Cisco 350-701 SCOR Exam Questions Instant Access

Question 1

[Secure Network Access, Visibility, and Enforcement]

What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an

organization? (Choose two)

Aflexibility of different methods of 2FA such as phone callbacks, SMS passcodes, and push notifications

Bsingle sign-on access to on-premises and cloud applications

Cintegration with 802.1x security using native Microsoft Windows supplicant

Dsecure access to on-premises and cloud applications

Eidentification and correction of application vulnerabilities before allowing access to resources

Answer : A, D

Two-factor authentication adds a second layer of security to your online accounts. Verifying your identity using a

second factor (like your phone or other mobile device) prevents anyone but you from logging in, even if they

know your password.

Note: Single sign-on (SSO) is a property of identity and access management that enables users to securely

authenticate with multiple applications and websites by logging in only once with just one set of credentials

(username and password). With SSO, the application or website that the user is trying to access relies on a

trusted third party to verify that users are who they say they are.

Question 2

[Security Concepts]

What is an advantage of network telemetry over SNMP pulls?

Aaccuracy

Bencapsulation

Csecurity

Dscalability

Answer : D

Network telemetry is a technology that allows network devices to push data to a collector in real time, rather than waiting for the collector to pull data from them. This improves the efficiency and accuracy of data collection, and enables the monitoring of a large number of network devices. SNMP, on the other hand, is a protocol that uses a pull model, where the collector requests data from the devices periodically. This can cause delays, gaps, and overhead in data collection, and limit the scalability of network monitoring. Therefore, network telemetry has an advantage over SNMP pulls in terms of scalability.Reference:

What Is Telemetry? Telemetry vs. SNMP - Huawei

Streaming telemetry challenges SNMP in large, complex networks

Network streaming telemetry: Monitoring in ''real-time'' - Paessler

An Overview of Network Telemetry - Geek Speak - Resources - THWACK

Question 3

[Security Concepts]

An engineer is configuring Cisco Umbrella and has an identity that references two different policies. Which action ensures that the policy that the identity must use takes precedence over the second one?

AConfigure the default policy to redirect the requests to the correct policy

BPlace the policy with the most-specific configuration last in the policy order

CConfigure only the policy with the most recently changed timestamp

DMake the correct policy first in the policy order

Answer : D

Cisco Umbrella evaluates policies from the top down and looks for a matching identity and destination. Once a match is found, Umbrella applies that policy's settings to the identity and destination and stops evaluating all other DNS policies. Therefore, to ensure that the policy that the identity must use takes precedence over the second one, the engineer should make the correct policy first in the policy order. This way, Umbrella will match the identity to the correct policy before checking the second policy. The other options are not correct because they do not guarantee that the identity will use the correct policy. Configuring the default policy to redirect the requests to the correct policy will not work if the identity matches another policy before the default one. Placing the policy with the most-specific configuration last in the policy order will not work if the identity matches a less-specific policy before the last one. Configuring only the policy with the most recently changed timestamp will not work if the identity matches an older policy before the newer one.Reference:=

Some possible references are:

Policy Precedence - Umbrella User Guide1

Manage Policies - Umbrella User Guide2

Umbrella Policy order - Cisco Community3

Question 4

[Secure Network Access, Visibility, and Enforcement]

In which two ways does Easy Connect help control network access when used with Cisco TrustSec? (Choose two)

AIt allows multiple security products to share information and work together to enhance security posture in the network.

BIt creates a dashboard in Cisco ISE that provides full visibility of all connected endpoints.

CIt allows for the assignment of Security Group Tags and does not require 802.1x to be configured on the switch or the endpoint.

DIt integrates with third-party products to provide better visibility throughout the network.

EIt allows for managed endpoints that authenticate to AD to be mapped to Security Groups (PassiveID).

Answer : C, E

Easy Connect simplifies network access control and segmentation by allowing the assignment of Security

Group Tags to endpoints without requiring 802.1X on those endpoints, whether using wired or wireless

connectivity.

Question 5

What is the difference between EPP and EDR?

AEDR focuses solely on prevention at the perimeter.

BHaving an EPP solution allows an engineer to detect, investigate, and remediate modern threats.

CHaving an EDR solution gives an engineer the capability to flag offending files at the first sign of malicious behavior.

DEPP focuses primarily on threats that have evaded front-line defenses that entered the environment.

Answer : C

Question 6

Which two actions does the Cisco ISE posture module provide that ensures endpoint security? (Choose two.)

AA centralized management solution is deployed.

BPatch management remediation is performed.

CThe latest antivirus updates are applied before access is allowed.

DAssignments to endpoint groups are made dynamically, based on endpoint attributes.

EEndpoint supplicant configuration is deployed.

Answer : B, C

Question 7

[Security Concepts]

Refer to the exhibit.

An organization is using DHCP Snooping within their network. A user on VLAN 41 on a new switch is

complaining that an IP address is not being obtained. Which command should be configured on the switch

interface in order to provide the user with network connectivity?

Aip dhcp snooping verify mac-address

Bip dhcp snooping limit 41

Cip dhcp snooping vlan 41

Dip dhcp snooping trust

Answer : D

To understand DHCP snooping we need to learn about DHCP spoofing attack first.

DHCP spoofing is a type of attack in that the attacker listens for DHCP Requests from clients and answers them with fake DHCP Response before the authorized DHCP Response comes to the clients. The fake DHCP Response often gives its IP address as the client default gateway -> all the traffic sent from the client will go through the attacker computer, the attacker becomes a ''man-in-the-middle''.

The attacker can have some ways to make sure its fake DHCP Response arrives first. In fact, if the attacker is ''closer'' than the DHCP Server then he doesn't need to do anything. Or he can DoS the DHCP Server so that it can't send the DHCP Response.

DHCP snooping can prevent DHCP spoofing attacks. DHCP snooping is a Cisco Catalyst feature that

determines which switch ports can respond to DHCP requests. Ports are identified as trusted and untrusted.

Only ports that connect to an authorized DHCP server are trusted, and allowed to send all types of DHCP

messages. All other ports on the switch are untrusted and can send only DHCP requests. If a DHCP response is seen on an untrusted port, the port is shut down.

The port connected to a DHCP server should be configured as trusted port with the ''ip dhcp snooping trust'' command. Other ports connecting to hosts are untrusted ports by default.

In this question, we need to configure the uplink to ''trust'' (under interface Gi1/0/1) as shown below.

Cisco Implementing and Operating Cisco Security Core Technologies 350-701 SCOR Exam Questions