QUESTION 121
Which platform must be used to seamlessly integrate Cisco and third-party security monitoring, network policy, and asset management platforms without using product-specific APIs?

A. Cisco Stealthwatch
B. Cisco SecureX
C. Cisco ISE
D. Cisco pxGrid

Correct Answer: B

QUESTION 122
An engineer must deploy 802.1X to a Cisco network switch. Ports must be configured to allow a host and an IP phone. Which CLI command must be run on the switch to configure 802.1X?

A. access-session host-mode mult-domain
B. access-session host-mode mult-auth
C. access-session host-mode mult-host
D. access-session host-mode single-host

Correct Answer: A

QUESTION 123
What is the advantage of a Dynamic Multipoint VPN over an IPsec VPN?

A. Dynamic Multipoint VPN offers secure mobile connectivity, and an IPsec VPN secures private internet communications.
B. Dynamic Multipoint VPN provides full mesh connectivity, and an IPsec VPN offers secure mobile connectivity.
C. Dynamic Multipoint VPN supports IP multicast traffic, and an IPsec VPN supports IP unicast traffic.
D. Dynamic Multipoint VPN offers secure communication between endpoints, and an IPsec VPN secures private internet communications.

Correct Answer: C

QUESTION 124
What is the component of endpoint protection against social engineering attacks?

A. IDS
B. IPsec
C. Cisco Secure Email Gateway
D. firewall

Correct Answer: C

QUESTION 125
What must be disabled on a Cisco Secure Web Appliance to ensure HTTPS traffic with a good reputation score bypasses decryption?

A. Decrypt for End-User Notification
B. Decrypt ACL
C. Decrypt for End-User Acknowledgment
D. Decrypt Policies

Correct Answer: A

QUESTION 126
Which third-party vendor platform integrates with Cisco Secure Client endpoint clients to provide deep endpoint insights and telemetry data?

A. Security Onion
B. BURP Suite
C. Cisco AMP
D. Splunk

Correct Answer: D

QUESTION 127
What is a capability of the westbound API in Cisco Catalyst Center?

A. integrates into third-party systems, such as IPAM and ITSM
B. enables management of non-Cisco devices
C. enables management of Cisco devices
D. creates policies on multiple devices by using HTTP requests

Correct Answer: A

QUESTION 128
A network administrator must create SaaS application authentication policies on a Cisco Secure Web Appliance. The administrator creates the associated identities and configures an identity provider. Which action completes the configuration?

A. Upload the certificate for the SaaS application.
B. Select Enable SaaS Single Sign-on Service.
C. Create an authentication realm.
D. Create authentication sequences.

Correct Answer: B

QUESTION 129
Which technology must be used to implement secure VPN connectivity among company branches over a private IP cloud with any-to-any scalable connectivity?

A. DMVPN
B. GET VPN
C. FlexVPN
D. IPsec DVTI

Correct Answer: B

QUESTION 130
What is a difference between SQL injection and buffer overflow attacks?

A. SQL injection reads data from memory, and buffer overflow inserts data into memory.
B. SQL injection targets websites, and buffer overflow targets software.
C. SQL injection requires only remote access, and buffer overflow needs local access.
D. SQL injection targets databases, and buffer overflow targets applications.

Correct Answer: D

QUESTION 131
How is an amplification DDoS attack performed?

A. sending instructions to a collection of compromised devices to launch a large-scale network attack
B. generating and sending the packets directly to the target device from the source of the attack to overwhelm the device
C. triggering a memory buffer overflow that causes a device to consume all the available recourses
D. turning small DNS queries into DNS responses that are much larger in packet size to flood the target device

Correct Answer: D

QUESTION 132
Which firewall mode does a Cisco Adaptive Security Appliance use to inspect Layer 2 traffic?

A. passive
B. transparent
C. inline
D. routed

Correct Answer: B

QUESTION 133
Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two.)

A. malware
B. eavesdropping
C. exploits
D. denial-of-service attacks
E. ARP spoofing

Correct Answer: AC

QUESTION 134
An engineer must configure a destination list on Cisco Umbrella. The destination list must allow requests to test.domain.com and block any other URLs to .domain.com. Which configuration must be performed?

A. Block list: !”test”.domain.com
Allow List: *.domain.com
B. Block list: test.domain.com
Allow List: test.domain.com
Block list: .domain.com
C. Block list: .domain.com
Allow List: *.domain.com
D. Block list: !”test”.domain.com
Allow List: test.domain.com
Block list: .domain.com

Correct Answer: D

QUESTION 135
What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?

A. If four log in attempts fail in 100 seconds, wait for 60 seconds to next log in prompt.
B. After four unsuccessful log in attempts, the line is blocked for 60 seconds and only permit IP addresses are permitted in ACL 100
C. After four unsuccessful log in attempts, the line is blocked for 100 seconds and only permit IP addresses are permitted in ACL 60.
D. lf four failures occur in 60 seconds, the router goes to quiet mode for 100 seconds.

Correct Answer: D

QUESTION 136
What are two benefits of using an MDM solution? (Choose two.)

A. on-device content management
B. antimalware and antispyware functionality
C. enhanced DNS security for endpoint devices
D. remote wipe capabilities to protect information on lost or stolen devices
E. allows for mobile endpoints to be used for authentication methods

Correct Answer: AD

QUESTION 137
Which statement about the configuration of Cisco ASA NetFlow v9 Secure Event Logging is true?

A. A flow-export event type must be defined under a policy.
B. To view bandwidth usage for Net-low records, the QoS feature must be enabled.
C. A sysopt command can be used to enable NSEL on a specific interface.
D. NSEL can be used without a collector configured.

Correct Answer: A

QUESTION 138
Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two.)

A. Block SQL code execution in the web application database login.
B. Use prepared statements and parameterized queries.
C. Secure the connection between the web and the app tier.
D. Write SQL code instead of using object-relational mapping libraries.
E. Check integer, float, or Boolean string parameters to ensure accurate values.

Correct Answer: BE

QUESTION 139
An engineer must configure a new remote access VPN connection using a Cisco Secure Firewall Threat Defense device as the VPN gateway and a Cisco Secure Client as the VPN client. These configurations were performed already in the Cisco Management interface of Cisco Secure Firewall Threat Defense:
1. Create a new remote access VPN policy using the Remote Access VPN Policy wizard.
2. Update the access control policy deployed to the Cisco Secure Firewall Threat Defense.
3. Configure a DNS.

Which two actions must the engineer take next to complete the configuration? (Choose two.)

A. Add a VPN client profile.
B. Add a Secure Client client profile.
C. Create an encryption key for the remote site.
D. Deploy the Site-to-site VPN policy.
E. Deploy the remote access VPN policy.

Correct Answer: AE

QUESTION 140
Which Cisco product provides proactive endpoint protection and allows administrators to centrally manage the deployment?

A. Secure Email Gateway
B. NGFW
C. AMP
D. Secure Web Appliance

Correct Answer: C