Cisco Updated 350-701 Exam Questions and Answers by shelby

Cisco Tetration is a Cisco security solution that provides patch management in the cloud. Patch management is the process of identifying, acquiring, installing, and verifying patches for products and systems to correct security and functionality problems in software and firmware1. Cisco Tetration is a cloud-native platform that delivers comprehensive workload protection for multicloud data centers by enabling a zero-trust model using segmentation2. One of the features of Cisco Tetration is software vulnerability detection and patch management, which allows users to identify software vulnerabilities on workloads, prioritize patching based on risk scores, and automate patch deployment using orchestration tools3. Cisco Tetration leverages the National Vulnerability Database (NVD) and Cisco Talos Intelligence Group to provide up-to-date information on software vulnerabilities and their severity levels3. Cisco Tetration also supports patch management for both Windows and Linux operating systems, as well as third-party applications such as Apache, Java, MySQL, and Oracle4. Therefore, the correct answer is D. Cisco Tetration. References: 1: RFC 9232: Network Telemetry Framework - Internet Engineering Task Force 2: Cisco Tetration - Workload Protection - Cisco 3: Cisco Tetration Software Vulnerability Detection and Patch Management - Cisco 4: Cisco Tetration Platform Data Sheet - Cisco

The event explicitly reports Audit mode and states that the malicious file was not quarantined, making B correct and C false. Audit mode records detections without applying the normal blocking or quarantine action. The telemetry also records the file as created and executed, identifies winword.exe as its parent, and shows outbound TCP and DNS activity to external infrastructure; therefore, D accurately summarizes the observed execution chain. Cisco explains that Secure Endpoint malware events can include information captured at execution time, including the file path and invoking application, in its file and malware event guidance. The retrospective verdict means a previously unknown file was later classified as malicious, not that signature updates were infrequent. Nothing in the exhibit indicates that winword.exe was allow-listed. Thus, B and D are supported directly by the evidence.

================

Runtime protection monitors and protects a container after deployment while its processes are executing. This is the stage at which attempted exploitation, unexpected process behavior, vulnerable packages, configuration weaknesses, and policy violations can become active threats. Cisco describes cloud workload protection as defending containers and other workloads against runtime threats, misconfigurations, and vulnerabilities. Consequently, option C directly matches the requirement. Control groups are a Linux resource-management mechanism; they limit or account for CPU, memory, and other resources but are not a complete security capability. Separation of duties is an administrative control that reduces excessive privilege in development and operations. Cloud-native firewalling controls network flows, but it does not by itself observe or stop every malicious action inside a running container. Cisco’s cloud workload protection overview confirms the runtime distinction.

================

Cisco Firepower impact flags are indicators that help you evaluate the impact an intrusion has on your network by correlating intrusion data, network discovery data, and vulnerability information1. Impact flags are assigned to intrusion events based on the following criteria:

The operating system and application protocol of the target host

The exploitability of the target host by the attacker

The relevance of the intrusion rule to the target host

The severity of the intrusion rule Impact flags can have four values: unknown, neutral, affected, or vulnerable. Unknown means that the system does not have enough information to assess the impact. Neutral means that the system knows the target host is not affected by the intrusion. Affected means that the system knows the target host is affected by the intrusion, but not necessarily exploitable. Vulnerable means that the system knows the target host is exploitable by the intrusion1. Impact flags can help you prioritize your response to intrusion events, as well as generate reports and alerts based on the impact level. You can also use impact flags to filter and search for intrusion events in the Firepower Management Center1. References: 1: Firepower Management Center Configuration Guide, Version 6.1 - External Alerting with Alert Responses.