350-701 試験問題と解答 - 模擬練習 - 練習問題・模擬試験

Question No : 1
What provides the ability to program and monitor networks from somewhere other than the DNAC GUI?

A.NetFlow
B.desktop client
C.ASDM
D.API

正解:

Question No : 2
For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two)

A.Windows service
B.computer identity
C.user identity
D.Windows firewall
E.default browser

正解:

Question No : 3
Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose two)

A.Cisco FTDv configured in routed mode and managed by an FMCv installed in AWS
B.Cisco FTDv with one management interface and two traffic interfaces configured
C.Cisco FTDv configured in routed mode and managed by a physical FMC appliance on premises
D.Cisco FTDv with two management interfaces and one traffic interface configured
E.Cisco FTDv configured in routed mode and IPv6 configured

正解:

Question No : 4
What is the primary role of the Cisco Email Security Appliance?

A.Mail Submission Agent
B.Mail Transfer Agent
C.Mail Delivery Agent
D.Mail User Agent

正解:

Question No : 5
What is a characteristic of Cisco ASA Netflow v9 Secure Event Logging?

A.It tracks flow-create, flow-teardown, and flow-denied events.
B.It provides stateless IP flow tracking that exports all records of a specific flow.
C.It tracks the flow continuously and provides updates every 10 seconds.
D.Its events match all traffic classes in parallel.

正解:
Explanation:
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/monitor-nsel.html

Question No : 6
What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

A.authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
B.authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
C.secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

正解:
Explanation:
Configure a Crypto ISAKMP Key
In order to configure a preshared authentication key, enter the crypto isakmp key command in global configuration mode:
crypto isakmp key cisco123 address 172.16.1.1
https://community.cisco.com/t5/vpn/isakmp-with-0-0-0-0-dmvpn/td-p/4312380
It is a bad practice but it is valid. 172.16.0.0/16 the full range will be accepted as possible PEER
https://www.examtopics.com/discussions/cisco/view/46191-exam-350-701-topic-1-question-71-discussion/#:~:text=Command%20reference%20is%20not%20decisive,172.16.1.128%20cisco123%0ACSR%2D1(config)%23
Testing without a netmask shows that command interpretation has a preference for /16 and /24.
CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0
CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.0.0 [255.255.0.0] cisco123
CSR-1(config)#no crypto isakmp key cisco123 address 172.16.0.0
CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.0
CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.0 [255.255.255.0] cisco123 CSR-1(config)#no crypto isakmp key cisco123 address 172.16.1.0
CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.128
CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.128 cisco123 CSR-1(config)#

Question No : 7
An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed through the Cisco Umbrella network .
Which action tests the routing?

A.Ensure that the client computers are pointing to the on-premises DNS servers.
B.Enable the Intelligent Proxy to validate that traffic is being routed correctly.
C.Add the public IP address that the client computers are behind to a Core Identity.
D.Browse to http://welcome.umbrella.com/to validate that the new identity is working.

正解:

Question No : 8
Which feature is supported when deploying Cisco ASAv within AWS public cloud?

A.multiple context mode
B.user deployment of Layer 3 networks
C.IPv6
D.clustering

正解:
Explanation:
The ASAv on AWS supports the following features:
+ Support for Amazon EC2 C5 instances, the next generation of the Amazon EC2 Compute Optimized instance family.
+ Deployment in the Virtual Private Cloud (VPC)
+ Enhanced networking (SR-IOV) where available
+ Deployment from Amazon Marketplace
+ Maximum of four vCPUs per instance+ User deployment of L3 networks
+ Routed mode (default)Note: The Cisco Adaptive Security Virtual Appliance (ASAv) runs the same software as physical Cisco ASAs to deliver proven security functionality in a virtual form factor. The ASAv can be deployed in the public AWS cloud. It can then be configured to protect virtual and physical data center workloads that expand, contract, or shift their location over time.
Reference: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/asav/quick-start-book/asav-96qsg/asavaws.html

Question No : 9
Refer to the exhibit.

Which statement about the authentication protocol used in the configuration is true?

A.The authentication request contains only a password
B.The authentication request contains only a username
C.The authentication and authorization requests are grouped in a single packet
D.There are separate authentication and authorization request packets

正解:
Explanation:
This command uses RADIUS which combines authentication and authorization in one function (packet).

Question No : 10
Which API is used for Content Security?

A.NX-OS API
B.IOS XR API
C.OpenVuln API
D.AsyncOS API

正解:

Question No : 11
Which proxy mode must be used on Cisco WSA to redirect TCP traffic with WCCP?

A.transparent
B.redirection
C.forward
D.proxy gateway

正解:
Explanation:
Reference: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2013/CVDWebSecurityUsingCiscoWSADesignGuide-AUG13.pdf

Question No : 12
Which benefit does endpoint security provide the overall security posture of an organization?

A.It streamlines the incident response process to automatically perform digital forensics on the endpoint.
B.It allows the organization to mitigate web-based attacks as long as the user is active in the domain.
C.It allows the organization to detect and respond to threats at the edge of the network.
D.It allows the organization to detect and mitigate threats that the perimeter security devices do not detect.

正解:

Question No : 13
Which action controls the amount of URI text that is stored in Cisco WSA logs files?

A.Configure the datasecurityconfig command
B.Configure the advancedproxyconfig command with the HTTPS subcommand
C.Configure a small log-entry size.
D.Configure a maximum packet size.

正解:

Question No : 14
Refer to the exhibit.

What is a result of the configuration?

A.Traffic from the DMZ network is redirected
B.Traffic from the inside network is redirected
C.All TCP traffic is redirected
D.Traffic from the inside and DMZ networks is redirected

正解:
Explanation:
Reference: https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configurefirepower-00.html

Question No : 15
What two mechanisms are used to redirect users to a web portal to authenticate to ISE for guest services? (Choose two)

A.multiple factor auth
B.local web auth
C.single sign-on
D.central web auth
E.TACACS+

正解:

Cisco 350-701 問題練習