Implementing and Operating Cisco Security Core Technologies (SCOR) practice questions

1. Question 1 of 25

   What can be integrated with Cisco Threat Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats?

   • ACisco Umbrella
   • BExternal Threat Feeds
   • CCisco Threat Grid
   • DCisco Stealthwatch

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   i would go with B here. Because the TID is used if you want to use external (not cisco provided) Security Information / Observables, in addition to what you get from cisco -> "The Cisco Threat Intelligence Director (TID) operationalizes threat intelligence data, helping you aggregate intelligence data, configure defensive actions, and analyze threats in your environment. This feature is intended to supplement other Firepower functionality, offering an additional line of defense against threats" https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html and for AMP you dont need the TID. AMP(for Networks) comes with its own configuration o the FMC for example where you can define the cloud you want to use etc.

   Adapted from community discussion by zeroC00L · 2022-04-02 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. C

      CiscoTech

      2020-12-30

      18 upvotes

      I think the answer is B. https://www.cisco.com/c/en/us/support/docs/storage-networking/security/214859-configure-and-troubleshoot-cisco-threat.html

   2. B

      brownbear505

      2022-08-22

      Selected B5 upvotes

      https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/cisco_threat_intelligence_director__tid_.html

   3. E

      essie007

      2021-04-14

      6 upvotes

      The question is about the TID, not CTR. Correct answer is BB

   4. U

      user636

      2021-06-22

      5 upvotes

      The answer is B, there no possibility to integrate ThreatGrid with TID at all. You could check the administration guide of TID.

2. Question 2 of 25

   Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?

   • Aaaa server radius dynamic-author
   • Bauth-type all
   • Caaa new-model
   • Dip device-tracking

   Show answer

   Correct answer: C

   How others answered

   • C73%
   • A27%

   Only 73% agreed on this answer — treat it as contested rather than settled.

   Explanation

   aaa new-model Enables authentication, authorization, and accounting (AAA) globally. aaa server radius dynamic-author Sets up the local AAA server for the dynamic authorization service, which must be enabled to support the CoA functionality to push the policy map in an input and output direction, and enters dynamic authorization local server configuration mode. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html

   Adapted from community discussion by Ampersand · 2021-03-24 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. A

      Ampersand

      2021-03-24

      25 upvotes

      aaa new-model Enables authentication, authorization, and accounting (AAA) globally. aaa server radius dynamic-author Sets up the local AAA server for the dynamic authorization service, which must be enabled to support the CoA functionality to push the policy map in an input and output direction, and enters dynamic authorization local server configuration mode. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_aaa/configuration/15-sy/sec-usr-aaa-15-sy-book/sec-rad-coa.html

   2. M

      Martian89

      2022-11-02

      Selected C4 upvotes

      Tried now You cant use the command "aaa server radius dynamic-author" without using "aaa new model" first. Suggesting that You have to first issue aaa new model to allow AAA globally on the switch so the COA is supported (so that You can put in the server command and anything else)

   3. P

      pr0fectus

      2021-12-29

      Selected C4 upvotes

      The way I understand the question is that it was asking for the command "so" that we can do CoA.

   4. T

      Tuxzinator

      2023-02-15

      Selected C3 upvotes

      So both commands, "aaa new-model" and "aaa server radius dynamic-author," can be used to enable CoA on a Cisco device, but they serve different purposes. The "aaa new-model" command is used to enable AAA globally on the device, while the "aaa server radius dynamic-author" command is used to configure a RADIUS server for dynamic authorization.

3. Question 3 of 25

   An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network. Which product should be used to accomplish this goal?

   • ACisco Firepower
   • BCisco Umbrella
   • CCisco ISE
   • DCisco AMP

   Show answer

   Correct answer: B

   How others answered

   • B46%
   • D38%
   • A15%

   Only 46% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer = B I work with Umbrella and Firepower daily. You can do this with Firepower, Umbrella whole existence is for blocking DNS connections to malicious sites before they are made, and blocking applications from launching on the internal network. For example, our users can't access Pandora, FB, Google Docs while on our internal network based on a policy configured in Umbrella.

   Adapted from community discussion by aaInman · 2021-07-06 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • cisco.com documentation
   • Cisco documentation
   • cisco.com documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. A

      aaInman

      2021-07-06

      17 upvotes

      Answer = B I work with Umbrella and Firepower daily. You can do this with Firepower, Umbrella whole existence is for blocking DNS connections to malicious sites before they are made, and blocking applications from launching on the internal network. For example, our users can't access Pandora, FB, Google Docs while on our internal network based on a policy configured in Umbrella.

   2. W

      west33637

      2022-12-09

      7 upvotes

      B is correct. AVC on Firepower can not block applications from being used within the network. Firepower can only block these applications if they pass through the firewall. Umbrella can block connections to malicious sites before the connection is made based on the DNS lookup. Umbrella also installs an endpoint supplicant or can be used as an Anyconnect module. This way you can push an application policy to the endpoints blocking even applications 'within the network'. Same as aalnman, I have used this at work and at home.

   3. M

      manhatar

      2021-11-29

      5 upvotes

      I was going with several people here : Umbrella. But after reading jaciro, I agree with firepower. Indeed Umbrella can block before the connection has established. Indeed firepower has to let pass some packets before application recognition (so before the connection has established doesn't work). BUT here we are saying :"blocking malicious destinations prior to a connection being established" and don't forget that in DAQ we have Security Intelligence able to block before the connection has establish for IP Blacklist AND URL blacklist. Si for me firepower can block before a connection with SI.

   4. A

      AS04

      2021-08-13

      7 upvotes

      A is correct, Firepower has AVC feature that can block traffic based on application.

4. Question 4 of 25

   What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?

   • AMultiple NetFlow collectors are supported.
   • BAdvanced NetFlow v9 templates and legacy v5 formatting are supported.
   • CSecure NetFlow connectors are optimized for Cisco Prime Infrastructure
   • DFlow-create events are delayed.

   Show answer

   Correct answer: A

   How others answered

   • A58%
   • D42%

   Only 58% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A is the answer. While events can be delayed they are not delayed by default. The flow-create event is exported as soon as the flow is created if the flow-export delay flow-create command is not configured.

   Adapted from community discussion by Reece_S · 2021-07-16 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. R

      Reece_S

      2021-07-16

      13 upvotes

      A is the answer. While events can be delayed they are not delayed by default. The flow-create event is exported as soon as the flow is created if the flow-export delay flow-create command is not configured.

   2. N

      nep1019

      2023-08-05

      Selected A5 upvotes

      Whew this is a hard question. Is A because as previously mentioned, delaying the export of flow-create events is NOT a default action. A is the "more correct" answer. Cisco exams are a racket.

   3. S

      Stevens0103

      2024-01-10

      Selected A4 upvotes

      The option D's wording implies that flow-create events are always delayed and this default action is a feature. However, flow-create events are actually optional and it is exactly this optionality makes it a feature. https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_nsel.html

   4. D

      Dinges

      2021-07-03

      3 upvotes

      Checked the link https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/asdm71/general/asdm_71_general_config/monitor_nsel.pdf and found: # The ASA and ASASM implementations of NSEL provide the following major functions: [...] • Delays the export of flow-create events. # You can configure a maximum of five collectors. Based on this, looks like both A and D are correct. BUT look at D more closely and notice that “Delays flow-create events” is not the same as “Delays the export of flow-create events”. So D seems incorrect at closer view and then A remains as the correct answer.

5. Question 5 of 25

   Select 2

   A Cisco FirePower administrator needs to configure a rule to allow a new application that has never been seen on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose two.)

   • Apermit
   • Ballow
   • Creset
   • Dtrust
   • Emonitor

   Show answer

   Correct answer: D, E

   How others answered

   • DE53%
   • BD47%

   Only 53% agreed on this answer — treat it as contested rather than settled.

   Explanation

   D & E Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule. Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.

   Adapted from community discussion by Jayde · 2021-06-07 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. L

      loiphin

      2021-12-23

      11 upvotes

      In case you are still nervy about the above answers, then this diagram will calm your nerves :) https://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/access_control_rules.html#ID-2190-00000005

   2. J

      Jayde

      2021-06-07

      4 upvotes

      D & E Rule 1: Monitor evaluates traffic first. Monitor rules track and log network traffic. The system continues to match traffic against additional rules to determine whether to permit or deny it. (However, see an important exception and caveat at Access Control Rule Monitor Action.) Rule 2: Trust evaluates traffic next. Matching traffic is allowed to pass to its destination without further inspection, though it is still subject to identity requirements and rate limiting. Traffic that does not match continues to the next rule. Rule 3: Block evaluates traffic third. Matching traffic is blocked without further inspection. Traffic that does not match continues to the final rule. Rule 4: Allow is the final rule. For this rule, matching traffic is allowed; however, prohibited files, malware, intrusions, and exploits within that traffic are detected and blocked. Remaining non-prohibited, non-malicious traffic is allowed to its destination, though it is still subject to identity requirements and rate limiting. You can configure Allow rules that perform only file inspection, or only intrusion inspection, or neither.

   3. W

      west33637

      2023-01-19

      Selected D, E6 upvotes

      create a monitor rule that matches the application. Then create a trust rule right below it.

   4. K

      klu16

      2021-08-31

      3 upvotes

      There are seven different actions which a rule can use: - Allow – Allows traffic. There may yet be more inspections, such as Intrusion and File policies - Trust – Sends traffic straight to the egress interface, without any extra inspections. Identity policies and rate limiting still apply - Monitor – Logs traffic, and continues to the rest of the rules - Block – Drops traffic silently, causing the connection to timeout - Block with reset – Drops traffic, and sends a TCP FIN, so the connection closes rather than times out - Interactive Block – Displays a web page with conditions that users may accept. This is where the Interactive Block Response Page comes into play - Interactive Block with Reset – Combination of interactive block, with a TCP FIN Therefore answers should be D & E in my opinion.

6. Question 6 of 25

   An administrator is configuring a DHCP server to better secure their environment. They need to be able to rate-limit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?

   • ASet a trusted interface for the DHCP server.
   • BSet the DHCP snooping bit to 1.
   • CEnable ARP inspection for the required VLAN.
   • DAdd entries in the DHCP snooping database.

   Show answer

   Correct answer: A

   How others answered

   • A54%
   • C38%

   Only 54% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Folks, we have lots of wrong answers verified and provided by "experts", there's no need to supply wrong answers by ourselves here. You can't add entries to DHCP snooping database. It's wrong answer. The only case when you create mapping of IP to MAC and VLAN and port is configuring "ip source guard" but it is not the same as DHCP snooping. Unless you explicitly configure a rate limit on an interface, changing the trust state of the interface also changes its rate limit to the default value for that trust state. After you configure the rate limit, the interface retains the rate limit even when its trust state is changed https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/dam/en/us/td/docs/switches/lan/catalyst4500/XE35-0XO/configuration/guide/dhcp.fm/jcr:content/renditions/config_dhcp.html.xml

   Adapted from community discussion by zheka · 2021-11-28 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. Z

      zheka

      2021-11-28

      14 upvotes

      Folks, we have lots of wrong answers verified and provided by "experts", there's no need to supply wrong answers by ourselves here. You can't add entries to DHCP snooping database. It's wrong answer. The only case when you create mapping of IP to MAC and VLAN and port is configuring "ip source guard" but it is not the same as DHCP snooping. Unless you explicitly configure a rate limit on an interface, changing the trust state of the interface also changes its rate limit to the default value for that trust state. After you configure the rate limit, the interface retains the rate limit even when its trust state is changed https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/dam/en/us/td/docs/switches/lan/catalyst4500/XE35-0XO/configuration/guide/dhcp.fm/jcr:content/renditions/config_dhcp.html.xml

   2. D

      Demon_Queen_Velverosa

      2024-09-15

      1 upvote

      This answer is A as shown below from the offical cert guide, don't over think it. The DHCP snooping feature determines whether traffic sources are trusted or untrusted. An untrusted source may initiate traffic attacks or other hostile actions. To prevent such attacks, the DHCP snooping feature filters messages and rate-limits traffic from untrusted sources. The following steps are required to implement DHCP snooping on your network: Step 1. Define and configure the DHCP server. Configuration of this step does not take place on the switch or router and is beyond the scope of this book. Step 2. Enable DHCP snooping globally. Step 3. Enable DHCP snooping on at least one VLAN. By default, DHCP snooping is inactive on all VLANs. Step 4. Ensure that the DHCP server is connected through a trusted interface. By default, the trust state of all interfaces is untrusted. Step 5. Configure the DHCP snooping database agent. This step ensures that database entries are restored after a restart or switchover.

   3. L

      Laryoul

      2022-01-11

      2 upvotes

      for me C is good but we need dhcp snooping activate (and dhcp snooping trust on interface of the DHCP server) But only C is an action that active rate limit. https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_0110111.html The switch CPU performs dynamic ARP inspection validation checks; therefore, the number of incoming ARP packets is rate-limited to prevent a denial-of-service attack. By default, the rate for untrusted interfaces is 15 packets per second (pps). Trusted interfaces are not rate-limited. You can change this setting by using theip arp inspection limitinterface configuration command.

   4. B

      BoxX

      2023-07-05

      2 upvotes

      If you won't to configure DAI (Dynamic ARP Inspection) and IP Source Guard (IPSG) you must add statically assigned IP addresses to the DHCP snooping database, as DAI and IPSG are using it. Depending on platform and version you can add static entries into the DHCP snooping database: - Router# ip dhcp snooping binding binding_id vlan vlan_id interface interface expiry lease_time - Switch# ip dhcp snooping binding mac-addr vlan vlan ipaddr interface ifname expiry lease-in-seconds Please, do not call someone "expert" just because you are not.

7. Question 7 of 25

   A network administrator is configuring SNMPv3 on a new router. The users have already been created, however an additional configuration is needed to facilitate access to the SNMP views. What must the administrator do to accomplish this?

   • Adefine the encryption algorithm to be used by SNMPv3
   • Bset the password to be used for SNMPv3 authentication
   • Cmap SNMPv3 users to SNMP views
   • Dspecify the UDP port used by SNMP

   Show answer

   Correct answer: C

   How others answered

   • C86%

   Explanation

   Agree with B Configuring SNMP Version 3 When you configure SNMPv3 and you want to use the SNMPv3 security mechanism for handling SNMP packets, you must establish SNMP groups and users with passwords. SNMPv3 is a security model. A security model is an authentication strategy that is set up for a user and the group in which the user resides. No default values exist for authentication or privacy algorithms when you configure the snmp-server group command. Also, no default passwords exist. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/12-4t/snmp-12-4t-book/nm-snmp-cfg-snmp-support.html

   Adapted from community discussion by MoII · 2021-11-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. K

      kornman

      2021-06-26

      14 upvotes

      I think the correct answer is C - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3e/snmp-xe-3e-book/nm-snmp-snmpv3-comm-supp.html

   2. T

      thetaken

      2021-07-19

      6 upvotes

      It looks like none of the options given make sense: A and B are part of the user creation command, C does not make any sense since views can be assigned to groups, not users and D is wrong because it only makes sense if a SNMP host is being configured.

   3. M

      MoII

      2021-11-20

      2 upvotes

      Agree with B Configuring SNMP Version 3 When you configure SNMPv3 and you want to use the SNMPv3 security mechanism for handling SNMP packets, you must establish SNMP groups and users with passwords. SNMPv3 is a security model. A security model is an authentication strategy that is set up for a user and the group in which the user resides. No default values exist for authentication or privacy algorithms when you configure the snmp-server group command. Also, no default passwords exist. https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/12-4t/snmp-12-4t-book/nm-snmp-cfg-snmp-support.html

   4. R

      Reece_S

      2021-07-16

      1 upvote

      This question is too vague to properly answer. When you create the user, you assign them to the group and this provides access to the view. C would be plausible if you mapped users to views but you don' t map users to views, you assign users to groups which provides access to views. The group and user option would enough in a NoAuth model. the answer wording is questionable C but it could be the answer based on NoAuth. Since we don't know the model that is being used. It's hard to say. With AuthNoPriv you would need the auth password. With AuthPriv you would need both the auth password and encryption. However in no case would just the encryption be enough by itself to allow access. For A to be correct, we'd have to assume that the user has been assigned to the group and that the auth password is correct.

8. Question 8 of 25

   An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?

   • ANetwork Discovery
   • BAccess Control
   • CPacket Tracer
   • DNetFlow

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   Opt for A. Cisco doc says Applications can be discovered by "non-NetFlow discovery rules" without Option D You can disable detection of application protocols in discovery rules configured to monitor NetFlow exporters, but not in discovery rules configured to monitor Firepower System managed devices. If you enable host or user discovery in non-NetFlow discovery rules, applications are automatically discovered. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/working_with_discovery_events.html

   Adapted from community discussion by semi1750 · 2022-04-02 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. D

      dzef13

      2021-06-16

      4 upvotes

      IGNORE MY LAST COMMENT NetFlow is a network protocol developed by Cisco for the collection and monitoring of network traffic flow data generated by NetFlow-enabled routers and switches. The flows do not contain actual packet data, but rather the metadata for communications. It is a standard form of session data that details who, what, when, and where of network traffic -> Netflow is not correct. ANswer Should be Network Discovery Reference: https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/ white-paper-c11-736595.html

   2. F

      francojaraba

      2022-07-16

      Selected A4 upvotes

      As long the questions indicates that no metada is required the answer is A - https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/white-paper-c11-736595.html Netflow are based on metadata - https://learning.oreilly.com/library/view/ccna-cyber-ops/9780134608938/ch04.html#ch04lev1sec1

   3. S

      semi1750

      2022-04-02

      Selected A3 upvotes

      Opt for A. Cisco doc says Applications can be discovered by "non-NetFlow discovery rules" without Option D You can disable detection of application protocols in discovery rules configured to monitor NetFlow exporters, but not in discovery rules configured to monitor Firepower System managed devices. If you enable host or user discovery in non-NetFlow discovery rules, applications are automatically discovered. https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/working_with_discovery_events.html

   4. S

      sis_net_sec

      2022-10-09

      Selected A2 upvotes

      https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Network_Discovery_Policies.html The network discovery policy has a single default rule in place, configured to discover applications from all observed traffic. The rule does not exclude any networks, zones, or ports, host and user discovery is not configured, and the rule is not configured to monitor a NetFlow exporter. This policy is deployed by default to any managed devices when they are registered to the Firepower Management Center. To begin collecting host or user data, you must add or modify discovery rules and re-deploy the policy to a device.

9. Question 9 of 25

   An organization deploys multiple Cisco FTD appliances and wants to manage them using one centralized solution. The organization does not have a local VM but does have existing Cisco ASA that must migrate over to Cisco FTDs. Which solution meets the needs of the organization?

   • ACisco FMC
   • BCDO
   • CCSM
   • DCisco FDM

   Show answer

   Correct answer: B

   How others answered

   • B59%
   • A41%

   Only 59% agreed on this answer — treat it as contested rather than settled.

   Explanation

   What a tricky question, but I think I just got you the perfect answer and the perfect link from Cisco. The correct answer is A, not B. The reason why, According to Cisco, if you want to migrate your ASA to FTD and want to manage them both through "CDO and FDM" then use (CDO), but if you want to migrate ASA to FTD and manage both in the same time (Centralized) then use FMC" So the answer is absolutely A, and here is the link: https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide-CDO/ASA2FTD_Using_CDO/ASA2FTD_with_FP_Migration_Tool_cdo_chapter_011.html

   Adapted from community discussion by eazy99 · 2021-09-26 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation
   • Cisco documentation
   • Cisco documentation
   • cisco.com documentation
   • Cisco documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

   1. E

      eazy99

      2021-09-26

      23 upvotes

      What a tricky question, but I think I just got you the perfect answer and the perfect link from Cisco. The correct answer is A, not B. The reason why, According to Cisco, if you want to migrate your ASA to FTD and want to manage them both through "CDO and FDM" then use (CDO), but if you want to migrate ASA to FTD and manage both in the same time (Centralized) then use FMC" So the answer is absolutely A, and here is the link: https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide-CDO/ASA2FTD_Using_CDO/ASA2FTD_with_FP_Migration_Tool_cdo_chapter_011.html

   2. S

      semi1750

      2022-04-17

      8 upvotes

      Vote for B FMC will manage only Firepower images (FTD or Firepower module Services). CDO is able to centrally manage your ASAs, FTD, Meraki security policies and AWS VPC security policies. For FMC, you need to have a local VM (with some resources like 32G RAM) and need to manage the redundancy as well. CDO is cloud based (could have a local VM with small resources to communicate with the cloud and not expose your devices management). You need to see CDO like the Meraki portal for Cisco Security Firewalls. https://community.cisco.com/t5/network-security/a-classic-cdo-vs-fmc/td-p/4070116

   3. A

      anna_montana

      2022-02-19

      6 upvotes

      This is in fact a tricky question. We need to take into account that they already have deployed multiple FTDs that are not being managed by FMC. If we recommend FMC then the org would have to redo all their FTDs since we dont have FDM to FMC migration tool. So the most convenient advice that we can give is to just go with CDO which can help them migrate the asa to ftd and manage all ftd at the same time. Hitting all their needs.

   4. L

      Laryoul

      2022-01-11

      5 upvotes

      For me I prefer answer B because it say : Migration of ASA (CDO could do it) does not have VM (that say, if we need a FMC they need to buy an appliance) Have already multiple FTD no centralize solution => this means that are manage by FDM that is more easy to import in CDO that time need to migration on FMC (reset configuration from zero) => B is the better solution. Don't know what is the better solution for people writting this question ;)

10. Question 10 of 25

    What is a functional difference between a Cisco ASA and Cisco IOS router with Zone-Based Policy Firewall?

    • AThe Cisco ASA can be configured for high availability, whereas the Cisco IOS router with Zone-Based Policy Firewall cannot.
    • BThe Cisco IOS router with Zone-Based Policy Firewall can be configured for high availability, whereas the Cisco ASA cannot.
    • CThe Cisco ASA denies all traffic by default, whereas the Cisco IOS router with Zone-Based Policy Firewall starts out by allowing all traffic, even on untrusted interfaces.
    • DThe Cisco IOS router with Zone-Based Policy Firewall denies all traffic by default, whereas Cisco ASA starts out by allowing traffic until rules are added.

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • C37%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router. https://networklessons.com/cisco/asa-firewall/cisco-asa-access-list Without any access-lists, the ASA will allow traffic from a higher security level to a lower security level https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217679-asa-access-control-list-configuration-ex.html By default, traffic that passes from a lower security level interface to a higher security level interface is denied whereas traffic from a higher security level interface to a lower security level interface is allowed. This behavior can also be overridden with an ACL. D) is the closest answer.

    Adapted from community discussion by Premium_Pils · 2024-10-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. K

       KPzee

       2023-04-02

       3 upvotes

       D is completely wrong. the Cisco ASA does not allow traffic to move from a lower security zone to a higher one by default, and it does start out with a default deny all policy. so "whereas Cisco ASA starts out by allowing traffic until rules are added." is contradictory. They both can be configured for high-availability so A & B is out. now for C & D, I think this question was poorly worded, poor usage of the english language. The default behavior of a Cisco ASA is to block incoming traffic and allow outgoing traffic i.e. from High security zone to a low one, and the reverse is denied whereas the default behavior of a Cisco IOS router with ZFW is to block all traffic though it can be argued that it behaves like the ASA if you consider that it has two default zones i.e. the self-zone other zone

    2. K

       kylesam2017

       2023-11-27

       4 upvotes

       "C" is the correct answer. Here is the link: "One difference is that the IOS router starts out by allowing all traffic [on your untrusted interfaces], where as the ASA starts by denying all traffic. Consequently you have to configure the actual hardening of your IOS router. " https://community.cisco.com/t5/network-security/ios-firewall-vs-asa/td-p/2133822#:~:text=One%20difference%20is%20that%20the,hardening%20of%20your%20IOS%20router.

    3. P

       Premium_Pils

       2024-10-12

       2 upvotes

       https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/98628-zone-design-guide.html All traffic to and from a given interface is implicitly blocked when the interface is assigned to a zone, except traffic to and from other interfaces in the same zone, and traffic to any interface on the router. https://networklessons.com/cisco/asa-firewall/cisco-asa-access-list Without any access-lists, the ASA will allow traffic from a higher security level to a lower security level https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217679-asa-access-control-list-configuration-ex.html By default, traffic that passes from a lower security level interface to a higher security level interface is denied whereas traffic from a higher security level interface to a lower security level interface is allowed. This behavior can also be overridden with an ACL. D) is the closest answer.

    4. D

       Demon_Queen_Velverosa

       2024-09-17

       2 upvotes

       Answers cannot be A or B as this is a firewall and a router making me surprised if they could not be used for high availability. The answer cannot be D as we are dealing with two different devices that are not the same. A firewall explicit device (ASA) and a router device (IOS) but it has extra features aka firewall. a firewall by default will have an implicit deny which is the ASA, but a IOS router? It would not have an implicit deny. why? Because, it is still a router when you pull it out of the box and routing is the primary function of a router. Thus you will need to enable or utilize the zone-based firewall policy feature in order for firewall rules to start to apply. Don't let the words "firewall" or "zone-based policy firewall". Now the Demon Queen will go drink some wine and continue planning for world domination.

11. Question 11 of 25

    An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1.1.1.1 using the flow record Stealthwatch406143794 command. Which additional command is required to complete the flow record?

    • Acache timeout active 60
    • Bdestination 1.1.1.1
    • Cmatch ipv4 ttl
    • Dtransport udp 2055

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    B Once the Flow Record has been created you would tie it to a Flow Exporter. Flow Exporter configuration defines the physical or virtual Flow Collector IP Address to which NetFlow data is sent. It also defines the source interface from which the Flow Exporter device will send NetFlow data, this can be a physical or logical address; it is also worth considering using a Loopback interface to source NetFlow data from as a Loopback typically will remain up even when other interfaces fail therefore enabling continuous transport (where routing permits) This is also where the transport protocol (TCP or UDP) and destination port is defined; the destination port is specific to the NetFlow Collector and in this case refers to the port used by the Stealthwatch Flow Collector. To define a Flow Exporter, follow these steps: flow exporter Stealthwatch_Exporter description Stealthwatch Export to Flow Collector destination [Collector_IP_Address] source [Physical_Interface | Logical_Interface] transport udp 2055 https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/config-trouble-netflow-stealth.pdf

    Adapted from community discussion by Smileebloke · 2023-10-25 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. S

       Smileebloke

       2023-10-25

       5 upvotes

       Ignore previous comment C: flow record Stealthwatch_FlowRecord description Flow Record for Export to Stealthwatch (optional) match ipv4 source address match ipv4 destination address match ipv4 protocol match ipv4 tos match transport source-port match transport destination-port match interface input match flow direction collect routing next-hop address ipv4 collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last

    2. S

       Smileebloke

       2023-10-25

       2 upvotes

       B Once the Flow Record has been created you would tie it to a Flow Exporter. Flow Exporter configuration defines the physical or virtual Flow Collector IP Address to which NetFlow data is sent. It also defines the source interface from which the Flow Exporter device will send NetFlow data, this can be a physical or logical address; it is also worth considering using a Loopback interface to source NetFlow data from as a Loopback typically will remain up even when other interfaces fail therefore enabling continuous transport (where routing permits) This is also where the transport protocol (TCP or UDP) and destination port is defined; the destination port is specific to the NetFlow Collector and in this case refers to the port used by the Stealthwatch Flow Collector. To define a Flow Exporter, follow these steps: flow exporter Stealthwatch_Exporter description Stealthwatch Export to Flow Collector destination [Collector_IP_Address] source [Physical_Interface | Logical_Interface] transport udp 2055 https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/config-trouble-netflow-stealth.pdf

    3. N

       NikoNiko

       2024-01-16

       2 upvotes

       So C is correct: match ipv4 ttl Exporter = specifications of NetFlow protocol parameters and dest. IP of Collector. Record = specifications of information that NetFlow gathers, such as packets in the flow and the types of counters gathered per flow. “match” and “collect” commands tell which fields to include in the outgoing NetFlow PDU. “match” = key fields used to determine the uniqueness of the flow. “collect” = extra fields to include for more detail to the collector for reporting and analysis. Monitor = pairs Record with Exporter and is applied to network interface from which we want to collect NetFlow statistics & data. https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/Cisco_NetFlow_Configuration.pdf

    4. N

       NikoNiko

       2024-01-16

       2 upvotes

       Example shows how to configure version 9 export for Flexible NetFlow. ! flow exporter EXPORTER-1 destination 172.16.10.2 export-protocol netflow-v9 transport udp 90 exit ! flow record v4_r1 match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect counter bytes long collect counter packets long ! flow monitor FLOW-MONITOR-1 record v4_r1 exporter EXPORTER-1 ! ip cef ! interface GigabitEthernet 0/0/0 ip address 172.16.6.2 255.255.255.0 ip flow monitor FLOW-MONITOR-1 input https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf-15-mt-book/fnf-v9-export.html

12. Question 12 of 25

    What is an attribute of the DevSecOps process?

    • Asecurity scanning and theoretical vulnerabilities
    • Bdevelopment security
    • Cisolated security team
    • Dmandated security controls and check lists

    Show answer

    Correct answer: B

    How others answered

    • B70%
    • D30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    DevSecOps (development, security, and operations) is a concept used in recent years to describe how to move security activities to the start of the development life cycle and have built-in security practices in the continuous integration/continuous deployment (CI/CD) pipeline. Thus minimizing vulnerabilities and bringing security closer to IT and business objectives. Three key things make a real DevSecOps environment: + Security testing is done by the development team. + Issues found during that testing is managed by the development team. + Fixing those issues stays within the development team. https://blogs.cisco.com/security/devsecops-win-win-for-all

    Adapted from community discussion by sis_net_sec · 2022-07-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. J

       jaciro11

       2021-11-27

       10 upvotes

       Man exactly that's the best answer they don´t ask about overall work of DevSecops. They ask about attribute.... Answer D

    2. S

       statikd

       2021-06-21

       8 upvotes

       But this same blog states: "Enabling businesses to address their most critical security requirements over a checklist or security mandates." Which is an attribute listed in the DevSecOps manifesto. Development security is overall what DevSecOps does, it's a given. I think the answer is D

    3. S

       sis_net_sec

       2022-07-30

       Selected B3 upvotes

       DevSecOps (development, security, and operations) is a concept used in recent years to describe how to move security activities to the start of the development life cycle and have built-in security practices in the continuous integration/continuous deployment (CI/CD) pipeline. Thus minimizing vulnerabilities and bringing security closer to IT and business objectives. Three key things make a real DevSecOps environment: + Security testing is done by the development team. + Issues found during that testing is managed by the development team. + Fixing those issues stays within the development team. https://blogs.cisco.com/security/devsecops-win-win-for-all

    4. T

       trickbot

       2021-05-12

       3 upvotes

       If I get this question on the Exam, I will be answering B) Development Security. For reference, search "Cisco's DevSecOps Manifesto, where it explicitly states it's mission is to solve security problems with "Consumable Security Services over Mandated Security Controls" and "Collaboration to Securely enable Business, over Mandates" its a very Agile-ish manifesto. I found it here. https://blogs.cisco.com/security/devsecops-win-win-for-all

13. Question 13 of 25

    An organization is receiving SPAM emails from a known malicious domain. What must be configured in order to prevent the session during the initial TCP communication?

    • AConfigure the Cisco ESA to reset the TCP connection.
    • BConfigure policies to stop and reject communication.
    • CConfigure the Cisco ESA to drop the malicious emails.
    • DConfigure policies to quarantine malicious emails.

    Show answer

    Correct answer: A

    How others answered

    • A61%
    • B33%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "You can configure your Email Security Appliance (ESA) to restrict connections by adding any of these items to Sender Groups which use Mail Flow Policies: IP range Specific host or domain name SenderBase Reputation Service (SBRS) "organization" classification SBRS score range DNS List query response Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA." Source (2014): https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html Newer (2021) - the same but TCPREFUSE is replaced by "TCP refuse": https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/216842-understand-parameters-related-to-mail-fl.html

    Adapted from community discussion by NikoNiko · 2022-07-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. W

       west33637

       2022-12-26

       Selected A8 upvotes

       A should be correct - TCPREFUSE resets the TCP connection. The question asks for preventing the session during the initial TCP communication. The remaining answers do not specify dropping the communication at TCP level.

    2. K

       kerniger

       2021-08-15

       6 upvotes

       hm it seems there is no clear valid answer A - probably the best answer because if you configure as "TCPREFUSE" it will send a "reset" at tcp. B - the client gehts responses at a higher level than tcp C - its not at tcp layer D - its not at tcp layer https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118179-configure-esa-00.html

    3. N

       NikoNiko

       2022-07-17

       2 upvotes

       "You can configure your Email Security Appliance (ESA) to restrict connections by adding any of these items to Sender Groups which use Mail Flow Policies: IP range Specific host or domain name SenderBase Reputation Service (SBRS) "organization" classification SBRS score range DNS List query response Each Mail Flow Policy has an access rule, such as ACCEPT, REJECT, RELAY, CONTINUE, and TCPREFUSE. A host that attempts to establish a connection to your ESA and matches a Sender Group using a TCPREFUSE access rule is not allowed to connect to your ESA." Source (2014): https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118007-configure-esa-00.html Newer (2021) - the same but TCPREFUSE is replaced by "TCP refuse": https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/216842-understand-parameters-related-to-mail-fl.html

    4. [

       [Removed]

       2022-05-30

       2 upvotes

       I think the answer is A according to the cisco definition: REJECT. Connection is initially accepted, but the client attempting to connect gets a 4XX or 5XX SMTP status code. No email is accepted. Note: You can also configure AsyncOS to perform this rejection at the message recipient level (RCPT TO), rather than at the start of the SMTP conversation. Rejecting messages in this way delays the message rejection and bounces the message, allowing AsyncOS to retain more detailed information about the rejected messages. This setting is configured from the CLI listenerconfig > setup command. TCPREFUSE. Connection is refused at the TCP level.

14. Question 14 of 25

    A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?

    • AThe policy was created to send a message to quarantine instead of drop.
    • BThe file has a reputation score that is below the threshold.
    • CThe file has a reputation score that is above the threshold.
    • DThe policy was created to disable file analysis.

    Show answer

    Correct answer: B

    How others answered

    • B64%
    • D29%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I found B a possibility Quarantine is only for unrecognised files. When file is undetermined, reputation score is checked. Reputation 1-59: Deliver file / Reputation 60-100: Block file So B looks correct. Look at - Figure 1. Advanced Malware Protection Workflow for Public-Cloud File Analysis Deployments https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010000.html

    Adapted from community discussion by Dinges · 2022-01-03 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. D

       Dinges

       2022-01-03

       20 upvotes

       I found B a possibility Quarantine is only for unrecognised files. When file is undetermined, reputation score is checked. Reputation 1-59: Deliver file / Reputation 60-100: Block file So B looks correct. Look at - Figure 1. Advanced Malware Protection Workflow for Public-Cloud File Analysis Deployments https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_010000.html

    2. J

       janzeleny

       2022-05-16

       5 upvotes

       It's definitely B. Look at the link https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_010000.html and check Figure 1. Advanced Malware Protection Workflow for Public-Cloud File Analysis Deployments. Don't confuse Undetermined Verdict and Unrecognized file. D would be correct if the file is unrecognized, but in this case they are asking about undetermined verdict for Recognized file! And the reason why file is not dropped (blocked) is that Score is below threshold (60 by default).

    3. I

       itisfakemaillol

       2021-12-27

       6 upvotes

       I am sure it is D. The policy was created to disable file analysis. When the reputation is not clear = undetermined, the file should be send for file analysis. It is not happening, so the file is not dropped.

    4. F

       Faruzzi1979

       2022-09-16

       Selected B2 upvotes

       Pay attention to "undetermined verdict" (not "unrecognized file"). Policy can not disable File Analysis service (so D can not be the correct answer), but it can send messages with unknown attachments to quarantine while file analysis is performed. After undetermined verdict for known file, reputation score is calculated, and if bellow threshold (60), message is sent to the recipient (B - correct answer). If file analysis service is enabled (you can not disable file analysis in the policy) and the file is defined as unrecognized (unknown), at the same time policy is set to send unrecognized files to quarantine during file analysis, then potentially this file could be defined as malicious (after sand-boxing) and for that reason not delivered to the recipient.

15. Question 15 of 25

    Which attack is preventable by Cisco ESA but not by the Cisco WSA?

    • ASQL injection
    • Bphishing
    • Cbuffer overflow
    • DDoS

    Show answer

    Correct answer: B

    How others answered

    • B53%
    • D47%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    but also B. Phishing Cisco ESA (Email Security Appliance) and Cisco WSA (Web Security Appliance) are both security products that provide protection against a variety of network-based threats. However, ESA is designed specifically to protect against email-based threats such as spam, phishing and malware, while WSA is designed to protect against web-based threats such as SQL injection, buffer overflow, and DoS attacks. So, Cisco ESA can prevent phishing but Cisco WSA can't.

    Adapted from community discussion by ddev3737 · 2023-01-29 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. D

       ddev3737

       2023-01-29

       8 upvotes

       but also B. Phishing Cisco ESA (Email Security Appliance) and Cisco WSA (Web Security Appliance) are both security products that provide protection against a variety of network-based threats. However, ESA is designed specifically to protect against email-based threats such as spam, phishing and malware, while WSA is designed to protect against web-based threats such as SQL injection, buffer overflow, and DoS attacks. So, Cisco ESA can prevent phishing but Cisco WSA can't.

    2. P

       pfunkylol

       2021-10-31

       9 upvotes

       you may have passed, but unless it was at max percentage you don't know if it was correct or not

    3. M

       MoII

       2021-11-21

       7 upvotes

       I'd go with B becasue the question is about "Preventable" meaning user should not get the email in the first place, that's ESA's job..

    4. D

       ddev3737

       2023-01-29

       1 upvote

       What about answer A A. SQL injection: Cisco ESA can prevent SQL injection attacks by inspecting the payload of the incoming email messages and identifying any SQL injection attempts. However, Cisco WSA is focused on web traffic and may not have the same level of protection against this type of attack. B. Phishing: Both Cisco ESA and Cisco WSA can prevent phishing attacks by using reputation-based filtering, SSL inspection, and anti-phishing capabilities. C. Buffer overflow: Cisco ESA can prevent buffer overflow attacks by inspecting the payload of incoming email messages and identifying any buffer overflow attempts. However, Cisco WSA is focused on web traffic and may not have the same level of protection against this type of attack. D. DoS: Both Cisco ESA and Cisco WSA can prevent DoS attacks by using rate-limiting, access controls, and other security measures to prevent the attack from overwhelming the system.

16. Question 16 of 25

    A network engineer must configure a Cisco ESA to prompt users to enter two forms of information before gaining access. The Cisco ESA must also join a cluster machine using preshared keys. What must be configured to meet these requirements?

    • AEnable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA GUI.
    • BEnable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA CLI.
    • CEnable two-factor authentication through a TACACS+ server and then join the cluster by using the Cisco ESA GUI.
    • DEnable two-factor authentication through a RADIUS server and then join the cluster by using the Cisco ESA CLI.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Document Updated on March6, 2023 https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200885-ESA-Cluster-Requirements-and-Setup.html Cluster configuration options must be done via the CLI on the ESA and cannot be created or joined in the GUI. Note: If you run the PREPJOIN option, you need to commit your changes to the primary ESA before you run clusterconfig on the secondary ESA and join that appliance to your newly configured cluster. This is noted from the output throughout the operation: to join this appliance to a cluster with pre-shared keys, log in to the cluster machine, run the clusterconfig > prepjoin > new command , enter the next details, and commit your changes. So I believe it is D

    Adapted from community discussion by Toni_Su91 · 2024-09-18 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. Y

       Yuta1123

       2023-10-28

       Selected D7 upvotes

       I think D is the answer. Sorce:https://www.cisco.com/c/ja_jp/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_fs/b_ESA_Admin_Guide_fs_chapter_0101000.html

    2. T

       Toni_Su91

       2024-09-18

       5 upvotes

       Document Updated on March6, 2023 https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200885-ESA-Cluster-Requirements-and-Setup.html Cluster configuration options must be done via the CLI on the ESA and cannot be created or joined in the GUI. Note: If you run the PREPJOIN option, you need to commit your changes to the primary ESA before you run clusterconfig on the secondary ESA and join that appliance to your newly configured cluster. This is noted from the output throughout the operation: to join this appliance to a cluster with pre-shared keys, log in to the cluster machine, run the clusterconfig > prepjoin > new command , enter the next details, and commit your changes. So I believe it is D

    3. N

       NikoNiko

       2024-01-12

       2 upvotes

       "You cannot create or join a cluster from the Graphical User Interface (GUI). You must use the Command Line Interface (CLI) to create, join, or configure clusters of machines. Once you have created a cluster, you can change configuration settings from either the GUI or the CLI. ... Although you cannot create or join clusters or administer cluster specific settings from the GUI (the equivalent of the clusterconfig command), you can browse machines in the cluster, create, delete, copy, and move settings among the cluster, groups, and machines (that is, perform the equivalent of the clustermode and clusterset commands) from within the GUI." https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_11_1_chapter_0101000.html#con_1122438

    4. G

       geppo81

       2024-01-03

       Selected D3 upvotes

       I found also these links: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_0100000.html https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-0/user_guide_fs/b_ESA_Admin_Guide_11_0/b_ESA_Admin_Guide_chapter_0100000.html#id_50726

17. Question 17 of 25

    Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?

    • AIt adds endpoints to identity groups dynamically
    • BIt allows the endpoint to authenticate with 802.1x or MAB
    • CIt allows CoA to be applied if the endpoint status is compliant
    • DIt verifies that the endpoint has the latest Microsoft security patches installed

    Show answer

    Correct answer: D

    How others answered

    • D52%
    • C38%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer should be C https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html step 3. Posture assessment happens. step 4. Session marked as Compliant. step 5. Change of Authorization (COA) triggered by posture status change leads to re-authentication of the endpoint to apply the next access level.

    Adapted from community discussion by MoII · 2021-11-01 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. M

       MoII

       2021-11-01

       21 upvotes

       Answer should be C https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215419-ise-session-management-and-posture.html step 3. Posture assessment happens. step 4. Session marked as Compliant. step 5. Change of Authorization (COA) triggered by posture status change leads to re-authentication of the endpoint to apply the next access level.

    2. D

       Dinges

       2021-07-07

       5 upvotes

       I would go for D Looks like dynamically assigning a device to a device group is done by profiling the device, not by running a compliance check by the posture service. So I would go for When endpoints are discovered on your network, they can be profiled dynamically based on the configured endpoint profiling policies, and assigned to the matching endpoint identity groups depending on their profiles. https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_identities.html

    3. S

       SegaMasterSystemAdmin

       2023-05-23

       Selected D4 upvotes

       Please stop voting for C, it is not the right answer. CoA is not a benefit, it's just the action as result of the compliance status whether it is compliant, noncompliant, or unknown. If you read the question carefully "Which benefit is provided by ensuring that an endpoint is compliant.." if checking for the latest MS security patches is what the posture policy is looking for, then that would be the benefit, answer is D.

    4. E

       Edy79

       2023-10-24

       2 upvotes

       It must be D. It cannot be C because CoA also happens if the endpoint is not compliant. " Validating a Posture Requirement Request Once the client (an endpoint) is authenticated on the network, the client can be granted limited access on the network. For example, the client can access remediation-only resources on the network. The NAC Agent that is installed on the client validates the requirements for an endpoint and the endpoint is moved to a compliant state upon successful validation of the requirements. If the endpoint satisfies the requirement, a compliance report will be sent to the Cisco ISE node that assumes the Policy Service persona and the run-time services triggers a Change of Authorization (CoA) for the posture compliant status. If the endpoint fails to satisfy the requirement, a noncompliance report will be sent to the Cisco ISE node that assumes the Policy Service persona and the run-time services triggers a CoA for the posture noncompliant status." source: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_pos_pol.html#wp1496783

18. Question 18 of 25

    An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which probe must be enabled for this type of profiling to work?

    • ASNMP
    • BNMAP
    • CDHCP
    • DNetFlow

    Show answer

    Correct answer: C

    How others answered

    • C45%
    • A28%
    • B25%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The answer is C, through DHCP Profiling. The OUI is part of the MAC address, which can be learned from the dhcp-client-identifier option 61.

    Adapted from community discussion by Jeeves69 · 2021-03-17 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation
    • cisco.com documentation
    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. J

       Jeeves69

       2021-03-17

       34 upvotes

       The answer is C, through DHCP Profiling. The OUI is part of the MAC address, which can be learned from the dhcp-client-identifier option 61.

    2. S

       semi1750

       2022-03-18

       7 upvotes

       I agree. NMAP scan is based on IP, any information collected during scan will be discarded if MAC-IP binding doesn't exist According to ISE profile design guide, "The dhcp-client-identifier typically provides the MAC address, which in turn provides the vendor OUI information through correlation from the MAC Address-OUI mapping table." under Procedure 25 Verify DHCP Probe Data https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456#toc-hId-2096149162

    3. M

       MariuszS

       2021-09-26

       4 upvotes

       It's not a question about how to get the OUI info but what to do when the OUI is interesting. So the answer is to run a NMAP scan - https://www.criticaldesign.net/post/cisco-ise-profiling "Network Scan (NMAP) Frequently NMAP is used only for certain device types that are not easy to identify. A good example is something like an HP endpoint. HP makes a million different endpoints and there does not appear to be much of a rhyme or reason to their MAC Address assignments. From the OUI, ISE will know it is an HP endpoint and ISE can automatically trigger an NMAP scan to gather more information."

    4. M

       madboy2

       2025-03-23

       Selected C2 upvotes

       Explanation: To automatically assign endpoints with a specific Organizationally Unique Identifier (OUI) into a new endpoint group, Cisco ISE needs to identify the MAC addresses of those endpoints. The DHCP probe extracts MAC addresses from DHCP request packets, allowing Cisco ISE to determine the OUI (first 24 bits of the MAC address) and categorize devices accordingly. Why not the other options? A. SNMP – Used for network device discovery, but not effective for identifying endpoint MAC addresses dynamically. B. NMAP – Performs active scanning but does not focus on OUI-based profiling. D. NetFlow – Provides traffic flow analysis, but does not extract MAC addresses from endpoint traffic.

19. Question 19 of 25

    An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?

    • ACisco Stealthwatch
    • BCisco Tetration
    • CCisco AMP
    • DCisco Umbrella

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    The solution to meet the requirements of an organization trying to implement micro-segmentation and gain visibility on applications within the network while maintaining and enforcing compliance is Cisco Tetration. Cisco Tetration is a data center security and application management solution that provides end-to-end visibility and control across multi-cloud and multi-segmented environments. It uses machine learning and big data analytics to gain real-time visibility into application behavior, and it provides micro-segmentation to enforce security policies on the network. This helps organizations to maintain and enforce compliance, protect their sensitive data, and reduce risk of security breaches.

    Adapted from community discussion by sull3y · 2024-08-10 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. D

       deathfrom

       2022-12-16

       8 upvotes

       B https://www.cisco.com/c/en_uk/products/security/tetration/index.html

    2. S

       sull3y

       2024-08-10

       5 upvotes

       The solution to meet the requirements of an organization trying to implement micro-segmentation and gain visibility on applications within the network while maintaining and enforcing compliance is Cisco Tetration. Cisco Tetration is a data center security and application management solution that provides end-to-end visibility and control across multi-cloud and multi-segmented environments. It uses machine learning and big data analytics to gain real-time visibility into application behavior, and it provides micro-segmentation to enforce security policies on the network. This helps organizations to maintain and enforce compliance, protect their sensitive data, and reduce risk of security breaches.

    3. J

       jccastiyo

       2023-05-19

       Selected B4 upvotes

       Tetration is the answer as Stealthwatch doesn't have capabilities for any kind of enforcement, only visibility.

    4. D

       disruptivespark

       2023-02-02

       4 upvotes

       B. Tetration - can enFORCE complianse and maintain compliance if workload moves. It can (and should) be used for on-prem workloads even if Tetration is in a cloud.

20. Question 20 of 25

    Select 2

    A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)

    • ARADIUS communication must be permitted between the ISE server and the domain controller.
    • BThe ISE account must be a domain administrator in Active Directory to perform JOIN operations.
    • CActive Directory only supports user authentication by using MSCHAPv2.
    • DLDAP communication must be permitted between the ISE server and the domain controller.
    • EActive Directory supports user and machine authentication by using MSCHAPv2.

    Show answer

    Correct answer: D, E

    How others answered

    • DE83%

    Explanation

    I would go for D,E as well according to this doc: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html#wp1079999 "MS-CHAPv2—Cisco ISE supports user and machine authentication against Active Directory using EAP-MSCHAPv2." "If there is a firewall between Cisco ISE and Active Directory, certain ports need to be opened to allow Cisco ISE to communicate with Active Directory. Ensure that the following default ports are open: LDAP 389 UDP (...amongst others)"

    Adapted from community discussion by PiX2 · 2024-03-08 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. P

       PiX2

       2024-03-08

       Selected D, E3 upvotes

       I would go for D,E as well according to this doc: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html#wp1079999 "MS-CHAPv2—Cisco ISE supports user and machine authentication against Active Directory using EAP-MSCHAPv2." "If there is a firewall between Cisco ISE and Active Directory, certain ports need to be opened to allow Cisco ISE to communicate with Active Directory. Ensure that the following default ports are open: LDAP 389 UDP (...amongst others)"

    2. A

       Anonymous983475

       2024-01-18

       Selected D, E4 upvotes

       ISE only authenticates the user it does not JOIN machines to the domain, so no admin account is needed. LDAP is used for communication with the Microsoft AD

    3. N

       nekkrokvlt

       2024-10-06

       5 upvotes

       Radius is between ISE and the NAD (network access device), not DC

    4. J

       Jessie45785

       2024-04-14

       Selected D, E2 upvotes

       A. RADIUS communication must be permitted between the ISE server and the domain controller. - NOT TRUE - this is only between Authenticator (switch / AP ) and Authentication Server (ie. ISE) B. The ISE account must be a domain administrator in Active Directory to perform JOIN operations. - NOT TRUE - it just need regular account no DC Admin privileges are necessary - such account is usually called service account C. Active Directory only supports user authentication by using MSCHAPv2. - NOT TURE - many other are supported as already mentioned below

21. Question 21 of 25

    An email administrator is setting up a new Cisco ESA. The administrator wants to enable the blocking of greymail for the end user. Which feature must the administrator enable first?

    • AIntelligent Multi-Scan
    • BAnti-Virus Filtering
    • CIP Reputation Filtering
    • DFile Analysis

    Show answer

    Correct answer: A

    How others answered

    • A55%
    • C45%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The Intelligent Multi-Scan feature enhances the scanning capabilities of the Cisco ESA by utilizing multiple AV engines and advanced analysis techniques to identify and block various types of threats - including malware, viruses, and phishing emails. While it may help in detecting and blocking graymail to an extent, it's not specifically designed for that purpose. To effectively block graymail, which typically involves emails from sources with poor reputation scores but may not necessarily contain malware or other malicious content, enabling the IP Reputation Filtering feature would be more suitable. IP Reputation Filtering helps to identify and block emails from sources with known poor reputations - which often includes sources associated with graymail. https://www.cisco.com/c/en/us/td/docs/security/esa/esa15-0/user_guide/b_ESA_Admin_Guide_15-0/b_ESA_Admin_Guide_12_1_chapter_0101.html Read the section "How Sender IP Reputation Filters Works"

    Adapted from community discussion by Tthurston1 · 2024-04-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. T

       Tthurston1

       2024-04-30

       3 upvotes

       The Intelligent Multi-Scan feature enhances the scanning capabilities of the Cisco ESA by utilizing multiple AV engines and advanced analysis techniques to identify and block various types of threats - including malware, viruses, and phishing emails. While it may help in detecting and blocking graymail to an extent, it's not specifically designed for that purpose. To effectively block graymail, which typically involves emails from sources with poor reputation scores but may not necessarily contain malware or other malicious content, enabling the IP Reputation Filtering feature would be more suitable. IP Reputation Filtering helps to identify and block emails from sources with known poor reputations - which often includes sources associated with graymail. https://www.cisco.com/c/en/us/td/docs/security/esa/esa15-0/user_guide/b_ESA_Admin_Guide_15-0/b_ESA_Admin_Guide_12_1_chapter_0101.html Read the section "How Sender IP Reputation Filters Works"

    2. L

       luisseijuro

       2023-02-10

       Selected A4 upvotes

       https://www.cisco.com/c/en/us/td/docs/security/esa/esa12-0/user_guide/b_ESA_Admin_Guide_12_0/b_ESA_Admin_Guide_chapter_01100.html#con_1192436

    3. R

       Rododendron2

       2024-05-19

       1 upvote

       It is A - specifically designed for that - Greymail engine. Issue of your statements is in understanding what greymail is. Overview of Graymail - as per link Graymail messages are messages that do not fit the definition of spam, for example, newsletters, mailing list subscriptions, social media notifications, and so on. These messages were of use at some point in time, but have subsequently diminished in value to the point where the end user no longer wants to receive them. The difference between graymail and spam is that the end user intentionally provided an email address at some point (for example, the end user subscribed to a newsletter on an e-commerce website or provided contact details to an organization during a conference) as opposed to spam, messages that the end user did not sign up for. https://www.cisco.com/c/en/us/td/docs/security/esa/esa13-5-1/user_guide/b_ESA_Admin_Guide_13-5-1/b_ESA_Admin_Guide_12_1_chapter_01110.html#id_101033

    4. N

       NoUserName1234

       2022-12-04

       3 upvotes

       Answer 'A' is correct: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjbkeqf2uD7AhUESuUKHTnDDrMQFnoECCQQAQ&url=https%3A%2F%2Fwww.cisco.com%2Fc%2Fen%2Fus%2Ftd%2Fdocs%2Fsecurity%2Fesa%2Fesa11-0%2Fuser_guide%2Fb_ESA_Admin_Guide%2Fb_ESA_Admin_Guide_chapter_01101.pdf&usg=AOvVaw2y8Tk0duu03elkbSJ45LZP

22. Question 22 of 25

    Select 2

    What are two benefits of Flexible NetFlow records? (Choose two.)

    • AThey provide accounting and billing enhancements.
    • BThey allow the user to configure flow information to perform customized traffic identification.
    • CThey provide monitoring of a wider range of IP packet information from Layer2 to 4.
    • DThey provide attack prevention by dropping the traffic.
    • EThey converge multiple accounting technologies into one accounting mechanism.

    Show answer

    Correct answer: B, E

    How others answered

    • BE83%
    • AB17%

    Explanation

    https://www.cisco.com/c/en/us/products/ios-nx-os-software/flexible-netflow/index.html Cisco IOS Flexible NetFlow benefits: Flexibility and scalability of flow data beyond traditional NetFlow Customized traffic identification ( B ) Ability to focus and monitor specific network behavior Ability to monitor a wider range of packet information, producing new information about network behavior ( look like C ) Enhanced network anomaly and security detection Convergence of multiple accounting technologies into one accounting mechanism. ( E ) So its B,C,E

    Adapted from community discussion by Moe1416 · 2023-06-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. W

       Webster21

       2023-05-21

       Selected B, E3 upvotes

       Cisco IOS Flexible NetFlow benefits: Flexibility and scalability of flow data beyond traditional NetFlow Customized traffic identification Ability to focus and monitor specific network behavior Ability to monitor a wider range of packet information, producing new information about network behavior Enhanced network anomaly and security detection Convergence of multiple accounting technologies into one accounting mechanism

    2. M

       Moe1416

       2023-06-18

       2 upvotes

       https://www.cisco.com/c/en/us/products/ios-nx-os-software/flexible-netflow/index.html Cisco IOS Flexible NetFlow benefits: Flexibility and scalability of flow data beyond traditional NetFlow Customized traffic identification ( B ) Ability to focus and monitor specific network behavior Ability to monitor a wider range of packet information, producing new information about network behavior ( look like C ) Enhanced network anomaly and security detection Convergence of multiple accounting technologies into one accounting mechanism. ( E ) So its B,C,E

    3. U

       ureis

       2023-06-29

       3 upvotes

       I found this: "With Deep Packet Inspection, different layer data can be anazled from layer "2 to layer 7" Ref: https://ipcisco.com/lesson/flexible-netflow/ So option C is wrong B, E are correct

    4. M

       MPoels

       2024-09-06

       2 upvotes

       Flexible NetFlow extends the capabilities of traditional NetFlow by allowing the collection of Layer 2 header information. Search for "match datalink" or "Layer 2" attributes: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-5/configuration_guide/nmgmt/b_165_nmgmt_9300_cg/b_165_nmgmt_9300_cg_chapter_01000.html

23. Question 23 of 25

    An engineer is trying to decide whether to use Cisco Umbrella. Cisco CloudLock. Cisco Stealthwatch. or Cisco AppDynamics Cloud Monitoring for visibility into data transfers as well as protection against data exfiltration. Which solution best meets these requirements?

    • ACisco AppDynamics Cloud Monitoring
    • BCisco CloudLock
    • CCisco Stealthwatch
    • DCisco Umbrella

    Show answer

    Correct answer: C

    How others answered

    • C40%
    • B33%
    • D27%

    Only 40% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "Protection against data exfiltration" Stealthwatch uses advanced machine learning and behavioral modeling techniques to establish a baseline of normal network behavior. It then identifies deviations from this baseline, helping detect suspicious data transfers and potential data exfiltration in real-time. It can also integrate with other security solutions, such as Cisco Firepower and Cisco Umbrella, to provide a more holistic security posture. https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/white-paper-c11-740605.html#:~:text=and%2Dcontrol%20communications%2C-,data%20exfiltration,-%2C%20and%20potentially%20unwanted

    Adapted from community discussion by ffaiz · 2023-06-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. S

       sull3y

       2023-01-19

       4 upvotes

       Cisco CloudLock (Option B) best meets the requirements for visibility into data transfers and protection against data exfiltration. Cisco CloudLock is a cloud-native security platform that provides visibility and control over data, users and infrastructure in the cloud. It offers a range of features including Cloud Data Loss Prevention (DLP), Cloud Access Security Broker (CASB) and Cloud Identity and Access Management (CIAM). It can detect and prevent data exfiltration, and also provide visibility into data transfers. While Cisco AppDynamics Cloud Monitoring (Option A) is a cloud-native monitoring solution that tracks the performance of cloud-based applications, Cisco Stealthwatch (Option C) is a network traffic analysis solution that provides visibility into network activity and detects threats, and Cisco Umbrella (Option D) is a secure internet gateway that provides protection against internet-based threats.

    2. F

       ffaiz

       2023-06-22

       Selected C2 upvotes

       "Protection against data exfiltration" Stealthwatch uses advanced machine learning and behavioral modeling techniques to establish a baseline of normal network behavior. It then identifies deviations from this baseline, helping detect suspicious data transfers and potential data exfiltration in real-time. It can also integrate with other security solutions, such as Cisco Firepower and Cisco Umbrella, to provide a more holistic security posture. https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/white-paper-c11-740605.html#:~:text=and%2Dcontrol%20communications%2C-,data%20exfiltration,-%2C%20and%20potentially%20unwanted

    3. L

       loser4fun

       2023-03-19

       2 upvotes

       B Cloudlock All of the mentioned solutions have different features and capabilities that can help with visibility and protection against data exfiltration. However, based on the specific requirements mentioned in the question, the solution that best meets them is Cisco CloudLock. Cisco CloudLock provides visibility and control over data in cloud applications, including data transfers and protection against data exfiltration. It offers real-time monitoring and alerting for data-related events and allows for granular policies to be applied to specific users, data types, and cloud applications. It also includes advanced threat detection capabilities, such as anomaly detection and machine learning-based analytics, to identify and mitigate potential data breaches.

    4. M

       Moe1416

       2022-12-19

       1 upvote

       Agree With you Cisco Umbrella and Cisco Cloudlock work together to secure access to the internet and usage of cloud apps. As a cloud-delivered service, Umbrella provides the first line of defense against threats on the internet, wherever users go. It provides organizations the visibility needed to protect internet access across all network devices, office locations, and roaming users. With Umbrella, customers can stop malware infections earlier, identify already-infected devices faster and prevent data exfiltration. Cisco Cloudlock is a Cloud Access Security Broker (CASB) that helps organizations to secure their identities, data, and applications in the cloud. It provides visibility and control over global cloud activities, enabling organizations to know who is doing what in their cloud applications, protecting against compromised accounts, insider threats, and malware. Cloudlock helps organizations identify and respond to data exposures and leakages as well as privacy and compliance violations.

24. Question 24 of 25

    Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?

    • ABYOD onboarding
    • BMAC authentication bypass
    • Cclient provisioning
    • DSimple Certificate Enrollment Protocol

    Show answer

    Correct answer: A

    How others answered

    • A42%
    • C35%
    • D23%

    Only 42% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A- is correct answer: https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-748642240 Endpoint Onboarding When leveraging ISE for BYOD, there are few actions that the endpoint needs to perform, which includes starting the communication with proper ISE node via the BYOD portal, creating digital certificate pairs, submitting certificate signing request, and configuring network profile. Some O/S has provisions for such functions natively while others require downloading and running an application temporarily to assist with the flow. Aside from Apple mobile devices (iOS), ISE leverages Network Setup Assistant (NSA or AKA Supplicant Provisioning Wizard (SPW)) to ease the BYOD flow for the users. NSA is an application that is downloaded to the endpoint either from the ISE itself or from app store for each of the endpoint types. NSA assists the user to generate certificate pair, install signed certificate, and configure network and proxy settings on the endpoint.

    Adapted from community discussion by Jessie45785 · 2023-06-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. S

       sull3y

       2023-01-25

       5 upvotes

       A. BYOD onboarding (Bring Your Own Device Onboarding) is a method used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources. This method allows employees to use their personal devices to connect to the corporate network, while ensuring that the devices meet certain security requirements. The process typically involves installing a certificate on the device, configuring the device's supplicant, and enrolling the device into a mobile device management (MDM) solution. This allows IT departments to manage and secure employee's devices while they are connected to the corporate network.

    2. L

       lnoraset

       2024-12-06

       Selected A4 upvotes

       BYOD (Bring Your Own Device) onboarding refers to the process of securely enrolling personal mobile devices (e.g., smartphones, tablets) into a network. During onboarding, the following actions typically occur: • Certificates are deployed to the device for secure authentication. • The supplicant (software responsible for 802.1X authentication) is configured to connect to the network. • Security policies are applied to ensure proper access control and compliance. This method is widely used in environments where employees or users bring their own devices and need secure access to enterprise network resources

    3. J

       Jessie45785

       2023-06-08

       Selected A2 upvotes

       A- is correct answer: https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-748642240 Endpoint Onboarding When leveraging ISE for BYOD, there are few actions that the endpoint needs to perform, which includes starting the communication with proper ISE node via the BYOD portal, creating digital certificate pairs, submitting certificate signing request, and configuring network profile. Some O/S has provisions for such functions natively while others require downloading and running an application temporarily to assist with the flow. Aside from Apple mobile devices (iOS), ISE leverages Network Setup Assistant (NSA or AKA Supplicant Provisioning Wizard (SPW)) to ease the BYOD flow for the users. NSA is an application that is downloaded to the endpoint either from the ISE itself or from app store for each of the endpoint types. NSA assists the user to generate certificate pair, install signed certificate, and configure network and proxy settings on the endpoint.

    4. 4

       4pelos

       2024-03-07

       3 upvotes

       Correct answer A: When supporting personal devices on a corporate network, you must protect network services and enterprise data by authenticating and authorizing users (employees, contractors, and guests) and their devices. Cisco ISE provides the tools you need to allow employees to securely use personal devices on a corporate network. Guests can add their personal devices to the network by running the native supplicant provisioning (Network Setup Assistant), or by adding their devices to the My Devices portal. Because native supplicant profiles are not available for all devices, users can use the My Devices portal to add these devices manually; or you can configure Bring Your Own Device (BYOD) rules to register these devices. Reference: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ISE_admin_guide_24/m_ise_devices_byod.html

25. Question 25 of 25

    An engineer needs behavioral analysis to detect malicious activity on the hosts, and is configuring the organization's public cloud to send telemetry using the cloud provider's mechanisms to a security device. Which mechanism should the engineer configure to accomplish this goal?

    • AsFlow
    • BNetFlow
    • Cmirror port
    • DVPC flow logs

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    It's B From the book SCOR 350-701: Stealthwatch Cloud is a Software as a Service (SaaS) cloud solution. You can use Stealthwatch Cloud to monitor many different public cloud environments, such as Amazon’s AWS, Google Cloud Platform, and Microsoft Azure. All of these cloud providers support their own implementation of NetFlow: ■■ In Amazon AWS, the equivalent of NetFlow is called VPC Flow Logs. You can obtain detailed information about VPC Flow Logs in AWS at https://docs.aws.amazon.com/ vpc/latest/userguide/flow-logs.html. ■■ Google Cloud Platform also supports VPC Flow Logs (or Google-branded GPC Flow Logs). You can obtain detailed information about VPC Flow Logs in Google Cloud Platform at https://cloud.google.com/vpc/docs/using-flow-logs. ■■ In Microsoft’s Azure, traffic flows are collected in Network Security Group (NSG) flow logs. NSG flow logs are a feature of Network Watcher. You can obtain additional information about Azure’s NSG flow logs and Network Watcher at https://docs.microsoft. com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

    Adapted from community discussion by VI_Vershinin · 2021-07-16 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • Cisco documentation
    • Cisco documentation
    • Cisco documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-701 or CertExamHQ.

    1. J

       jaciro11

       2021-11-13

       9 upvotes

       Its D I totally remember when I configure the first time the Stealthwatch Cloud

    2. V

       VI_Vershinin

       2021-07-16

       4 upvotes

       It's B From the book SCOR 350-701: Stealthwatch Cloud is a Software as a Service (SaaS) cloud solution. You can use Stealthwatch Cloud to monitor many different public cloud environments, such as Amazon’s AWS, Google Cloud Platform, and Microsoft Azure. All of these cloud providers support their own implementation of NetFlow: ■■ In Amazon AWS, the equivalent of NetFlow is called VPC Flow Logs. You can obtain detailed information about VPC Flow Logs in AWS at https://docs.aws.amazon.com/ vpc/latest/userguide/flow-logs.html. ■■ Google Cloud Platform also supports VPC Flow Logs (or Google-branded GPC Flow Logs). You can obtain detailed information about VPC Flow Logs in Google Cloud Platform at https://cloud.google.com/vpc/docs/using-flow-logs. ■■ In Microsoft’s Azure, traffic flows are collected in Network Security Group (NSG) flow logs. NSG flow logs are a feature of Network Watcher. You can obtain additional information about Azure’s NSG flow logs and Network Watcher at https://docs.microsoft. com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

    3. S

       semi1750

       2022-04-28

       3 upvotes

       D - VPC flow logs is answer The question asks "public cloud" and cisco made the following explanation. Cisco Telemetry Broker The Cisco Telemetry Broker is capable of ingesting network telemetry from a variety of telemetry sources, transforming their data formats, and then forwarding that telemetry to one or multiple destinations. For example, it can ingest any of the following: ● On-premises network telemetry, including NetFlow, SYSLOG, and IPFIX ● Cloud-based telemetry sources, such as AWS VPC flow logs and Azure NSG flow logs And it can forward that telemetry to any or all of the following example destinations: ● Analytics platforms, such as Hadoop ● Network management and automation platforms, such as Cisco DNA Center ● Security Information and Event Management (SIEM) platforms ● Storage/smart capture, such as Cisco Security Analytics and Logging (On-premises) https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/datasheet-c78-739398.html

    4. B

       brownbear505

       2022-02-22

       Selected D3 upvotes

       Specifically, AWS VPC Flow Logs contain the following information: ● Which IP entities are communicating inside and outside the VPC ● Which protocols (such as TCP and UDP) are being used ● How much traffic is sent and received by each entity ● Whether the flow was allowed or blocked by the security policy

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-701 practice, question 1 of 25