marks4sure logo
Which Cisco product is open, scalable, and built on IETF standards to allow multiple security products from
Cisco and other vendors to share data and interoperate with each other?
An engineer needs a solution for TACACS+ authentication and authorization for device administration.
The engineer also wants to enhance wired and wireless network security by requiring users and endpoints to
use 802.1X, MAB, or WebAuth. Which product meets all of these requirements?
A mall provides security services to customers with a shared appliance. The mall wants separation of
management on the shared appliance. Which ASA deployment mode meets these needs?
Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?
Which feature of Cisco ASA allows VPN users to be postured against Cisco ISE without requiring an inline
posture node?
Which benefit is provided by ensuring that an endpoint is compliant with a posture policy configured in Cisco ISE?
What is a language format designed to exchange threat intelligence that can be transported over the TAXII
protocol?
Which two features of Cisco Email Security can protect your organization against email threats? (Choose two)
An engineer is configuring AMP for endpoints and wants to block certain files from executing. Which outbreak
control method is used to accomplish this task?
Which capability is exclusive to a Cisco AMP public cloud instance as compared to a private cloud instance?
Which cloud service model offers an environment for cloud consumers to develop and deploy applications
without needing to manage or maintain the underlying cloud infrastructure?
An engineer wants to automatically assign endpoints that have a specific OUI into a new endpoint group. Which
probe must be enabled for this type of profiling to work?
Which functions of an SDN architecture require southbound APIs to enable communication?
Which technology reduces data loss by identifying sensitive information stored in public computing
environments?
An engineer is trying to securely connect to a router and wants to prevent insecure algorithms from being used.
However, the connection is failing. Which action should be taken to accomplish this goal?
An engineer configured a new network identity in Cisco Umbrella but must verify that traffic is being routed
through the Cisco Umbrella network. Which action tests the routing?
Refer to the exhibit.
Which statement about the authentication protocol used in the configuration is true?
Which ID store requires that a shadow user be created on Cisco ISE for the admin login to work?
Which two tasks allow NetFlow on a Cisco ASA 5500 Series firewall? (Choose two)
An engineer wants to generate NetFlow records on traffic traversing the Cisco ASA. Which Cisco ASA
command must be used?
Which term describes when the Cisco Firepower downloads threat intelligence updates from Cisco Talos?
What does the Cloudlock Apps Firewall do to mitigate security concerns from an application perspective?
Which two endpoint measures are used to minimize the chances of falling victim to phishing and social
engineering attacks? (Choose two)
In which form of attack is alternate encoding, such as hexadecimal representation, most often observed?
What is the primary difference between an Endpoint Protection Platform and an Endpoint Detection and
Response?
When web policies are configured in Cisco Umbrella, what provides the ability to ensure that domains are blocked when they host malware, command and control, phishing, and more threats?
An organization is trying to improve their Defense in Depth by blocking malicious destinations prior to a
connection being established. The solution must be able to block certain applications from being used within the network. Which product should be used to accomplish this goal?
Which exfiltration method does an attacker use to hide and encode data inside DNS requests and queries?
Which benefit does endpoint security provide the overall security posture of an organization?
Which two prevention techniques are used to mitigate SQL injection attacks? (Choose two)
An administrator is trying to determine which applications are being used in the network but does not want the
network devices to send metadata to Cisco Firepower. Which feature should be used to accomplish this?
An engineer has enabled LDAP accept queries on a listener. Malicious actors must be prevented from quickly
identifying all valid recipients. What must be done on the Cisco ESA to accomplish this goal?
An organization is implementing URL blocking using Cisco Umbrella. The users are able to go to some sites
but other sites are not accessible due to an error. Why is the error occurring?
A network administrator is configuring a switch to use Cisco ISE for 802.1X. An endpoint is failing
authentication and is unable to access the network. Where should the administrator begin troubleshooting to verify the authentication details?
Which group within Cisco writes and publishes a weekly newsletter to help cybersecurity professionals remain
aware of the ongoing and most prevalent threats?
Drag and drop the threats from the left onto examples of that threat on the right
What is the Cisco API-based broker that helps reduce compromises, application risks, and data breaches in an environment that is not on-premise?
In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?
An organization wants to secure users, data, and applications in the cloud. The solution must be API-based and
operate as a cloud-native CASB. Which solution must be used for this implementation?
Due to a traffic storm on the network, two interfaces were error-disabled, and both interfaces sent SNMP traps.
Which two actions must be taken to ensure that interfaces are put back into service? (Choose two)
A Cisco Firepower administrator needs to configure a rule to allow a new application that has never been seen
on the network. Which two actions should be selected to allow the traffic to pass without inspection? (Choose
two)
Which factor must be considered when choosing the on-premise solution over the cloud-based one?
Which component of Cisco umbrella architecture increases reliability of the service?
Which type of algorithm provides the highest level of protection against brute-force attacks?
For Cisco IOS PKI, which two types of Servers are used as a distribution point for CRLs? (Choose two)
Drag and drop the descriptions from the left onto the correct protocol versions on the right.
In an IaaS cloud services model, which security function is the provider responsible for managing?
Drag and drop the capabilities from the left onto the correct technologies on the right.
A network administrator needs to find out what assets currently exist on the network. Third-party systems need to be able to feed host data into Cisco Firepower. What must be configured to accomplish this?
In which two ways does Easy Connect help control network access when used with Cisco TrustSec? (Choose two)
Which type of protection encrypts RSA keys when they are exported and imported?
Drag and drop the common security threats from the left onto the definitions on the right.
What is the purpose of the certificate signing request when adding a new certificate for a server?
An organization has two systems in their DMZ that have an unencrypted link between them for communication.
The organization does not have a defined password policy and uses several default accounts on the systems.
The application used on those systems also have not gone through stringent code reviews. Which vulnerability
would help an attacker brute force their way into the systems?
An organization has a Cisco ESA set up with policies and would like to customize the action assigned for
violations. The organization wants a copy of the message to be delivered with a message added to flag it as a
DLP violation. Which actions must be performed in order to provide this capability?
An engineer is implementing NTP authentication within their network and has configured both the client and server devices with the command ntp authentication-key 1 md5 Cisc392368270. The server at 1.1.1.1 is attempting to authenticate to the client at 1.1.1.2, however it is unable to do so. Which command is required to enable the client to accept the server’s authentication key?
Which type of API is being used when a security application notifies a controller within a software-defined network architecture about a specific security threat?
Drag and drop the descriptions from the left onto the encryption algorithms on the right.
Refer to the exhibit.
Traffic is not passing through IPsec site-to-site VPN on the Firepower Threat Defense appliance. What is causing this issue?
In which situation should an Endpoint Detection and Response solution be chosen versus an Endpoint
Protection Platform?
A network administrator is configuring SNMPv3 on a new router. The users have already been created;
however, an additional configuration is needed to facilitate access to the SNMP views. What must the
administrator do to accomplish this?
What is the role of Cisco Umbrella Roaming when it is installed on an endpoint?
Which method is used to deploy certificates and configure the supplicant on mobile devices to gain access to
network resources?
A network engineer has been tasked with adding a new medical device to the network. Cisco ISE is being used as the NAC server, and the new device does not have a supplicant available. What must be done in order to securely connect this device to the network?
An organization is trying to implement micro-segmentation on the network and wants to be able to gain visibility on the applications within the network. The solution must be able to maintain and force compliance. Which product should be used to meet these requirements?
Drag and drop the solutions from the left onto the solution's benefits on the right.
With which components does a southbound API within a software-defined network architecture communicate?
Which risk is created when using an Internet browser to access cloud-based service?
Why is it important to have logical security controls on endpoints even though the users are trained to spot security threats and the network devices already help prevent them?
A Cisco ESA network administrator has been tasked to use a newly installed service to help create policy based on the reputation verdict. During testing, it is discovered that the Cisco ESA is not dropping files that have an undetermined verdict. What is causing this issue?
An organization is using Cisco Firepower and Cisco Meraki MX for network security and needs to centrally
manage cloud policies across these platforms. Which software should be used to accomplish this goal?
An attacker needs to perform reconnaissance on a target system to help gain access to it. The system has weak passwords, no encryption on the VPN links, and software bugs on the system’s applications. Which
vulnerability allows the attacker to see the passwords being transmitted in clear text?
Which cryptographic process provides origin confidentiality, integrity, and origin authentication for packets?
Which product allows Cisco FMC to push security intelligence observable to its sensors from other products?
When planning a VPN deployment, for which reason does an engineer opt for an active/active FlexVPN
configuration as opposed to DMVPN?
When configuring ISAKMP for IKEv1 Phase1 on a Cisco IOS router, an administrator needs to input the
command crypto isakmp key cisco address 0.0.0.0. The administrator is not sure what the IP addressing in this command issued for. What would be the effect of changing the IP address from 0.0.0.0 to 1.2.3.4?
Which two aspects of the cloud PaaS model are managed by the customer but not the provider? (Choose two)
What are the two types of managed Intercloud Fabric deployment models? (Choose two.)
An organization has two systems in their DMZ that have an unencrypted link between them for communication.
The organization does not have a defined password policy and uses several default accounts on the systems.
The application used on those systems also have not gone through stringent code reviews. Which vulnerability
would help an attacker brute force their way into the systems?
An engineer has been tasked with implementing a solution that can be leveraged for securing the cloud users,
data, and applications. There is a requirement to use the Cisco cloud native CASB and cloud cybersecurity
platform. What should be used to meet these requirements?
Which Cisco platform ensures that machines that connect to organizational networks have the recommended
antivirus definitions and patches to help prevent an organizational malware outbreak?
An organization is receiving SPAM emails from a known malicious domain. What must be configured in order to
prevent the session during the initial TCP communication?
Which two risks is a company vulnerable to if it does not have a well-established patching solution for
endpoints? (Choose two)
Which deployment model is the most secure when considering risks to cloud adoption?
Which two behavioral patterns characterize a ping of death attack? (Choose two)
What are two reasons for implementing a multifactor authentication solution such as Duo Security provide to an
organization? (Choose two)
When using Cisco AMP for Networks which feature copies a file to the Cisco AMP cloud for analysis?
Which two probes are configured to gather attributes of connected endpoints using Cisco Identity Services
Engine? (Choose two)
Which action controls the amount of URI text that is stored in Cisco WSA logs files?
A network administrator configures Dynamic ARP Inspection on a switch. After Dynamic ARP Inspection is applied, all users on that switch are unable to communicate with any destination. The network administrator checks the interface status of all interfaces, and there is no err-disabled interface. What is causing this problem?
The Cisco ASA must support TLS proxy for encrypted Cisco Unified Communications traffic. Where must the
ASA be added on the Cisco UC Manager platform?
Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?
Which two characteristics of messenger protocols make data exfiltration difficult to detect and prevent?
(Choose two)
What can be integrated with Cisco Threat Intelligence Director to provide information about security threats,
which allows the SOC to proactively automate responses to those threats?
A network administrator is modifying a remote access VPN on an FTD managed by an FMC. The administrator wants to offload traffic to certain trusted domains. The administrator wants this traffic to go out of the client's local internet and send other internet-bound traffic over the VPN Which feature must the administrator configure?
Which solution is made from a collection of secure development practices and guidelines that developers must follow to build secure applications?
Which feature within Cisco ISE verifies the compliance of an endpoint before providing access to the
network?
An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1 1 11 using the flow record Stea!thwatch406397954 command Which additional command is required to complete the flow record?
Which RADIUS feature provides a mechanism to change the AAA attributes of a session after it is
authenticated?
An administrator needs to configure the Cisco ASA via ASDM such that the network management system
can actively monitor the host using SNMPv3. Which two tasks must be performed for this configuration?
(Choose two.)
An administrator configures a Cisco WSA to receive redirected traffic over ports 80 and 443. The organization requires that a network device with specific WSA integration capabilities be configured to send the traffic to the WSA to proxy the requests and increase visibility, while making this invisible to the users. What must be done on the Cisco WSA to support these requirements?
An organization wants to provide visibility and to identify active threats in its network using a VM. The
organization wants to extract metadata from network packet flow while ensuring that payloads are not retained
or transferred outside the network. Which solution meets these requirements?
Which Cisco platform provides an agentless solution to provide visibility across the network including encrypted traffic analytics to detect malware in encrypted traffic without the need for decryption?
Which type of data exfiltration technique encodes data in outbound DNS requests to specific servers
and can be stopped by Cisco Umbrella?
Drag and drop the exploits from the left onto the type of security vulnerability on the right.
Which function is performed by certificate authorities but is a limitation of registration authorities?
Which solution supports high availability in routed or transparent mode as well as in northbound and
southbound deployments?
A Cisco ISE engineer configures Central Web Authentication (CWA) for wireless guest access and must have the guest endpoints redirect to the guest portal for authentication and authorization. While testing the policy, the engineer notices that the device is not redirected and instead gets full guest access. What must be done for the redirect to work?
Drag and drop the features of Cisco ASA with Firepower from the left onto the benefits on the right.
A network security engineer must export packet captures from the Cisco FMC web browser while troubleshooting an issue. When navigating to the address https://
Which Cisco security solution secures public, private, hybrid, and community clouds?
Refer to the exhibit.
What does the API key do while working with https://api.amp.cisco.com/v1/computers?
What are two things to consider when using PAC files with the Cisco WSA? (Choose two.)
A network engineer must configure a Cisco ESA to prompt users to enter two forms of information before gaining access The Cisco ESA must also join a cluster machine using preshared keys What must be configured to meet these requirements?
Refer to the exhibit.
An engineer must configure a Cisco switch to perform PPP authentication via a TACACS server located at IP address 10.1.1.10. Authentication must fall back to the local database using the username LocalUser and password C1Sc0451069341l if the TACACS server is unreachable.
Drag and drop the commands from the left onto the corresponding configuration steps on the right.
Which direction do attackers encode data in DNS requests during exfiltration using DNS tunneling?
An engineer configures new features within the Cisco Umbrella dashboard and wants to identify and proxy traffic that is categorized as risky domains and may contain safe and malicious content. Which action accomplishes these objectives?
What is the process In DevSecOps where all changes In the central code repository are merged and synchronized?
Which CoA response code is sent if an authorization state is changed successfully on a Cisco IOS device?
An engineer is implementing DHCP security mechanisms and needs the ability to add additional attributes to profiles that are created within Cisco ISE Which action accomplishes this task?
With Cisco AMP for Endpoints, which option shows a list of all files that have been executed in your
environment?
An engineer is trying to decide between using L2TP or GRE over IPsec for their site-to-site VPN implementation. What must be un solution?
Which Cisco security solution determines if an endpoint has the latest OS updates and patches installed on the system?
During a recent security audit a Cisco IOS router with a working IPSEC configuration using IKEv1 was flagged for using a wildcard mask with the crypto isakmp key command The VPN peer is a SOHO router with a dynamically assigned IP address Dynamic DNS has been configured on the SOHO router to map the dynamic IP address to the host name of vpn sohoroutercompany.com In addition to the command crypto isakmp key Cisc425007536 hostname vpn.sohoroutercompany.com what other two commands are now required on the Cisco IOS router for the VPN to continue to function after the wildcard command is removed? (Choose two)
A network administrator is configuring a role in an access control policy to block certain URLs and selects the "Chat and instant Messaging" category. which reputation score should be selected to accomplish
this goal?
An organization wants to secure data in a cloud environment. Its security model requires that all users be
authenticated and authorized. Security configuration and posture must be continuously validated before access is granted or maintained to applications and data. There is also a need to allow certain application traffic and deny all other traffic by default. Which technology must be used to implement these requirements?
Which method must be used to connect Cisco Secure Workload to external orchestrators at a client site when the client does not allow incoming connections?
Drag and drop the posture assessment flow actions from the left into a sequence on the right.
A network engineer is tasked with configuring a Cisco ISE server to implement external authentication against Active Directory. What must be considered about the authentication requirements? (Choose two.)
What are two facts about WSA HTTP proxy configuration with a PAC file? (Choose two.)
A company identified a phishing vulnerability during a pentest What are two ways the company can protect employees from the attack? (Choose two.)
A network engineer entered the snmp-server user asmith myv7 auth sha cisco priv aes 256
cisc0xxxxxxxxx command and needs to send SNMP information to a host at 10.255.255.1. Which
command achieves this goal?
Drag and drop the Cisco CWS redirection options from the left onto the capabilities on the right.
Which two types of connectors are used to generate telemetry data from IPFIX records in a Cisco Secure Workload implementation? (Choose two.)
An engineer is configuring Dropbox integration with Cisco Cloudlock. Which action must be taken before granting API access in the Dropbox admin console?
An organization wants to improve its cybersecurity processes and to add intelligence to its data The organization wants to utilize the most current intelligence data for URL filtering, reputations, and vulnerability information that can be integrated with the Cisco FTD and Cisco WSA What must be done to accomplish these objectives?
Which two functions does the Cisco Advanced Phishing Protection solution perform in trying to protect from phishing attacks? (Choose two.)
An engineer must modify a policy to block specific addresses using Cisco Umbrella. The policy is created already and is actively u: of the default policy elements. What else must be done to accomplish this task?
Drag and drop the security responsibilities from the left onto the corresponding cloud service models on the right.
Which feature enables a Cisco ISR to use the default bypass list automatically for web filtering?
What is the result of the ACME-Router(config)#login block-for 100 attempts 4 within 60 command on a Cisco IOS router?
An organization is selecting a cloud architecture and does not want to be responsible for patch management of the operating systems. Why should the organization select either Platform as a Service or Infrastructure as a Service for this environment?
A security test performed on one of the applications shows that user input is not validated. Which security vulnerability is the application more susceptible to because of this lack of validation?
Which industry standard is used to integrate Cisco ISE and pxGrid to each other and with other
interoperable security platforms?
When network telemetry is implemented, what is important to be enabled across all network infrastructure devices to correlate different sources?
TESTED 22 Feb 2025
Graphical user interface
Description automatically generated with low confidence
Text, chat or text message
Description automatically generated
A picture containing application
Description automatically generated
