Cisco Updated 350-701 Exam Questions and Answers by kiyaan

Explanation

The profiling service issues the change of authorization in the following cases:

– Endpoint deleted—When an endpoint is deleted from the Endpoints page and the endpoint is disconnected

or removed from the network.

An exception action is configured—If you have an exception action configured per profile that leads to an

unusual or an unacceptable event from that endpoint. The profiling service moves the endpoint to the

corresponding static profile by issuing a CoA.

– An endpoint is profiled for the first time—When an endpoint is not statically assigned and profiled for the first time; for example, the profile changes from an unknown to a known profile.

+ An endpoint identity group has changed—When an endpoint is added or removed from an endpoint identity group that is used by an authorization policy.

The profiling service issues a CoA when there is any change in an endpoint identity group, and the endpoint identity group is used in the authorization policy for the following:

++ The endpoint identity group changes for endpoints when they are dynamically profiled

++ The endpoint identity group changes when the static assignment flag is set to true for a dynamic endpoint – An endpoint profiling policy has changed and the policy is used in an authorization policy—When an endpoint profiling policy changes, and the policy is included in a logical profile that is used in an authorization policy. The endpoint profiling policy may change due to the profiling policy match or when an endpoint is statically assigned to an endpoint profiling policy, which is associated to a logical profile. In both the cases, the profiling service issues a CoA, only when the endpoint profiling policy is used in an authorization policy.

Threat intelligence collects and contextualizes indicators associated with malicious activity so security controls and analysts can recognize adversary infrastructure and artifacts. Examples include malicious IP addresses and domains, file hashes, malware characteristics, command-and-control infrastructure, and related tactics, techniques, and procedures. Therefore, option D is the best answer. Firewall syslogs and routing tables may provide local telemetry for investigation, but they are not, by themselves, the clearest representation of gathered intelligence about known threats. Performance metrics describe network health rather than adversary behavior. Collecting users’ personal browsing data is neither the defined purpose nor an appropriate general description of threat intelligence. Cisco Talos reporting commonly supplies file hashes, domains, and IP addresses connected with malicious operations, allowing products and SOC teams to detect and block related activity. Cisco’s threat-intelligence guidance supports option D.

================

Explanation

FlexVPN is an IKEv2-based VPN technology that provides several benefits beyond traditional site-to-site VPN implementations. FlexVPN is a standards-based solution that can interoperate with non-Cisco IKEv2

implementations. Therefore FlexVPN can support a multivendor environment. All of the three VPN technologies support traffic between sites (site-to-site or spoke-to-spoke).

Cisco Secure Endpoint IP block and allow lists support individual IP addresses, CIDR blocks, and IP-address/port combinations for device flow correlation. Cisco’s configuration procedure states that one entry can be added per row, while the Add Multiple Rows feature allows an administrator to enter or paste a list of IP addresses and CIDR blocks into one dialog and then add the rows. That is the direct method for the large set described. The console also supports file upload, but Cisco specifies a newline-delimited CSV file—not JSON—so option C is incorrect. A global bulk configuration wizard is not the documented IP-list workflow, and subscribing to a threat feed through an API does not add this administrator-supplied set to the current custom list. Thus, Add Multiple Rows is the appropriate next action. Cisco Secure Endpoint IP-list configuration