SCORE Dump

Refer to the exhibit. An engineer creates a Python script to make an API call to Cisco Secure Access. Which output should be expected from the script?. device URL. client secret. access token. endpoint token.

A security administrator is evaluating solutions to secure corporate endpoints. The organization needs a tool that blocks malware in real time and enables forensic investigation and containment actions after an incident occurs. Which type of solution must be selected?. host-based firewall. DNS-layer filtering service. EPPI. EDR.

A network engineer is enabling RADIUS CoA on a fleet of Cisco Catalyst switches so that Cisco ISE can quarantine compromised endpoints in real time. To uniquely target an active session for disconnect or re-authorization, Cisco ISE must include an IETFI attribute 31 to identify the endpoint. Which configuration action must be done on Cisco ISE to meet the requirement?. Apply Message-Authenticator attribute for endpoint session lookup. Implement Acct-Session-ID attribute for matching the active session. Use NAS-Port-ID attribute for the CoA disconnect request. Configure Calling-Station-ID attribute for COA session identification.

What is the function of IKE protocol in an IPSec VPN?. negotiate tunnel parameters. manage data transfers. handle packet filtering. encrypt data packets.

Refer to the exhibit An engineer configures an IPSec VPN betwen two Cisco Secure Firewall Threat Defense devices named FTD1 and FTD2, however, the hosts behind the FTD1 and FTD2 cannot communicate with each other, The enginer runs debug command to troubleshoot the issue. What must be configured to resolve this issue?. transform set. preshared secret. crypto access-control list. NAT Traversal.

Which open standard underpins OpenlD Connect, enabling Cisco Duo to authorize application access?. OAuth 2.0. Kerberos. SCEP. RSTP.

Which security control is required for identifying and neutralizing malicious code that attempts to execute on an endpoint?. CASB. SWG. EPP. XDR.

Refer to the exhibit. What conclusion should an administrator draw about the URL malicious-domain-example com?. domain is blocked because it is newly registered domain regardless of the Threat Score. domain is safe as Security Score is 25/100. high Threat Score along with the presence of DNS Tunneling and DGA. domain is a legacy site that has been compromised with Domain Age of 4 days.

Which Cisco IOS XE command rejects packets with a source IP address that fails a reverse path forwarding prefix check on the ingress interface?. ip verify unicast source reachable-via rx. ip verify unicast source reachable-via any. ip verify unicast source reachable-via tx. ip verify unicast source reachable-via both.

Which IPS analysis technique matches traffic against a database of known attack patterns?. Anomaly-based detection. Signature-based detection. Behavioral analytics. Heuristic detection.

A security engineer requires social media websites to be blocked via Cisco Secure Firewall Threat Defense for a company. Which configuration action must the engineer apply to meet the requirement?. enable global settings with default URL filtering. apply web filtering in an access policy. block social media URL category in access policy rule destination. configure file policy in an access policy.

A regional engineering firm has deployed Cisco Secure Firewall Threat Defense as its Cisco Secure Client VPN headend managed by Cisco Secure Firewall Management Center. The Cisco Secure VPN Client grants staff remote access to interna applications hosted on the 172.16.50.0/24 server subnet in the data center. Security policy dictates that only sessions destined for the internal servers must be encrypted and routed through the tunnel. All traffic to the internet must utilize user's loca internet connection. Which configuration must be done to meet these requirements?. Implement split tunneling to exclude the 172.16.50.0/24 internal server network. Deploy a dynamic access policy that forwards all non-corporate traffic locally. Enable VPN load balancing to distribute the 172.16.50.0/24 traffic across peers. Configure split tunneling to tunnel traffic for the 172.16.50.0/24 network only.

What is a key feature of the BYOD capability in Cisco ISE?. to assess the security posture of personal devices before network access is allowed. to fully manage network devices based on the characteristics before access is allowed. to provide femporary internet access for personal devices of guesf users. to encrypt endpoints data against predefined security policies.

A manufacturing firm is deploying Cisco Firepower Threat Defense managed by Cisco Secure Firewall Management Center to safeguard the industrial control network from protocol misuse. The Cisco Secure Firewall is positioned inline to monitor all SCADA traffic between plant devices and the data center. Industrial Security has been enabled, and DNP3 packets are confirmed to reach the sensor unencrypted. Management requires the firewalls to drop offending packets and generate an alert on any abnormal data values. Which configuration action must be done to meet the requirements?. Create a prefilter rule that fastpaths all DNP3 sessions to the sensors. Configure application detection for industrial traffic in the access control policy. Enable deep packet inspection in a flex-config to analyze DNP3 traffic. Configure Intrusion rules for the DNP3 preprocessor within the Intrusion policy.

An engineer is configuring Cisco Secure Endpoint to enhance network security by specifying a large set of external IP addresses that must be monitored for potential threats. The engineer is configuring the IP List and must add the IP addresses in the list. Which configuration action must the engineer take next to meet the requirement?. automate threat feed subscription using API. add IP addresses using the global bulk configuration wizard. use the data upload function, import a file formatted in JSON. utilize the multiple-row feature, paste all addresses into the input field.

A large enterprise is currently managing a hybrid environment consisting of a private data center and multiple public cloud providers. The security engineering team is concerned aboutiShadow IT" and the lack of visibility into unauthorized cloud services being utilized by various departments. The architect must select a solution that provides comprehensive discovery of cloud application usage and assesses the risk of each service based on industry certifications. Which technical solution must be used t provide the cross-environment visibility?. CWPP. Secure Firewall. EDRI. CASB.

Which mitigation strategy should be used to protect against session hijacking attacks in a cloud environment?. Use secure cookies. Use anti-cross-site request forgery tokens. Apply the principle of least privilege. Implement input validation.

A network engineer must configure a Cisco Catalyst switch to prevent traffic on the network from being interrupted by broadcast packets flooding the network using a predefined threshold. The engineer also must ensure that multicast and unicast traffic surges are controlled to maintain optimal network performance. What must be configured on the switch to meet the requirements?. BPDU guard. DHCP snooping. storm control. loop guard.

Refer to the exhibit. A security engineer is publishing a public web server located on the DMZ of a Cisco Secure Firewall Threat Defense managed by Cisco Secure Firewall Management Center. The required network objects, Webserver Private and Webserver_Public, are already defined, and an Auto NAT static rule mapping the public address to the private DMZ address is in place. The web server must be reachable from any source on the internet. The engineer must configure the new Access Control Rule within the existing Access Control Policy. Which two configuration actions must be done to meet the requirements? (Choose two.). Add Any as Source Network and Webserver Private as the Destination Network. Add Webserver Private as Source Network and Webserver Public as Destination Network. Add Outside as the Source Zone and DMZ as the Destination Zone. Add Any as Source Network and Webserver Public as the Destination Network. Add DMZ as the Source Zone and Outside as the Destination Zone.

Which two capabilities of Cisco Secure Workload facilitate the detection of lateral movement within the data center and cloud environment? (Choose two.). automatic blocking of all inbound and outbound traffic. integration with threat intelligence for identifying malicious IP addresses. real-time visibility into communication patterns between workloads. recommendations for implementing VLANs for network segmentation. dynamic updates to firewall rules based on user access.

A large retail enterprise is deploying Cisco Secure Private Access to enable remote employees to reach internal applications without manual intervention. The IT department requires a seamless, zero-touch enrollment process where users are registered and authenticated transparently without requiring end-user action. The architecture must support robust high availability for back-end connectivity to ensure continuous access to private resources. Which configuration approach must the administrator implement to meet the requirement?. Define VPN Machine Tunnel with Certificates Enrollment and Connector Groups associated with the private resource. Implement ZTA with Certificate Enrollment and multiple Connector Groups associated with the private resource. Configure ZTA with SAML Enrollment and multiple Connector Groups associated with the private resource. Apply ZTA with SAML Enrollment including passwordless Enrollment and single Connector associated with the private resource.

A security policy administrator configures Cisco Secure Access SIA DNS policy to block all social media categories for the Marketing Active Directory group. While testing from one of the user machines, access to the domain https://socialmediaexample.org was allowed. When searching for this domain in the user activity search, no queries for that specific domain were returned. Consider these facts: • The user being used for testing is part of the Marketing Active Directory group. • The domain socialmediaexample org is part of the social media category. • The user is configured with Umbrella Roaming Client for DNS redirection. • All other social media websites are properly blocked from the same user and matching the correct policy Which configuration must the administrator do in the Cisco Secure Access to meet the requirement?. Enable HTTPS inspection on web policy because this is a HTTPS site. Add domain socialmediaexample.org to the External domain list. Add domain socialmediaexample.org to the Internal domain list. Enable the intelligence proxy to properly identify this domain.

A manufacturing company contracted an external software vendor to develop an application that dynamically creates marketing messages personalized to the business and audience. To ensure that communication between the sender and recipient emai addresses does not create false positives, an exception rule must be configured in Cisco Email Threat Defense. Which configuration must be done on Cisco Email Threat Defense to accomplish the task?. implement Exception Rule with wildcard email. apply sender-based Policy Exception Rule. add Policy Exception Rule with Sender/Recipient pair set. configure Recipient based Policy Exception Rule.

Which compliance status is shown in EPP when a configured posture policy requirement is not met?. unknown. noncompliant. authorized. compliant.

Agroup of hospitals is collaborating to transition from an on-premises infrastructure to a cloud solution. The solution must be cost-effective, flexible, scalable and it must support large volumes of data traffic. Each hospital has its own rules and policies that require direct control over its processes. The sensitive data including patient records must remain on-premises. Which type of cloud must be used?. hybrid. federated. private. public.

Which character is strictly prohibited at the beginning of a Splunk event type search string?. Quotes (*). Equal (=). Pipe (|). Wildcard (*).

What is the purpose of threat intelligence in the Cisco Security Reference Architecture?. to assist with threat monitoring and incident response. to analyze network traffic and identify potential vulnerabilities. to manage access control and authentication mechanisms. to ensure compliance with industry regulations.

Which security principle advocates rapid cryptographic algorithm replacement to defend against quantum-computing threats?. Crypto agility. Zero trust. Network slicing. Key escrow.

Which Splunk SOAR component automates multi-step security actions into a repeatable workflow?. Data model. Action. Playbook. Alert.

A security engineer must protect endpoints when a file appears harmless during initial inspection but later shows malicious behavior. The solution must continuously observe process and file activity after execution and respond when a threat emerges The infrastructure includes Cisco Secure Endpoint. Which feature must the engineer configure to meet the requirements?. Continuous Behavioral Monitoring. File Reputation. System Process Protection. Forensic Analysis.

A logistics company issues corporate laptops that must automatically build a Cisco Secure Client VPN tunnel whenever the users are not in the office and connected to any untrusted external network. Cisco Secure Firewall Threat Defense is used as the VPN headend and already configured with remote-access profiles, address pools, and a PKI distributing both machine and a user certificates to endpoints. Management requires the tunnel to come up unattended before any a user signs in to a laptop Device based authentication must be used, and the client must distinguish the corporate LAN from outside networks. VPN must be connected when a user is outside the corporate network. Which configuration action must be done to meet the requirements?. Configure Trusted Network Detection and SBL with machine certificate authentication for the client. Configure Trusted Network Detection using cached domain credentials for client authentication. Implement Start Before Logon paired with a user certificate authentication in the profile. Configure Management VPN tunnel with a user certificate authentication for unattended connectivity.

A company wants to enforce security policy using Cisco Secure Access SIA. The design requirements are: • Block adult content and gambling categories for all users • Inspect file downloads for malware • Bypass TLS decryption for financial and healthcare domains due to compliance • Allow the marketing department to use social media, while kepping file scanning active for downloads from those sites. Which two configuration actions must the engineer make on Cisco Secure Access SIG to meet the requirements? (Choose two.). configure Marketing policy with higher precedence to allow social networking sites. apply decryption bypass list for financial and healthcare domains. disable TLS decryption globally to rely on DNS-layer reputation for blocking adult content and gambling sites. create a global policy blocking adult content and gambling with TLS enabled with Marketing policy that has higher precedence to allow social networking sites. implement a single global policy blocking adult and gambling categories, add a web application allow rule for social networking. use destination allow lists for financial and healthcare sites to prevent SSL inspection with malware scanning enabled in full inspection mode for all traffic.

What is a difference between cross-site request forgery and cross-site scripting?What is a difference between cross-site request forgery and cross-site scripting?. Cross-site request forgery exploits web app vulnerabilities, and cross-site scripting exploits the trust that a web app has in a browser. Cross-site request forgery sends HTTP requests and receives responses, and cross-site scripting is limited to HTTP requests. Cross-site request forgery requires only device interaction to operate, and cross-site scripting requires human interaction. Cross-site request forgery is limited to the actions the target is able to perform, and cross-site scripting uses malicious scripts.

What is a difference between SQL injection and buffer overflow?. SQL injection gives unauthorized access to a database, and buffer overflow executes arbitrary code and corrupts memory. SQL injection causes denial-of-service, and buffer overflow bypasses all forms of user authentication. SQL injection is delivered by a web form, and buffer overflow bypasses all forms of user authentication entirely. SQL injection is a stack-based attack, and buffer overflow is a heap-based attack.

Refer to the exhibit. A security analyst at a financial institution is reviewing the Cisco Secure Endpoint Device Trajectory for a Windows endpoint after a high-severity alert. The analyst observes the event chain below. Which two actions must be taken to contain the threat and prevent further compromise? (Choose two.). Configure a network block policy in Cisco Secure Endpoint for destination IP address and update the DNS security policy to block resolution of the associated C2 domain across all managed endpoints. Run an Orbital live query on FIN-WKSTN-021 to enumerate active network connections and registry Run keys, then use the query results to manually remove the persistence entry before isolating the endpoint. Add the SHA256 hash of payload bin/svcupdate.dll to a custom block list in Cisco Secure Endpoint to prevent the quarantined file from being restored or re-introduced on any managed edpint. Reimage FIN-WKSTN-021 immediately, as the registry persistence entry makes live remediation unreliable and the payload has already been quarantined, eliminating the need for further forensic investigation. Use the Cisco Secure Endpoint console to isolate FIN-WKSTN-021 from the network, severing the active C2 connection while preserving the endpoint for investigation through the Secure Endpoint connector.

Which solution offers automated blocking of known threats and visibility into zero-day attack behavior with the ability to respond directly from the console?. cloud-native antivirus with offline update support. EDR with behavioral analytics and remote containment. EPP solution with an HIDS integration. Secure Email Gateway with phishing sandboxing.

A network engineer is configuring NTP authentication on a Cisco Catalyst Switch to ensure secure time synchronization. The engineer configures the client and NTP server by running the ntp authentication-key 10 md5 CiscoR45745212 command. The engineer must associate the NTP client at IP address 10.10.10.2 with the NTP server at IP address 10.10.10.1 using the correct key Which configuration completes the requirement?. Intp server 10.10.10.1 key 10. Intp peer 10.10.10.2 key 10. Intp server 10.10.10.2 key 10. Intp peer 10.10.10.1 key 10.

Which approach reduces risk from social engineering attacks?. enabling NAT traversal for endpoint management. restricting outbound TCP traffic to known subnets. using port security to limit DHCP spoofing. conducting regular security awareness training for all users.

A network engineer must enable SSH and SCP on a Cisco IOS router. The engineer already generated the encryption keys and enabled SCP services on the router. Which configuration action must be done next?. Enable SCP strict host key checking. Add an ACL to deny access from the LAN. Enable SSHv2 in the configuration. Restrict access to specific SSH commands.

What is the AI/LLM vulnerability where faulty semantic indexes leak sensitive training data?. Supply chain. Vector and embedding weaknesses. System prompt leakage. Prompt injection.

What causes alert fatigue in Cisco XDR?. automatic policy enforcement in a suspicious event. alerts lacking sufficient context to be accurate. reauthentication of an active endpoint during a vulnerability incident. notifications from too few devices in a data breach event.

Which feature of a secure CI/CD pipeline defends container workloads against detected exploits, application flaws, configuration errors, and policy violations?. control groups. runtime protection. cloud-native firewalling. separation of duties.

A financial services firm is concerned about employees inadvertently pasting sensitive customer account information into public generative Al websites. The security team needs to implement a solution that inspects outbound traffic and prevents the transmission of the sensitive data to Al platforms. Which two configuration actions must the administrator perform on Cisco Secure Access to achieve the requirement? (Choose two.). Implement a strict firewall rule to block all outbound traffic on port 443 for the entire organization. Configure a DLP policy to inspect outbound traffic for sensitive data patterns.!. Enable the local endpoint firewall to block all traffic to known Al service IP addresses. Apply an Al guardrail rule to block uploads to unauthorized Al domains. Disable all web browser access for employees to prevent them from navigating to any external websites.

Which functionality does incident triage provide in Cisco XDR?. It enables backup activities in case of misidentification of a threat. It calculates the time it usually takes for incident identification. It prioritizes the steps to recover from the incident. It determines the time it takes to resolve an issue.

Which standard format is used to represent structured threat intelligence information for automated sharing?. PKI. VDB. STIX. SRU.

Which two types of policies are used by ZTNA to provide access to an application? (Choose two.). identity. access. context. site-to-site. remote access.

Which DevSecOps practice helps reduce vulnerabilities introduced through external open-source components?. performing static routing configuration checks. conducting software composition analysis during builds. using dynamic routing between Kubernetes clusters. setting up round-robin DNS resolution for service discovery.

Which feature enforces continuous connectivity by preventing users from disconnecting the Cisco Secure Client tunnel?. Always-On. AllowLocalLAN. SmartTunnel. PathMTUDiscovery.

A network engineer must prevent endpoints from becoming infected by malicious files. The infrastructure includes a Cisco Secure Endpoint platform that must execute suspicious files in a cloud sandbox. Which feature must the engineer configure on Cisco Secure Endpoint to meet the requirement?. Layer 4 Traffic Monitor. Orbital Advanced Search. Dynamic File Analysis. Cisco Application Visibility and Control.

An engineer is securing access to the data served by a cloud-based app. The data must be protected from being modified in transit and integrity being validated. The security measures were implemented: • Governance with role-based access control based on the principle of least privilege • TLS 1.3 with signed certificates • AES-256 with MD5 What must be configured to complete the implementation that secures the data?. SSLv3 instead of MD5. DES instead of TLS 1.3. 3DES instead of AES. SHA-512 instead of MD5.

Refer to the exhibit. Which task is the Python script performing when using the Cisco Secure Firewall Management Center REST API?. creating an access control rule that monitors suspicious URLS. deleting an access control rule that blocks suspicious URLs. deleting an access control rule that monitors suspicious URLs. creating an access control rule that blocks suspicious URLs.

Refer to the exhibit. A newly installed stack of Catalyst switches has just been integrated with Cisco ISE for 802. 1X port control and DACL enforcement. Test workstation authenticate successfully, but the expected DACL never appears in the port configuration, leaving all traffic unrestricted. Packet captures confirm that ISE transmit the correct attributes, yet the switches classify them as "unknown" and ignore the instructions. A review of the running configuration shows complete AAA and 802.1X configuration. Which configuration command must be added to resolve the issue?. radius-server vsa send accounting|. aaa authorization exec default group radius. radius-server vsa send authentication. aaa authorization network default group radius.

Anetwork engineer is configuring SNMPV3 on a new Cisco router. The SNMPV3 users and group were created, but the users do not have access to the SNMP views. Which configuration action must the engineer take to allow access?. Set the username and password for SNMPv3 authentication. Define the encryption algorithm to be used by SNMPV3. Specify the UDP port to be used by SNMPv3. Map the new SNMPv3 users to SNMP views.

Refer to the exhibit. An engineer is implementing a network access control solution. Users can authenticate against the RADIUS server using 802. 1X, and now the engineer wants to configure a downloadable access control list on the switchport using Cisco ISE. Which command must be used next on the Cisco Catalyst Switch to complete the requirement?. ip access-group ACL-NAME out. switchport mode access. authentication order mab dot 1x. radius-server vsa send authentication.

The security architect has concluded that the optimal mail flow positions the existing Secure Emall Gateways as the first termination point for inbound messages, while Cisco Email Threat Defense is positioned between the Secure Email Gateways and the mail cloud. The security engineer has been asked to configure the incoming-traffic domain setting on Cisco Email Threat Defense so that it reflects the Secure Email Gateway handling inbound messages ahead of the service. Which domain configuration for incoming traffic must be selected on Cisco Email Threat Defense to meet the requirements?. Secondary Gateway. Primary Gateway. Secondary with Additional Gateway. Primary with Additional Gateway.

What is the difference between site-to-site VPN and remote access VPN?. Site-to-site VPN connects a private network using software endpoints, and remote access VPN connects devices to user resources in the network. Site-to-site VPN uses a GRE over IPsec configuration, and remote access VPN uses a Cisco GET Transport VPN configuration. Site-to-site VPN connects two private networks behind VPN termination devices, and remote access VPN connects a user to a private network. Site-to-site VPN uses a Cisco GET VPN configuration, and remote access VPN uses a virtual tunnel interface configuration.

Which capability within the Security Service Edge enforces application-level access based on user identity and device posture?. Identity-based firewalling. Clientless SSL VPN. ZTNA. NAC.

Which Linux system call loads an eBPF program and manages eBPF maps within the kernel?. ioctl(). perf_event_open(). pretl(). bpf().

Which Cisco Secure Endpoint feature tracks the propagation and execution path of a malicious file across the environment?. File Trajectory. Device Flow Correlation. Exclusion Lists. Incident Manager.

How is ICMP used in a data exfiltration attack?. It replaces IMP with encrypted IRC traffic over SNMP. It embeds small data payloads inside IMP echo-request and echo-reply packets. It spoofs MAC addresses to force ICMP fragments into VLAN trunks. It compresses emails into ICMP packets and routes them through an SMTP proxy.

A multinational logistics firm is transitioning from a traditional VPN-based remote access model to Cisco Secure Private Access ZTA. The firm is migrating its existing legacy inventory management applications to a ZTA framework to minimize the attack surface. Security requirements mandate that access to the applications must be based on Zero Trust Principles. The solution must ensure that traffic is tunneled through secure connectors without exposing the application directly to the internet. Which configuration must be performed within the private resource definition to accomplish the task?. Configure CIDR-based network range and associate it with an access policy that enforces device posture and evaluates user group membership. Apply specific hostnames and port protocols, bind it to an access policy that evaluates user group membership. Create hostnames and port protocols tunneled through secure connector and bind it to an access policy that uses user group and device posture status. Define specific hostnames, bind it to an access policy that evaluates user group membership while applying a posture bypass rule.

A healthcare organization is deploying Cisco Secure Access to prevent protected health information from being shared with generative Al services. The security team requires that real-time DLP inspection occur only on traffic destined for Al applications, with minimal false positives on general web browsing. The policy must also allow tuning based on proximity and match counts of PHI identifiers. Which configuration action must the engineer perform to meet the requirement ?. Deploy a real-time DLP rule referencing a built-in PHI data classification with tuned match-count thresholds, scoped to a web profile filtered by destination domain lists for known Al vendors. Implement an API-based DLP rule referencing a custom PHI data classification with tuned proximity and match-count thresholds, scoped to the generative Al application category. Configure a real-time DLP rule referencing a built-in PHI data classification with default thresholds, scoped to a web profile that includes alf internet traffic. Apply a real-time DLP rule referencing a custom PHI data classification with tuned proximity and match-count thresholds, scoped to a web profile filtered by the generative Al application category.

The security team of a multinational corporation is deploying Cisco Secure Firewall Threat Defense managed by Cisco Secure Firewall Management Center to enforce web-access restrictions at its internet edge. Management now mandates that any request to high-risk web resources and any BotNet URLs be denied. Which configuration action must be done to meet the requirement?. Schedule hourly URL database updates under global system update settings. Configure an access control rule with category and reputation-based URL blocking. Order the access control rules so the malware filter applies first. Enable SSL decryption for all destinations to inspect encrypted web traffic.

What are two benefits of using Cisco Secure Access Secure Web Gateway in addition to DNS-layer protection? (Choose two). routing traffic through internal mail filters. enforcing URL-based filtering. caching DNS queries at the firewall. data loss prevention. blocking malware before DNS lookup.

Which type of information does threat intelligence gather to identify potential threats using common adversary techniques?. aggregated firewall syslogs and routing tables. network traffic statistics and performance metrics. data on known malware signatures and IP addresses. user browsing history and personal data.

Refer to the exhibit. A threat analyst is investigating the domain federatedplantmesh garden after it appeared in DNS logs from several roaming users. In the Cisco Secure Access Investigate dashboard security analyst notes that several individual indicators including Lexical, TLD, and Geo Popularity are not strongly elevated, yet the overall Risk Score is 100. What is occurring?. The keyword Score 83 is the only elevated indicator driving the overall score to 100; the Security Category is unverified given the Dispute Categorization link. D. has no active threat infrastructure. The infrastructure fields including Recent IP, ASN, and Registrant are blank which is consistent with a newiy registered or non-resolving domain with a malware security category. The overall score of 100 is inconsistent and likely a dashboard rendering error, domain must be re-queried before trusting the classification. The dispute categorization indicates the malware classification is contested and pending review, the empty Recent IP and ASN fields confirm the domain has no active threat infraestructure.

What is a capability of a Trojan horse on a computer system?. It enables access to restricted areas without being detected. It inserts its own code when legitimate programs are executed. It replicates itself to other programs. It disguises itself as a legitimate program.

Which operation layer executes eBPF programs for packet processin?. User space. Control plane. Data plane. Management plane.

Refer to the exhibit. A security analyst at a pharmaceutical company is reviewing a Cisco Secure Endpoint malware detection alert triggered on a laboratory workstation. The analyst observes the event data below. Which two things are occurring? (Choose two.). Endpoint is running in Audit mode, the file was detected and quarantined. The file winword exe is on a custom application allow list and treated as false positive. Endpoint is running in Audit mode, the file was detected but not quarantined. The antivirus engine update interval on workstation LAB-WKSTN-047 is too infrequent. The file executed, was spawned from winword exe, and opened an outbound TCP connection.

A security engineer is integrating a new Cisco Catalyst access switch with Cisco ISE to enforce port-based network access control using 802.1X. The AAA RADIUS server group, access interfaces are configured on the Cisco Catalyst Switch. Cisco OSE is configured with authentication and authorization policies. Supplicat on the workstations is configured as expected. Connectivity between the Cisco Catalyst Switch and the Cisco ISE server verified and working. During testing, the workstations fail to trigger any authentication sessions, and no RADIUS request appear in the ISE logs and on the switch interface. Which two configuration commands must be added to Cisco Catalyst Switch to accomplish? (Choose two). Configure the dot 1x system-auth-control command globally. Apply the dot1x pae authenticator command under interfaces that require 802. 1X. Add the mab command under all switch interfaces. Implement aaa server radius dynamic-author command globally. Configure the ip radius source-interface command globally.

A security administrator must implement a network intrusion policy in Cisco Secure Firewall to block new potential threats without sacrificing network performance. The administrator plans to create a base policy that has a large set of rules optimized to protect the environment without impacting throughput. Which type of policy should the administrator create?. Maximum Detection. Balanced Security and Connectivity. Security Over Connectivity. Connectivity Over Security.

In a federated single sign-on environment, which protocol exchanges XML-based assertions between an identity provider and a service provider for authentication?. RADIUS. SAML. LDAP. OAuth 2.0.

Which type of attack uses malicious code to interact with a backend database and manipulate data?. man-in-the-middle. phishing. cross-site scripting. SQL injection.

What is the purpose of a hashing algorithm in cryptographic systems?. exchanging symmetric keys between hosts using RSA. authorizing users by validating their digital certificates. encrypting entire data streams for confidentiality during transport. verifying data integrity by producing a fixed-size output from input data.

Which authentication framework is employed to validate user credentials during the device initial enrollment handshake with MDM?. OIDC. CHAP. PAP. Kerberos.

How is DNS tunneling used by an attacker to exfiltrate confidential data?. Data is embedded within POST requests, and the requests are sent over HTTP/HTTPS connection. An attacker poisons a victim's DNS records and forwards the traffic to another machine. Data is encoded and encapsulated inside the header information of a packet. Data is encoded in a URL, and a query is made to a domain controlled by the attacker.

Refer to the exhibit. During the rollout of a new site-to-site VPN between a headquarters Cisco Secure Firewall Threat Defense and a partner Firewall, the tunnel never completes IKEv1 Phase 1 and stays in MM_WAIT_MSG_6. Reachability between firewalls over internet is verified, ISAKMP UDP-500 is permitted end-to-end, and the IKE phaset policy parameters including encryption, hashing, DH Group and lifetime matches exactly on both ends. Which configuration action must be done to resolve the issue?. add the same pre-shared key on both peers within their tunnel-group attributes. implement identical Diffie-Hellman group numbers within the active IKEv1 policy. configure matching peer identity values under each tunnel-group on both endpoints. apply equivalent transform sets and lifetimes inside the crypto map entries.

What is the difference between DMVPN and Cisco GET VPN?. Cisco GET VPN makes encryption key management complex, and DMVPN simplifies the hub router configuration. Cisco GET VPN uses the hub-and-spoke topology only, and DMVPN supports the full mesh topology. Cisco GET VPN uses peer-to-peer encryption, and DMVPN uses group protection encryption. Cisco GET VPN uses Group Domain of Interpretation protocol, and DMVPN uses Next Hop Resolution Protocol.

Refer to the exhibit. Asite-to-site IKEv2 VPN between two Cisco Secure Firewall Threat Defense at a healthcare organization completes IKE Phase 1 successfully but fails during CREATE_CHILD_SA, The engineer captures the debug output from the initiating Cisco Secure Firewall. Which action must be performed to resolve the issue?. Align the protected network definitions on both Firewalls so the local and remote traffic selectors proposed during CREATE_CHILD_SA match on both peers. Change the IPsec encryption algorithm from AES-256 to AES-128 on the initiating Firewall and redeploy the VPN policy. Remove DH-Group-19 from the IPsec proposal on the initiating FTD, as the TS_UNACCEPTABLE notification indicates the responder does not support the proposed PFS group. Extend the IKE SA lifetime on both Firewalls to give CREATE_CHILD_SA sufficient time to complete the negotiation before the Phase 1 SA expires.

Which component of a Cisco IOS NetFlow solution enables the aggregation of data packets into flows?. exporter. sampler. collector. analyzer.

A network engineer is deploying multiple Cisco Secure Firewall Threat Defense devices across two data centers. The solution requirements are: • Management must have no Internet dependency • Management must remain accessible during major outages • Centralized policy management Which solution must be implemented to meet the requirements?. each firewall locally managed with Cisco Secure Firepower Device Manager over the production network. Cisco Secure Firewall Management Center per datacenter with in-band network management. security Cloud Control over the Internet with no on-premise managers. on-premises Cisco Secure Firepower Management Center in HA with dedicated OOB network.

Refer to the exhibit. A Cisco Secure Endpoint malware event shows that a file was convicted as malicious and the remediation status for the file is Quarantine Failed. Before escalating the incident, the analyst must determine what is concluded from the available event data. What is occurring based on the logs?. failed quarantine status indicates that the threat continued executing after the remediation attempt. event data does not establish if the threat still remains present or remediated through another mechanism. failed quarantine status indicates that the file remained accessible to the operating system after the remediation attempt. failed quarantine status indicates that the endpoint was unable to apply the configured remediation policy.

Which protocol does the BYOD component in Cisco ISE use to obtain a unique device certificate from an internal CA?. SFTP. SCEP. OCSP. CMP.

Refer to the exhibit. A site-to-site IKEv2 VPN between a Cisco Secure Firewall Threat Defense with public IP address 203.0.113.10 and a third-party firewall with public IP address 198.51.100.20 is failing to establish at a logistics company. The engineer enables IKEv2 debug on the FTD and captures the output. Which action must be performed to resolve the issue?. Update the IKEv2 policy to remove SHA-384 and use only SHA-256 , aligning Phase 1 integrity to the algorithm agreed upon during IKE_SA_INIT. Switch both peers to certificate-based authentication by enrolling an identity certificate from the corporate CA and sharing the CA certificate with the remote peer. Verify the pre-shared key configured on the VPN peer object exactly matches the key on the remote peer, including case, special characters, and any leading or trailing spaces. Change the DH group IKEv2 policy from Group 20 to Group 14 to match the group negotiated during IKE_SA_INIT.

A pharmaceutical research facility has implemented a Clean Room" network segment to protect sensitive research data and automated manufacturing equipment. Strict compliance requirements mandate that all network traffic logs from Cisco Secure Firewall serving the segment be forwarded to Splunk for auditing. A Splunk Universal Forwarder is deployed locally on the log collection servers to monitor syslog files. The engineer must configure the Universal Forwarder to monitor the local syslog files and assign a specific Sourcetype for proper ingestion into Splunk. Which stanza configuration must be done to meet the requirements?. inputs.conf using [monitor:///var/log/syslog]. server.conf using [monitor://syslog]. props.conf using [syslog]. outputs.conf using [tcpout].

A facilities team is onboarding a fleet of badge readers and IP cameras through MAB authentication on Cisco Catalyst access switches integrated with Cisco ISE. After Cisco ISE profiles each endpoint, an authorization policy must dynamically move the device into a dedicated loT VLAN that differs from the access VLAN statically defined on the port. The endpoints lack a supplicant and do not have ability to auto renew DHCP IP addresses. The network engineer requires Cisco ISE to issue a CoA that forces each endpoint to re-establish the connectivity and request a fresh DHCP lease with the new authorization policy. Which configuration action must be done on Cisco ISE to meet the requirement?. Implement the authorization profile to send a CoA-Reauth to the access switch. Apply the authentication policy to send a CoA-Terminate to reconnect the endpoint. Use the authorization policy to send a CoA-Reconnect and rely on idle timeout. Configure the authorization profile to send a Port-Bounce CoA to the switch.

A recent change left network engineers unable to SSH into a branch Cisco Catalyst switch. Network engineer confirms that the TACACS server group TACACS-GROUP is defined but not reachable. There is no fallback configured to the local database when TACACS+ is down. Security policy requires TACACS+ for primary authentication with automatic fallback to local accounts. Which configuration command must be added to resolve the issue?. aaa authentication login default group TACACS-GROUP local. aaa authentication login group TACACS-GROUP local. aaa authentication login ssh LOCAL TACACS-GROUP. aaa authentication serial console TACACS-GROUP LOCAL.

An engineer must implement an external application that authenticates against the Cisco Email Threat Defense API to perform automated message searches. The application already presents a user bearer token, but the API requires an additional authentication header to be supplied with each request. The engineer must configure the external application to include the required header alongside the bearer token so the API calls are accepted. Which header must be configured for authentication on Cisco Email Threat Defense to accomplish the task?. token-id. client_secret. x-auth-token. x-api-key.

A network engineer must upload an operating system image to a network devices and activate the image on the device by using the Cisco Catalyst Center API. Which two configuration methoeds will upload and activate the image? (Choose two). POST/dna/intent/api/v1/onboarding/pnp-device/import. POST/dna/intent/api/v1/image/activation/device. POST/dna/intent/api/v1/network/{site_id}. POST/dna/intent/api/vi/template-programmer/project/{project_id) /template. POST/dna/intent/api/v1/image/distribution.

A development team is building a new microservices-based application and wants to avoid the operational burden of managing virtual machines or hardware. They require a service model that provides a preconfigured environment including the operating system, middleware, and runtime libraries. According to the NiST SP 800-145 framework, which service model should the engineering team select for the design?. SECaaS. PaaS. laaS. SaaS.

Which protocol does Cisco Duo use to transport authentication assertions for single sign-on?. EAP. SCP. SCEP. SAML.

A technology company is centralizing telemetry from Google Cloud Platform and Okta into Splunk Enterprise for unified SOC monitoring. The engineer has installed the Splunk Add-on for Google Cloud Platform and the Splunk Add-on for Okta Identity Cloud on a heavy forwarder cluster. GCP audit logs are delivered to a Pub/Sub topic with a service account JSON key created for Splunk, and an Okta API token has been generated for the System Log API. SOC analysts require both data sources to land in dedicated indexes for Enterprise Security correlation searches. Which two configurations must be done on Splunk to meet the requirements? (Choose two.). Configure a Google Cloud Pub/Sub input in the GCP Add-on with the project ID, subscription name, and service account credentials specifying the destination index. Deploy a Google Cloud Storage input bound to the Pub/Sub topic setting the sourcetype to google gcp:audit for proper CIM mapping. Configure a SAML federation input in the Okta Identity Cloud Add-on using a signed metadata file to authenticate System Log retrieval. Enable an Okta input in the Okta Identity Cloud Add-on with the Okta org URL and API token, specifying the destination index for System Log events. Implement HTTP Event Collector token on the indexers pointing both the GCP Pub/Sub and Okta exporters to the HE endpoint.

Refer to the exhibit. A network engineer configures DHCP snooping on a network that has Cisco Catalyst switches. Auser connected to VLAN 100 uses through the switch uplink interface. The switchport access interface configurations are verified and correct. DHCP server responses must be allowed through the uplink interface for VLAN 100. Which configuration command must be added to accomplish the requirement?. ip dhep snooping trust. ip dhep snooping limit 100. ip dhcp snooping binding. ip dhcp snooping vlan 100.

A security engineer is deploying an IPsec site-to-site VPN between headquarters and a remote plant, protected by Cisco Secure Firewall Threat Defense managed by Cisco Secure Firewall Management Center. These configurations have already been performed: • Matching IKEv2 proposal, Pre-Shared key and IPsec transform set • Access control rules to allow the traffic • Crypto map applied to the outside interfaces VPN traffic is exempted from inspection. During a packet capture on the firewall it was noted that traffic is translated to the public IP and preventing tunnel establishment. Which configuration action must be done next to accomplish the task?. Enable IKEv2 fragmentation on both peers to reduce packet size. Configure NAT exemption for traffic between the interesting subnet pairs. Create a tunnel-group with preshared key authentication under connection profiles. Attach the new VPN policy to the global prefilter default action.

Which two services are provided by the Cisco Talos Incident Response group? (Choose two.). security policy authorization. automatic vulnerability remediation. cyber range training. threat hunting. bug identification.

Which WASP LM risk involves an attacker embedding hidden instructions in user input to manipulate the model's behavior?. System Prompt Leakage. Data Exfiltration. Output Truncation. Prompt Injection.

Which capability allows an administrator to configure forensics rules in Cisco Secure Workload?. Cisco Secure Workload predefined. MITRE TT&CK framework only predefined. custom clauses. Windows or Linux application.

A security engineer is required to configure a Cisco Splunk Universal Forwarder to send network traffic logs from Cisco Catalyst switches to a Splunk Indexer cluster in compliance with security policies. To meet strict compliance requirements, all network traffic logs from the Cisco Catalyst switches must be ingested into Splunk to provide a tamper-proof audit trail. The Security engineer must configure outputs conf on a Universal Forwarder to send data to an Indexer cluster including thousands of forwarders. The data must be distributed across all indexers. Which two configuration actions must be done to accomplish the task? (Choose two.). configure single primary indexer in the outputs conf and enable forced connection. Use a deployment server to push an app containing the outputs. conf out to all of the Universal Forwarders. Configure outputs conf with the DNS names and indexing ports of all the indexers within the cluster. implement large output queue size in the outputs conf and disable automatic load balancing. configure the forwarder to write logs to a local file share and schedule a batch job to copy the data into the indexers.

A network engineer must enable DHCP snooping for the corporate switches only for VLAN 2. The management wants to drop DHCP traffic from unauthorized servers. DHCP snooping is already enabled globally and the trust interface set on the uplink. Which configuration must be applied to meet the requirement?. ip dhcp snooping trust vlan 2. ip dhcp snooping vlan 2. ip dhcp relay information trusted vlan 2. ip dhcp snooping information option vlan 2.

A company wants to migrate to the cloud to reduce operational costs. The company requires full control to modify and patch applications. The cloud provider must be responsible for managing everything else, and all data must be secure at rest. Which cloud service modle must be used to meet these requirement?. SaaS. hybrid. laaS. PaaS.