What is provided by the Secure Hash Algorithm in a VPN?
Answer(s): A
The HMAC-SHA-1-96 (also known as HMAC-SHA-1) encryption technique is used by IPSec to ensure that a message has not been altered. (-> Therefore answer "integrity" is the best choice). HMAC- SHA-1 uses the SHA-1 specified in FIPS-190-1, combined with HMAC (as per RFC 2104), and is described in RFC 2404.
https://www.ciscopress.com/articles/article.asp?p=24833&seqNum=4
A network engineer is deciding whether to use stateful or stateless failover when configuring two ASAs for high availability.What is the connection status in both cases?
Answer(s): B
Which type of protection encrypts RSA keys when they are exported and imported?
DRAG DROP (Drag and Drop is not supported)Drag and drop the capabilities of Cisco Firepower versus Cisco AMP from the left into the appropriate category on the right.
The Firepower System uses network discovery and identity policies to collect host, application, and user data for traffic on your network. You can use certain types of discovery and identity data to build a comprehensive map of your network assets, perform forensic analysis, behavioral profiling, access control, and mitigate and respond to the vulnerabilities and exploits to which your organization is susceptible.The Cisco Advanced Malware Protection (AMP) solution enables you to detect and block malware, continuously analyze for malware, and get retrospective alerts. AMP for Networks delivers network- based advanced malware protection that goes beyond point-in-time detection to protect your organization across the entire attack continuum before, during, and after an attack. Designed for Cisco Firepower® network threat appliances, AMP for Networks detects, blocks, tracks, and contains malware threats across multiple threat vectors within a single system. It also provides the visibility and control necessary to protect your organization against highly sophisticated, targeted, zero-day, and persistent advanced malware threats.
DRAG DROP (Drag and Drop is not supported)Drag and drop the suspicious patterns for the Cisco Tetration platform from the left onto the correct definitions on the right.
Cisco Tetration platform studies the behavior of the various processes and applications in the workload,measuring them against known bad behavior sequences. It also factors in the process hashes it collects. By studying various sets of malwares, the Tetration Analytics engineering team deconstructed it back into its basic building blocks. Therefore, the platform understands clear and crisp definitions of these building blocks and watches for them.The various suspicious patterns for which the Cisco Tetration platform looks in the current release are:+ Shell code execution: Looks for the patterns used by shell code. + Privilege escalation: Watches for privilege changes from a lower privilege to a higher privilege in the process lineage tree.+ Side channel attacks: Cisco Tetration platform watches for cache-timing attacks and page table fault bursts.Using these, it can detect Meltdown, Spectre, and other cache-timing attacks. + Raw socket creation: Creation of a raw socket by a nonstandard process (for example, ping). + User login suspicious behavior: Cisco Tetration platform watches user login failures and user login methods.+ Interesting file access: Cisco Tetration platform can be armed to look at sensitive files. + File access from a different user: Cisco Tetration platform learns the normal behavior of which file is accessed by which user.+ Unseen command: Cisco Tetration platform learns the behavior and set of commands as well as the lineage of each command over time. Any new command or command with a different lineage triggers the interest of theTetration Analytics platform.
https://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration- analytics/whitepaper-c11-740380.html
Post your Comments and Discuss Cisco 350-701 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 350-701 content, but please register or login to continue.