QUESTION 21
What has driven an increase in the need for endpoint-based security?

A. stricter control mechanism requirements for enterprise access
B. increased data volumes and value in data center storage
C. increased number of BYOD policies and hybrid remote worker
D. minimal endpoint-based security manual configuration and implementation

Correct Answer: C

QUESTION 22
A security engineer configures Cisco Secure Endpoint to ensure that certain files can be prevented from executing but does not want to quarantine the files. Which outbreak control method must be configured?

A. advanced custom detection set
B. simple custom detection list
C. file blocking list
D. blocked application list

Correct Answer: C

QUESTION 23
How does the Cisco Secure Web Appliance enforce bandwidth restrictions for web applications?

A. It sends commands to the uplink router to apply traffic policing to the application traffic.
B. It implements a policy route to redirect application traffic to a lower-bandwidth link.
C. It simulates a slower link by introducing latency into application traffic.
D. It dynamically creates a scavenger class QoS policy and applies it to each client that connects through the Secure Web Appliance.

Correct Answer: D

QUESTION 24
An engineer migrates a web server to the cloud in a platform as a service model. Which security measure must be implemented next to protect the resources?

A. Add physical security control.
B. Perform operating system patching.
C. Implement a proxy server.
D. Perform IPS scanning.

Correct Answer: B

QUESTION 25
Which parameter is needed to configure an Outbound Malware Scanning Policy in which group membership must be based on the type of web browser the client uses on a Cisco Secure Web Appliance?

A. User Agents
B. Protocols
C. URL Categories
D. Proxy Ports

Correct Answer: A

QUESTION 26
A secure engineer has observed the log entry on Cisco Secure Web Appliance.
10.10.10.10 TCP_CLIENT_REFRESH_MISS/200 2256 CONNECT tunnel://www.test.com:443/ – DIRECT/www.test.com – PASSTHRU_WBRS-DefaultGroup-test.id-NONE-NONE-DefaultRouting –

Based on the log entry, which mode does the Cisco Secure Web Appliance operate in?

A. Explicit Proxy mode
B. Bridged mode
C. Upstream Transparent Proxy mode
D. Transparent Proxy mode

Correct Answer: D

QUESTION 27
What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?

A. It discovers and controls cloud apps that are connected to a company’s corporate environment.
B. It allows the administrator to quarantine malicious files so that the application can function, just not maliciously.
C. It sends the application information to an administrator to act on.
D. It deletes any application that does not belong in the network.

Correct Answer: A

QUESTION 28
How does a WCCP-configured router identify if the Cisco WSA is functional?

A. The router sends a Here-I-Am message every 10 seconds, and the WSA acknowledges with an l-See-You message.
B. If an ICMP ping fails three consecutive times between a router and the WSA, traffic is no longer transmitted to the router.
C. If an ICMP ping fails three consecutive times between a router and the WSA, traffic is no longer transmitted to the WSA.
D. The WSA sends a Here-I-Am message every 10 seconds, and the router acknowledges with an I-See-You message.

Correct Answer: D

QUESTION 29
Which Cisco ASA deployment model is used to filter traffic between hosts in the same IP subnet using higher-level protocols without re addressing the network?

A. multiple context mode
B. transparent mode
C. routed mode
D. single context mode

Correct Answer: B

QUESTION 30
What are two things to consider when using PAC files with the Cisco WSA? (Choose two.)

A. By default, they direct traffic through a proxy when the PC and the host are on the same subnet.
B. The WSA hosts PAC files on port 9001 by default.
C. The WSA hosts PAC files on port 6001 by default.
D. PAC files use if-else statements to determine whether to use a proxy or a direct connection for traffic between the PC and the host
E. If the WSA host port is changed, the default port redirects web traffic to the correct port automatically.

Correct Answer: BD

QUESTION 31
Which Cisco solution provides a comprehensive view of Internet domains, IP addresses, and autonomous systems to help pinpoint attackers and malicious infrastructures?

A. Cisco Secure Workload Cloud
B. Cisco Advanced Malware Investigate
C. Cisco Threat Indication Database
D. Cisco Umbrella Investigate

Correct Answer: D

QUESTION 32
In which cloud services model is the customer responsible for scanning for and mitigation of application vulnerabilities?

A. PaaS
B. VMaaS
C. IaaS
D. SaaS

Correct Answer: C

QUESTION 33
Which two devices support WCCP for traffic redirection? (Choose two.)

A. Cisco ASA
B. Cisco IOS
C. Cisco IPS
D. proxy server
E. Cisco Secure Web Appliance

Correct Answer: AB

QUESTION 34
What is an advantage of using a next-generation firewall compared to a traditional firewall?
A. Next-generation firewall have stateless inspection capabilities, and traditional firewalls use stateful inspection.
B. Next-generation firewalls use dynamic packet filtering, and traditional firewalls use static packet filtering.
C. Next-generation firewalls have threat intelligence feeds, and traditional firewalls use signature detection.
D. Next-generation firewalls use intrusion prevention policies, and traditional firewalls use intrusion detection policies.

Correct Answer: C

QUESTION 35
Which parameter must be set for an invalid certificate handling on a Cisco Secure Web Appliance with a policy for HTTPS traffic?

A. Reject
B. Decrypt
C. Scan
D. Accept

Correct Answer: B

QUESTION 36
Which Cisco Secure Firewall Threat Defense 4100 Series deployment model restricts routing and filtering traffic between networks using a Secure Firewall Threat Defense appliance?

A. single instance
B. transparent mode
C. routed mode
D. multiple instance

Correct Answer: B

QUESTION 37
A network engineer is configuring a Cisco Catalyst switch. The network engineer must prevent traffic on the network from being interrupted by broadcast packets flooding the network using a predefined threshold. What must be configured on the switch?

A. DHCP Snooping
B. Loop Guard
C. Storm Control
D. Embedded Event Monitoring

Correct Answer: C

QUESTION 38
Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to network resources?

A. MAC authentication bypass
B. client provisioning
C. Simple Certificate Enrollment Protocol
D. BYOD onboarding

Correct Answer: D

QUESTION 39
An organization is using Cisco Firepower and Cisco Meraki MX for network security and needs to centrally manage cloud policies across these platforms. Which software should be used to accomplish this goal?

A. Cisco Secureworks
B. Cisco DNA Center
C. Cisco Configuration Professional
D. Cisco Defense Orchestrator

Correct Answer: D

QUESTION 40
What is a prerequisite when integrating a Cisco ISE server and an AD domain?

A. Synchronize the clocks of the Cisco ISE server and the AD server.
B. Place the Cisco ISE server and the AD server in the same subnet.
C. Configure a common administrator account.
D. Configure a common DNS server.

Correct Answer: A