Free 350-701 Exam Braindumps (page: 46)

Page 46 of 153

Using Cisco Firepower's Security Intelligence policies, upon which two criteria is Firepower block based?
(Choose two)

  1. URLs
  2. protocol IDs
  3. IP addresses
  4. MAC addresses
  5. port numbers

Answer(s): A,C

Explanation:

Security Intelligence Sources
...
Custom Block lists or feeds (or objects or groups)
Block specific IP addresses, URLs, or domain names using a manually-created list or feed (for IP addresses,
you can also use network objects or groups.)
For example, if you become aware of malicious sites or addresses that are not yet blocked by a feed, add these sites to a custom Security Intelligence list and add this custom list to the Block list in the Security Intelligence tab of your access control policy.


Reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc- configguide-v623/security_intelligence_blacklisting.html



Which Cisco platform ensures that machines that connect to organizational networks have the recommended antivirus definitions and patches to help prevent an organizational malware outbreak?

  1. Cisco WiSM
  2. Cisco ESA
  3. Cisco ISE
  4. Cisco Prime Infrastructure

Answer(s): C

Explanation:

A posture policy is a collection of posture requirements, which are associated with one or more identity groups, and operating systems. We can configure ISE to check for the Windows patch at Work Centers > Posture > Posture Elements > Conditions > File. In this example, we are going to use the predefined file check to ensure that our Windows 10 clients have the critical security patch installed to prevent the Wanna Cry malware; and we can also configure ISE to update the client with this patch.



What are two benefits of Flexible NetFlow records? (Choose two)

  1. They allow the user to configure flow information to perform customized traffic identification
  2. They provide attack prevention by dropping the traffic
  3. They provide accounting and billing enhancements
  4. They converge multiple accounting technologies into one accounting mechanism
  5. They provide monitoring of a wider range of IP packet information from Layer 2 to 4

Answer(s): A,D

Explanation:

NetFlow is typically used for several key customer applications, including the following:
...
Billing and accounting. NetFlow data provides fine-grained metering (for instance, flow data includes details such as IP addresses, packet and byte counts, time stamps, type of service (ToS), and application ports) for highly flexible and detailed resource utilization accounting. Service providers may use the information for billing based on time of day, bandwidth usage, application usage, quality of service, and so on. Enterprise customers may use the information for departmental charge back or cost allocation for resource utilization.


Reference:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf- 15-mt-book/fnffnetflow.html
If the predefined Flexible NetFlow records are not suitable for your traffic requirements, you can create a userdefined (custom) record using the Flexible NetFlow collect and match commands. Before you can create a customized record, you must decide the criteria that you are going to use for the key and nonkey fields.


https://www.cisco.com/en/US/docs/ios/fnetflow/configuration/guide/ cust_fnflow_rec_mon_external_docbase_0900e4b18055d0d2_4container_external_docbase_0900e 4b181b413 d9.html#wp1057997
Note: Traditional NetFlow allows us to monitor from Layer 2 to 4 but Flexible NetFlow goes beyond these layers.



How does DNS Tunneling exfiltrate data?

  1. An attacker registers a domain that a client connects to based on DNS records and sends malware through that connection.
  2. An attacker opens a reverse DNS shell to get into the client's system and install malware on it.
  3. An attacker uses a non-standard DNS port to gain access to the organization's DNS servers in order to poison the resolutions.
  4. An attacker sends an email to the target with hidden DNS resolvers in it to redirect them to a malicious domain.

Answer(s): A



Page 46 of 153



Post your Comments and Discuss Cisco® 350-701 exam with other Community members:

David A commented on January 16, 2024
Good Colombia
Anonymous
upvote

Kim commented on May 25, 2023
I just purchased and downloaded my files. Everything looks good so far.
UNITED STATES
upvote