Cisco Updated 350-701 Exam Questions and Answers by subhan

The Cisco Identity Services Engine (ISE) posture module provides a service that allows you to check the compliance of endpoints with corporate security policies. This service consists of three main components: client provisioning, posture policy, and authorization policy. Client provisioning ensures that the endpoints receive the appropriate posture agent, such as the AnyConnect ISE Posture Agent or the Network Admission Control (NAC) Agent. Posture policy defines the conditions and requirements that the endpoints must meet to be considered compliant, such as having the latest antivirus updates or patches installed. Authorization policy determines the level of network access granted to the endpoints based on their posture assessment results, such as allowing full access, limited access, or quarantine.

The two actions that the Cisco ISE posture module provides that ensure endpoint security are:

• The latest antivirus updates are applied before access is allowed. This action prevents malware infections and protects the network from potential threats. The posture policy can include predefined or custom conditions that check the antivirus status of the endpoints, such as the product name, version, definition date, and scan result. If the endpoint does not meet the antivirus requirement, the posture agent can trigger a remediation action, such as launching the antivirus update or scan, before allowing network access.
• Patch management remediation is performed. This action ensures that the endpoints have the latest security patches installed and are not vulnerable to known exploits. The posture policy can include predefined or custom conditions that check the patch status of the endpoints, such as the operating system, service pack, hotfix, or update. If the endpoint does not meet the patch requirement, the posture agent can trigger a remediation action, such as redirecting the endpoint to a patch management server or launching the patch installation, before allowing network access.

References :=

• Cisco Identity Services Engine Administrator Guide, Release 2.2 - Configure Client Posture Policies
• Configuring posture services with the Cisco Identity Services Engine
• Cisco Identity Services Engine Administrator Guide, Release 2.0 - Posture Policy

DNS tunneling is a technique that uses the DNS protocol to exfiltrate data or establish command and control channels between a compromised host and an attacker-controlled server. DNS tunneling can bypass network security controls that allow outbound DNS traffic without inspection or filtering. To stop DNS tunneling, two recommended approaches are:

• Enforce security over port 53. This means applying firewall rules, access control lists, or other mechanisms to restrict outbound DNS traffic to only authorized DNS servers and domains. Additionally, DNS traffic should be inspected and analyzed for anomalies, such as unusually large or frequent queries, non-standard encoding, or suspicious domains. This can help detect and block DNS tunneling attempts.
• Use Cisco Umbrella. Cisco Umbrella is a cloud-based security service that provides DNS security, web filtering, and threat intelligence. Cisco Umbrella can prevent DNS tunneling by blocking malicious domains, enforcing policies based on content categories, and applying machine learning to identify and stop emerging threats. Cisco Umbrella can also provide visibility and reporting on DNS activity and security events.

References :=

• Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 5: Securing the Cloud, Lesson 5.2: DNS Security
• What Is DNS Tunneling? - Palo Alto Networks
• An Introduction to DNS Tunneling Detection & Data Exfiltration via DNS - Vercara

 Cisco Container Platform (CCP) is a solution that simplifies the deployment and management of containerized applications across multiple clouds. It provides the following benefits to customers who utilize cloud service providers12:

• Allows developers to create code once and deploy to multiple clouds. CCP is based on open source components, such as Kubernetes and Docker, that are compatible with various cloud platforms. This enables developers to write code once and run it anywhere, without worrying about the underlying infrastructure or vendor lock-in. CCP also supports hybrid and multicloud scenarios, allowing customers to leverage the best features of different cloud providers and optimize their costs and performance.
• Manages Kubernetes clusters. CCP automates the installation, configuration, and maintenance of Kubernetes clusters, which are groups of nodes that run containerized applications. CCP provides a simple GUI-driven menu system to deploy clusters, as well as automated monthly updates for bug fixes, feature enhancements, and security patches. CCP also offers a choice of networking solutions, such as Cisco ACI, Calico, or Contiv, to connect and secure the clusters. CCP also integrates with Cisco AppDynamics and Prometheus for visibility and monitoring of the clusters and applications. References:
• Cisco Container Platform - Cisco
• Cisco Container Platform - At-a-Glance - Cisco