Cisco Updated 350-701 Exam Questions and Answers by honey

Cisco Umbrella is a cloud-delivered and SaaS-based solution that provides DNS-layer security and web filtering for internet traffic. It blocks requests to malicious domains or IPs before a connection is even established, and logs and inspects all web traffic for greater transparency, control, and protection1.

However, not all domains or IPs are clearly malicious or benign. Some of them may be risky, meaning that they host both legitimate and malicious content, or that they have a low reputation score based on various factors. For these domains or IPs, Cisco Umbrella offers the option to proxy the traffic through the intelligent proxy, which is a selective web proxy that performs deeper inspection and analysis of the web content2.

The intelligent proxy can apply URL filtering, file inspection, and file type control to the proxied traffic, and block or allow it based on the policy settings. The intelligent proxy can also leverage Cisco Advanced Malware Protection (AMP) and antivirus engines to scan files for malware and threats3.

Therefore, by using the intelligent proxy, Cisco Umbrella can manage traffic that is directed toward risky domains more effectively, and provide an additional layer of security and visibility for the organization.

References :=

Manage the Intelligent Proxy

Manage File Inspection

Cisco Umbrella At a Glance

Explanation

Cisco Cloudlock is a cloud-native cloud access security broker (CASB) that helps you move to the cloud safely.

It protects your cloud users, data, and apps. Cisco Cloudlock provides visibility and compliance checks,

protects data against misuse and exfiltration, and provides threat protections against malware like ransomware.

Explanation

Umbrella Roaming is a cloud-delivered security service for Cisco’s next-generation firewall. It protects your employees even when they are off the VPN.

 Dynamic ARP Inspection (DAI) is a security feature that protects ARP (Address Resolution Protocol) from an attack like ARP poisoning. ARP poisoning is a technique where an attacker sends forged ARP responses to trick hosts into associating IP addresses with the attacker’s MAC address. This allows the attacker to intercept, modify, or drop traffic between the victims, creating a “man-in-the-middle” scenario. DAI can prevent this attack by validating ARP packets on untrusted interfaces, using information from the DHCP snooping database and/or an ARP access-list. If the ARP packet contains invalid MAC address to IP address bindings, it will be dropped and logged. DAI can also rate-limit ARP packets to mitigate ARP flooding attacks. DAI is configured on a per-VLAN basis and requires DHCP snooping to be enabled on the same VLANs. References :=

Some possible references are:

Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 2: Network Security, Lesson 2.4: Implement Layer 2 Security

Understanding and Configuring Dynamic ARP Inspection

DAI (Dynamic ARP Inspection)