cisco platform processes behavior baselines, monitors for deviations, and reviews for malicious processes in data center traffic and servers while performing software vulnerability detection?
Show answer and explanation
Correct answer: A. Cisco Tetration
Cisco Tetration is the platform specifically designed to process behavior baselines, monitor for deviations from normal activity, detect malicious processes in data center traffic and servers, and perform software vulnerability detection across the data center environment.
Why the other options are wrong
- B. Cisco ISE focuses on identity and access management, not behavior baselining and vulnerability detection in data centers.
- C. Cisco AnyConnect is an endpoint VPN and security client for remote access, not a data center traffic analysis platform.
- D. Cisco AMP for Network provides malware detection but does not focus on behavior baselines and vulnerability detection in data centers like Tetration does.
Question 57
Which feature is leveraged by advanced antimalware capabilities to be an effective endpoint protection platform?
Show answer and explanation
Correct answer: D. sandboxing
Sandboxing is a core technology leveraged by advanced antimalware solutions to be effective endpoint protection platforms. It allows suspicious files and programs to be executed in an isolated environment to safely analyze their behavior without risking the actual endpoint, enabling detection of zero-day and polymorphic threats.
Why the other options are wrong
- A. Blocklisting alone is a basic signature-based approach and not the advanced feature that makes modern EPP effective.
- B. Storm centers are not a standard antimalware feature in endpoint protection platforms.
- C. While big data analytics support threat analysis, sandboxing is the more fundamental advanced capability for EPP.
Question 58
Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?
Show answer and explanation
Correct answer: D. A flow-export event type must be defined under a policy.
In Cisco ASA NetFlow v9 Secure Event Logging (NSEL), a flow-export event type must be defined under a policy to specify which events should be exported and logged. This policy-based approach allows administrators to control what types of network events are captured and sent to the collector, making it a required configuration element for NSEL to function properly.
Why the other options are wrong
- A. NetFlow records can show bandwidth usage independent of QoS being enabled; QoS is not required for NetFlow bandwidth visibility.
- B. NSEL is enabled globally or at the device level, not through a sysopt command on specific interfaces.
- C. NSEL requires a collector to be configured to receive and process the exported flow data; it cannot function without one.
Question 59
Which deployment model is the most secure when considering risks to cloud adoption?
Show answer and explanation
Correct answer: D. private cloud
Private cloud deployment is the most secure cloud model when considering adoption risks because the infrastructure is dedicated exclusively to a single organization, maintaining complete control over security policies, data residency, physical security, and access controls. Unlike public clouds where resources are shared among multiple tenants, private clouds eliminate the risks associated with resource sharing and third-party access, allowing organizations to implement stringent security measures tailored to their specific requirements.
Why the other options are wrong
- A. Public cloud is the least secure model due to shared resources, multi-tenancy, and limited control over security infrastructure.
- B. Hybrid cloud combines public and private elements, introducing security complexity at the integration points and maintaining some of the risks of public cloud components.
- C. Community cloud shares infrastructure among multiple organizations with common interests, still introducing shared-resource risks and complexity compared to private cloud.
Question 60
In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint Protection Platform?
Show answer and explanation
Correct answer: A. when there is a need to have more advanced detection capabilities
Endpoint Detection and Response (EDR) solutions should be chosen when advanced detection capabilities are needed, particularly for identifying sophisticated threats, behavioral analysis, and threat hunting. EDR focuses on detecting and responding to advanced threats that traditional endpoint protection may miss, making it ideal for organizations requiring deeper visibility and investigation capabilities.
Why the other options are wrong
- B. Firewall presence or absence does not determine whether EDR should be chosen over EPP.
- C. Traditional anti-malware detection is the primary function of EPP, not a reason to choose EDR.
- D. Both EDR and EPP solutions support centralized management, so lack of central management need does not justify choosing EDR.
Question 61
Which risk is created when using an Internet browser to access cloud-based service?
Show answer and explanation
Correct answer: C. vulnerabilities within protocol
Using an Internet browser to access cloud services introduces protocol-level vulnerabilities including man-in-the-middle attacks, SSL/TLS weaknesses, DNS spoofing, and other transport layer security issues inherent in HTTP/HTTPS protocols.
Why the other options are wrong
- A. Misconfiguration risk is related to cloud infrastructure setup, not specifically to browser access mechanisms.
- B. Connection issues to cloud connectors are operational concerns, not security risks created by browser usage.
- D. While API security is important in cloud services, the specific risk introduced by browser access is protocol-level vulnerability, not API implementation.
Question 62
Which statement about IOS zone-based firewalls is true?
Show answer and explanation
Correct answer: D. An interface can be assigned only to one zone.
In IOS zone-based firewalls, each interface can be assigned to only one zone. This design ensures clear traffic flows and unambiguous policy application between zones.
Why the other options are wrong
- A. Unassigned interfaces cannot communicate with assigned interfaces; traffic must follow zone policies.
- B. Multiple interfaces can be assigned to the same zone for traffic policy consolidation.
- C. An interface cannot belong to multiple zones simultaneously; zone assignment is mutually exclusive.
Question 63
What is a characteristic of a bridge group in a Cisco ASA Firewall running in transparent mode?
Show answer and explanation
Correct answer: C. It includes multiple interfaces and access rules between interfaces are customizable.
A bridge group in Cisco ASA transparent mode consists of multiple physical interfaces grouped together and operates at Layer 2. Access control rules between interfaces in the bridge group are customizable, allowing granular control over traffic flowing between bridged interfaces while maintaining transparency.
Why the other options are wrong
- A. Bridge groups use Bridge Virtual Interfaces (BVI) which have IP addresses for management, but this is not the defining characteristic.
- B. While ARP traffic is important in bridge groups, it is not limited to a single access rule; rules are fully customizable.
- D. Bridge groups are Layer 2 constructs, not Layer 3, and include multiple ports with customizable rules, not just one port.
Question 64
Which baseline form of telemetry is recommended for network infrastructure devices?
Show answer and explanation
Correct answer: D. SNMP
SNMP (Simple Network Management Protocol) is the recommended baseline form of telemetry for network infrastructure devices. It provides standardized, lightweight monitoring of device health, performance metrics, and status across all major vendors and device types, making it the foundational telemetry method for infrastructure monitoring.
Why the other options are wrong
- A. SDNS is related to DNS security, not general infrastructure telemetry.
- B. NetFlow is flow-based telemetry useful for traffic analysis but not the baseline infrastructure device telemetry method.
- C. Passive taps are network tools for traffic capture, not telemetry mechanisms for device monitoring.
Question 65
What are two functions of secret key cryptography? (Choose two.)
Show answer and explanation
Correct answer: A, E. utilization of less memory; provides the capability to only know the key on one side
Secret key (symmetric) cryptography utilizes less memory compared to asymmetric cryptography and provides the capability where only one side needs to know the key, as both parties share the same secret key for encryption and decryption. This contrasts with asymmetric cryptography which requires larger key sizes and more computational resources.
Why the other options are wrong
- B. Large prime number iterations are characteristic of asymmetric (public key) cryptography, not secret key cryptography.
- C. Secret key cryptography uses the same key for both encryption and decryption, not different keys; using different keys defines asymmetric cryptography.
- D. Key selection with or without integer factorization relates to asymmetric cryptography and RSA specifically, not secret key cryptography.
Question 66
A Cisco FTD engineer is creating a newIKEv2 policy called s2s00123456789 for their organization to allow additional protocols to terminate network devices with. They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy. What should be done in order to support this?
Show answer and explanation
Correct answer: D. Make the priority for the new policy 5 and the primary policy 1.
In IKEv2 policy configuration, lower priority numbers are evaluated first, making them primary policies. To make the existing policy primary (stronger algorithms) with priority 1 and the new backup policy with priority 5, the new policy becomes secondary. When devices attempt negotiation, IKE will try the primary policy first and fall back to the backup policy if the primary fails, allowing devices with weaker algorithm support to still connect.
Why the other options are wrong
- A. Using AES* wildcard notation does not create a proper backup policy hierarchy; it still represents the same encryption strength.
- B. Priority 10 and 1 are reversed; the primary policy should have the lower priority number (1), not the higher number (10).
- C. Using SHA* wildcard for integrity does not establish the proper policy priority ordering needed for backup functionality.
Question 67
An engineer is implementing NTP authentication within their network and has configured both the client and server devices with the command ntp authentication-key 1 md5 Cisc392481137. The server at 1.1.1.1 is attempting to authenticate to the client at 1.1.1.2, however is unable to do so. Which command is required to enable the client to accept the server's authentication key?
Show answer and explanation
Correct answer: C. ntp server 1.1.1.1 key 1
The client at 1.1.1.2 needs to be configured to trust and use the authentication key when communicating with the NTP server at 1.1.1.1. The command 'ntp server 1.1.1.1 key 1' on the client specifies that it should authenticate messages from server 1.1.1.1 using authentication key 1. This enables the client to verify the server's authenticity.
Why the other options are wrong
- A. This configures the client to authenticate to 1.1.1.2, which is the client itself, not the server.
- B. The 'ntp peer' command is used for symmetric NTP relationships, not client-server authentication.
- D. The 'ntp peer' command with the server's IP is incorrect for a client-server authentication model.
Question 68
Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two.)
Show answer and explanation
Correct answer: A, D. Assignments to endpoint groups are made dynamically, based on endpoint attributes; Patch management remediation is performed.
The Cisco ISE posture module provides dynamic assignment of endpoints to groups based on their security attributes (A) and performs patch management remediation (D) to ensure endpoints comply with security policies before granting network access.
Why the other options are wrong
- B. Supplicant configuration deployment is handled by ISE but is not specifically a posture module action for ensuring endpoint security.
- C. While ISE is centralized management, this is not an action performed by the posture module specifically.
- E. Antivirus updates are a remediation concern but ISE posture performs broader patch management remediation rather than specific antivirus update deployment.
Question 69
What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?
Show answer and explanation
Correct answer: B. It discovers and controls cloud apps that are connected to a company's corporate environment.
The Cloudlock Apps Firewall functions by discovering cloud applications that are connected to or integrated with a company's corporate environment and provides administrators with controls to manage and restrict their usage. It identifies SaaS applications, integrations, and data flows to prevent unauthorized or risky cloud services from accessing corporate data and resources, thereby mitigating security concerns from an application perspective.
Why the other options are wrong
- A. Quarantining malicious files to allow applications to function defeats the security purpose; the firewall blocks or restricts problematic applications rather than allowing them to operate.
- C. The Apps Firewall doesn't delete applications; it monitors, discovers, and controls access to them based on policy.
- D. While administrators may be notified, the primary function is active control and enforcement, not merely informing administrators.
Question 70
Which two key and block sizes are valid for AES? (Choose two.)
Show answer and explanation
Correct answer: C, D. 128-bit block size, 192-bit key length; 128-bit block size, 256-bit key length
AES (Advanced Encryption Standard) uses a fixed block size of 128 bits and supports three key lengths: 128-bit, 192-bit, and 256-bit. Therefore, both a 128-bit block size with 192-bit key length and a 128-bit block size with 256-bit key length are valid AES configurations.
Why the other options are wrong
- A. AES does not use 64-bit blocks; it uses only 128-bit blocks, and 112-bit keys are not valid for AES.
- B. AES does not use 64-bit blocks; it uses only 128-bit blocks, and 168-bit keys are not valid for AES.
- E. AES does not support 192-bit block sizes; it uses only 128-bit blocks.
Question 71
Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?
Show answer and explanation
Correct answer: C. aaa new-model
The 'aaa new-model' command enables the AAA model globally on a Cisco device, which is the foundational requirement for supporting Change of Authorization (CoA). This command must be configured first before other AAA features, including the dynamic authorization server settings, can function properly. The 'aaa server radius dynamic-author' command configures the RADIUS dynamic authorization server but requires AAA to be enabled first.
Why the other options are wrong
- A. The 'aaa server radius dynamic-author' command configures RADIUS CoA but doesn't enable AAA globally.
- B. The 'auth-type all' command is not a valid Cisco command for AAA enablement.
- D. The 'ip device-tracking' command is for DHCP snooping and device tracking, not AAA enablement.
Question 72
An MDM provides which two advantages to an organization with regards to device management? (Choose two.)
Show answer and explanation
Correct answer: A, B. asset inventory management; allowed application management
Mobile Device Management provides asset inventory management, allowing organizations to track and catalog all enrolled devices, and allows management of approved applications that can run on devices. These capabilities enable organizations to maintain visibility over mobile assets and enforce application security policies.
Why the other options are wrong
- C. Active Directory group policy management is a traditional IT management function, not an MDM advantage.
- D. Network device management (switches, routers) is outside the scope of MDM solutions.
- E. Critical device management is not a standard MDM terminology or advantage.
Question 73
An engineer adds a custom detection policy to a Cisco AMP deployment and encounters issues with the configuration. The simple detection mechanism is configured, but the dashboard indicates that the hash is not 64 characters and is non-zero. What is the issue?
Show answer and explanation
Correct answer: D. The engineer is attempting to upload a hash created using MD5 instead of SHA-256.
Cisco AMP's simple detection policy requires SHA-256 hashes, which are 64 hexadecimal characters long. MD5 hashes are only 32 characters, which explains why the dashboard indicates the hash is not 64 characters. The engineer must convert the detection mechanism to use SHA-256 instead of MD5 for simple detections to work properly.
Why the other options are wrong
- A. Incorrect format of a set would typically produce a different error message, not a character length mismatch.
- B. Uploading files instead of hashes would result in a different validation error related to file type.
- C. Simple detections can work with proper hash formats; the issue is specifically about hash algorithm choice, not detection method capability.
Question 74
Which command enables 802.1X globally on a Cisco switch?
Show answer and explanation
Correct answer: A. dot1x system-auth-control
The dot1x system-auth-control command is the global configuration command that enables 802.1X authentication on a Cisco switch. This must be configured before port-level 802.1X settings can take effect.
Why the other options are wrong
- B. dot1x pae authenticator is a port-level command that configures the switch role, but it does not enable 802.1X globally.
- C. authentication port-control auto is a port-level command for 802.1X behavior, not the global enablement command.
- D. aaa new-model enables AAA globally but does not specifically enable 802.1X authentication.
Question 75
What is an advantage of the Cisco Umbrella roaming client?
Show answer and explanation
Correct answer: C. the ability to dynamically categorize traffic to previously uncategorized sites
The Cisco Umbrella roaming client can dynamically categorize traffic to previously uncategorized sites in real-time, providing enhanced visibility and protection even for newly discovered or uncommon destinations that may not be in existing categorization databases.
Why the other options are wrong
- A. Umbrella does not provide visibility into all traffic without TLS decryption; it relies on DNS analysis and IP reputation rather than packet inspection.
- B. While Umbrella does provide IP-based threat visibility, it does not specifically tunnel suspicious IP connections as a primary feature.
- D. The roaming client provides visibility into traffic regardless of destination location, not specifically limited to office environment traffic.
Question 76
Which two descriptions of AES encryption are true? (Choose two.)
Show answer and explanation
Correct answer: B, D. AES is more secure than 3DES; AES can use a 256-bit key for encryption.
AES is more secure than 3DES due to its stronger mathematical foundation and larger key space, making it resistant to modern cryptanalysis. Additionally, AES can use a 256-bit key for encryption, which is one of its three valid key lengths (128-bit, 192-bit, and 256-bit). These are two true statements about AES capabilities and security.
Why the other options are wrong
- A. AES is more secure than 3DES, not less secure.
- C. AES cannot use 168-bit keys; valid AES key lengths are only 128, 192, or 256 bits.
- E. AES does not encrypt and decrypt keys three times in sequence; that describes 3DES (Triple DES).
Question 77
An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which probe must be enabled for this type of profiling to work?
Show answer and explanation
Correct answer: C. DHCP
DHCP probes must be enabled to profile endpoints by OUI (Organizationally Unique Identifier). The DHCP probe captures DHCP discover and request messages that contain the MAC address prefix (OUI), allowing Cisco ISE to identify device manufacturers and automatically assign endpoints to groups based on their OUI.
Why the other options are wrong
- A. SNMP probes gather device information but do not reliably capture OUI data for profiling.
- B. NMAP is a network scanning tool not used by ISE for DHCP-based OUI profiling.
- D. NetFlow provides network flow data, not MAC address or OUI information for device profiling.
Question 78
Which two Cisco ISE components must be configured for BYOD? (Choose two.)
Show answer and explanation
Correct answer: A, D. local WebAuth; guest
For BYOD implementations, Cisco ISE must be configured with local WebAuth (A) to handle user registration and onboarding, and guest access (D) to provide appropriate network segmentation and policies for personally owned devices.
Why the other options are wrong
- B. Central WebAuth is not a standard ISE component specifically required for BYOD configuration.
- C. Null WebAuth is not a recognized ISE authentication method for BYOD scenarios.
- E. Dual is not a standard ISE component related to BYOD configuration.
Question 79
What is a difference between an XSS attack and an SQL injection attack?
Show answer and explanation
Correct answer: A. SQL injection is a hacking method used to attack SQL databases, whereas XSS attack can exist in many different types of applications.
SQL injection attacks specifically target SQL databases by exploiting input validation flaws to execute malicious SQL commands, making them database-specific threats. XSS (Cross-Site Scripting) attacks can occur in any web application or system that renders user-supplied input, as they exploit inadequate output encoding to inject malicious scripts that execute in users' browsers. This key difference is that SQL injection is database-focused while XSS is application-agnostic.
Why the other options are wrong
- B. This reverses the actual purposes: SQL injection targets databases to steal data, while XSS targets users to steal credentials or session data, not redirect for physical theft.
- C. This incorrectly labels XSS as database-specific when it actually affects web applications broadly.
- D. This reverses the actual attack vectors and purposes of both attack types.
Question 80
What is the function of Cisco Cloudlock for data security?
Show answer and explanation
Correct answer: A. data loss prevention
Cisco Cloudlock's primary function is data loss prevention (DLP) in cloud environments. It detects sensitive data exposure, monitors risky user activities, and prevents unauthorized data sharing across cloud applications and services.
Why the other options are wrong
- B. While Cloudlock includes threat intelligence, controlling malicious apps is not its primary function; that's more aligned with mobile threat defense.
- C. Anomaly detection is a supporting capability but not the core function of Cloudlock.
- D. UEBA is a broader security analytics function that Cloudlock may incorporate, but DLP is its primary purpose.
Question 81
What is a difference between a DoS attack and DDos attack?
Show answer and explanation
Correct answer: D. A DoS attack is where a computer is used to flood a server with TCP and UDP packets, whereas DDoS attack is where multiple systems target a single system with a DoS attack.
A Denial of Service (DoS) attack originates from a single computer that floods a server with packets (TCP, UDP, or both) to overwhelm its resources. A Distributed Denial of Service (DDoS) attack coordinates multiple compromised systems to simultaneously launch DoS attacks against a single target, overwhelming it through distributed traffic. The critical distinction is the number of attack sources: one for DoS versus many for DDoS.
Why the other options are wrong
- A. DoS attacks are not limited to TCP packets; they can use TCP, UDP, or both types of packets.
- B. This incorrectly specifies packet types to attack methods; both DoS and DDoS can use either TCP or UDP packets.
- C. While DoS uses TCP and UDP packets correctly, the DDoS description is incorrect; DDoS targets a single system with coordinated attacks, not multiple servers on a LAN.
Question 82
How does DNS Tunneling exfiltrate data?
Show answer and explanation
Correct answer: A. An attacker registers a domain that a client connects to based on DNS records and sends malware through that connection.
DNS tunneling exfiltrates data by encoding information within DNS queries and responses. An attacker registers a domain and configures it so that when a compromised client makes DNS queries to resolve subdomains of that attacker-controlled domain, the encoded data travels through DNS traffic, which typically bypasses firewalls. This technique exploits the fact that DNS is usually allowed through network perimeters.
Why the other options are wrong
- B. A reverse DNS shell is not how DNS tunneling works; DNS tunneling uses DNS queries themselves as the exfiltration channel, not shell access.
- C. Hidden DNS resolvers in emails is not a DNS tunneling technique; DNS tunneling involves encoding data in DNS queries to an attacker-controlled domain.
- D. Using non-standard DNS ports for server access is not DNS tunneling; tunneling specifically encodes data within DNS protocol traffic to exfiltrate information.
Question 83
An organization wants to improve its cybersecurity processes and to add intelligence to its data. The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA. What must be done to accomplish these objectives?
Show answer and explanation
Correct answer: A. Configure the integrations with Talos intelligence to take advantage of the threat intelligence that it provides.
Cisco Talos is the threat intelligence platform that provides current and comprehensive data for URL filtering, reputations, and vulnerability information. Talos intelligence can be integrated directly with Cisco FTD and Cisco WSA to improve security processes and add intelligence to organizational data.
Why the other options are wrong
- B. The IETF does not provide threat intelligence feeds; it focuses on internet standards and protocols.
- C. While Internet Storm Center provides some threat data, Talos is the primary Cisco threat intelligence source designed for integration with FTD and WSA.
- D. pxGrid connections are for device communication and policy sharing, not for importing NIST threat intelligence into security products.
Question 84
Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?
Show answer and explanation
Correct answer: A. file access from a different user
File access from a different user is a suspicious pattern that helps Cisco Tetration learn and establish normal user behavior baselines. By identifying when file access occurs from unexpected users, the platform can distinguish between normal activity and anomalous behavior, enabling it to learn what constitutes normal user conduct.
Why the other options are wrong
- B. User login suspicious behavior is an indicator of threat, not a pattern used to learn normal behavior.
- C. Privilege escalation is a security event, not a baseline learning pattern.
- D. Interesting file access is too vague; the specific pattern involves access from different users deviating from norms.
Question 85
Which threat involves software being used to gain unauthorized access to a computer system?
Show answer and explanation
Correct answer: D. virus
A virus is malicious software designed to gain unauthorized access to a computer system, replicate itself, and potentially cause harm. Viruses are programs that require human action to spread and can compromise system security and user data. This matches the definition of software being used to gain unauthorized access.
Why the other options are wrong
- A. Ping of death is a network-based denial-of-service attack using malformed ping packets, not software designed to gain unauthorized system access.
- B. HTTP flood is a volume-based DDoS attack that overwhelms servers with HTTP requests, not malware for unauthorized system access.
- C. NTP amplification is a DDoS attack technique using Network Time Protocol, not malware for gaining unauthorized access to systems.
Question 86
What is the purpose of the My Devices Portal in a Cisco ISE environment?
Show answer and explanation
Correct answer: A. to register new laptops and mobile devices
The My Devices Portal in Cisco ISE is designed to allow end users to register and manage their personal and corporate devices. It provides a self-service interface where users can enroll new laptops, mobile devices, and other endpoints into the ISE system for network access and compliance management.
Why the other options are wrong
- B. Antivirus and patch management is handled by dedicated endpoint management tools, not the My Devices Portal.
- C. Provisioning userless and agentless systems is not the primary purpose of the My Devices Portal.
- D. Requesting newly provisioned devices is a procurement function, not a capability of the My Devices Portal.
Question 87
Where are individual sites specified to be blacklisted in Cisco Umbrella?
Show answer and explanation
Correct answer: D. destination lists
In Cisco Umbrella, individual sites are blacklisted using destination lists. These lists allow administrators to specify particular domains or URLs that should be blocked, providing granular control over which destinations are prohibited from user access.
Why the other options are wrong
- A. Application settings configure general Umbrella features, not blacklist specifications.
- B. Content categories block entire categories of content, not individual sites.
- C. Security settings configure broader security policies, not individual site blacklists.
Question 88
When wired 802.1X authentication is implemented, which two components are required? (Choose two.)
Show answer and explanation
Correct answer: A, C. authentication server: Cisco Identity Service Engine; authenticator: Cisco Catalyst switch
Wired 802.1X authentication requires an authenticator (the Cisco Catalyst switch that enforces port-based access) and an authentication server (Cisco Identity Service Engine that validates credentials). These two components work together to control network access.
Why the other options are wrong
- B. The Cisco AnyConnect ISE Posture module is a supplicant component for wireless or endpoint compliance, not required for basic wired 802.1X.
- D. The authentication server role must be a dedicated AAA server like ISE, not the switch itself.
- E. Cisco Prime Infrastructure is a management platform, not an authentication server for 802.1X.
Question 89
When web policies are configured in Cisco Umbrella, what provides the ability to ensure that domains are blocked when they host malware, command and control, phishing, and more threats?
Show answer and explanation
Correct answer: B. Security Category Blocking
Security Category Blocking in Cisco Umbrella specifically targets threats like malware, command and control servers, phishing, and other security threats by blocking domains that host these malicious activities. This is distinct from content category blocking which focuses on types of content rather than security threats.
Why the other options are wrong
- A. Application Control manages which applications can be used, not threat-based domain blocking.
- C. Content Category Blocking focuses on content types like adult material or social media, not security threats.
- D. File Analysis examines file characteristics but doesn't directly block domains based on threat hosting.
Question 90
What is the intent of a basic SYN flood attack?
Show answer and explanation
Correct answer: C. to exceed the threshold limit of the connection queue
A SYN flood attack works by sending numerous SYN packets to a target, consuming connection queue slots and preventing legitimate connections from being established. The attacker's goal is to exceed the threshold of available connection slots in the target's connection queue, causing a denial of service.
Why the other options are wrong
- A. SYN floods target TCP connection establishment, not DNS resolution.
- B. Register stack flushing is not the mechanism or intent of SYN flood attacks.
- D. While buffer overflow is a separate attack type, basic SYN floods specifically target connection queue exhaustion, not buffer overflow.
Question 91
An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network. Which product should be used to accomplish this goal?
Show answer and explanation
Correct answer: B. Cisco Umbrella
Cisco Umbrella operates at the DNS layer to block malicious destinations before connections are established, preventing users from accessing malicious sites. It also provides application-level blocking capabilities. This approach aligns with the Defense in Depth strategy by stopping threats at the earliest possible point in the connection process, before a full network connection is even attempted.
Why the other options are wrong
- A. Cisco Firepower operates at the network and application layers but is better suited for post-connection inspection rather than pre-connection blocking at DNS level.
- C. Cisco ISE is an identity and access management solution, not a destination blocking or application control solution.
- D. Cisco AMP is focused on malware detection and advanced threat protection, not destination or application-level blocking.
Question 92
An organization wants to use Cisco FTD or Cisco ASA devices. Specific URLs must be blocked from being accessed via the firewall, which requires that the administrator input the bad URL categories that the organization wants blocked into the access policy. Which solution should be used to meet this requirement?
Show answer and explanation
Correct answer: D. Cisco FTD because it includes URL filtering in the access control policy capabilities, whereas Cisco ASA does not.
Cisco FTD (Firewall Threat Defense) includes integrated URL filtering capabilities that can be configured directly in access control policies, allowing administrators to block specific URL categories. Cisco ASA does not have built-in URL filtering in its access control policies and would require separate modules or solutions for URL-based blocking.
Why the other options are wrong
- A. While FTD has URL filtering, ASA also has some filtering capabilities, though not at the access policy level as required.
- B. ASA does not include URL filtering in its access control policy capabilities.
- C. ASA does not include URL filtering in access control policy capabilities, making this incorrect.
Question 93
What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?
Show answer and explanation
Correct answer: C. to ensure that assets are secure from malicious links on and off the corporate network
Cisco Umbrella Roaming is an endpoint agent that enforces DNS-based security policies on devices whether they are connected to the corporate network or operating remotely. It protects endpoints from malicious links and malware by redirecting requests to malicious domains regardless of location, ensuring consistent security on and off the corporate network.
Why the other options are wrong
- A. Umbrella Roaming provides DNS security, not VPN connectivity to the corporate network.
- B. Posture compliance and mandatory software are functions of endpoint management solutions, not Umbrella Roaming.
- D. Umbrella Roaming provides DNS-based protection against malicious domains, not file transfer protection specifically.
Question 94
In which scenario is endpoint-based security the solution?
Show answer and explanation
Correct answer: D. inspecting a password-protected archive
Endpoint-based security is the solution for inspecting password-protected archives because the security agent runs on the endpoint with full system access and can decrypt password-protected files before inspection. Network-based security solutions cannot access protected content without the password, making endpoint-based inspection essential for this scenario.
Why the other options are wrong
- A. Inspecting encrypted traffic is better performed at the network gateway level where decryption can occur, not primarily at endpoints.
- B. Device profiling and authorization is a network-based function, not specifically an endpoint-based security strength.
- C. Signature-based application control can be performed at both network and endpoint levels; endpoint-based security is not uniquely the solution here.
Question 95
What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and Response?
Show answer and explanation
Correct answer: A. EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.
EPP (Endpoint Protection Platform) is primarily prevention-focused, using techniques like antivirus, anti-malware, and firewall capabilities to block threats before they execute. EDR (Endpoint Detection and Response) focuses on identifying and responding to advanced threats that bypass prevention controls. EDR provides behavioral analysis, threat hunting, and incident response capabilities for sophisticated attacks that evade perimeter defenses.
Why the other options are wrong
- B. EDR is detection and response, not prevention; EPP is prevention-based, not threat-focused.
- C. Both EPP and EDR focus on device/endpoint security, not network security distinctions.
- D. Both focus on endpoint security; EDR does not focus on network security.
Question 96
A company is experiencing exfiltration of credit card numbers that are not being stored on-premise. The company needs to be able to protect sensitive data throughout the full environment. Which tool should be used to accomplish this goal?
Show answer and explanation
Correct answer: D. Cloudlock
Cloudlock is Cisco's cloud access security broker (CASB) tool specifically designed to protect sensitive data in cloud environments. Since the credit card data is not stored on-premise but is being exfiltrated from cloud environments, Cloudlock provides visibility and protection for data throughout cloud services and the full environment. Cisco ISE manages network access, Web Security Appliance focuses on web traffic filtering, and Security Manager provides centralized management, none of which specifically address cloud data protection.
Why the other options are wrong
- A. Cisco ISE manages network access control, not cloud data protection.
- B. Web Security Appliance filters web traffic but does not provide cloud data loss prevention.
- C. Security Manager is a centralized management tool, not a data protection solution.
Question 97
An engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware. Which two solutions mitigate the risk of this ransomware infection? (Choose two.)
Show answer and explanation
Correct answer: C, E. Configure a posture policy in Cisco Identity Services Engine to check that an endpoint patch level is met before allowing access on the network; Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.
Configuring a posture policy in ISE to check endpoint patch levels before allowing network access (option C) prevents unpatched systems from connecting, and implementing a well-defined endpoint patching strategy (option E) ensures critical vulnerabilities are patched timely. Both are proactive prevention measures that directly address the WannaCry vulnerability gap.
Why the other options are wrong
- A. ISE posture policies cannot install patches; they can only check for compliance and enforce access.
- B. Profiling policies identify endpoint characteristics but cannot enforce patch installation or prevent access based on patches.
- D. Endpoint firewall policies cannot stop exploit execution; they only control traffic flow, and WannaCry spreads through lateral movement which firewalls cannot fully prevent.
Question 98
Which term describes when the Cisco Firepower downloads threat intelligence updates from Cisco Talos?
Show answer and explanation
Correct answer: B. consumption
The term 'consumption' describes when a device or system receives and uses threat intelligence updates from an external source like Cisco Talos. Firepower consumes these updates to enhance its threat detection and prevention capabilities.
Why the other options are wrong
- A. Authoring refers to creating threat intelligence content, not downloading it.
- C. Sharing refers to distributing threat intelligence between systems, not receiving it.
- D. Analysis refers to examining threats, not the download process itself.
Question 99
Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other third-party management tools, and prioritize application traffic?
Show answer and explanation
Correct answer: B. Cisco Application Visibility and Control
Cisco Application Visibility and Control (AVC) combines IOS and IOS XE components to enable recognition of applications, collection of network metrics sent to Cisco Prime and third-party management tools, and prioritization of application traffic based on business policies.
Why the other options are wrong
- A. Cisco Security Intelligence is focused on threat intelligence, not application visibility and traffic prioritization.
- C. Cisco Model Driven Telemetry is a mechanism for collecting operational data, not a solution for application visibility and control.
- D. Cisco DNA Center is a network management platform that does not specifically provide application visibility and control functionality.
Question 100
Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the deployment?
Show answer and explanation
Correct answer: B. AMP
Cisco AMP (Advanced Malware Protection) is the dedicated endpoint protection product that provides proactive protection against advanced threats and allows administrators to centrally manage deployment across multiple endpoints in an organization.
Why the other options are wrong
- A. NGFW is a network firewall, not an endpoint protection solution.
- C. WSA is a web security appliance for network traffic, not endpoint protection.
- D. ESA is an email security appliance, not an endpoint protection product.
Question 101
A network administrator is configuring SNMPv3 on a new router. The users have already been created, however an additional configuration is needed to facilitate access to the SNMP views. What must the administrator do to accomplish this?
Show answer and explanation
Correct answer: C. map SNMPv3 users to SNMP views
After SNMPv3 users are created, they must be mapped to SNMP views to grant them access to specific MIB objects. This mapping associates user credentials with the views they are allowed to access, enabling the access control functionality.
Why the other options are wrong
- A. Encryption algorithm definition is part of user security configuration, not view access.
- B. Authentication password is configured during user creation, not for view access.
- D. UDP port specification is a global SNMP setting, not specific to view access.
Question 102
Which posture assessment requirement provides options to the client for remediation within a certain timeframe?
Show answer and explanation
Correct answer: B. mandatory
The 'mandatory' posture requirement allows endpoints that fail compliance to be given a grace period for remediation before access is revoked, providing options for users to correct non-compliance within a specified timeframe.
Why the other options are wrong
- A. Audit requirements monitor and report on compliance without enforcing remediation.
- C. Visibility requirements track and display endpoint status but do not require or enforce remediation.
- D. Optional requirements do not enforce compliance or provide remediation timelines.
Question 103
For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two.)
Show answer and explanation
Correct answer: B, D. Windows service; Windows firewall
ISE posture assessment can check Windows service status (whether specific services are running or disabled) and Windows firewall configuration (whether the firewall is enabled and properly configured). These are system-level security checks performed on endpoints.
Why the other options are wrong
- A. Computer identity is an ISE profiling attribute, not a posture assessment condition.
- C. User identity is related to authentication, not endpoint posture conditions.
- E. Default browser is not a standard ISE posture assessment condition.
Question 104
Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two.)
Show answer and explanation
Correct answer: A, B. Check integer, float, or Boolean string parameters to ensure accurate values; Use prepared statements and parameterized queries.
The two primary prevention techniques for SQL injection attacks are checking and validating string parameters to ensure they contain only expected data types and formats, and using prepared statements with parameterized queries that separate SQL code from data, preventing user input from being interpreted as executable SQL commands. These techniques prevent malicious SQL code from being injected into queries.
Why the other options are wrong
- C. Securing the web-to-app tier connection protects data in transit but does not prevent SQL injection at the database layer.
- D. Writing SQL code directly instead of using ORM libraries actually increases SQL injection risk; ORMs abstract and sanitize queries.
- E. Blocking SQL execution in database login credentials does not address SQL injection in application queries.
Question 105
A network engineer is configuring DMVPN and entered the crypto isakmp key cisc0383320506 address 0.0.0.0 command on host A. The tunnel is not being established to host B. What action is needed to authenticate the VPN?
Show answer and explanation
Correct answer: C. Enter the same command on host B
For DMVPN tunnel establishment between host A and host B using ISAKMP pre-shared key authentication, both hosts must use the same authentication credential. Since host A has entered a specific pre-shared key, host B must enter the identical command with the same password on its configuration to authenticate and establish the tunnel successfully.
Why the other options are wrong
- A. Changing to a default password would not help establish the tunnel; both sides need the same key regardless.
- B. Using a different password on host B would prevent authentication, as pre-shared keys must match.
- D. Changing to IKEv2 is a protocol upgrade but does not solve the authentication mismatch if the same key is not configured on host B.
Question 106
What is a characteristic of Firepower NGIPS inline deployment mode?
Show answer and explanation
Correct answer: D. It must have inline interface pairs configured
In inline deployment mode, Firepower NGIPS must have inline interface pairs configured. These paired interfaces allow the device to sit directly in the traffic path between internal and external networks, inspecting traffic flowing between them. This is a fundamental requirement for inline mode operation, unlike passive or out-of-band modes.
Why the other options are wrong
- A. ASA with Firepower module can be deployed in inline mode without restriction.
- B. Inline deployment mode can take blocking actions on traffic based on configured policies.
- C. Inline deployment is in-band with traffic flow, not out-of-band; devices sitting out-of-band are passive.
Question 107
Which network monitoring solution uses streams and pushes operational data to provide a near real-time view of activity?
Show answer and explanation
Correct answer: D. model-driven telemetry
Model-driven telemetry uses streaming technology to continuously push operational data from network devices to collection points, providing near real-time visibility into network activity. Unlike traditional pull-based methods, telemetry streams data proactively, enabling faster detection and response to network events.
Why the other options are wrong
- A. SNMP is a pull-based protocol for retrieving device metrics, not a push-based streaming solution.
- B. SMTP is an email protocol unrelated to network monitoring or telemetry.
- C. Syslog is a log collection mechanism, not a streaming telemetry solution providing real-time operational data.
Question 108
An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?
Show answer and explanation
Correct answer: D. NetFlow
NetFlow provides application and traffic visibility data independently without requiring metadata to be sent to Cisco Firepower. It allows local analysis of network applications and traffic patterns on the network device itself.
Why the other options are wrong
- A. Network Discovery is a Firepower feature that sends metadata to Firepower for analysis.
- B. Access Control manages traffic policies but does not discover applications.
- C. Packet Tracer is a diagnostic tool, not an application discovery mechanism.
Question 109
Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?
Show answer and explanation
Correct answer: D. Cisco ISE
Cisco ISE includes posture assessment capabilities that check endpoint compliance with organizational security requirements, including verifying that machines have recommended antivirus definitions and current patches installed. ISE can deny network access to non-compliant devices or restrict their access to remediation resources, helping prevent malware outbreaks.
Why the other options are wrong
- A. Cisco Prime Infrastructure is focused on network device management and monitoring, not endpoint posture assessment.
- B. Cisco ESA (Email Security Appliance) is designed for email security, not endpoint antivirus and patch verification.
- C. Cisco WiSM (Wireless Services Module) manages wireless networks, not endpoint security posture.
Question 110
Which technology limits communication between nodes on the same network segment to individual applications?
Show answer and explanation
Correct answer: B. microsegmentation
Microsegmentation is the technology that limits communication between nodes on the same network segment by enforcing policies at the application level. It restricts which individual applications can communicate with each other, even if they reside on the same physical network segment, creating isolated security zones around each application or service.
Why the other options are wrong
- A. Serverless infrastructure is a deployment model unrelated to limiting inter-node communication within network segments.
- C. SaaS deployment describes software delivery models, not a technology for restricting application-level communication.
- D. Machine-to-machine firewalling is not a standard security technology term and does not specifically describe network segment communication controls.
Question 111
How does Cisco Umbrella archive logs to an enterprise-owned storage?
Show answer and explanation
Correct answer: D. by being configured to send logs to a self-managed AWS S3 bucket
Cisco Umbrella supports archiving logs to self-managed AWS S3 buckets, allowing enterprises to maintain their logs in their own storage infrastructure with full control and compliance capabilities.
Why the other options are wrong
- A. While APIs can be used for certain operations, the standard log archival method is not through API log fetching.
- B. Syslog is not the primary method Cisco Umbrella uses for archival to enterprise-owned storage.
- C. Manual downloading from the web portal is not a practical archival solution for continuous log retention.
Question 112
An engineer notices traffic interruptions on the network. Upon further investigation, it is learned that broadcast packets have been flooding the network. What must be configured, based on a predefined threshold, to address this issue?
Show answer and explanation
Correct answer: A. Storm Control
Storm Control is a feature configured on network switches that monitors traffic levels and applies a predefined threshold to prevent broadcast, multicast, and unicast flooding. When traffic exceeds the threshold, the switch takes action to suppress the flooding. This directly addresses the issue of broadcast packet flooding interrupting network operations.
Why the other options are wrong
- B. Embedded event monitoring tracks system events but does not prevent broadcast flooding.
- C. Access control lists filter traffic by source/destination but do not address broadcast storm suppression based on traffic thresholds.
- D. Bridge Protocol Data Unit guard prevents spanning tree attacks but does not mitigate general broadcast flooding.
Question 113
A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)
Show answer and explanation
Correct answer: D, E. LDAP communication must be permitted between the ISE server and the domain controller; Active Directory supports user and machine authentication by using MSCHAPv2.
When configuring ISE for external authentication against Active Directory, LDAP communication (D) must be permitted between ISE and the domain controller for directory queries, and Active Directory supports both user and machine authentication using MSCHAPv2 (E) protocol.
Why the other options are wrong
- A. RADIUS communication is typically used between network devices and ISE, not between ISE and Active Directory itself.
- B. The ISE account does not need to be a domain administrator; a standard service account with appropriate LDAP query permissions is sufficient.
- C. Active Directory supports authentication methods beyond MSCHAPv2, and both user and machine authentication are supported (making this incomplete).
Question 114
What is the term for having information about threats and threat actors that helps mitigate harmful events that would otherwise compromise networks or systems?
Show answer and explanation
Correct answer: A. threat intelligence
Threat intelligence is defined as information about threats and threat actors that helps organizations mitigate harmful events and protect their networks and systems. This information enables proactive defense and informed security decisions.
Why the other options are wrong
- B. Indicators of Compromise are artifacts observed on a network or system that suggest a breach, but they are a component of threat intelligence, not the overarching concept.
- C. Trusted Automated Exchange of Intelligence Information (TAXII) is a protocol for sharing threat intelligence, not the term for threat intelligence itself.
- D. The Exploit Database is a repository of known exploits, not a general term for threat intelligence.
Question 115
An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?
Show answer and explanation
Correct answer: B. Cisco Tetration
Cisco Tetration is purpose-built for micro-segmentation and provides application-level visibility, dependency mapping, compliance enforcement, and policy recommendations. It discovers applications running on the network and enables organizations to maintain and enforce compliance policies across micro-segments.
Why the other options are wrong
- A. Cisco Stealthwatch provides network visibility and threat detection but is not optimized for micro-segmentation.
- C. Cisco AMP focuses on endpoint malware protection, not application-level visibility for micro-segmentation.
- D. Cisco Umbrella is a DNS-based cloud security service for threat protection, not for micro-segmentation.
Question 116
Which VPN technology can support a multivendor environment and secure traffic between sites?
Show answer and explanation
Correct answer: C. FlexVPN
FlexVPN is a standards-based VPN technology that supports multivendor environments and can securely interconnect multiple sites. It is built on standard protocols like IPsec and IKEv2, making it interoperable across different vendor equipment while maintaining site-to-site secure connectivity.
Why the other options are wrong
- A. SSL VPN is primarily designed for remote user access, not site-to-site multivendor connectivity.
- B. GET VPN is a Cisco proprietary technology and does not support multivendor environments.
- D. DMVPN is primarily a Cisco technology and requires hub-and-spoke architecture; it is not ideal for true multivendor environments.
Question 117
An engineer needs behavioral analysis to detect malicious activity on the hosts, and is configuring the organization's public cloud to send telemetry using the cloud provider's mechanisms to a security device. Which mechanism should the engineer configure to accomplish this goal?
Show answer and explanation
Correct answer: D. VPC flow logs
VPC Flow Logs is the cloud provider's native mechanism for capturing network flow telemetry in public cloud environments. VPC Flow Logs record information about IP traffic going to and from network interfaces in a VPC, providing behavioral and traffic analysis data that can be sent to security devices for malicious activity detection.
Why the other options are wrong
- A. sFlow is a technology for monitoring physical network infrastructure, not cloud-native VPC monitoring.
- B. NetFlow is used in traditional network environments, not as the cloud provider's primary telemetry mechanism.
- C. Mirror ports are a physical or virtual switch feature but are not the cloud provider's designated mechanism for sending telemetry to security devices.
Question 118
What is a benefit of performing device compliance?
Show answer and explanation
Correct answer: B. verification of the latest OS patches
Device compliance checking verifies that devices meet security requirements, including having the latest operating system patches installed. This is a core benefit of compliance as it ensures systems are protected against known vulnerabilities through current patching levels.
Why the other options are wrong
- A. Multi-factor authentication is an authentication mechanism, not a primary benefit of device compliance verification.
- C. Attribute-driven policies are part of policy implementation, but not what device compliance itself directly provides.
- D. While device classification may occur during compliance, authorization decisions are a separate process from compliance verification.
Question 119
How does a cloud access security broker function?
Show answer and explanation
Correct answer: C. It integrates with other cloud solutions via APIs and monitors and creates incidents based on events from the cloud solution.
A Cloud Access Security Broker (CASB) integrates with cloud applications via APIs, monitors user activity and data movement, and generates security incidents based on detected suspicious events. It acts as an enforcement point between users and cloud services to monitor behavior and enforce policies.
Why the other options are wrong
- A. Authentication and single sign-on are identity management functions, not the primary role of a CASB.
- B. Vulnerability scanning is a separate security function; CASBs focus on behavioral monitoring and policy enforcement, not network scanning.
- D. A CASB is distinct from SIEM solutions; while it may generate events, it doesn't function as a SIEM receiving syslog.
Question 120
Which compliance status is shown when a configured posture policy requirement is not met?
Show answer and explanation
Correct answer: D. noncompliant
When a device fails to meet a configured posture policy requirement in Network Access Control, its compliance status is marked as noncompliant. This status indicates the device does not satisfy the security requirements and may face access restrictions.
Why the other options are wrong
- A. Authorized refers to authentication status, not compliance with posture policies.
- B. Compliant status indicates the device meets all posture policy requirements, the opposite of the scenario.
- C. Unknown status suggests no assessment data is available, not that a policy requirement was not met.
Question 121
An organization configures Cisco Umbrella to be used for its DNS services. The organization must be able to block traffic based on the subnet that the endpoint is on, but sees only the requests from its public IP addresses instead of each internal IP address. What must be done to resolve this issue?
Show answer and explanation
Correct answer: D. Set up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address.
A Cisco Umbrella virtual appliance deployed internally intercepts DNS requests at the source, allowing the system to see individual internal IP addresses instead of only the organization's public IP address. This enables subnet-based traffic blocking and per-client visibility in the Umbrella dashboard.
Why the other options are wrong
- A. Microsoft Active Directory Connector provides identity information but does not resolve the issue of seeing only public IP addresses instead of internal IPs.
- B. Tenant control features do not provide per-internal-IP visibility; they manage organizational unit segmentation.
- C. Internal domain configuration does not address the fundamental issue of DNS requests appearing from the public IP rather than individual client IPs.
Question 122
Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?
Show answer and explanation
Correct answer: C. interpacket variation
Interpacket variation captures the variations within a flow by examining metrics such as packet TTL (Time to Live), IP/TCP flags, and payload length. These variations provide detailed behavioral insights into individual packets within a flow, helping identify anomalies and patterns in network behavior.
Why the other options are wrong
- A. Flow insight variation is not a standard telemetry metric term.
- B. Software package variation refers to differences in installed software, not packet-level metrics.
- D. Process details variation focuses on process behavior, not packet-level characteristics within flows.
Question 123
Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?
Show answer and explanation
Correct answer: C. Active Directory
Active Directory requires that a shadow user be created on Cisco ISE for admin login to function properly. A shadow user is a local ISE account that mirrors an Active Directory user account, allowing authentication to occur even if Active Directory is temporarily unavailable. This is a specific requirement for AD integration in ISE.
Why the other options are wrong
- A. RSA SecureID does not require shadow user creation; it uses token-based authentication.
- B. Internal Database stores credentials directly in ISE without requiring shadow users.
- D. LDAP does not require shadow user creation for standard authentication.
Question 124
While using Cisco Firepower's Security Intelligence policies, which two criteria is blocking based upon? (Choose two.)
Show answer and explanation
Correct answer: A, B. IP addresses; URLs
Cisco Firepower's Security Intelligence policies block traffic based on IP addresses and URLs. IP addresses are used to block known malicious or suspicious hosts, and URLs are used to block access to known malicious or unwanted websites and domains.
Why the other options are wrong
- C. Port numbers are not a criteria for Security Intelligence blocking; port-based rules are configured elsewhere in access control policies.
- D. Protocol IDs are not used as blocking criteria in Security Intelligence policies.
- E. MAC addresses are Layer 2 identifiers and are not used by Security Intelligence blocking policies, which operate at higher layers.
Question 125
What is the benefit of integrating Cisco ISE with a MDM solution?
Show answer and explanation
Correct answer: A. It provides compliance checks for access to the network.
The primary benefit of integrating Cisco ISE with Mobile Device Management (MDM) solutions is to perform compliance checks on mobile devices before granting them network access. This ensures that only compliant devices meeting organizational security policies can connect to the network.
Why the other options are wrong
- B. MDM handles application updates directly; ISE integration does not provide this capability through ISE itself.
- C. Application provisioning is an MDM function, not something ISE provides through integration.
- D. Network device administration access is unrelated to MDM integration with ISE.
Question 126
Which security solution protects users leveraging DNS-layer security?
Show answer and explanation
Correct answer: B. Cisco Umbrella
Cisco Umbrella is specifically designed to provide DNS-layer security by filtering and categorizing traffic at the DNS level before connections are established. It intercepts DNS queries and blocks malicious, unwanted, or risky domains before users can connect to them.
Why the other options are wrong
- A. Cisco ISE provides identity and access management but does not operate at the DNS layer.
- C. Cisco ASA is a firewall/VPN appliance that operates at network and transport layers, not DNS.
- D. Cisco FTD provides firewall and threat defense but is not primarily a DNS-layer security solution.
Question 127
An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively used by devices, using many of the default policy elements. What else must be done to accomplish this task?
Show answer and explanation
Correct answer: A. Create a destination list for addresses to be allowed or blocked
To block specific addresses in Cisco Umbrella, an engineer must create a destination list that contains the addresses to be blocked or allowed. This destination list is then referenced within the policy rules to enforce the blocking action. This is the standard method for managing specific address blocking in Umbrella policies.
Why the other options are wrong
- B. Content categories are used for blocking types of content and categories of websites, not specific individual addresses.
- C. The identities list in Umbrella manages users and devices, not destination addresses for blocking.
- D. Application settings control which applications are allowed or blocked, not specific network addresses or destinations.
Question 128
An administrator is adding a new switch onto the network and has configured AAA for network access control. When testing the configuration, the RADIUS authenticates to Cisco ISE but is being rejected. Why is the ip radius source-interface command needed for this configuration?
Show answer and explanation
Correct answer: A. Only requests that originate from a configured NAS IP are accepted by a RADIUS server.
The ip radius source-interface command is needed because RADIUS servers are configured to accept authentication requests only from specific NAS (Network Access Server) IP addresses. When a switch initiates RADIUS requests without a defined source interface, the requests may originate from different IP addresses (such as management IPs or loopback addresses), causing the RADIUS server to reject them as coming from an unauthorized source. By specifying a source interface, all RADIUS requests originate from a consistent, pre-configured IP address that matches the NAS IP registered with the RADIUS server.
Why the other options are wrong
- B. The RADIUS authentication key is transmitted in the authentication packet regardless of source interface configuration; the source interface doesn't control key transmission.
- C. RADIUS requests are generated by routers whether or not a source interface is defined; the source interface only determines which IP address appears in the request.
- D. RADIUS encryption (such as RADIUS-over-TLS) is independent of source interface configuration; encrypted authentication doesn't require this command.
Question 129
What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?
Show answer and explanation
Correct answer: A. Multiple NetFlow collectors are supported.
Cisco NetFlow Secure Event Logging for ASAs supports multiple NetFlow collectors, allowing administrators to send flow data to multiple destinations for redundancy, load balancing, and diverse analysis. This is a key feature that provides flexibility in log collection architecture.
Why the other options are wrong
- B. While NetFlow v9 and v5 formats may be supported, this is not a distinctive feature of secure event logging specifically.
- C. Secure NetFlow connectors are not specifically optimized for Cisco Prime Infrastructure in the context of ASA logging.
- D. Flow-create events are not delayed; the purpose of NetFlow is real-time or near real-time flow visibility.
Question 130
Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?
Show answer and explanation
Correct answer: D. network discovery
Network discovery policy is the feature used on Cisco Firepower NGIPS to capture and collect host information. This policy enables the system to identify active hosts, determine their operating systems, discover running applications and services, and build an inventory of network assets that feeds into the overall security posture and risk assessment.
Why the other options are wrong
- A. Correlation policy is used for event analysis and response, not for capturing host information.
- B. Intrusion policy focuses on detecting and preventing intrusion attempts and suspicious traffic patterns, not host discovery.
- C. Access control policy manages traffic flow and enforcement rules, not host information collection.
Question 131
An organization has two machines hosting web applications. Machine 1 is vulnerable to SQL injection while machine 2 is vulnerable to buffer overflows. What action would allow the attacker to gain access to machine 1 but not machine 2?
Show answer and explanation
Correct answer: D. inserting malicious commands into the database
Inserting malicious commands into the database exploits SQL injection vulnerabilities, which directly targets Machine 1's weakness. This attack method would not affect Machine 2, which is vulnerable to buffer overflows rather than SQL injection, as buffer overflow exploits target memory management rather than database input validation.
Why the other options are wrong
- A. Packet sniffing captures network traffic but does not exploit either SQL injection or buffer overflow vulnerabilities.
- B. Continuous pings test connectivity and may cause denial of service but do not exploit SQL injection or buffer overflow vulnerabilities.
- C. Overflowing the buffer's memory exploits Machine 2's vulnerability, not Machine 1's SQL injection weakness.
Question 132
What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?
Show answer and explanation
Correct answer: D. Enable Intelligent Proxy.
Enabling Intelligent Proxy is a required prerequisite to enable malware file scanning for the Secure Internet Gateway. Intelligent Proxy provides the necessary capability to intercept, inspect, and scan files for malware threats. While AMP licensing provides the malware detection engine and SSL decryption allows inspection of encrypted traffic, the Intelligent Proxy functionality is the specific prerequisite that enables the malware file scanning feature. IP Layer enforcement is unrelated to malware scanning.
Why the other options are wrong
- A. IP Layer enforcement is not related to malware file scanning.
- B. While AMP licensing is needed for malware detection, Intelligent Proxy is the prerequisite.
- C. SSL decryption is helpful for scanning encrypted content but is not the required prerequisite.
Question 133
An organization wants to secure data in a cloud environment. Its security model requires that all users be authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and data. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these requirements?
Show answer and explanation
Correct answer: D. microsegmentation
Microsegmentation is the technology that implements zero trust principles by continuously validating authentication, authorization, and security posture before granting access, and enforcing allow-specific/deny-all-other policies. It creates isolated network segments and restricts traffic to only authorized communications.
Why the other options are wrong
- A. VRF (Virtual Routing and Forwarding) is a network routing technique, not a security posture validation mechanism.
- B. Access control policies are a component of security but don't inherently provide the continuous validation and posture checking described.
- C. VLANs are network segmentation at layer 2, not the granular application-aware microsegmentation required for the described zero trust model.
Question 134
Which protocol provides the strongest throughput performance when using Cisco AnyConnect VPN?
Show answer and explanation
Correct answer: A. DTLSv1
DTLS (Datagram TLS) provides superior throughput performance compared to TLS variants when using Cisco AnyConnect VPN. DTLS operates over UDP, which has lower overhead than TCP used by TLS, resulting in better throughput performance for VPN connections.
Why the other options are wrong
- B. TLSv1 operates over TCP, which has higher overhead than DTLS and lower throughput performance.
- C. TLSv1.1 operates over TCP with higher overhead than DTLS, providing lower throughput performance.
- D. TLSv1.2, while more secure, still operates over TCP and provides lower throughput than DTLS.
Question 135
Due to a traffic storm on the network, two interfaces were error-disabled, and both interfaces sent SNMP traps. Which two actions must be taken to ensure that interfaces are put back into service? (Choose two.)
Show answer and explanation
Correct answer: C, E. Ensure that interfaces are configured with the error-disable detection and recovery feature; Enter the shutdown and no shutdown commands on the interfaces.
To restore error-disabled interfaces to service, two actions are required: First, configure the error-disable detection and recovery feature on the switch (option C) which automatically re-enables ports after a timeout period. Second, manually perform a shutdown and no shutdown cycle on the affected interfaces (option E) to immediately bring them back online. Option C provides the automatic recovery mechanism, while option E provides immediate recovery.
Why the other options are wrong
- A. The 'snmp-server enable traps' command enables SNMP trap transmission but does not restore error-disabled interfaces.
- B. While EEM could automate recovery, it is not a required action; the error-disable recovery feature is the standard solution.
- D. Cisco Prime Infrastructure sending SNMP set commands is not the standard method for recovering error-disabled ports.
Question 136
Which two endpoint measures are used to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two.)
Show answer and explanation
Correct answer: D, E. Install a spam and virus email filter; Protect systems with an up-to-date antimalware program.
Installing a spam and virus email filter blocks phishing emails before they reach users, and an up-to-date antimalware program protects endpoints from malware delivered via phishing attacks. These are the two primary endpoint measures that directly mitigate phishing and social engineering risks.
Why the other options are wrong
- A. Cross-site scripting patches protect web applications, not against phishing attacks.
- B. Cloud backups help with recovery but don't prevent phishing attacks.
- C. Input validation protects against injection attacks, not phishing and social engineering.
Question 137
An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is required to complete the flow record?
Show answer and explanation
Correct answer: C. match ipv4 ttl
When configuring a NetFlow flow record, the 'match ipv4 ttl' command specifies which fields from the IP packet header should be collected and exported in the flow data. This command is required to complete a functional flow record definition by identifying what packet attributes to include in the exported NetFlow data sent to the collector (Stealthwatch).
Why the other options are wrong
- A. The 'cache timeout active' command configures cache behavior but is not the required command to complete a flow record definition.
- B. The destination is configured in the flow exporter, not within the flow record itself.
- D. Transport and port are configured in the flow exporter configuration, not as part of the flow record command.
Question 138
Why is it important to have logical security controls on endpoints even though the users are trained to spot security threats and the network devices already help prevent them?
Show answer and explanation
Correct answer: B. because human error or insider threats will still exist
Logical security controls on endpoints are critical because human error and insider threats remain constant risks regardless of user training or network defenses. Even well-trained users can make mistakes, and malicious insiders can bypass controls. Defense-in-depth requires multiple security layers including endpoint controls to address these residual risks that training and network devices alone cannot eliminate.
Why the other options are wrong
- A. Defense-in-depth does not stop at the network; it extends to endpoints and is why endpoint controls are necessary.
- C. Physical theft prevention is a separate concern unrelated to logical security controls.
- D. Logical security controls reduce threats on endpoints; they do not expose endpoints to more threats.
Question 139
An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak control method is used to accomplish this task?
Show answer and explanation
Correct answer: C. application blocking list
The application blocking list is the outbreak control method in Cisco AMP for Endpoints that allows administrators to block specific files from executing. This list prevents designated applications or file hashes from running on protected endpoints, providing immediate protection against known malicious files.
Why the other options are wrong
- A. Device flow correlation analyzes network traffic patterns, not file execution blocking.
- B. Simple detections use basic signatures, not the specific blocking mechanism for executable files.
- D. Advanced custom detections create behavioral rules but are not the primary method for blocking specific files from executing.
Question 140
An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10. What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?
Show answer and explanation
Correct answer: A. Cisco Identity Services Engine and AnyConnect Posture module
Cisco Identity Services Engine combined with the AnyConnect Posture module is the correct solution for checking endpoint compliance before allowing network access. The Posture module evaluates whether endpoints meet requirements such as antivirus installation and OS version before granting access to the corporate network.
Why the other options are wrong
- B. Stealthwatch is for monitoring and analytics, not for enforcing pre-access compliance checks.
- C. ASA with Dynamic Access Policies manages traffic after access is granted, not pre-access compliance validation.
- D. PxGrid enables context sharing between ISE and other systems but does not perform posture checking itself.
Question 141
In an IaaS cloud services model, which security function is the provider responsible for managing?
Show answer and explanation
Correct answer: C. hypervisor OS hardening
In an IaaS model, the provider is responsible for the underlying infrastructure including the hypervisor and its OS hardening. The provider manages the hypervisor layer security, as customers do not have direct access to or control over this foundational infrastructure component.
Why the other options are wrong
- A. Firewalling virtual machines is the customer's responsibility in IaaS; they manage their VM security.
- B. Internet proxy configuration is a customer-level service, not a provider responsibility in IaaS.
- D. CASB is a cloud security service, not part of the IaaS provider's core managed responsibilities.
Question 142
What are two list types within Cisco AMP for Endpoints Outbreak Control? (Choose two.)
Show answer and explanation
Correct answer: B, D. simple custom detections; allowed applications
Cisco AMP for Endpoints Outbreak Control includes two main list types: simple custom detections (for creating detection rules) and allowed applications (for whitelisting trusted software). These lists allow administrators to manage what is blocked or allowed during outbreak situations.
Why the other options are wrong
- A. Blocked ports are not a list type in AMP Outbreak Control.
- C. Command and control is a threat category, not a list type within Outbreak Control.
- E. URLs are not a list type in AMP for Endpoints Outbreak Control features.
Question 143
What is managed by Cisco Security Manager?
Show answer and explanation
Correct answer: D. Cisco ASA
Cisco Security Manager is designed to manage Cisco ASA devices, providing centralized management of firewall policies, configurations, and security services. While Cisco Security Manager has been historically used for ASA management, it does not manage WLC, ESA, or WSA devices, which are managed by their respective dedicated management platforms.
Why the other options are wrong
- A. Cisco WLC is managed by its own wireless management interface, not Cisco Security Manager.
- B. Cisco ESA email security appliances are managed through their own management interfaces.
- C. Cisco WSA web security appliances have their own independent management interface.
Question 144
What is a benefit of using Cisco FMC over Cisco ASDM?
Show answer and explanation
Correct answer: B. Cisco FMC provides centralized management while Cisco ASDM does not.
Cisco Firepower Management Center (FMC) provides centralized management of multiple Firepower and ASA devices from a single console, whereas Cisco ASDM is a device-level management tool that connects to individual ASA appliances. This centralized approach is a significant benefit when managing multiple devices.
Why the other options are wrong
- A. Technology choices (Java vs HTML5) do not represent a functional benefit; this is implementation detail.
- C. Both FMC and ASDM support pushing configurations to their respective managed devices.
- D. While FMC supports broader product coverage, ASDM is specifically designed for ASA devices and performs well in that scope.
Question 145
Which attack is commonly associated with C and C++ programming languages?
Show answer and explanation
Correct answer: D. buffer overflow
Buffer overflow attacks are the attack type most commonly associated with C and C++ programming languages. These languages lack built-in bounds checking on memory operations, allowing attackers to write data beyond allocated buffer boundaries, overwriting adjacent memory and potentially executing arbitrary code. This vulnerability is fundamental to the memory management model of C and C++.
Why the other options are wrong
- A. Cross-site scripting (XSS) is a web application vulnerability, primarily affecting JavaScript and interpreted web languages.
- B. Water holing attacks target websites frequented by specific user groups; they are not language-specific.
- C. DDoS attacks are network-based attacks independent of programming language.
Question 146
How does Cisco Workload Optimization Manager help mitigate application performance issues?
Show answer and explanation
Correct answer: A. It automates resource resizing.
Cisco Workload Optimization Manager (WOM) is designed to automatically resize and optimize computing resources based on workload demands and performance metrics. This automation directly mitigates application performance issues by ensuring resources are appropriately allocated to match application needs, reducing bottlenecks and improving responsiveness.
Why the other options are wrong
- B. Workload forensic scoring is a monitoring metric, not a mitigation mechanism for performance issues.
- C. Flow path optimization is not a primary function of WOM; it focuses on resource allocation.
- D. WOM does not deploy AWS Lambda systems; it manages resources across existing infrastructure.
Question 147
What are two ways that Cisco Container Platform provides value to customers who utilize cloud service providers? (Choose two.)
Show answer and explanation
Correct answer: A, D. Allows developers to create code once and deploy to multiple clouds; manages Kubernetes clusters
Cisco Container Platform allows developers to create code once and deploy it to multiple cloud providers (A), and it manages Kubernetes clusters (D). These two capabilities provide flexibility and portability across cloud environments while simplifying container orchestration management.
Why the other options are wrong
- B. The platform does not manage source code; it manages container deployment and orchestration.
- C. While it works with Docker containers, managing Docker specifically is not a primary differentiator for cloud service provider value.
- E. Creating complex tasks would be a disadvantage, not a value proposition.
Question 148
Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?
Show answer and explanation
Correct answer: A. DNS tunneling
DNS tunneling is the exfiltration method where an attacker encodes and hides data inside DNS requests and queries. The attacker embeds exfiltrated data within DNS protocol queries sent to a DNS server they control, allowing data to be extracted through the normal DNS protocol which typically flows through firewalls and security controls that may not inspect DNS traffic thoroughly.
Why the other options are wrong
- B. DNSCrypt is a protocol that encrypts DNS communications for privacy, not an exfiltration method.
- C. DNS security refers to security measures protecting DNS infrastructure, not an exfiltration technique.
- D. DNSSEC is a security extension to DNS that provides authentication and integrity verification, not an exfiltration method.
Question 149
A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?
Show answer and explanation
Correct answer: D. RADIUS Live Logs
RADIUS Live Logs in Cisco ISE provide real-time visibility into authentication transactions, allowing administrators to see the detailed authentication flow, failure reasons, and protocol exchanges between the endpoint, switch, and ISE. This is the primary tool for troubleshooting 802.1X authentication failures.
Why the other options are wrong
- A. Context Visibility shows endpoint profile and classification data, not detailed authentication transaction logs.
- B. Accounting Reports track session usage and disconnects but do not provide real-time authentication troubleshooting details.
- C. Adaptive Network Control Policy List is used to view and manage policies, not to troubleshoot individual authentication failures.
Question 150
An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA. Which Cisco ASA command must be used?
Show answer and explanation
Correct answer: C. flow-export destination inside 1.1.1.1 2055
The correct command to configure NetFlow export on a Cisco ASA is 'flow-export destination', which specifies the collector address and port where NetFlow records will be sent. This is the ASA-specific syntax for exporting NetFlow data to a collection server.
Why the other options are wrong
- A. Flow exporter is used in modern IOS configurations but not the standard ASA NetFlow command syntax.
- B. This is IOS router syntax for NetFlow v5 export, not applicable to ASA configuration.
- D. Flow monitor input is used in IOS for applying NetFlow to interfaces, not for NetFlow generation on ASA.
Question 151
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
Show answer and explanation
Correct answer: C. Telemetry uses a push method, which makes it faster than SNMP.
Telemetry uses a push method where devices continuously stream data to collectors without polling, whereas SNMP uses a pull method requiring periodic queries. This push-based approach eliminates polling overhead and reduces latency, making telemetry faster for real-time monitoring.
Why the other options are wrong
- A. While telemetry can use both push and pull, security is not the primary advantage over SNMP.
- B. Scalability benefits come from reduced overhead, but the core advantage stated is speed.
- D. SNMP uses pull, and telemetry using push is actually faster, not more reliable through pull.
Question 152
Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?
Show answer and explanation
Correct answer: D. It verifies that the endpoint has the latest Microsoft security patches installed
When an endpoint is compliant with ISE posture policies, it verifies that the device meets security requirements, including having the latest Microsoft security patches installed. The posture policy checks and enforces that endpoints maintain current patch levels, ensuring they meet baseline security standards before allowing network access.
Why the other options are wrong
- A. Dynamic identity group assignment is based on profiling data, not posture compliance verification.
- B. Authentication methods like 802.1x or MAB occur before posture assessment, independent of compliance.
- C. CoA can be applied based on compliance status, but the benefit of compliance itself is the verification of security requirements, not the ability to apply CoA.
Question 153
Which two features of Cisco DNA Center are used in a Software Defined Network solution? (Choose two.)
Show answer and explanation
Correct answer: B, C. assurance; automation
Cisco DNA Center provides assurance (monitoring and analytics of network health and performance) and automation (automating network provisioning, configuration, and policy deployment) as core features of its Software Defined Network solution. These two capabilities enable centralized management and intelligent network operations.
Why the other options are wrong
- A. Accounting is not a primary feature of DNA Center; this is more relevant to AAA services.
- D. Authentication is handled by supporting systems like ISE, not as a DNA Center feature itself.
- E. Encryption is not a distinguishing feature or primary function of DNA Center.
Question 154
An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE. Which CoA type achieves this goal?
Show answer and explanation
Correct answer: C. CoA Reauth
CoA Reauth (Change of Authorization - Re-authentication) forces an endpoint to re-authenticate its existing session without disrupting the connection. This allows ISE to apply new or updated policies by having the endpoint go through authentication again, ensuring compliance with the latest policy requirements while maintaining session continuity.
Why the other options are wrong
- A. Port Bounce disconnects and reconnects the port, which disrupts the endpoint connection.
- B. CoA Terminate ends the session entirely, which is disruptive and not the goal.
- D. CoA Session Query retrieves session information but does not force re-authentication.
Question 155
How many interfaces per bridge group does an ASA bridge group deployment support?
Show answer and explanation
Correct answer: C. up to 4
An ASA bridge group deployment supports up to 4 interfaces per bridge group. This is a fixed architectural limitation in Cisco ASA devices for bridge group configurations, allowing administrators to aggregate multiple interfaces within a single bridge group for transparent firewall deployments.
Why the other options are wrong
- A. 16 interfaces exceeds the actual limit of 4 per bridge group.
- B. 2 interfaces is below the maximum capacity of bridge groups.
- D. 8 interfaces exceeds the architectural maximum of 4 per bridge group.
Question 156
What are two advantages of using Cisco AnyConnect over DMVPN? (Choose two.)
Show answer and explanation
Correct answer: B, E. It enables VPN access for individual users from their machines; It allows customization of access policies based on user identity.
Cisco AnyConnect is a client-based remote access VPN solution that enables individual users to securely connect from their machines (B), providing granular access control based on user identity and device posture policies (E). DMVPN, by contrast, is a site-to-site VPN technology designed for connecting multiple branch offices to a central data center, not for individual user remote access. AnyConnect's user-centric approach allows customization of access policies based on user identity, which is a significant advantage over the network-centric DMVPN architecture.
Why the other options are wrong
- A. Spoke-to-spoke communication is a DMVPN advantage, not an AnyConnect advantage; AnyConnect focuses on client-to-gateway connectivity.
- C. Connecting multiple sites to the data center is a DMVPN advantage, not specific to AnyConnect.
- D. Both AnyConnect and DMVPN operate at the network layer; this is not a distinguishing advantage of AnyConnect over DMVPN.
Question 157
What are two reasons for implementing a multifactor authentication solution such as Cisco Duo Security provide to an organization? (Choose two.)
Show answer and explanation
Correct answer: C, E. secure access to on-premises and cloud applications; flexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications
Cisco Duo Security provides secure access to both on-premises and cloud applications through multifactor authentication, significantly reducing the risk of unauthorized access. Additionally, Duo Security offers flexibility in 2FA methods including phone callbacks, SMS passcodes, and push notifications, allowing organizations to accommodate diverse user preferences and device capabilities while maintaining security.
Why the other options are wrong
- A. Single sign-on is primarily an identity management feature, not a core benefit of multifactor authentication solutions.
- B. Application vulnerability identification and correction is a SAST/DAST function, not a multifactor authentication benefit.
- D. Integration with 802.1x using native Windows supplicant is a network authentication feature unrelated to Duo Security's multifactor authentication capabilities.
Question 158
Which two capabilities does TAXII support? (Choose two.)
Show answer and explanation
Correct answer: A, B. exchange; pull messaging
TAXII (Trusted Automated Exchange of Indicator Information) is a protocol designed to standardize the sharing of cyber threat intelligence. It supports two primary capabilities: exchange, which refers to the overall sharing of threat information between parties, and pull messaging, which allows clients to request and retrieve threat intelligence data from servers. These are the core operational modes of TAXII communication.
Why the other options are wrong
- C. Binding is not a TAXII capability; it relates to web services and SOAP protocols.
- D. Correlation is a data analysis function, not a TAXII protocol capability.
- E. Mitigating refers to threat response actions, not a TAXII protocol capability.
Question 159
Which component of Cisco Umbrella architecture increases reliability of the service?
Show answer and explanation
Correct answer: B. anycast IP
Cisco Umbrella uses anycast IP addressing as a core architectural component to increase service reliability. Anycast allows multiple data centers to advertise the same IP address, automatically directing client requests to the geographically closest or best-performing server. This redundancy and distribution ensures high availability and fault tolerance.
Why the other options are wrong
- A. BGP route reflector is a routing protocol component not specific to Umbrella's architecture.
- C. AMP Threat Grid is a threat analysis and intelligence component, not a reliability mechanism.
- D. Cisco Talos is a threat intelligence source, not an architectural component for reliability.
Question 160
An engineer has been tasked with implementing a solution that can be leveraged for securing the cloud users, data, and applications. There is a requirement to use the Cisco cloud-native CASB and cloud cybersecurity platform. What should be used to meet these requirements?
Show answer and explanation
Correct answer: B. Cisco Cloudlock
Cisco Cloudlock is the cloud-native CASB (Cloud Access Security Broker) solution that secures cloud users, data, and applications. It provides comprehensive cloud security through API-based integration with cloud services and is specifically designed for cloud-native environments.
Why the other options are wrong
- A. Cisco NGFW is a network firewall, not a cloud-native CASB solution.
- C. Cisco Cloud Email Security is focused on email protection, not comprehensive cloud data and application security.
- D. Cisco Umbrella is a DNS-layer security solution for threat prevention, not a cloud-native CASB.
Question 161
How does Cisco Advanced Phishing Protection protect users?
Show answer and explanation
Correct answer: B. It uses machine learning and real-time behavior analytics.
Cisco Advanced Phishing Protection leverages machine learning algorithms and real-time behavior analytics to detect and prevent phishing attacks. This approach analyzes email patterns, user behavior, and content characteristics to identify suspicious phishing attempts before they reach users, making it more effective than static rule-based methods.
Why the other options are wrong
- A. While sensors are part of security infrastructure, Cisco APP's primary protection mechanism is not about secure message transmission but threat detection.
- C. DKIM is an email authentication protocol for validating sender identity, but it is not the primary mechanism used by Cisco Advanced Phishing Protection.
- D. Determining perceived identities is not the core function of Cisco APP; the focus is on detecting phishing behavior and malicious emails.
Question 162
What is a commonality between DMVPN and FlexVPN technologies?
Show answer and explanation
Correct answer: C. IOS routers run the same NHRP code for DMVPN and FlexVPN
Both DMVPN and FlexVPN use NHRP (Next Hop Resolution Protocol) for hub-and-spoke communication and dynamic spoke discovery. The NHRP code implementation in IOS routers is shared between these two VPN technologies, making this a key commonality between them.
Why the other options are wrong
- A. While both can use IKEv2, DMVPN traditionally uses IKEv1 and does not require IKEv2 as a commonality.
- B. DMVPN and FlexVPN do not use IS-IS routing protocol; they use standard IP routing and NHRP for discovery.
- D. Both technologies can support various hashing algorithms, but they do not exclusively use the same ones as a defining commonality.
Question 163
What must be configured in Cisco ISE to enforce reauthentication of an endpoint session when an endpoint is deleted from an identity group?
Show answer and explanation
Correct answer: B. CoA
Change of Authorization (CoA) is the mechanism used in Cisco ISE to enforce reauthentication of endpoint sessions. When an endpoint is deleted from an identity group, a CoA message is sent to the network access device to terminate the current session and force the endpoint to reauthenticate, allowing ISE to apply updated policies based on the group change.
Why the other options are wrong
- A. SNMP probes gather device attributes but do not enforce reauthentication actions.
- C. External identity sources authenticate users but do not trigger session termination.
- D. Posture assessment evaluates device compliance but is not used to enforce reauthentication based on group membership changes.
Question 164
An administrator configures new authorization policies within Cisco ISE and has difficulty profiling the devices. Attributes for the new Cisco IP phones that are profiled based on the RADIUS authentication are seen; however, the attributes for CDP or DHCP are not. What should the administrator do to address this issue?
Show answer and explanation
Correct answer: D. Configure the device sensor feature within the switch to send the appropriate protocol information.
The device sensor feature on the switch enables collection and transmission of protocol-specific information including CDP, DHCP, and other device discovery protocols to Cisco ISE. Without device sensor configured, ISE cannot receive CDP and DHCP discovery information needed for proper device profiling, which explains why only RADIUS authentication attributes are visible.
Why the other options are wrong
- A. Service templates standardize port configurations but do not enable protocol information collection.
- B. DHCP snooping trust commands control DHCP message handling but do not send profiling data to ISE.
- C. Authentication port-control auto is for 802.1X port state management, not for collecting discovery protocol data.
Question 165
In which cloud services model is the tenant responsible for virtual machine OS patching?
Show answer and explanation
Correct answer: A. IaaS
In Infrastructure as a Service (IaaS), the provider manages the underlying infrastructure including hypervisors and hardware, but the tenant is responsible for managing virtual machines, operating systems, patches, and applications deployed on those VMs.
Why the other options are wrong
- B. UCaaS (Unified Communications as a Service) is a specific application delivery model where the provider manages most patching responsibilities.
- C. In PaaS, the provider manages the OS and runtime environments; tenants only manage applications and data.
- D. In SaaS, the provider manages all infrastructure, OS, and application patching; the tenant only manages user access and data.
Question 166
Which API is used for Content Security?
Show answer and explanation
Correct answer: D. AsyncOS API
The AsyncOS API is used for Content Security in Cisco security appliances. AsyncOS is Cisco's operating system for email and web security appliances, and its API provides programmatic access to security functions including content security policies.
Why the other options are wrong
- A. NX-OS API is for Cisco Nexus switches and network devices, not content security.
- B. IOS XR API is for Cisco router platforms, not email or web content security.
- C. OpenVuln API is used for vulnerability information, not content security configuration.
Question 167
Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?
Show answer and explanation
Correct answer: D. platform settings policy
Platform settings policy represents a shared set of features or parameters that define the aspects of a managed device likely to be similar across other managed devices in a deployment. This policy type is used for standardizing and centralizing common configuration elements across multiple devices.
Why the other options are wrong
- A. Group policy is used for user or endpoint grouping and policy assignment, not for defining shared device parameters.
- B. Access control policy is focused on traffic and access rules, not shared device configuration features.
- C. Device management policy is broader and covers operational management aspects rather than shared feature definitions.
Question 168
Which information is required when adding a device to Firepower Management Center?
Show answer and explanation
Correct answer: D. registration key
A registration key is required when adding a device to Firepower Management Center. This unique key establishes a secure trust relationship between the managed device and the FMC. While username and password are used for device management after registration, and device serial numbers may be documented, the registration key is the specific requirement for the initial addition process.
Why the other options are wrong
- A. Username and password are used for accessing the device, not for initial FMC registration.
- B. Encryption method is not a requirement for adding a device to FMC.
- C. Device serial number is identifying information but not required for the FMC registration process.
Question 169
What is an advantage of network telemetry over SNMP pulls?
Show answer and explanation
Correct answer: B. scalability
Network telemetry provides superior scalability compared to SNMP pulls because it uses push-based mechanisms rather than pull-based polling. Telemetry can continuously stream data from many devices without the overhead of individual polling requests, allowing monitoring of far greater numbers of devices and data points with less network load.
Why the other options are wrong
- A. Both SNMP and telemetry have security considerations; telemetry does not inherently provide better security.
- C. Accuracy is not a primary advantage of telemetry over SNMP; both can be equally accurate.
- D. Encapsulation is a technical detail not specific to the advantages of telemetry over SNMP polling.
Question 170
An engineer enabled SSL decryption for Cisco Umbrella intelligent proxy and needs to ensure that traffic is inspected without alerting end-users. Which action accomplishes this goal?
Show answer and explanation
Correct answer: D. Install the Cisco Umbrella root CA onto the user's device.
Installing the Cisco Umbrella root CA certificate onto user devices allows the intelligent proxy to decrypt and inspect SSL/TLS traffic without generating certificate validation errors. When users' devices trust the Umbrella root CA, they will not see warnings about untrusted certificates, enabling transparent inspection without alerting end-users to the security controls in place.
Why the other options are wrong
- A. Restricting access to trusted third-party certificates does not enable SSL decryption inspection and would actually limit functionality.
- B. Modifying browser settings to suppress errors is not a reliable or proper solution and may bypass important security warnings.
- C. Uploading the root CA to Cisco Umbrella itself does not address the client-side certificate validation that alerts users.
Question 171
How is DNS tunneling used to exfiltrate data out of a corporate network?
Show answer and explanation
Correct answer: B. It encodes the payload with random characters that are broken into short strings and the DNS server rebuilds the exfiltrated data
DNS tunneling exfiltrates data by encoding the payload with random characters, breaking it into short DNS query strings, and sending these queries through the DNS server to an attacker-controlled DNS server. The attacker's DNS server receives these fragments and reassembles them to reconstruct the exfiltrated data. This technique abuses the DNS protocol's legitimate function to covertly tunnel data out of networks that allow DNS queries.
Why the other options are wrong
- A. Recursive lookup spreading describes DNS amplification DDoS attacks, not data exfiltration.
- C. Redirecting DNS to steal credentials describes DNS hijacking or poisoning, not DNS tunneling for exfiltration.
- D. Corrupting DNS servers with rogue IP addresses describes DNS poisoning attacks, not the DNS tunneling exfiltration method.
Question 172
What are two functions of TAXII in threat intelligence sharing? (Choose two.)
Show answer and explanation
Correct answer: B, E. determines how threat intelligence information is relayed; supports STIX information
TAXII (Trusted Automated Exchange of Indicator Information) serves two key functions: it determines how threat intelligence information is relayed between organizations through its services and protocols (B), and it supports the exchange of STIX information, which is the standardized format for expressing threat intelligence data (E). TAXII is the transport mechanism while STIX is the data format.
Why the other options are wrong
- A. TAXII does not describe motivations and abilities; that is a STIX data characterization function.
- C. Determining the 'what' of threat intelligence is a STIX function, not a TAXII function.
- D. TAXII exchanges threat indicators and intelligence, not specifically 'anomaly intelligence.'
Question 173
What is a functional difference between a Cisco ASA and Cisco IOS router with Zone-Based Policy Firewall?
Show answer and explanation
Correct answer: C. The Cisco ASA denies all traffic by default, whereas the Cisco IOS router with Zone-Based Policy Firewall starts out by allowing all traffic, even on untrusted interfaces.
A Cisco ASA operates with a default-deny (implicit deny all) posture, all traffic is denied by default unless explicitly permitted by security policies. In contrast, a Cisco IOS router with Zone-Based Policy Firewall allows all traffic by default on untrusted interfaces unless explicitly blocked by zone policies. This is a fundamental architectural difference in how these platforms handle unknown or unevaluated traffic.
Why the other options are wrong
- A. Both Cisco ASA and IOS routers with ZBPFW can be configured for high availability; this is not a functional difference.
- B. IOS with ZBPFW does not have inherently better high availability support than ASA; both support HA.
- D. This reverses the actual behavior; ASA denies by default and IOS ZBPFW allows by default, not the opposite.
Question 174
An engineer is trying to securely connect to a router and wants to prevent insecure algorithms from being used. However, the connection is failing. Which action should be taken to accomplish this goal?
Show answer and explanation
Correct answer: A. Generate the RSA key using the crypto key generate rsa command.
Generating RSA keys using the crypto key generate rsa command is essential for enabling SSH with strong cryptographic algorithms. Without RSA keys, the router cannot perform the key exchange necessary for SSH connections, which rely on asymmetric cryptography rather than insecure algorithms like those used in Telnet.
Why the other options are wrong
- B. The ip ssh port 22 command configures the port but does not generate the necessary cryptographic keys for secure connections.
- C. The ip ssh server command enables the SSH server but requires RSA keys to already be generated; without keys, the server cannot establish secure sessions.
- D. Disabling Telnet prevents insecure access but does not enable or configure SSH with proper cryptographic material.
Question 175
What features does Cisco FTDv provide over Cisco ASAv?
Show answer and explanation
Correct answer: D. Cisco FTDv supports URL filtering while Cisco ASAv does not.
Cisco FTDv is the next-generation firewall that includes advanced threat protection features such as URL filtering, intrusion prevention, and malware defense, which are not available in the legacy ASAv platform. ASAv is the virtualized version of the traditional ASA firewall without these modern threat defense capabilities. While both can run on various hypervisors including VMware and AWS, the key differentiator is FTDv's advanced security features like URL filtering.
Why the other options are wrong
- A. Both FTDv and ASAv support throughput specifications; this is not a distinguishing feature.
- B. Both ASAv and FTDv can run on VMware as virtualized appliances.
- C. Both FTDv and ASAv support deployment on AWS cloud infrastructure.
Question 176
Which benefit does endpoint security provide the overall security posture of an organization?
Show answer and explanation
Correct answer: D. It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.
Endpoint security provides value by detecting and responding to threats that perimeter security devices miss. These include threats from compromised insiders, encrypted traffic, lateral movement within the network, and sophisticated attacks that bypass traditional perimeter controls. Endpoints are the actual targets of most attacks and provide critical detection opportunities.
Why the other options are wrong
- A. Endpoint security does not automatically perform digital forensics; this requires additional tools and analyst involvement.
- B. Endpoint security effectiveness is not limited to active domain sessions; modern endpoint solutions work regardless of user state.
- C. While endpoint security does operate at the edge, the more comprehensive benefit is detecting threats that perimeter devices fail to catch.
That was 176 of 703.
The full Cisco 350-701 SCOR pack has all 703 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 351 free as one PDF by email. Get the Half Pack →