350-701 Exam Dumps - Cisco CCNP Security Questions and Answers

 EPP solutions solely focus on the perimeter of the network, which is the boundary between the internal and external networks. The perimeter is where most of the endpoints, such as laptops, desktops, mobile devices, and IoT devices, are located and connected to the network. EPP solutions aim to prevent, detect, and remediate security threats on these endpoints by using technologies such as antivirus, data encryption, and data loss prevention. EPP solutions rely on signatures and other indicators of intrusion by known threats to block malicious activity and malware on the endpoints12.

EDR solutions do not focus on the perimeter, but rather on the entire network, including the core and the East-West gateways. The core is the central part of the network that connects different segments and provides high-speed data transmission. The East-West gateways are the points of communication between different segments within the network, such as between different data centers or cloud environments. EDR solutions provide continuous and comprehensive visibility into endpoint activities across the network by using threat hunting tools for behavior-based endpoint threat detection. EDR solutions monitor and record endpoint data, detect anomalies and malicious behavior, and respond to threats that EPP and other security tools did not catch. EDR solutions also enable security teams to proactively investigate and contain incidents by using incident data search, alert triage, threat validation, and malicious activity blocking134.

References := 1: EPP vs. EDR: Why You Need Both - CrowdStrike 2: Comparing endpoint security: EPP vs. EDR vs. XDR | Infosec 3: EDR vs EPP: What is the Difference? - Exabeam 4: EDR vs EPP: Key Features, Differences, and How They Work Together

Explanation

Cisco Context Directory Agent (CDA) is a mechanism that maps IP Addresses to usernames in order to allow

security gateways to understand which user is using which IP Address in the network, so those security

gateways can now make decisions based on those users (or the groups to which the users belong to).

CDA runs on a Cisco Linux machine; monitors in real time a collection of Active Directory domain controller (DC) machines for authentication-related events that generally indicate user logins; learns, analyzes, and caches mappings of IP Addresses and user identities in its database; and makes the latest mappings available to its consumer devices.

Cisco ISE’s BYOD onboarding workflow uses Simple Certificate Enrollment Protocol to request and obtain a unique endpoint certificate from the configured certificate authority, including the ISE internal CA when that service is selected. SCEP is specifically designed for certificate-enrollment and related PKI operations. Therefore, B is correct. CMP is another certificate-management protocol, but it is not the protocol used by the ISE BYOD provisioning workflow described here. SFTP securely transfers files and cannot perform certificate enrollment. OCSP determines whether an already-issued certificate has been revoked; it does not request or issue certificates. The resulting per-device certificate establishes a unique endpoint identity and supports certificate-based network authentication, commonly through EAP-TLS, after the BYOD onboarding process is completed. Cisco SCEP overview

================

CoA-ACK is the CoA response code that is sent if an authorization state is changed successfully on a Cisco IOS device. CoA-ACK stands for CoA acknowledgment, which indicates that the device has received and processed the CoA request from the server and applied the new authorization settings to the session. The attributes returned within a CoA-ACK can vary based on the CoA request, such as session reauthentication, session termination, or session modification. The other options are not correct because they are not valid CoA response codes. CoA-NCL, CoA-NAK, and CoA-MAV are not defined in RFC 5176, which specifies the CoA protocol. CoA-NAK is the closest option, but it stands for CoA non-acknowledgment, which indicates that the device has rejected the CoA request from the server due to some error or inconsistency. References :=

Some possible references are:

RADIUS Change of Authorization - Cisco

Security and VPN Configuration Guide, Cisco IOS XE 17.x

RFC 5176 - Dynamic Authorization Extensions to Remote Authentication Dial In User Service (RADIUS)

 Microsegmentation is a method of securing multi cloud data centers using granular segmentation rules for the individual workload or application, reducing the risk of an attacker moving from one compromised workload or application to another1. Microsegmentation with Cisco ACI enables you to automatically assign endpoints to logical security zones called endpoint groups (EPGs). These EPGs are based on various network-based or virtual machine (VM)-based attributes2. Microsegmentation is also referred to as application segmentation or east-west segmentation in a multicloud data center1. References: 1: What Is Micro-Segmentation? - Cisco 2: Microsegmentation with Cisco ACI

Explanation

Explanation

Many enterprises prefer to deploy development workloads in the public cloud, primarily for convenience and

faster deployment. This approach can cause concern for IT administrators, who must control the flow of IT

traffic and spending and help ensure the security of data and intellectual property. Without the proper controls,

data and intellectual property can escape this oversight. The Cisco Intercloud Fabric solution helps control this

shadow IT, discovering resources deployed in the public cloud outside IT control and placing these resources

under Cisco Intercloud Fabric control.

Cisco Intercloud Fabric addresses the cloud deployment requirements appropriate for two hybrid cloud

deployment models: Enterprise Managed (an enterprise manages its own cloud environments) and Service

Provider Managed (the service provider administers and controls all cloud resources).

When the Cisco Secure Firewall downloads threat intelligence updates from Cisco Talos, it is engaged in " consumption. " This term refers to the process of receiving and utilizing threat intelligence data to enhance security measures. Cisco Talos provides comprehensive threat intelligence that Cisco Secure Firewall consumes to update its threat detection and prevention capabilities.

Cisco Secure Email Threat Defense public APIs require the API key in the x-api-key request header in addition to the authorization mechanism used for the request. Cisco’s Message Search API documentation states that API keys are created under Administration > API Clients and that rate limiting is applied by sending x-api-key in request headers. The API error table also identifies a missing x-api-key as a forbidden-request condition. Therefore, option A is correct. A client secret is used when obtaining credentials or tokens and should not be substituted as an arbitrary request header. token-id and x-auth-token are not the documented headers for this API workflow. The external application must preserve the bearer token and add the API-key header to every applicable call. Cisco API documentation verifies this requirement.

================

The W32/AutoRun worm is a type of malware that spreads through removable drives, such as USB flash drives, and modifies the autorun.inf file to execute itself when the drive is inserted. The worm also attempts to connect to a remote server and download additional malicious files. One of the features of this worm is that it generates random domain names based on the current date and time, and sends DNS requests to these domains. This is a technique to evade detection and analysis, as well as to communicate with the command and control server. The DNS requests generated by the worm have a distinctive pattern, such as the length of the domain name, the number of subdomains, and the use of redacted characters. By comparing these features to the expected behavior of normal DNS requests, security analysts can identify the presence of the worm and block its traffic. References :=

Some possible references are:

W32/AutoRun worm

DNS requests malicious attack

Four major DNS attack types and how to mitigate them

Cisco Secure Email Threat Defense uses Secondary Gateway mode when inbound mail first reaches an additional gateway and then passes to Secure Email Threat Defense before final delivery. In this scenario, the existing Cisco Secure Email Gateways are the Internet-facing termination point, and Secure Email Threat Defense is downstream of them but upstream of the cloud mail platform. That sequence exactly matches Secondary Gateway mode. Primary Gateway mode would place Secure Email Threat Defense first and require inbound mail to reach it directly. Primary with Additional Gateway would also place Secure Email Threat Defense before another gateway, reversing the stated design. “Secondary with Additional Gateway” is not the documented flow required for the described single upstream gateway layer. Therefore, the correct incoming-traffic domain setting is Secondary Gateway. Cisco Secure Email Threat Defense mail-flow modes

The overall score is a composite risk judgment, not a simple average of the visible Lexical, TLD, Geo Popularity, and Keyword values. The decisive evidence is the Umbrella Block Status at 100/100, the Malware Block List label, the Malware security category, and the explicit High Risk classification. Blank Recent IP, ASN, and registrant fields can occur when a domain is not currently resolving; they do not override reputation or block-list intelligence. Thus, option B correctly reconciles the score with the exhibit. Option A invents a rendering error. Option C ignores the stronger Umbrella block signal, and option D incorrectly treats a Dispute Categorization link as proof that the verdict is contested. Cisco defines 100 as the highest Investigate risk and explains that scores derive from multiple domain and request characteristics. Cisco risk-score documentation confirms this model.

================

A destination list is a list of internet destinations: domains, URLs, and CIDRs. To control identity access to specific destinations, you can add destination lists to Umbrella and then select them when configuring your Web and DNS policies12. When you add or edit a destination list, the changes are applied immediately if the destination list is part of a policy3. This means that any identities that are associated with the policy will be affected by the changes in the destination list. You do not need to save the configuration or remove the destination list from the policy to apply the changes. However, you do need to have the appropriate user role to manage destination lists. The user role of Block Page Bypass or higher is needed to perform these changes4. References :=

Manage Destination Lists - Umbrella User Guide

Manage Destination Lists - Umbrella SIG User Guide

Add a Destination List - Umbrella User Guide

Add a DNS Destination List - Umbrella SIG User Guide

Cisco Security Intelligence is a feature that allows you to block or monitor traffic based on IP addresses or domain names that are known to be malicious or suspicious. Cisco Security Intelligence requires a Protect license on the Cisco Next Generation Intrusion Prevention System (NGIPS), which is part of the Firepower Threat Defense (FTD) software. A Protect license allows you to perform intrusion detection and prevention, file control, and Security Intelligence filtering1. The other license options (control, malware, and URL filtering) do not enable Cisco Security Intelligence on the NGIPS. References:

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, section “Security Intelligence”

Firepower Management Center Configuration Guide, Version 6.0, section “Licensing the Firepower System”

Explanation

A data breach is the intentional or unintentional release of secure or private/confidential information to an

untrusted environment.

When your credentials have been compromised, it means someone other than you may be in possession of your account information, such as your username and/or password.