Cisco CCNP 350-701 SCOR Practice Exam

• A. It streamlines the incident response process to automatically perform digital forensics on the endpoint.
• B. It allows the organization to mitigate web-based attacks as long as the user is active in the domain.
• C. It allows the organization to detect and respond to threats at the edge of the network.
• D. It allows the organization to detect and mitigate threats that the perimeter security devices do not detect. Correct answer

Endpoint security enhances the overall security posture by detecting and mitigating threats that perimeter security devices do not detect, which is crucial for comprehensive security coverage.

• A. Exchange Correct answer
• B. Pull messaging Correct answer
• C. Binding
• D. Correlation
• E. Mitigating

TAXII (Trusted Automated eXchange of Indicator Information) supports functions such as Exchange and Pull messaging, which are essential for sharing threat intelligence.

• A. AES-GCM Correct answer
• B. SHA-96
• C. AES-256
• D. SHA-384

AES-GCM is a widely accepted encryption and authentication algorithm used for data plane communication, making it the correct choice for this question.

• A. Rootkit Installation
• B. SQL Injection
• C. Phishing Attack
• D. Man-in-the-Middle Attack Correct answer

A Man-in-the-Middle Attack is a common threat that can exploit the connection between ASA1 and Cloud1 by intercepting and potentially altering the communication between the two, especially if IP addresses are exposed. SQL Injection (B) and Rootkit Installation (A) are not directly related to the exposure of IP addresses in a network connection context. Phishing Attack (C) typically targets users rather than exploiting network connections directly. Therefore, C is the most relevant and correct option.

• A. asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv des ciscXXXXXXXX asa-host (config)#snmp-server host inside 10.255.254.1 version 3 andy
• B. asa-host(config)#snmp-server group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy
• C. asa-host(config)#snmpserver group myv3 v3 noauth asa-host(config)#snmp-server user andy myv3 auth sha cisco priv 3des ciscXXXXXXXX asa-host(config)#snmp-server host inside 10.255.254.1 version 3 andy
• D. asa-host(config)#snmp-server group myv3 v3 priv asa-host(config)#snmp-server user andy myv3 auth sha cisco priv aes 256 ciscXXXXXXXX asa-host (config)#snmp-server host inside 10.255.254.1 version 3 andy Correct answer

The configuration in option D uses SNMPv3 with both authentication (SHA) and encryption (AES 256), which provides the highest level of security as per SNMPv3 standards.

• A. routed mode
• B. transparent mode
• C. multiple context mode Correct answer
• D. multiple zone mode

Multiple context mode allows for separate management of security services on a shared appliance, which meets the requirements stated in the question.

• A. They allow the user to configure flow information to perform customized traffic identification Correct answer
• B. They provide attack prevention by dropping the traffic
• C. They provide accounting and billing enhancements
• D. They converge multiple accounting technologies into one accounting mechanism Correct answer
• E. They provide monitoring of a wider range of IP packet information from Layer 2 to 4

Flexible NetFlow records allow for customized traffic identification and can converge multiple accounting technologies into one mechanism, which are recognized advantages in the context of Cisco's security technologies.

• A. ISP in the Internet
• B. WEB1 in the DMZ
• C. FW1 in the DMZ Correct answer
• D. SW1 in the Internal Network

Option C, 'FW1 in the DMZ', is correct because a firewall (FW1) is specifically designed to control access between different network segments, including the Internet and the internal network, while also providing intrusion prevention capabilities. The other options do not fulfill both roles: A (SW1 in the Internal Network) is a switch and does not provide firewall or intrusion prevention; B (WEB1 in the DMZ) is likely a web server, which does not control access; D (ISP in the Internet) refers to an Internet Service Provider, which does not provide direct control over access to the internal network.

• A. Public Cloud
• B. Hybrid Cloud
• C. Community Cloud
• D. Private Cloud Correct answer

The Private Cloud model is considered the most secure deployment model for cloud adoption due to its dedicated resources and enhanced control over security measures.

• A. Cisco Umbrella
• B. Cisco Cloud Email Security
• C. Cisco NGFW
• D. Cisco Cloudlock Correct answer

Cisco Cloudlock is the Cisco cloud-native CASB solution designed to secure cloud users, data, and applications, making it the appropriate choice for the given requirements.

• A. IaaS (Infrastructure as a Service) Correct answer
• B. PaaS (Platform as a Service)
• C. FaaS (Function as a Service)
• D. SaaS (Software as a Service)

The option 'C: IaaS (Infrastructure as a Service)' is correct because IaaS provides virtualized computing resources over the internet, which aligns with the concept of a private cloud segment that typically offers infrastructure management and security devices. The other options are not correct because: 'A: SaaS' refers to software applications delivered over the internet, 'B: PaaS' refers to platforms for developing applications, and 'D: FaaS' refers to serverless computing, none of which specifically describe the infrastructure aspect of a private cloud.

• A. Ensure that the client computers are pointing to the on-premises DNS servers.
• B. Enable the Intelligent Proxy to validate that traffic is being routed correctly.
• C. Add the public IP address that the client computers are behind to a Core Identity.
• D. Browse to http://welcome.umbrella.com/ to validate that the new identity is working. Correct answer

Browsing to http://welcome.umbrella.com/ is a standard method to verify that traffic is being routed through the Cisco Umbrella network after configuring a new network identity.

• A. Set content settings to High
• B. Configure the intelligent proxy. Correct answer
• C. Use destination block lists.
• D. Configure application block lists.

The Umbrella intelligent proxy enables deep packet inspection and content analysis to distinguish between malicious and legitimate traffic on the same domains. It inspects actual content being downloaded to detect and block only the malicious payloads, while allowing legitimate web traffic to pass through—providing granular control beyond simple DNS blocking.

• A. Configure malware scanning on ASA1. Correct answer
• B. Enable URL filtering on SW1.
• C. Activate TLS decryption on PC1 and PC2.
• D. Implement block listing on R1.

Option A, 'Configure malware scanning on ASA1,' is correct because it directly addresses the need to inspect web traffic for malware before it reaches the internet. The ASA (Adaptive Security Appliance) is designed to provide security features such as malware scanning. The other options do not directly relate to inspecting web traffic for malware: Option B refers to URL filtering, which is not specifically for malware; Option D discusses block listing, which is not a malware inspection method; and Option C involves TLS decryption, which is not a direct method for malware scanning but rather a way to inspect encrypted traffic.

• A. It provides operating system patches on the endpoints for security
• B. It provides flow-based visibility for the endpoints network connections
• C. It enables behavioral analysis to be used for the endpoints
• D. It protects endpoint systems through application control and real-time scanning Correct answer

Cisco Secure Endpoint provides protection through application control and real-time scanning, which is a key feature of the solution.

• A. when there is a need for traditional anti-malware detection
• B. when there is no need to have the solution centrally managed
• C. when there is no firewall on the network
• D. when there is a need to have more advanced detection capabilities Correct answer

An Endpoint Detection and Response (EDR) solution is designed for advanced detection capabilities, which is a key differentiator from traditional Endpoint Protection Platforms (EPP).

• A. blocked ports
• B. simple custom detections Correct answer
• C. command and control
• D. allowed applications Correct answer
• E. URL

Cisco Secure Endpoint Outbreak Control uses **simple custom detections** to rapidly deploy custom signatures against emerging threats, and **allowed applications** whitelists to restrict execution to only trusted binaries. Together they contain outbreaks by blocking malware while permitting legitimate software.

• A. data exfiltration Correct answer
• B. command and control communication Correct answer
• C. intelligent proxy
• D. snort
• E. URL categorization

Cognitive Threat Analytics includes engines for detecting data exfiltration and command and control communication, which are critical for identifying security threats.

• A. To prevent man-in-the-middle attacks from being successful
• B. To prevent DoS attacks from being successful.
• C. To prevent brute force attacks from being successful. Correct answer
• D. To prevent phishing attacks from being successful.

Implementing MFA is crucial in preventing brute force attacks, as it adds an additional layer of security beyond just passwords, making it significantly harder for attackers to gain unauthorized access.

• A. BYOD onboarding Correct answer
• B. Simple Certificate Enrollment Protocol
• C. Client provisioning
• D. MAC authentication bypass

BYOD (Bring Your Own Device) onboarding automates certificate distribution and supplicant installation on personally-owned mobile devices. It provisions employees' devices with the necessary 802.1X credentials and security clients to enable seamless network authentication without manual per-device configuration, streamlining mobile access for BYOD programs.