Quiz
CCNP SCOR parte 3
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (50)
1What is a functional difference between a Cisco ASA and a Cisco IOS router with Zone-based policy firewall?
- AThe Cisco ASA denies all traffic by default whereas the Cisco IOS router with Zone-Based Policy Firewall starts out by allowing all traffic, even on untrusted interfaces.
- BThe Cisco IOS router with Zone-Based Policy Firewall can be configured for high availability, whereas the Cisco ASA cannot
- CThe Cisco IOS router with Zone-Based Policy Firewall denies all traffic by default, whereas the Cisco ASA starts out by allowing all traffic until rules are added
- DThe Cisco ASA can be configured for high availability whereas the Cisco IOS router with Zone-Based Policy Firewall cannot
2What is a benefit of performing device compliance?
- Averification of the latest OS patches
- Bdevice classification and authorization
- Cproviding multi-factor authentication
- Dproviding attribute-driven policies
3Which cloud model is a collaborative effort where infrastructure is shared and jointly accessed by several organizations from a specific group?
- Ahybrid
- Bcommunity
- Cprivate
- Dpublic
4Which cryptographic process provides origin confidentiality, integrity, and origin authentication for packets?
- AIKEv1
- BAH
- CESP
- DIKEv2
5An organization wants to secure users, data, and applications in the cloud, The solution must be API-based and operate as a cloud-native CASB. Which solution must be used for this implementation?
- ACisco Cloudlock
- BCisco Cloud Email Security
- CCisco Firepower Next-Generation Firewall
- DCisco Umbrella
6What are two Trojan malware attacks? (Choose two)
- Afrontdoor
- Brootkit
- Csmurf
- Dbackdoor
- Esync
7What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?
- Ato protect the endpoint against malicious file transfers
- Bto ensure that assets are secure from malicious links on and off the corporate network
- Cto establish secure VPN connectivity to the corporate network
- Dto enforce posture compliance and mandatory software
8What is a capability of Cisco ASA Netflow?
- AIt filters NSEL events based on traffic
- BIt generates NSEL events even if the MPF is not configured
- CIt logs all event types only to the same collector.
- DIt sends NetFlow data records from active and standby ASAS in an active standby failover pair.
9Which component of Cisco umbrella architecture increases reliability of the service?
- AAnycast IP
- BAMP Threat grid
- CCisco Talos
- DBGP route reflector
10What is the benefit of integrating Cisco ISE with a MDM solution?
- AIt provides compliance checks for access to the network
- BIt provides the ability to update other applications on the mobile device
- CIt provides the ability to add applications to the mobile device through Cisco ISE
- DIt provides network device administration access
11An administrator configures a new destination list in Cisco Umbrella so that the organization can block specific domains for ¡ts devices. What should be done to ensure that all subdomains of domain.com are blocked?
- AConfigure the *.com address in the block list.
- BConfigure the *.domain.com address in the block list
- CConfigure the www.domain.com address in the block list
- DConfigure the domain.com address in the block list
12An organization wants to provide visibility and to identify active threats in its network using a VM, The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network. Which solution meets these requirements?
- ACisco Umbrella Cloud
- BCisco Stealthwatch Cloud PNM
- CCisco Stealthwatch Cloud PCM
- DCisco Umbrella On-Premises
13An organization deploys multiple Cisco FTD appliances and wants to manage them using one centralized solution. The organization does not have a local VM but does have existing Cisco ASAs that must migrate over to Cisco FTDs. Which solution meets the needs of the organization?
- ACisco FMC
- BCSM
- CCisco FDM
- DCDO
14An organization wants to secure data in a cloud environment, Its security model requires that all users be authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and data. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these
requirements?- Avirtual routing and forwarding
- Bmicrosegmentation
- Caccess control policy
- Dvirtual LAN
15A Cisco FTD engineer is creating a new IKEv2 policy called 52500123456789 for their organization to allow for additional protocols to terminate network devices with. They currently only have one policy established and need the new policy to be a backup in case some devices cannot support the stronger algorithms listed in the primary policy. What should be done in order to support this?
- AChange the integrity algorithms to SHA* to support all SHA algorithms in the primary policy
- BMake the priority for the new policy 5 and the primary policy 1.
- CChange the encryption to AES* to support all AES algorithms in the primary policy
- DMake the priority for the primary policy 10 and the new policy 1
16Which type of encryption uses a public key and private key?
- Aasymmetric
- Bsymmetric
- Clinear
- Dnonlinear
17What are two features of NetFlow flow monitoring? (Choose two)
- ACan track ingress and egress information
- BInclude the flow record and the flow importer
- CCopies all ingress flow information to an interface
- DDoes not required packet sampling on interfaces
- ECan be used to track multicast, MPLS, or bridged traffic
18A customer has various external HTTP resources available including Intranet Extranet and Internet, with a proxy configuration running in explicit mode. Which method allows the client desktop browsers to be configured to select when to connect direct or when to use the proxy?
- ATransport mode
- BForward file
- CPAC file
- DBridge mode
19Which Talos reputation center allows for tracking the reputation of IP addresses for email and web traffic?
- AIP and Domain Reputation Center
- BFile Reputation Center
- CIP Slock List Center
- DAMP Reputation Center
20An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence, Which protocol accomplishes this goal?
- AAES-192
- BIKEv1
- CAES-256
- DESP
21An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of 172.19.20.24. Which command on the hub will allow the administrator to accomplish this?
- Acrypto ca identity 172.19.20.24
- Bcrypto isakmp key Cisco0123456789 172.19.20.24
- Ccrypto enrollment peer address 172.19.20.24
- Dcrypto isakmp identity address 172.19.20.24
22What is a difference between an XSS attack and an SQL injection attack?
- ASQL injection is a hacking method used to attack SQL databases, whereas XSS attacks can exist in many different types of applications
- BXSS is a hacking method used to attack SQL databases, whereas SQL injection attacks can exist in many different types of applications
- CSQL injection attacks are used to steal information from databases whereas XSS attacks are used to redirect users to websites where attackers can steal data from them
- DXSS attacks are used to steal information from databases whereas SQL injection attacks are used to redirect users to websites where attackers can steal data from them
23An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?
- AImplement pre-filter policies for the CIP preprocessor
- BEnable traffic analysis in the Cisco FTD
- CConfigure intrusion rules for the DNP3 preprocessor
- DModify the access control policy to trust the industrial traffic
24Which posture assessment requirement provides options to the client for remediation and requires the remediation within a certain timeframe?
- AAudit
- BMandatory
- COptional
- DVisibility
25Which attribute has the ability to change during the RADIUS CoA?
- ANTP
- Bauthorization
- Caccessibility
- Dmembership
26With Cisco AMP for Endpoints, which option shows a list of all files that have been executed in your environment?
- Aprevalence
- Bfile analysis
- Cdetections
- Dvulnerable software
- Ethreat root cause
27A company discovered an attack propagating through their network via a file. A custom file policy was created in order to track this in the future and ensure no other endpoints execute the infected file. In addition, it was discovered during testing that the scans are not detecting the file as an indicator of compromise. What must be done in order to ensure that the created is functioning as it should?
- ACreate an IP block list for the website from which the file was downloaded
- BBlock the application that the file was using to open
- CUpload the hash for the file into the policy
- DSend the file to Cisco Threat Grid for dynamic analysis
28A network engineer is trying to figure out whether FlexVPN or DMVPN would fit better in their environment, They have a requirement for more stringent security multiple security associations for the connections, more efficient VPN establishment as well consuming less bandwidth. Which solution would be best for this and why?
- ADMVPN because it supports IKEv2 and FlexVPN does not.
- BFlexVPN because it supports IKEv2 and DMVPN does not.
- CFlexVPN because it uses multiple SAs and DMVPN does not.
- DDMVPN because it uses multiple SAs and FlexVPN does not.
29How does Cisco Workload Optimization Manager help mitigate application performance issues?
- AIt deploys an AWS Lambda system
- BIt automates resource resizing
- CIt optimizes a flow path
- DIt sets up a workload forensic score
30An organization configures Cisco Umbrella to be used for its DNS services. The organization must be able to block traffic based on the subnet that the endpoint is on but ¡t sees only the requests from its public IP address instead of each internal IP address. What must be done to resolve this issue?
- ASet up a Cisco Umbrella virtual appliance to internally field the requests and see the traffic of each IP address
- BUse the tenant control features to identify each subnet being used and track the connections within the Cisco Umbrella dashboard
- CInstall the Microsoft Active Directory Connector to give IP address information stitched to the requests in the Cisco Umbrella dashboard
- DConfigure an internal domain within Cisco Umbrella to help identify each address and create policy from the domains
31What is a difference between a DoS attack and a DDoS attack?
- AA DOS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where multiple systems target a single system with a DoS attack.
- BA DoS attack is where a computer is used to flood a server with TCP and UDP packets whereas a DDoS attack is where a computer is used to flood multiple servers that are distributed over a LAN
- CA DOS attack is where a computer is used to flood a server with UDP packets whereas a DDoS attack is where a computer is used to flood a server with TCP packets
- DA DoS attack is where a computer is used to flood a server with TCP packets whereas a DDoS attack is where a computer is used to flood a server with UDP packets
32Which two capabilities of Integration APIs are utilized with Cisco DNA center? (Choose two)
- AAutomatically deploy new virtual routers
- BUpgrade software on switches and routers
- CApplication monitors for power utilization of devices and loT sensors
- DConnect to ITSM Platforms
- ECreate new SSIDs on a wireless LAN controller
33Which kind of API that is used with Cisco DNA Center provisions SSIDs, QoS policies, and update software versions on switches?
- Aintegration
- Bintent
- Cevent
- Dmultivendor
34What is the purpose of CA in a PKI?
- Ato issue and revoke digital certificates.
- Bto validate the authenticity of a digital certificate
- Cto create the private key for a digital certificat
- Dto certify the ownership of a public key by the named subject
35Which DevSecOps implementation process gives a weekly or daily update instead of monthly or quarterly in the applications?
- Aorchestration
- BCI/CD pipeline
- Ccontainer
- Dsecurity
36Which parameter is required when configuring a Netflow exporter on a Cisco Router?
- ADSCP value
- Bsource interface
- Cexporter name
- Dexporter description
37Which category includes Dos Attacks?
- Avirus attacks
- Btrojan attacks
- Cflood attacks
- Dphishing attacks
38What are two advantages of using Cisco Any connect over DMVPN? (Choose two)
- AIt provides spoke-to-spoke communications without traversing the hub
- BIt allows different routing protocols to work over the tunnel
- CIt allows customization of access policies based on user identity
- DIt allows multiple sites to connect to the data center
- EIt enables VPN access for individual users from their machines
39When choosing an algorithm to us, what should be considered about Diffie Hellman and RSA for key establishment?
- ARSA is an asymmetric key establishment algorithm intended to output symmetric keys.
- BRSA is a symmetric key establishment algorithm intended to output asymmetric keys.
- CDH is a symmetric key establishment algorithm intended to output asymmetric keys.
- DDH is on asymmetric key establishment algorithm intended to output symmetric Keys.
40Which type of DNS abuse exchanges data between two computers even when there is no direct connection?
- Amalware installation
- Bcommand-and-control communication
- Cnetwork footprinting
- Ddata exfiltration
41What is a difference between GETVPN and IPsec?
- AGETVPN reduces latency and provides encryption over MPLS without the use of a central hub
- BGETVPN provides key management and security association management
- CGETVPN is based on IKEv2 and does not support IKEv1
- DGETVPN is used to build a VPN network with multiple sites without having to statically configure all devices
42What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- ATelemetry uses a pull, method which makes it more reliable than SNMP
- BTelemetry uses push and pull, which makes it more scalable than SNMP
- CTelemetry uses push and pull which makes it more secure than SNMP
- DTelemetry uses a push method which makes it faster than SNMP
43An organization wants to use Cisco FTD or Cisco ASA devices, Specific URLs must be blocked from being accessed via the firewall which requires that the administrator input the bad URL categories that the organization wants blocked into the access policy. Which solution should be used to meet this requirement?
- ACisco ASA because it enables URL filtering and blocks malicious URLs by default, whereas Cisco FTD does not
- BCisco ASA because it includes URL filtering in the access control policy capabilities, whereas Cisco FTD does not
- CCisco FTD because it includes URL filtering in the access control policy capabilities, whereas Cisco ASA does not
- DCisco FTD because it eablens URL filtering and blocks malicious URLs by default, whereas Cisco ASA does not
44An administrator configures a Cisco WSA to receive redirected traffic over ports 80 and 443, The organization requires that a network device with specific WSA integration capabilities be configured to send the traffic to the WSA to proxy the requests and increase visibility, while making this invisible to the users. What must be done on the Cisco WSA to support these requirements?
- AConfigure transparent traffic redirection using WCCP in the Cisco WSA and on the network device
- BConfigure active traffic redirection using WPAD in the Cisco WSA and on the network device
- CUse the Layer 4 setting in the Cisco WSA to receive explicit forward requests from the network device
- DUse PAC keys to allow only the required network devices to send the traffic to the Cisco WSA
45An administrator configures new authorization policies within Cisco ISE and has difficulty profiling the devices. Attributes for the new Cisco IP phones that are profiled based on the RADIUS authentication are seen however the attributes for CDP or DHCP are not. What should the administrator do to address this issue?
- AConfigure the ip dhcp snooping trust command on the DHCP interfaces to get the information to Cisco ISE
- BConfigure the authentication port-control auto feature within Cisco ISE to identify the devices that are trying to connect
- CConfigure a service template within the switch to standardize the port configurations so that the correct information is sent to Cisco ISE
- DConfigure the device sensor feature within the switch to send the appropriate protocol information
46A network engineer must monitor user and device behavior within the on-premises network. This data must be sent to the Cisco Stealthwatch Cloud analytics platform for analysis. What must be done to meet this requirement using the Ubuntu-based VM appliance deployed in a VMware-based hypervisor?
- AConfigure a Cisco FMC to send syslogs to Cisco Stealthwatch Cloud
- BDeploy the Cisco Stealthwatch Cloud PNM sensor that sends data to Cisco Stealthwatch Cloud
- CDeploy a Cisco FTD sensor to send network events to Cisco Stealthwatch Cloud
- DConfigure a Cisco FMC to send NetFlow to Cisco Stealthwatch Cloud
47An organization uses Cisco FMC to centrally manage multiple Cisco FTD devices. The default management port conflicts with other communications on the network and must be changed. What must be done to ensure that all devices can communicate together?
- AManually change the management port on Cisco FMC and all managed Cisco FTD devices
- BSet the tunnel to go through the Cisco FTD
- CChange the management port on Cisco FMC so that it pushes the change to all managed Cisco FTD devices
- DSet the tunnel port to 8305
48Which service allows a user export application usage and performance statistics with Cisco Application Visibility and control?
- ASNORT
- BNetFlow
- CSNMP
- D802,1X
49An engineer adds a custom detection policy to a Cisco AMP deployment and encounters issues with the configuration. The simple detection mechanism is configured, but the dashboard indicates that the hash is not 64 characters and is non-zero. What is the issue?
- AThe engineer is attempting to upload a hash created using MD5 instead of SHA-256
- BThe file being uploaded is incompatible with simple detections and must use advanced detections
- CThe hash being uploaded is part of a set in an incorrect format
- DThe engineer is attempting to upload a file instead of a hash
50Refer to the exhibit. What does this python script accomplish?
- AIt lists the LDAP users from the external identity store configured on Cisco ISE
- BIt authenticates to a Cisco ISE server using the username of ersad
- CIt allows authentication with TLSv1 SSL protocol
- DIt authenticates to a Cisco ISE with an SSH connection
Information
- Description
- Ingeniería Quiz on CCNP SCOR parte 3, created by Fernando Mayorga on 07/07/2024.
- Author
- Fernando Mayorga
- Language
- Español
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz