2023 Cisco 350-701 Exam Dumps Questions

1. Which two criteria must a certificate meet before the WSA uses it to decrypt application traffic? (Choose two.)

2. Refer to the exhibit.





Which command was used to display this output?

3. Which component of Cisco umbrella architecture increases reliability of the service?

4. How does DNS Tunneling exfiltrate data?

5. Which Cisco product is open, scalable, and built on IETF standards to allow multiple security products from Cisco and other vendors to share data and interoperate with each other?

6. How is Cisco Umbrella configured to log only security events?

7. Which posture assessment requirement provides options to the client for remediation and requires the remediation within a certain timeframe?

8. Which solution supports high availability in routed or transparent mode as well as in northbound and southbound deployments?

9. An engineer needs to configure an access control policy rule to always send traffic for inspection without using the default action.

Which action should be configured for this rule?

10. Which two authentication protocols are supported by the Cisco WSA? (Choose two.)

11. What is a key difference between Cisco Firepower and Cisco ASA?

12. Refer to the exhibit.





What does the API do when connected to a Cisco security appliance?

13. An administrator is trying to determine which applications are being used in the network but does not want the network devices to send metadata to Cisco Firepower.

Which feature should be used to accomplish this?

14. What is an advantage of network telemetry over SNMP pulls?

15. What is the role of an endpoint in protecting a user from a phishing attack?

16. Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

17. What is the purpose of the Decrypt for Application Detection feature within the WSA Decryption options?

18. What is the default action before identifying the URL during HTTPS inspection in Cisco Secure Firewall Threat Defense software?

19. What is an attribute of the DevSecOps process?

20. What does endpoint isolation in Cisco AMP for Endpoints security protect from?

21. Which Cisco security solution stops exfiltration using HTTPS?

22. An administrator configures a Cisco WSA to receive redirected traffic over ports 80 and 443. The organization requires that a network device with specific WSA integration capabilities be configured to send the traffic to the WSA to proxy the requests and increase visibility, while making this invisible to the users.

What must be done on the Cisco WSA to support these requirements?

23. An organization is using Cisco Firepower and Cisco Meraki MX for network security and needs to centrally manage cloud policies across these platforms.

Which software should be used to accomplish this goal?

24. DRAG DROP

Drag and drop the steps from the left into the correct order on the right to enable AppDynamics to monitor an EC2 instance in Amazon Web Services.

25. An organization has DHCP servers set up to allocate IP addresses to clients on the LAN.

What must be done to ensure the LAN switches prevent malicious DHCP traffic while also distributing IP addresses to the correct endpoints?

26. Which two probes are configured to gather attributes of connected endpoints using Cisco Identity Services Engine? (Choose two)

27. Which security product enables administrators to deploy Kubernetes clusters in air-gapped sites without needing Internet access?

28. Which feature is configured for managed devices in the device platform settings of the Firepower Management Center?

29. Which Cisco solution provides a comprehensive view of Internet domains. IP addresses, and autonomous systems to help pinpoint attackers and malicious infrastructures?

30. Which two configurations must be made on Cisco ISE and on Cisco TrustSec devices to force a session to be adjusted after a policy change is made? (Choose two)

31. Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?

32. DRAG DROP

Refer to the exhibit.





An engineer must configure a Cisco switch to perform PPP authentication via a TACACS server located at IP address 10.1.1.10. Authentication must fall back to the local database using the username Local User and password C1Sc0451069341l if the TACACS server is unreachable.

Drag and drop the commands from the left onto the corresponding configuration steps on the right.

33. An engineer is configuring 802.1X authentication on Cisco switches in the network and is using CoA as a mechanism.

Which port on the firewall must be opened to allow the CoA traffic to traverse the network?

34. What is the purpose of CA in a PKI?

35. Which attack type attempts to shut down a machine or network so that users are not able to access it?

36. What is the difference between deceptive phishing and spear phishing?

37. Which industry standard is used to integrate Cisco ISE and pxGrid to each other and with other interoperable security platforms?

38. What is a feature of Cisco NetFlow Secure Event Logging for Cisco ASAs?

39. Which security solution uses NetFlow to provide visibility across the network, data center, branch offices, and cloud?

40. During a recent security audit a Cisco IOS router with a working IPSEC configuration using IKEv1 was flagged for using a wildcard mask with the crypto isakmp key command The VPN peer is a SOHO router with a dynamically assigned IP address Dynamic DNS has been configured on the SOHO router to map the dynamic IP address to the host name of vpn sohoroutercompany.com.

In addition to the command crypto isakmp key Cisc425007536 hostname vpn.sohoroutercompany.com what other two commands are now required on the Cisco IOS router for the VPN to continue to function after the wildcard command is removed? (Choose two)

41. An engineer needs a solution for TACACS+ authentication and authorization for device administration.

The engineer also wants to enhance wired and wireless network security by requiring users and endpoints to use 802.1X, MAB, or WebAuth.

Which product meets all of these requirements?

42. When MAB is configured for use within the 802.1X environment, an administrator must create a policy that allows the devices onto the network.

Which information is used for the username and password?

43. An engineer is trying to securely connect to a router and wants to prevent insecure algorithms from being used.

However, the connection is failing.

Which action should be taken to accomplish this goal?

44. Which command enables 802.1X globally on a Cisco switch?

45. An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network.

Which action tests the routing?

46. Which API method and required attribute are used to add a device into Cisco DNA Center with the native API?

47. How is data sent out to the attacker during a DNS tunneling attack?

48. Which technology enables integration between Cisco ISE and other platforms to gather and share network and vulnerability data and SIEM and location information?

49. What provides total management for mobile and PC including managing inventory and device tracking, remote view, and live troubleshooting using the included native remote desktop support?

50. Which technology should be used to help prevent an attacker from stealing usernames and passwords of users within an organization?

51. A customer has various external HTTP resources available including Intranet Extranet and Internet, with a proxy configuration running in explicit mode.

Which method allows the client desktop browsers to be configured to select when to connect direct or when to use the proxy?

52. Refer to the exhibit.





A Cisco ISE administrator adds a new switch to an 802.1X deployment and has difficulty with some endpoints gaining access.

Most PCs and IP phones can connect and authenticate using their machine certificate credentials. However printer and video cameras cannot base d on the interface configuration provided, what must be to get these devices on to the network using Cisco ISE for authentication and authorization while maintaining security controls?

53. Which two components do southbound APIs use to communicate with downstream devices? (Choose two.)

54. Which type of data does the Cisco Stealthwatch system collect and analyze from routers, switches, and firewalls?

55. Which Cisco command enables authentication, authorization, and accounting globally so that CoA is supported on the device?

56. Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

57. DRAG DROP

Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.

58. Which two parameters are used to prevent a data breach in the cloud? (Choose two.)

59. Which two functions does the Cisco Advanced Phishing Protection solution perform in trying to protect from phishing attacks? (Choose two.)

60. What is a characteristic of an EDR solution and not of an EPP solution?

61. An organization has a Cisco ESA set up with policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation.

Which actions must be performed in order to provide this capability?

62. Which type of dashboard does Cisco DNA Center provide for complete control of the network?

63. What is the difference between a vulnerability and an exploit?

64. What is a difference between FlexVPN and DMVPN?

65. In which cloud services model is the tenant responsible for virtual machine OS patching?

66. Which feature is supported when deploying Cisco ASAv within AWS public cloud?

67. DoS attacks are categorized as what?

68. Which system facilitates deploying microsegmentation and multi-tenancy services with a policy-based container?

69. How does a WCCP-configured router identify if the Cisco WSA is functional?

70. An engineer configures new features within the Cisco Umbrella dashboard and wants to identify and proxy traffic that is categorized as risky domains and may contain safe and malicious content.

Which action accomplishes these objectives?

71. What is the difference between Cross-site Scripting and SQL Injection, attacks?

72. Which service allows a user export application usage and performance statistics with Cisco Application Visibility and control?

73. What is a description of microsegmentation?

74. Which SNMPv3 configuration must be used to support the strongest security possible?

75. Which type of algorithm provides the highest level of protection against brute-force attacks?

76. Which Cisco AMP file disposition valid?

77. Which two Cisco ISE components must be configured for BYOD? (Choose two.)

78. For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two)

79. Which feature is used in a push model to allow for session identification, host reauthentication, and session termination?

80. Refer to the exhibit,





Which command results in these messages when attempting to troubleshoot an IPsec VPN connection?

81. What is the purpose of the certificate signing request when adding a new certificate for a server?

82. An engineer must modify an existing remote access VPN using a Cisco AnyConnect Secure Mobility client solution and a Cisco Secure Firewall. Currently, all the traffic generate by the user Is sent to the VPN tunnel and the engineer must now exclude some servers and access them directly instead.

Which element must be modified to achieve this goat?

83. Which security solution protects users leveraging DNS-layer security?

84. Which type of API is being used when a controller within a software-defined network architecture dynamically makes configuration changes on switches within the network?

85. What is managed by Cisco Security Manager?

86. Which two kinds of attacks are prevented by multifactor authentication? (Choose two)

87. An engineer notices traffic interruption on the network. Upon further investigation, it is learned that broadcast packets have been flooding the network.

What must be configured, based on a predefined threshold, to address this issue?

88. An engineer needs to add protection for data in transit and have headers in the email message Which configuration is needed to accomplish this goal?

89. Client workstations are experiencing extremely poor response time. An engineer suspects that an attacker is eavesdropping and making independent connections while relaying messages between victims to make them think they are talking to each other over a private connection.

Which feature must be enabled and configured to provide relief from this type of attack?

90. What are the two types of managed Intercloud Fabric deployment models? (Choose two.)

91. An MDM provides which two advantages to an organization with regards to device management? (Choose two)

92. A network administrator has configured TACACS on a network device using the key Cisc0467380030 tor authentication purposes. However, users are unable to authenticate. TACACS server is reachable, but authentication is tailing.

Which configuration step must the administrator complete?

93. A security engineer must add destinations into a destination list in Cisco Umbrell a.

What describes the application of these changes?

94. Refer to the exhibit.





An administrator is adding a new Cisco FTD device to their network and wants to manage it with Cisco FMC.

The Cisco FTD is not behind a NAT device.

Which command is needed to enable this on the Cisco FTD?

95. Which type of protection encrypts RSA keys when they are exported and imported?

96. An engineer has been tasked with implementing a solution that can be leveraged for securing the cloud users, data, and applications. There is a requirement to use the Cisco cloud native CASB and cloud cybersecurity platform.

What should be used to meet these requirements?

97. An engineer is configuring cloud logging using a company-managed Amazon S3 bucket for Cisco Umbrella logs.

What benefit does this configuration provide for accessing log data?

98. Refer to the exhibit.





What is the function of the Python script code snippet for the Cisco ASA REST API?

99. A company identified a phishing vulnerability during a pentest What are two ways the company can protect employees from the attack? (Choose two.)

100. Which two features of Cisco Email Security can protect your organization against email threats? (Choose two)

101. A network engineer must monitor user and device behavior within the on-premises network. This data must be sent to the Cisco Stealthwatch Cloud analytics platform for analysis.

What must be done to meet this requirement using the Ubuntu-based VM appliance deployed in a VMware-based hypervisor?

102. What must be used to share data between multiple security products?

103. Which CoA response code is sent if an authorization state is changed successfully on a Cisco IOS device?

104. A Cisco AMP for Endpoints administrator configures a custom detection policy to add specific MD5 signatures. The configuration is created in the simple detection policy section, but it does not work

What is the reason for this failure?

105. DRAG DROP

Drag and drop the security solutions from the left onto the benefits they provide on the right.

106. What is the concept of Cl/CD pipelining?

107. What is the term for when an endpoint is associated to a provisioning WLAN that is shared with guest access, and the same guest portal is used as the BYOD portal?

108. What are two characteristics of the RESTful architecture used within Cisco DNA Center? (Choose two.)

109. What features does Cisco FTDv provide over ASAv?

110. Which solution stops unauthorized access to the system if a user's password is compromised?

111. Which feature is leveraged by advanced antimalware capabilities to be an effective endpomt protection platform?

112. A switch with Dynamic ARP Inspection enabled has received a spoofed ARP response on a trusted interface.

How does the switch behave in this situation?

113. A network engineer has entered the snmp-server user andy myv3 auth sha cisco priv aes 256 cisc0380739941 command and needs to send SNMP information to a host at 10.255.254.1.

Which command achieves this goal?

114. Refer to the exhibit.





All servers are in the same VLAN/Subnet. DNS Server-1 and DNS Server-2 must communicate with each other, and all servers must communicate with default gateway multilayer switch.

Which type of private VLAN ports should be configured to prevent communication between DNS servers and the file server?

115. What is the purpose of a denial-of-service attack?

116. An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of 172.19.20.24.

Which command on the hub will allow the administrator to accomplish this?

117. Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?

118. Refer to the exhibit





When configuring this access control rule in Cisco FMC, what happens with the traffic destined to the DMZ_jnside zone once the configuration is deployed?

119. What are two security benefits of an MDM deployment? (Choose two.)

120. Which two actions does the Cisco Identity Services Engine posture module provide that ensures endpoint security? (Choose two.)

121. In which two ways does the Cisco Advanced Phishing Protection solution protect users? (Choose two.)

122. Which Cisco platform processes behavior baselines, monitors for deviations, and reviews for malicious processes in data center traffic and servers while performing software vulnerability detection?

123. An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively u: of the default policy elements.

What else must be done to accomplish this task?

124. Which Cisco Umbrella package supports selective proxy for Inspection of traffic from risky domains?

125. What must be configured on Cisco Secure Endpoint to create a custom detection tile list to detect and quarantine future files?

126. Which Talos reputation center allows for tracking the reputation of IP addresses for email and web traffic?

127. A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing authentication and is unable to access the network.

Where should the administrator begin troubleshooting to verify the authentication details?

128. DRAG DROP

Drag and drop the common security threats from the left onto the definitions on the right.

129. Which type of attack is MFA an effective deterrent for?

130. Which deployment model is the most secure when considering risks to cloud adoption?

131. For a given policy in Cisco Umbrella, how should a customer block website based on a custom list?

132. How does Cisco Advanced Phishing Protection protect users?

133. Which parameter is required when configuring a Netflow exporter on a Cisco Router?

134. DRAG DROP

Drag and drop the posture assessment flow actions from the left into a sequence on the right.

135. What are two Trojan malware attacks? (Choose two)

136. Which Cisco security solution secures public, private, hybrid, and community clouds?

137. Why is it important for the organization to have an endpoint patching strategy?

138. Refer to the exhibit.





What is a result of the configuration?

139. What are two benefits of using an MDM solution? (Choose two.)

140. A university policy must allow open access to resources on the Internet for research, but internal workstations are exposed to malware.

Which Cisco AMP feature allows the engineering team to determine whether a file is installed on a selected few workstations?

141. Which Cisco product provides proactive endpoint protection and allows administrators to centrally

manage the deployment?

142. DRAG DROP

Drag and drop the cloud security assessment components from the left onto the definitions on the right.

143. What are the two most commonly used authentication factors in multifactor authentication? (Choose two)

144. What is a difference between an XSS attack and an SQL injection attack?

145. Which two solutions help combat social engineering and phishing at the endpoint level? (Choose two.)

146. Which portion of the network do EPP solutions solely focus on and EDR solutions do not?

147. Which command is used to log all events to a destination colector 209.165.201.107?

148. A network engineer entered the snmp-server user asmith myv7 auth sha cisco priv aes 256 cisc0xxxxxxxxx command and needs to send SNMP information to a host at 10.255.255.1.

Which command achieves this goal?

149. Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat?

150. What are two Detection and Analytics Engines of Cognitive Threat Analytics? (Choose two)

151. Which feature must be configured before implementing NetFlow on a router?

152. Which technology is used to improve web traffic performance by proxy caching?

153. What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an organization? (Choose two)

154. Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

155. What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?

156. What are two workload security models? (Choose two.)

157. Which Cisco security solution determines if an endpoint has the latest OS updates and patches installed on the system?

158. Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?

159. DRAG DROP

Drag and drop the features of Cisco ASA with Firepower from the left onto the benefits on the right.

160. What are two functionalities of northbound and southbound APIs within Cisco SDN architecture? (Choose two.)

161. Which two descriptions of AES encryption are true? (Choose two)

162. DRAG DROP

Drag and drop the Cisco CWS redirection options from the left onto the capabilities on the right.

163. An organization wants to reduce their attach surface for cloud applications. They want to understand application communications, detect abnormal application Behavior, and detect vulnerabilities within the applications.

Which action accomplishes this task?

164. Which Cisco solution extends network visibility, threat detection, and analytics to public cloud environments?

165. Refer to the exhibit.





Which statement about the authentication protocol used in the configuration is true?

166. DRAG DROP

Drag and drop the cryptographic algorithms for IPsec from the left onto the cryptographic processes on the right.

167. Which technology provides the benefit of Layer 3 through Layer 7 innovative deep packet inspection, enabling the platform to identify and output various applications within the network traffic flows?

168. An engineer must configure Cisco AMP for Endpoints so that it contains a list of files that should not be executed by users. These files must not be quarantined.

Which action meets this configuration requirement?

169. Based on the NIST 800-145 guide, which cloud architecture may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises?

170. Which Cisco DNA Center Intent API action is used to retrieve the number of devices known to a DNA Center?

171. DRAG DROP

Drag and drop the VPN functions from the left onto the description on the right.

172. Which statement describes a serverless application?

173. An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a connection being established. The solution must be able to block certain applications from being used within the network.

Which product should be used to accomplish this goal?

174. Refer to the exhibit.





What function does the API key perform while working with https://api.amp.cisco.com/v1/computers?

175. What is a function of the Layer 4 Traffic Monitor on a Cisco WSA?

176. A network engineer must create an access control list on a Cisco Adaptive Security Appliance firewall. The access control list must permit HTTP traffic to the internet from the organization's inside network 192.168.1.0/24.

Which IOS command must oe used to create the access control list?

A)





B)





C)





D)

177. Which information is required when adding a device to Firepower Management Center?

178. Which Cisco network security device supports contextual awareness?

179. With regard to RFC 5176 compliance, how many IETF attributes are supported by the RADIUS CoA feature?

180. What are two list types within AMP for Endpoints Outbreak Control? (Choose two)

181. An administrator is adding a new switch onto the network and has configured AAA for network access control. When testing the configuration, the RADIUS authenticates to Cisco ISE but is being rejected.

Why is the ip radius source-interface command needed for this configuration?

182. What is the primary benefit of deploying an ESA in hybrid mode?

183. Refer to the exhibit.





An engineer is implementing a certificate based VPN.

What is the result of the existing configuration?

184. An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed.

What must be done to ensure

that all devices can communicate together?

185. How does Cisco Umbrella archive logs to an enterprise owned storage?

186. Which ASA deployment mode can provide separation of management on a shared appliance?

187. What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

188. A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen on the network.

Which two actions should be selected to allow the traffic to pass without inspection? (Choose two)