CCNP Security Flashcards by Lucas Persell

What are two list types within Cisco AMP for Endpoint Outbreak Control? (Choose two)

A. blocked ports

B. simple custom detections

C. command and control

D. allowed applications

E. URL

How well did you know this?

Not at all

Perfectly

Which command enables 802.1x globally on a Cisco switch?

A. dot1x system-auth-control

B. dot1x pae authenticator

C. authentication port-control auto

D. aaa new-model

How well did you know this?

Not at all

Perfectly

What is the function of Cisco Cloudlock for data security?

A. data loss prevention

B. controls malicious cloud apps

C. detects anomalies

D. user and entity behavior analytics

How well did you know this?

Not at all

Perfectly

For which two conditions can an endpoint be checked using ISE posture assessment? (Choose two)

A. computer identity

B. Windows service

C. user identity

D. Windows Firewall

E. default browser

How well did you know this?

Not at all

Perfectly

What is a characteristic of Dynamic ARP Inspection?

A. DAI determines the validity of an ARP packet based on valid IP to MAC address bindings from the DHCP snooping binding database.

B. In a typical network, make all ports as trusted except for the ports connecting to switches, which are untrusted.

C. DAI associates a trust state with each switch.

D. DAI intercepts all ARP requests and responses on trusted ports only.

How well did you know this?

Not at all

Perfectly

Which Cisco product provides endpoint protection and allows administrators to centrally manage the deployment?

A. NGFW

B. AMP

C. WSA

D. ESA

How well did you know this?

Not at all

Perfectly

Where are individual sites specified to be blacklisted in Cisco Umbrella?

A. application settings

B. content categories

C. security settings

D. destination lists

How well did you know this?

Not at all

Perfectly

Which Statement about IOS zone-based firewalls is true?

A. An unassigned interface can communicate with assigned interfaces.

B. Only one interface can be assigned to a zone

C. An interface can be assigned to multiple zones

D. An interface can be assigned only to one zone

How well did you know this?

Not at all

Perfectly

Which two activities can be done using Cisco DNA Center?

A. DHCP

B. design

C. accounting

D. DNS

E. Provisioning

How well did you know this?

Not at all

Perfectly

Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?

A. RSA SecureID

B. Internal Database

C. Active Directory

D. LDAP

How well did you know this?

Not at all

Perfectly

Which VPN technology can support a multivendor environment and secure traffic between sites?

A. SSL VPN

B. GET VPN

C. FlexVPN

D. DMVPN

How well did you know this?

Not at all

Perfectly

Which SNMPv3 Configuration must be used to support the strongest security possible?

aes 256

How well did you know this?

Not at all

Perfectly

Which solution combines Cisco IOS and IOS XE components to enable administrators to recognize applications, collect and send network metrics to Cisco Prime and other 3rd party management tools, and prioritize application traffic?

A. Cisco Security Intelligence

B. Cisco Application Visibility and Control

C. Cisco Model Driven Telemetry

D. Cisco DNA Center

How well did you know this?

Not at all

Perfectly

Which two endpoint measures are sued to minimize the chances of falling victim to phishing and social engineering attacks? (Choose two)

A. Patch for Cross-Site Scripting

B. Perform backups to the private cloud

C. Protect against input validation and character escapes in the endpoint.

D. Install a spam and virus email filter

E. Protect systems with an up-to-date antimalware program.

How well did you know this?

Not at all

Perfectly

An Engineer used a posture check on a Microsoft Windows endpoint and discovered that the MS 17-010 patch was not installed, which left the endpoint vulnerable to WannaCry ransomware.

Which two solutions mitigate the risk of this ransomware infection? (Choose Two)

A. Configure a posture policy in Cisco ISE to install the MS17-010 patch before allowing access to the network.

B. Set up a profiling policy in Cisco ISE to check and endpoint patch level before allowing access to the network.

C. Configure a posture policy in Cisco ISE to check that an endpoint patch level is met before allowing access on the network.

D. Configure endpoint firewall policies to stop the exploit traffic from being allowed to run and replicate throughout the network.

E. Set up a well-defined endpoint patching strategy to ensure that endpoints have critical vulnerabilities patched in a timely fashion.

How well did you know this?

Not at all

Perfectly

Why would a user choose an on-premises ESA versus a CSA solution?

A. Sensitive data must remain onsite.

B. Demand is unpredicatable

C. The server team wants to outsource this service

D. ESA is deployed inline.

How well did you know this?

Not at all

Perfectly

Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

A. DMVPN

B. FlexVPN

C. IPSec DVTI

D. GET VPN

How well did you know this?

Not at all

Perfectly

Which cloud service model offers an environment for cloud consumers to develop and deploy applications without needing to manage or maintain the underlying cloud infrastructure?

A. PaaS

B. XaaS

C. IaaS

D. SaaS

How well did you know this?

Not at all

Perfectly

What is a required prerequisite to enable malware file scanning for the Secure Internet Gateway?

A. Enable IP layer enforcement

B. Activate the Advanced Malware Protection License

C. Activate SSL Decryption

D. Enable Intelligent Proxy

How well did you know this?

Not at all

Perfectly

Which two features are used to configure Cisco Secure Email Gateway with a multilayer approach to fight viruses and malware? (Choose Two)

A. Sophos Engine

B. White list

C. RAT

D. outbreak filters

E. DLP

A
D

How well did you know this?

Not at all

Perfectly

How is Cisco Umbrella configured to log only security events?

A. per policy

B. in the Reporting Settings

C. in the security settings section

D. per network in the deployments section

How well did you know this?

Not at all

Perfectly

What is the primary difference between and Endpoint Protection Platform and an Endpoint Detection and Response?

A. EPP focuses on prevention, and EDR focuses on advanced threats that evade perimeter defenses.

B. EDR focuses on prevention, and EPP focuses on advanced threats that evade perimeter defenses.

C. EPP focuses on network security, and EDR focuses on device security.

D. EDR focuses on network security, and EPP focuses on device security

How well did you know this?

Not at all

Perfectly

On which part of the IT environment does DevSecOps focus?

A. Application Development

B. Wireless network

C. Data center

D. Perimeter Network

How well did you know this?

Not at all

Perfectly

Which functions of an SDN architecture require southbound APIs to enable communication?

A. SDN Controller and the network elements

B. Management Console and the SDN controller

C. Management Console and the Cloud

D. SDN controller and the cloud

How well did you know this?

Not at all

Perfectly

What is a characteristic of traffic storm control behavior?

Traffic storms drops all broadcast and multicast traffic if the combined traffic exceeds the level within the interval.

Which two request methods of REST API are valid on the Cisco ASA Platform? A. put B. options C. get D. push E. connect

A C

In a PaaS model, which layer is the tenant responsible for maintaining and patching? A. hypervisor B. virtual machine C. network D. application

An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak control method is used to accomplish this task? A. device flow correlation B. simple detections C. application blocking list D. advanced custom detections

Which ASA deployment mode can provide separation of management on a shared appliance? A. DMZ multiple zone mode B. transparent firewall mode C. multiple context mode D. routed mode

Which two deployment model configurations are supported for Cisco FTDv in AWS? (Choose Two) A. FTDv configured in routed mode and managed by an FMCv installed in AWS. B. FTDv with one management interface and two traffic interfaces configured. C. FTDv configured in routed mode and managed by a physical FMC appliance on premises D. FTDv with two management interfaces and one traffic interface configured. E. FTDv configured in routed mode and IPv6 configured.

A C

What can be integrated with Cisco Talos Intelligence Director to provide information about security threats, which allows the SOC to proactively automate responses to those threats? A. Umbrealla B. External Threat Feeds C. Cisco Threat Grid D. Cisco Stealthwatch

What provides visibility and awareness into what is currently occurring on the network? A. CMX B. WMI C. Prime Infrastructure D. Telemetry

Which attack is commonly associated with C and C++ programming languages? A. XSS B. Water Holing C. DDoS D. Buffer Overflow

An engineer must force an endpoint to re-authenticate an already authenticated session without disrupting the endpoint to apply a new or updated policy from ISE. Which CoA type achieves this goal?

CoA Reauth

REFER TO EXHIBIT Which command was used to display this output?

show dot1x all

Which two prevention techniques are used to mitigate SQL injection attacks?

1. Check integer, float, or Boolean string parameters to ensure accurate values. 2. Use prepared statements and parameterized queries.

How does Cisco Stealthwatch Cloud provide security for cloud environments?

Delivers visibility and threat detections

Which two application layer preprocessors are used by Firepower Next Generation Intrusion Prevention System?

SIP SSL

Which feature is configured for managed devices in the device platform settings of the Firepower Management Center?

Time Synchronization

The main function of northbound APIs is in the SDN architecture is to enable communication between which two areas of a network?

SDN controller and the management solution

REFER TO THE EXHIBIT: What is the result of the configuration?

Traffic from the inside and DMZ networks is redirected

Which information is required when adding a device to Firepower Management Center?

Registration Key

Which two services must remain as on-premises equipment when a hybrid email solution is deployed? (Choose Two)

Encryption DLP

What is a characteristic of Cisco ASA NetFlow v9 Secure Event Logging?

It tracks flow-create, flow-teardown, and flow-denied events.

Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

SSL Decryption

Which two kinds of attacks are prevented by MFA?

Phishing Brute Force

With Cisco AMP, which option shows a list of all files that have been executed in your environment?

prevalenace

Which RADIUS attribute can you use to filter MAB requests in an 802.1x deployment?

Which two features of Cisco Email Security can protect your organization against email threats?

Data Loss Prevention Geolocation-based filtering

DRAG AND DROP List the correct steps to enable AppDynamics to monitor an EC2 Instance in AWS?

1. Configure a Machine Agent 2. Install Monitoring extension 3. Update config yaml 4. Restart the Machine agent

Which feature requires a network discovery policy on the Cisco Firepower Next Generation Intrusion Prevention System?

Impact Flag

REFER TO THE EXHIBIT: Which statement about the authentication protocol used in the configuration is true?

The authentication and authorization requests are grouped in a single packet.

Which two preventive measures are used to control cross-site scripting? (Choose Two) A. Enable client-side scripts on a per-domain basis B. Incorporate contextual output encoding/escaping C. Disable cookie inspection in the HTML inspection engine. D. Run untrusted HTML input through an HTML sanitization engine. E. Same Site cookie attribute should not be used.

B D

Which policy is used to capture host information on the Cisco Firepower Next Generation Intrusion Prevention System?

network discovery

REFER TO THE EXHIBIT: Which command was used to generate this output and to show which ports are authenticating with dot1x or mab?

show authentication sessions

An engineer is configuring a Cisco Secure Email Gateway and wants to control whether to accept or reject email messages to a recipient address. Which list contains the allowed recipient addresses?

RAT (Recipient Access Table)

Which two capabilities does TAXII support? A. exchange B. pull messaging C. binding D. correlation E. mitigating

A B

Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment? A. group policy B. access control policy C. device management policy D. platform service policy

An administrator wants to ensure that all endpoints are complaint before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10. What must the administrator implement to ensure that all devices are complaint before they are allowed on the network?

Cisco ISE and AnyConnect Posture module

What are two detection and analytics engines of Cognitive Threat Analytics? (Choose two) A. data exfiltration B. command and control communication C. intelligent proxy D. snort E. URL categorization

A B

In which form of attack is alternate encoding, such as hexadecimal representation, most often observed? A. smurf B. distributed denial of service C. cross-site scripting D. rootkit exploit

Which two conditions are prerequisites for stateful failover for IPsec?

1. The IPsec configuration that is set up on the active device must be duplicated on the standby device. 2. The active and standby devices must run the same version of the Cisco IOS software and must be the same type of device.

What Cisco command shows you the status of an 802.1x connection on interface gi0/1?

show authen sess int gi0/1

A malicious user gained network access by spoofing printer connections that were authorized using MAB on four different switch ports at the same time. What two catalyst switch security features will prevent further violations?

DHCP Snooping Dynamic ARP inspection

Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline posture node? A. RADIUS Change of Authorization B. device tracking C. DHCP snooping D. VLAN hopping

What is the result of running the crypto isakmp key ciscxxxxxxxxxxxx address 172.16.0.0 command?

authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscxxxxxxxxxxx.

Which two probes are configured to gather attributes of connected endpoints using Cisco ISE?

RADIUS DHCP

Which solution protects hybrid cloud deployment workloads with application visibility and segmentation?

Tetration

What are the two most commonly used authentication factors in MFA?

Time Factor Knowledge Factor

Which two key and block sizes are valid for AES?

128- bit block size. 192 bit key length 128-bit block size. 256 bit key length

After deploying a Cisco Secure Email Gateway on your network, you notice that some messages fail to reach their destinations. Which task can you perform to determine where each message was lost? A. Configure the trackingconfig command to enable message tracking. B. Generate a system report C. Review the log files D. Perform a trace

Elliptic curve cryptography is a stronger more efficient cryptography method meant to replace which current encryption technology?

RSA

How is ICMP used an exfiltration technique? A. by Flooding the destination host with unreachable packets. B. by sending large number of ICMP packets with a targeted hosts source IP address using an IP broadcast address. C. By encrypting the payload in an ICMP packet to carry out command and control tasks on a compromised host D. by overwhelming a targeted host with ICMP echo-request packets.

What is the difference between deceptive phishing and spear phishing?

Spear Phishing campaign is aimed at a specific person versus a group of people.

An engineer needs a solution for TACACS+ authentication and authorization for device administration. The engineer also wants to enhance wired and wireless network security by requiring users and endpoints to use 802.1x, MAB, or WebAuth. Which products meets all of these requirements?

Cisco ISE

When wired 802.1x authentication is implemented, which two components are required? (Choose Two) A. authentication server: Cisco ISE B. supplicant: Cisco AnyConnect ISE Posture module C. authenticator: Cisco Catalyst Swtich D. authenticator: Cisco ISE E. authenticator server: Cisco Prime Infrastructure

A C

The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic. Where must the ASA be added on the Cisco UC Manager platform?

Certificate Trust List

Which API is used for Content Security?

AsyncOS API

CCNP Security Flashcards

(79 cards)