350-701 Exam Dumps - Cisco CCNP Security Questions and Answers

Explanation

Cisco Hybrid Email Security is a unique service offering that combines a cloud-based email security deployment

with an appliance-based email security deployment (on premises) to provide maximum choice and control for

your organization. The cloud-based infrastructure is typically used for inbound email cleansing, while the onpremises appliances provide granular control – protecting sensitive information with data loss

prevention (DLP) and encryption technologies.

Explanation

Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also

known as posture, of all the endpoints that are connecting to a network for compliance with corporate security

policies.

A posture policy is a collection of posture requirements that are associated with one or more identity groups and

operating systems.

Posture-policy requirements can be set to mandatory, optional, or audit types in posture policies.

+ If a mandatory requirement fails, the user will be moved to Non-Compliant state

+ If an optional requirement fails, the user is allowed to skip the specified optional requirements and the user

is moved to Compliant state

This Qdid not clearly specify the type of posture policy requirement (mandatory or optional) is not met so the

user can be in Non-compliant or compliant state. But “noncompliant” is the best answer here.

The event explicitly reports Audit mode and states that the malicious file was not quarantined, making B correct and C false. Audit mode records detections without applying the normal blocking or quarantine action. The telemetry also records the file as created and executed, identifies winword.exe as its parent, and shows outbound TCP and DNS activity to external infrastructure; therefore, D accurately summarizes the observed execution chain. Cisco explains that Secure Endpoint malware events can include information captured at execution time, including the file path and invoking application, in its file and malware event guidance. The retrospective verdict means a previously unknown file was later classified as malicious, not that signature updates were infrequent. Nothing in the exhibit indicates that winword.exe was allow-listed. Thus, B and D are supported directly by the evidence.

================

IETF RADIUS attribute 31 is Calling-Station-ID, which commonly carries the endpoint MAC address. Consequently, A is the only option that matches the attribute number stated in the requirement. Cisco ISE can use this endpoint identifier to correlate authentication context and locate the appropriate active session when issuing a Change of Authorization disconnect or reauthorization; Cisco’s monitoring guide confirms that CoA requires a MAC address or session ID. The ISE Administrator Guide explicitly identifies Calling-Station-ID as attribute 31. Message-Authenticator protects packet integrity; it is not attribute 31. Acct-Session-ID has a different attribute number, while NAS-Port-ID identifies the access port. Thus, configuring Calling-Station-ID satisfies the stated identification requirement.

================

Explanation

Explanation

Cisco IOS public key infrastructure (PKI) provides certificate management to support security protocols such as IP Security (IPSec), secure shell (SSH), and secure socket layer (SSL). This module identifies and describes concepts that are needed to understand, plan for, and implement a PKI.

A PKI is composed of the following entities: …

– A distribution mechanism (such as Lightweight Directory Access Protocol [LDAP] or HTTP) for certificate revocation lists (CRLs)

The crypto isakmp identity hostname command is required to define the identity used by the router when participating in the Internet Key Exchange protocol. This command is needed when you specify preshared keys for authentication. The ip name-server < DNS Server IP Address > command is required to specify the IP address of the DNS server that can resolve the FQDN of the remote peer. This command is needed when you use the crypto isakmp key command with the hostname option instead of the address option. The other commands are not required or correct for this scenario. References: 1, 2, 3

A teardrop attack is a type of DoS attack that uses fragmented packets in an attempt to crash a target machine. The attacker sends IP packets that are deliberately malformed, such that the fragments overlap or have invalid offsets. When the target machine tries to reassemble the packets, it encounters an error or a buffer overflow, resulting in a system crash or a denial of service. Teardrop attacks exploit a vulnerability in the TCP/IP fragmentation reassembly process, which is responsible for splitting and recombining large packets that exceed the maximum transmission unit (MTU) size. Teardrop attacks can affect various operating systems, such as Windows, Linux, and BSD, depending on the implementation of the TCP/IP stack. Teardrop attacks are also known as IP fragmentation attacks or overlapping fragment attacks. References:

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 5: Securing the Cloud, Lesson 5.2: Cloud Security Threats, Topic 5.2.2: DoS Attacks

What is an IP Fragmentation Attack (Teardrop ICMP/UDP)

Teardrop Attack - Radware

What Is a Teardrop Attack? | F5

AES encryption is a symmetric block cipher algorithm that uses a single key to encrypt and decrypt data. It is more secure than 3DES, which is an older and slower algorithm that encrypts and decrypts a key three times in sequence. AES can use different key sizes, such as 128, 192, or 256 bits, depending on the security level required. The longer the key, the more rounds of encryption and decryption are performed, making it harder to break. AES encryption is based on a substitution-permutation network, which consists of a series of operations that transform the input data into the output data using the key. References :=

https://www.simplilearn.com/tutorials/cryptography-tutorial/aes-encryption

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Explanation

Explanation

Telemetry – Information and/or data that provides awareness and visibility into what is occurring on the network

at any given time from networking devices, appliances, applications or servers in which the core function of the

device is not to generate security alerts designed to detect unwanted or malicious activity from computer

networks.

Explanation

Umbrella Roaming is a cloud-delivered security service for Cisco’s next-generation firewall. It protects your employees even when they are off the VPN.