Cisco 350-701 Practice Test Questions, Exam Dumps

Practice Exams:

View All

350-701 Cisco Practice Test Questions and Exam Dumps

Question No 1:

In an SDN (Software-Defined Networking) architecture, which of the following components require the use of southbound APIs for communication?

A. SDN controller and the network elements
B. Management console and the SDN controller
C. Management console and the cloud
D. SDN controller and the cloud

Answer: A. SDN controller and the network elements

Explanation:

In Software-Defined Networking (SDN), the architecture is designed to separate the control plane (which makes decisions about network management) from the data plane (which forwards traffic based on those decisions). The control plane is typically managed by an SDN controller, and it communicates with various network elements, such as switches, routers, and other hardware devices. The communication between the SDN controller and these network devices is enabled by southbound APIs.

Here’s a breakdown of the relevant components and their communication needs:

Southbound APIs: These are interfaces that allow the SDN controller to interact with the network hardware and devices at the lower layers of the network (the data plane). Southbound APIs are crucial for the SDN controller to send instructions to devices such as switches and routers, enabling the configuration, monitoring, and management of the network infrastructure. Examples of southbound APIs include OpenFlow and NETCONF.
Northbound APIs: These APIs are used for communication between the SDN controller and higher-level applications, such as network management systems or cloud services. Northbound APIs allow the SDN controller to share information and enable management functions with higher-level systems.

Thus, Option A is the correct answer because the southbound APIs are specifically used for communication between the SDN controller and the network elements (such as routers, switches, firewalls, etc.), which are at the data plane of the network.

Let’s review the other options:

Option B (Management console and the SDN controller): This refers to communication between the management console (which may be a user interface for administrators) and the SDN controller. This is typically handled through northbound APIs, not southbound APIs.
Option C (Management console and the cloud): The management console interacting with the cloud services typically involves higher-level communication and does not involve southbound APIs. This would also be managed using northbound APIs or other management interfaces.
Option D (SDN controller and the cloud): While the SDN controller may interact with cloud-based services for orchestration, automation, and management, this communication is generally through northbound APIs, which are designed to provide a link between the SDN controller and cloud platforms, rather than using southbound APIs.

In summary, southbound APIs are primarily used to facilitate communication between the SDN controller and network elements, such as switches and routers, enabling the configuration and management of the physical infrastructure.

Question No 2:

Which two HTTP request methods are valid for use with the REST API on the Cisco ASA platform? (Choose two.)

A. PUT
B. OPTIONS
C. GET
D. PUSH
E. CONNECT

Answer:
A. PUT
C. GET

Explanation:

The Cisco ASA (Adaptive Security Appliance) platform, which provides robust security solutions such as firewalls, VPNs, and intrusion prevention, uses a REST API to enable programmatic interaction with its management features. The REST API allows users to perform various operations, such as querying configurations, modifying settings, and managing firewall rules.

REST (Representational State Transfer) APIs use standard HTTP methods to perform operations on resources, which are typically represented in JSON or XML format. The main HTTP methods include:

GET (C): The GET method is used to retrieve data or information from a server. In the context of the Cisco ASA platform, this method allows users to retrieve configuration settings, status information, or other data from the ASA device. For example, you can use GET to retrieve the current configuration of a firewall rule or the status of a VPN connection. It is a read-only operation, meaning it does not alter the system’s state.
PUT (A): The PUT method is used to update an existing resource on the server or create a new resource if it doesn’t already exist. In the case of the Cisco ASA platform, the PUT method would be used to modify configuration settings, such as updating firewall rules, IP addresses, or other security parameters. It is a write operation, meaning it can change the state of the system.

Let’s consider the other options:

OPTIONS (B): The OPTIONS method is used to describe the communication options for the target resource. It’s commonly used to discover what HTTP methods are supported by a server for a specific resource. While OPTIONS is a valid HTTP method, it is not typically used for interacting with resources in the Cisco ASA platform through the REST API. It’s more of an informational method, rather than one used to modify or query the actual configuration.
PUSH (D): The PUSH method is not a standard HTTP method. While there are various other protocols that might use the term "push" (such as WebSockets or server push notifications), it is not part of the HTTP method standard, and therefore, it’s not a valid option for the Cisco ASA REST API.
CONNECT (E): The CONNECT method is used to establish a tunnel to the server, typically for proxy purposes (such as in HTTPS proxying). It is not typically used in REST APIs for interacting with resources, and as such, it’s not a valid method for interacting with the Cisco ASA REST API.

In conclusion, the valid HTTP methods for the Cisco ASA REST API are PUT and GET. These methods are used for retrieving information and modifying configurations, which are essential for automating and managing the firewall and security appliance through the API.

Question No 3:

In the context of Software-Defined Networking (SDN) architecture, what is the primary function of northbound APIs? Which two areas of the network do they enable communication between?

A. SDN controller and the cloud
B. Management console and the SDN controller
C. Management console and the cloud
D. SDN controller and the management solution

Answer: B. Management console and the SDN controller

Explanation:

In Software-Defined Networking (SDN), the architecture is typically divided into three main components: the data plane, the control plane, and the application plane. The northbound API refers to the interface that facilitates communication between the SDN controller and the management console or other higher-level management applications.

SDN Controller: The SDN controller is responsible for managing the data plane, which includes the physical network devices like routers and switches. It acts as the central brain of the network, making decisions about how traffic should be forwarded based on the network topology and policies.
Management Console: The management console typically refers to the user interface or platform through which administrators can interact with the SDN network. It allows network administrators to configure, monitor, and manage network devices and policies.
Northbound APIs: These are the communication channels that sit at the top of the SDN controller. They allow the controller to interface with higher-layer applications, such as network management solutions, orchestration systems, or business applications. Northbound APIs enable applications (like a management console) to interact with the controller to define network policies, automate configurations, and collect network analytics.

By enabling communication between the management console and the SDN controller, northbound APIs allow administrators and network management systems to orchestrate and monitor the network. This setup helps in automating network configurations, performance monitoring, and policy enforcement.

Why not other options?

Option A (SDN controller and the cloud) is incorrect because while SDN controllers can interact with cloud resources, northbound APIs are primarily used for communication between the SDN controller and management solutions, not directly with the cloud.
Option C (management console and the cloud) is incorrect as this doesn't accurately describe the role of northbound APIs in SDN. The console communicates with the controller through northbound APIs, not directly with the cloud.
Option D (SDN controller and the management solution) is close but not entirely accurate. The correct answer specifies the management console as the interface for SDN network administration, which is a broader category that includes management solutions.

Key Points:

Northbound APIs are crucial for connecting the SDN controller with higher-level management applications.
They enable the management console to define network policies, monitor traffic, and automate tasks in the SDN.
This interface is fundamental for network automation and simplifying network management tasks.

Question No 4:

What is a feature of the open platform capabilities of Cisco DNA Center?

A. Application adapters
B. Domain integration
C. Intent-based APIs
D. Automation adapters

Answer: C. Intent-based APIs

Explanation:

Cisco DNA Center is a comprehensive network management and automation platform that simplifies and accelerates the management of network infrastructure. It provides a set of open platform capabilities designed to enhance the flexibility and scalability of network operations, enabling IT teams to respond to changing business needs quickly.

One of the core features of Cisco DNA Center is its intent-based networking approach, which focuses on defining network intent (desired network state) rather than specific configurations. This allows network administrators to express high-level objectives, and Cisco DNA Center automatically translates these intents into the necessary configuration changes across the network.

Intent-based APIs are an integral part of this approach. They allow users to define, manage, and automate the network’s desired state using APIs that support intent-based programming. The system will then ensure that the network's configuration is aligned with this intent, automating tasks like policy enforcement, traffic optimization, and network health monitoring.

Why not other options?

Option A (Application adapters) is not the correct choice because application adapters are typically used to integrate external applications into the Cisco DNA Center platform. While useful, they are not the primary feature related to the open platform capabilities.
Option B (Domain integration) is also incorrect because Cisco DNA Center's domain integration feature focuses on connecting various network domains (e.g., campus, branch, cloud), but it doesn’t specifically highlight the open platform capabilities that focus on intent-based networking.
Option D (Automation adapters) is somewhat related but not the most relevant answer in this case. While automation is a significant feature of Cisco DNA Center, the open platform specifically refers to intent-based APIs, which are more aligned with Cisco's automation and network orchestration efforts.

Key Points:

Intent-based APIs are central to Cisco DNA Center’s open platform, allowing network administrators to specify network intentions rather than configuring each individual setting manually.
These APIs help automate the network’s configuration, simplify policy enforcement, and improve operational efficiency.
Cisco DNA Center is designed to automate and streamline network management, enabling businesses to focus on their goals and leave the network’s operational complexity to the platform.

Question No 5:

Refer to the exhibit. What action does the API perform when connected to a Cisco security appliance?

A. It establishes an SNMP pull mechanism for managing Cisco Advanced Malware Protection (AMP).

B. It collects network telemetry data from Cisco AMP for endpoints.

C. It retrieves the process and PID information from computers within the network.

D. It gathers network interface information from the computers that Cisco AMP monitors.

The correct answer is B. gather network telemetry information from AMP for endpoints.

Explanation:

When an API is connected to a Cisco security appliance, such as Cisco AMP (Advanced Malware Protection), it allows for communication between external systems (like management consoles, security monitoring systems, or SIEMs) and the Cisco appliance. In the context of Cisco AMP for Endpoints, APIs are often used to interact with endpoint data and gather telemetry information regarding endpoint security status, threats, and performance.

Here’s a breakdown of the options:

A. create an SNMP pull mechanism for managing AMP

Incorrect. While Simple Network Management Protocol (SNMP) is widely used for network management and monitoring, it is not typically the method for interacting with Cisco AMP. SNMP is more commonly used for gathering status and performance data from networking devices like routers, switches, or firewalls, rather than specific endpoint security data.

B. gather network telemetry information from AMP for endpoints

Correct. Cisco AMP for Endpoints provides detailed telemetry data on endpoints that are protected by the AMP security platform. This includes information such as file and process behavior, network activity, and endpoint health. The API allows an external system to query Cisco AMP and gather this information to monitor security events, analyze threats, and improve response times.

C. get the process and PID information from the computers in the network

Incorrect. While it’s true that Cisco AMP for Endpoints can track processes and other indicators of compromise on protected devices, the specific function of the API is generally focused on gathering broader telemetry data, such as alerts, threat detection, or overall system health, rather than just the process or PID data. The API does not exclusively retrieve such detailed, low-level process information unless explicitly configured to do so.

D. gather the network interface information about the computers AMP sees

Incorrect. While Cisco AMP may be capable of monitoring network interfaces as part of endpoint security management, the primary focus of the API in this context is on collecting telemetry data related to endpoint security events and behavior, not necessarily just the network interface details. Network interface data is typically available as part of a more extensive analysis, but it is not the primary objective of the API connection.

In summary, the API is primarily used to gather network telemetry information from Cisco AMP for endpoints, allowing security teams to monitor, analyze, and respond to potential security threats effectively. This data includes details about endpoints, processes, file activities, and any other relevant security events that can help inform a broader security strategy.

Question No 6:

Which type of attack is typically carried out using botnets?

A. TCP Flood
B. DDoS
C. DoS
D. Virus

The correct answer is B. DDoS.

Explanation:

A botnet is a collection of compromised computers or devices that are controlled by an attacker, typically without the knowledge of the device owners. These devices, referred to as "bots" or "zombies," can be used to perform various malicious activities, one of the most common being the Distributed Denial of Service (DDoS) attack.

Here’s a breakdown of the options:

A. TCP Flood

Incorrect. A TCP flood is a type of attack where an attacker sends an overwhelming amount of TCP packets to a target server, attempting to exhaust the server's resources. While a botnet can indeed be used to launch this type of attack, it’s a more specific form of attack compared to DDoS, which encompasses a broader range of flooding techniques, including TCP floods.

B. DDoS (Distributed Denial of Service)

Correct. A DDoS attack is an attempt to overwhelm a target system, typically a server or network, with a massive volume of traffic, rendering the service unavailable to legitimate users. This attack is usually distributed across a network of infected computers (botnet) to increase the scale of the attack and make it more difficult to stop. By using a botnet, an attacker can coordinate a large-scale DDoS attack, flooding the target with traffic from many different sources, making it harder for the target to differentiate between legitimate and malicious traffic.

C. DoS (Denial of Service)

Incorrect. A DoS attack is similar to a DDoS attack, but it typically originates from a single machine or source. While botnets are usually associated with DDoS attacks, they can also be used to carry out a DoS attack by flooding the target with traffic. However, since botnets usually amplify the attack's scale, a DDoS is the more likely form of attack carried out using a botnet.

D. Virus

Incorrect. A virus is a type of malware that can spread from one computer to another, typically by attaching itself to a program or file. While botnets are often created by spreading viruses, a virus itself is not a type of attack. A virus can be part of a botnet’s creation, but it is not directly responsible for launching attacks like a DDoS.

In summary, DDoS is the most common attack form launched using a botnet. The distributed nature of the botnet amplifies the impact of the attack, making it challenging for organizations to mitigate. Botnets can be rented or used by attackers to initiate these large-scale, disruptive attacks on their targets.

Question No 7:

In which type of attack is alternate encoding, such as hexadecimal representation, most often observed?

A. Smurf
B. Distributed Denial of Service (DDoS)
C. Cross-Site Scripting (XSS)
D. Rootkit Exploit

The correct answer is C. Cross-Site Scripting (XSS).

Explanation:

Alternate encoding, including hexadecimal representation, is often used as a technique in Cross-Site Scripting (XSS) attacks to bypass security filters or detection mechanisms. In an XSS attack, the attacker injects malicious scripts into webpages viewed by other users, which could lead to session hijacking, defacement, or the stealing of sensitive data. Alternate encoding is often employed to obfuscate the attack and prevent it from being detected by web application firewalls or security filters.

Here’s a breakdown of the options:

A. Smurf

Incorrect. A smurf attack is a type of Distributed Denial of Service (DDoS) attack where the attacker sends ICMP Echo Request (ping) packets with a spoofed source address (the target’s address) to a network’s broadcast address. This causes all devices in the network to respond to the target with a ping reply, overwhelming it with traffic. Smurf attacks do not generally use alternate encoding like hexadecimal representation, which is more relevant in the context of web security and XSS.

B. Distributed Denial of Service (DDoS)

Incorrect. While DDoS attacks can involve large-scale traffic floods aimed at overwhelming a target, they typically do not rely on alternate encoding or hexadecimal representations. DDoS is primarily about traffic volume, not about obfuscating or encoding payloads to bypass security measures.

C. Cross-Site Scripting (XSS)

Correct. XSS attacks often use techniques like alternate encoding, including hexadecimal or Unicode encoding, to evade detection by security mechanisms such as input sanitizers or filters that might block malicious scripts. For example, an attacker might encode a malicious script in hexadecimal form to prevent it from being recognized as a script by the security tools or the web application’s input validation systems. This obfuscation technique makes it harder for traditional filters to detect the malicious payload and allows the attacker to execute JavaScript on the victim’s browser, often leading to the theft of sensitive information or session tokens.

D. Rootkit Exploit

Incorrect. A rootkit exploit is a type of malware that provides unauthorized root or administrative access to a system. While rootkits may use various obfuscation techniques to hide their presence, hexadecimal encoding is not a signature feature of rootkit attacks. Rootkits generally focus on stealth and persistence rather than encoding techniques like XSS.

In conclusion, Cross-Site Scripting (XSS) attacks frequently involve alternate encoding methods like hexadecimal or Unicode encoding to bypass security defenses. This makes it harder for security tools to detect and filter out malicious payloads, allowing attackers to execute harmful scripts on the target website’s users.

Question No 8:

What flaw do attackers exploit when conducting an SQL injection attack on a website or web application?

A. Inadequate user input validation
B. Vulnerabilities in the Linux or Windows operating systems
C. Weaknesses in the database itself
D. Problems related to web page images

Correct Answer: A. Inadequate user input validation

Explanation:

SQL injection (SQLi) is one of the most common and dangerous vulnerabilities in web applications. It allows attackers to manipulate a website's database by injecting malicious SQL code through user inputs, such as form fields or URL parameters. The primary flaw exploited during SQL injection is inadequate user input validation. This occurs when the application fails to properly sanitize or validate user input before it is included in SQL queries. As a result, attackers can enter harmful SQL commands that the application executes as part of a database query, giving the attacker unauthorized access to the database, potentially leading to data theft, data modification, or even full administrative control over the database.

User input validation ensures that the data entered by users into forms or fields is safe to process and does not contain executable SQL code. Without proper validation, user input could be used to inject SQL commands that alter the behavior of the database query, resulting in security breaches. For instance, an attacker might input ' OR 1=1 -- into a login form, which could bypass authentication checks and allow unauthorized access to user accounts.

The other options listed (B, C, D) are not directly related to SQL injection attacks. While database weaknesses may contribute to vulnerabilities, they are not the primary target in SQL injection. Similarly, operating systems and web page images are not directly involved in SQL injection exploits.

Question No 9:

What is the key difference between deceptive phishing and spear phishing?

A. Deceptive phishing targets a specific C-level executive within the organization.
B. Spear phishing attacks focus on a particular individual rather than a group of individuals.
C. Spear phishing specifically targets C-level executives in an organization.
D. Deceptive phishing involves hijacking and manipulating the DNS server to redirect users to fake websites.

Correct Answer: B. Spear phishing attacks focus on a particular individual rather than a group of individuals.

Explanation:

Phishing is a form of cyber attack where the attacker attempts to deceive the victim into divulging sensitive information, such as login credentials or personal details. The two main types of phishing are deceptive phishing and spear phishing.

Deceptive Phishing involves broad, unsolicited attempts to steal information from a large group of people. Attackers usually send emails that appear to be from legitimate sources (such as banks or e-commerce sites) to many individuals, trying to lure them into clicking on malicious links or revealing personal data. The attack is not targeted and typically involves generic messages sent to a wide audience.

Spear Phishing, on the other hand, is highly targeted. It involves an attacker focusing on a specific individual or organization. The attacker customizes the phishing message, often using detailed personal information about the victim to make the email appear more credible. Spear phishing campaigns are more sophisticated and are typically aimed at high-value targets within an organization, such as executives, employees with access to sensitive data, or IT staff.

The correct answer is B because spear phishing is defined by its focus on individual targets, making it more dangerous than deceptive phishing. While option C refers to targeting high-level executives, it doesn't fully capture the broader distinction between the two types of phishing.

Question No 10:

Which two characteristics define a "Ping of Death" (PoD) attack? (Choose two)

A. The attack is fragmented into groups of 16 octets before transmission.
B. The attack is fragmented into groups of 8 octets before transmission.
C. Short bursts of traffic are used to disrupt TCP connections.
D. Malformed packets are used to crash systems.
E. Publicly accessible DNS servers are typically used to execute the attack.

Correct Answers:
D. Malformed packets are used to crash systems.
C. Short bursts of traffic are used to disrupt TCP connections.

Explanation:

A "Ping of Death" attack is a type of Denial of Service (DoS) attack that targets a computer system by sending a malformed or oversized ICMP (Internet Control Message Protocol) packet. The ping command is typically used for network diagnostics, but in a Ping of Death attack, the attacker sends an abnormally large or malformed packet, which exceeds the buffer capacity of the target system. This causes the system to crash or reboot, disrupting its normal operation.

Here are the two main characteristics of a Ping of Death attack:

Malformed packets used to crash systems (D): The key feature of this attack is the exploitation of malformed ICMP packets. These packets can be crafted to have more data than the receiving system's memory can handle, which causes the system to fail when it attempts to process them.
Short bursts of traffic used to disrupt TCP connections (C): While the Ping of Death is primarily associated with ICMP packets, it also disrupts network communications. By sending bursts of traffic, attackers can overwhelm the victim's system, preventing it from maintaining stable connections and causing system crashes or network congestion.

The other options listed (A, B, E) are either irrelevant to Ping of Death specifically or describe other types of network-based attacks. For instance, the fragmentation of packets into specific octet sizes is not a defining feature of the Ping of Death attack. Option E about DNS servers is more applicable to DNS-based attacks like DNS amplification, not Ping of Death.