Reliable CCNP Security 350-701 Dumps PDF Oct 26, 2021 Recently Updated Questions
Pass Your Cisco 350-701 Exam with Correct 358 Questions and Answers
The Cisco 350-701 or Implementing and Operating Cisco Security Core Technologies is a core exam that’s related to the CCNP Security, Cisco Certified Specialist-Security Core, and CCIE Security certifications. From the name, this test checks your knowledge and skills regarding the execution and operations necessary for basic security technologies.
Test Objectives
Overall, the Cisco 350-701 SCOR exam is built around 6 major domains which act as the general guidelines for the certification exam preparation. Be prepared to master the following when working toward your CCNP Security certification:
- Endpoint Protection and Detection (10%);
- Securing the Cloud (15%).
- Network Security (20%);
- Secure Network Access, Visibility, and Enforcement (15%);
- Content Security (15%);
- Security Concepts (25%);
What Are the Tested Skills in 350-701 SCOR Certification Exam?
Candidates who want to get the passing score in the Cisco 350-701 SCOR exam should be ready to demonstrate that they have skills in the following domains:
- Security concepts
During preparation for this topic, the candidate will learn how to explain common threats against cloud and on-premises environments. Also, they will become skilled in comparing common security vulnerabilities and will no longer have any surprises when it comes to software bugs, weak passwords, or missing encryption. Another subtopic included here covers cryptography components functions as well as hashing, encryption, SSL, and IPsec functions. Besides, applicants will become proficient in interpreting basic Python scripts and explaining North and South Bound as well as DNAC APIs for network provisioning.
- Network security
Within this domain, examinees will show their ability to compare network security solutions and deployment models related to different network security solutions and architectures. They should also understand how NetFlow and Flexible NetFlow records, components, and capabilities work. During the training classes, they will learn how to properly implement segmentation, access control policies, and management options for security solutions. Also, they will discover how to configure AAA for network and device access. Another subtopic included here will be the configuration of secure network management and site-to-site VPN.
- Securing the Cloud
The candidates will learn how to identify security solutions that contribute to cloud environment performance. Also, the comparison between the customer and provider security responsibility is also handled in this section. Another subtopic is related to DevSecOps description and application implementation. Candidates will have to demonstrate that they know how to identify security capabilities and deployment models and also understand how to configure logging and monitoring methodology. Finally, the training courses focusing on this topic will teach them essential workload and application security concepts.
- Content security
Within this topic, examinees will become experienced in implementing capture methods and traffic redirection. Also, they will know how more about web proxy identity and authentication by utilizing the user identification tools. Components like ESA, CES, or WSA will be also described in this section. Another subtopic is dedicated to web and email security verification and configuration. Secure internet gateway and web security features configuration and verification are also handled here. Candidates will learn more about how Cisco Umbrella works and what are its benefits. Finally, they will configure and verify web security controls with the help of Cisco Umbrella features.
- Endpoint protection and detection
The fifth topic will take the candidates in the area of understanding how Endpoint Protection Platforms and Endpoint Detection and Response solutions work. Also, they will become skilled in handling antimalware solutions, antivirus, dynamic file analysis, and endpoint-sourced telemetry features configuration. Another subtopic included in this section talks about endpoint device management, multifactor authentication strategy, posture assessment solutions, and endpoint patching.
- Secure network access, visibility, and enforcement
Last but not least, candidates need to be proficient in using guest services, profiling, BYOD, and posture assessment tools. They need to understand what's involved in the network access with CoA, what are the device compliance benefits, and different exfiltration techniques. It is essential that examinees demonstrate that they know the benefits of network telemetry and different Cisco components and capabilities.
NEW QUESTION 89
How does Cisco Stealthwatch Cloud provide security for cloud environments?
- A. It facilitates secure connectivity between public and private networks.
- B. It assigns Internet-based DNS protection for clients and servers.
- C. It prevents exfiltration of sensitive data.
- D. It delivers visibility and threat detection.
Answer: D
Explanation:
Explanation
Cisco Stealthwatch Cloud: Available as an SaaS product offer to provide visibility and threat detection within public cloud infrastructures such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).
NEW QUESTION 90
An administrator is configuring a DHCP server to better secure their environment. They need to be able to ratelimit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?
- A. Add entries in the DHCP snooping database
- B. Set a trusted interface for the DHCP server
- C. Set the DHCP snooping bit to 1
- D. Enable ARP inspection for the required VLAN
Answer: B
Explanation:
To understand DHCP snooping we need to learn about DHCP spoofing attack first.
DHCP spoofing is a type of attack in that the attacker listens for DHCP Requests from clients and answers them with fake DHCP Response before the authorized DHCP Response comes to the clients. The fake DHCP Response often gives its IP address as the client default gateway -> all the traffic sent from the client will go through the attacker computer, the attacker becomes a "man-in-the-middle".
The attacker can have some ways to make sure its fake DHCP Response arrives first. In fact, if the attacker is "closer" than the DHCP Server then he doesn't need to do anything. Or he can DoS the DHCP Server so that it can't send the DHCP Response.
DHCP snooping can prevent DHCP spoofing attacks. DHCP snooping is a Cisco Catalyst feature that determines which switch ports can respond to DHCP requests. Ports are identified as trusted and untrusted.
Only ports that connect to an authorized DHCP server are trusted, and allowed to send all types of DHCP messages. All other ports on the switch are untrusted and can send only DHCP requests. If a DHCP response is seen on an untrusted port, the port is shut down.
NEW QUESTION 91
What are two DDoS attack categories? (Choose two.)
- A. sequential
- B. volume-based
- C. protocol
- D. source-based
- E. database
Answer: B,C
NEW QUESTION 92
Refer to the exhibit.
An administrator is adding a new Cisco FTD device to their network and wants to manage it with Cisco FMC.
The Cisco FTD is not behind a NAT device. Which command is needed to enable this on the Cisco FTD?
- A. configure manager add DONTRESOLVE kregistration key>
- B. configure manager add <FMC IP address> <registration key>
- C. configure manager add DONTRESOLVE <registration key> FTD123
- D. configure manager add <FMC IP address> <registration key> 16
Answer: B
Explanation:
Explanation : Explanation : To let FMC manages FTD, first we need to add manager from the FTD and assign a register key of your choice. The command configure manager add 1.1.1.2 the_registration_key_you_want, where 1.1.1.2 is the IP address of the FMC, you need to use the same registration key in FMC when adding this FTD as a managed device. Reference: https://cyruslab.net/2019/09/03/ciscocisco-firepower-lab-setup/ Explanation:
To let FMC manages FTD, first we need to add manager from the FTD and assign a register key of your choice. The command configure manager add 1.1.1.2 the_registration_key_you_want, where 1.1.1.2 is the IP address of the FMC, you need to use the same registration key in FMC when adding this FTD as a managed device.
Explanation : Explanation : To let FMC manages FTD, first we need to add manager from the FTD and assign a register key of your choice. The command configure manager add 1.1.1.2 the_registration_key_you_want, where 1.1.1.2 is the IP address of the FMC, you need to use the same registration key in FMC when adding this FTD as a managed device. Reference: https://cyruslab.net/2019/09/03/ciscocisco-firepower-lab-setup/
NEW QUESTION 93
Which policy represents a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in a deployment?
- A. Platform Service Policy
- B. Device Management Policy
- C. Access Control Policy
- D. Group Policy
Answer: A
Explanation:
Explanation Cisco Firepower deployments can take advantage of platform settings policies. A platform settings policy is a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in your deployment, such as time settings and external authentication. Examples of these platform settings policies are time and date settings, external authentication, and other common administrative features. A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device. For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-configguide-v62/platform_settings_policies_for_managed_devices.html Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best answer here so we have to choose it.
Cisco Firepower deployments can take advantage of platform settings policies. A platform settings policy is a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in your deployment, such as time settings and external authentication. Examples of these platform settings policies are time and date settings, external authentication, and other common administrative features.
A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device.
For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy.
Reference:
Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best Explanation Cisco Firepower deployments can take advantage of platform settings policies. A platform settings policy is a shared set of features or parameters that define the aspects of a managed device that are likely to be similar to other managed devices in your deployment, such as time settings and external authentication. Examples of these platform settings policies are time and date settings, external authentication, and other common administrative features. A shared policy makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes to a platform settings policy affects all the managed devices where you applied the policy. Even if you want different settings per device, you must create a shared policy and apply it to the desired device. For example, your organization's security policies may require that your appliances have a "No Unauthorized Use" message when a user logs in. With platform settings, you can set the login banner once in a platform settings policy. Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-configguide-v62/platform_settings_policies_for_managed_devices.html Therefore the answer should be "Platform Settings Policy", not "Platform Service Policy" but it is the best answer here so we have to choose it.
NEW QUESTION 94
Refer to the exhibit.
Which type of authentication is in use?
- A. LDAP authentication for Microsoft Outlook
- B. SMTP relay server authentication
- C. external user and relay mail authentication
- D. POP3 authentication
Answer: C
Explanation:
Explanation The TLS connections are recorded in the mail logs, along with other significant actions that are related to messages, such as filter actions, anti-virus and anti-spam verdicts, and delivery attempts. If there is a successful TLS connection, there will be a TLS success entry in the mail logs. Likewise, a failed TLS connection produces a TLS failed entry. If a message does not have an associated TLS entry in the log file, that message was not delivered over a TLS connection. Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118844-technoteesa-00.html The exhibit in this Qshows a successful TLS connection from the remote host (reception) in the mail log.
The TLS connections are recorded in the mail logs, along with other significant actions that are related to messages, such as filter actions, anti-virus and anti-spam verdicts, and delivery attempts. If there is a successful TLS connection, there will be a TLS success entry in the mail logs. Likewise, a failed TLS connection produces a TLS failed entry. If a message does not have an associated TLS entry in the log file, that message was not delivered over a TLS connection.
Reference:
Explanation The TLS connections are recorded in the mail logs, along with other significant actions that are related to messages, such as filter actions, anti-virus and anti-spam verdicts, and delivery attempts. If there is a successful TLS connection, there will be a TLS success entry in the mail logs. Likewise, a failed TLS connection produces a TLS failed entry. If a message does not have an associated TLS entry in the log file, that message was not delivered over a TLS connection. Reference: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118844-technoteesa-00.html The exhibit in this Qshows a successful TLS connection from the remote host (reception) in the mail log.
NEW QUESTION 95
Which attack type attempts to shut down a machine or network so that users are not able to access it?
- A. MAC spoofing
- B. IP spoofing
- C. smurf
- D. bluesnarfing
Answer: C
Explanation:
Denial-of-service (DDoS) aims at shutting down a network or service, causing it to be inaccessible to its intended users.
The Smurf attack is a DDoS attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address.
NEW QUESTION 96
Under which two circumstances is a CoA issued? (Choose two.)
- A. An endpoint is profiled for the first time.
- B. A new Identity Source Sequence is created and referenced in the authentication policy.
- C. A new Identity Service Engine server is added to the deployment with the Administration persona.
- D. An endpoint is deleted on the Identity Service Engine server.
- E. A new authentication rule was added to the policy on the Policy Service node.
Answer: A,D
Explanation:
Explanation/Reference: https://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html
NEW QUESTION 97
Which form of attack is launched using botnets?
- A. virus
- B. ODOS
- C. EIDDOS
- D. TCP flood
Answer: C
NEW QUESTION 98
Which algorithm provides asymmetric encryption?
- A. 3DES
- B. RC4
- C. RSA
- D. AES
Answer: C
NEW QUESTION 99
Drag and drop the NetFlow export formats from the left onto the descriptions on the right.
Answer:
Explanation:
NEW QUESTION 100
An organization has a Cisco ESA set up with DLP policies and would like to customize the action assigned for violations. The organization wants a copy of the message to be delivered with a message added to flag it as a DLP violation. Which actions must be performed in order to provide this capability?
- A. quarantine and send a DLP violation notification
- B. deliver and send copies to other recipients
- C. deliver and add disclaimer text
- D. quarantine and alter the subject header with a DLP violation
Answer: A
NEW QUESTION 101
An engineer notices traffic interruption on the network. Upon further investigation, it is learned that broadcast packets have been flooding the network. What must be configured, based on a predefined threshold, to address this issue?
- A. storm control
- B. embedded event monitoring
- C. access control lists
- D. Bridge Protocol Data Unit guard
Answer: A
Explanation:
Storm control prevents traffic on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the physical interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation, mistakes in network configurations, or users issuing a denial-of-service attack can cause a storm.
By using the "storm-control broadcast level [falling-threshold]" we can limit the broadcast traffic on the switch.
NEW QUESTION 102
An organization wants to provide visibility and to identify active threats in its network using a VM. The organization wants to extract metadata from network packet flow while ensuring that payloads are not retained or transferred outside the network. Which solution meets these requirements?
- A. Cisco Stealthwatch Cloud PCM
- B. Cisco Stealthwatch Cloud PNM
- C. Cisco Umbrella On-Premises
- D. Cisco Umbrella Cloud
Answer: B
Explanation:
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
Reference:
Private Network Monitoring (PNM) provides visibility and threat detection for the on-premises network, delivered from the cloud as a SaaS solution. It is the perfect solution for organizations who prefer SaaS products and desire better awareness and security in their on-premises environments while reducing capital expenditure and operational overhead. It works by deploying lightweight software in a virtual machine or server that can consume a variety of native sources of telemetry or extract metadata from network packet flow. It encrypts this metadata and sends it to the Stealthwatch Cloud analytics platform for analysis. Stealthwatch Cloud consumes metadata only. The packet payloads are never retained or transferred outside the network.
This lab focuses on how to configure a Stealthwatch Cloud Private Network Monitoring (PNM) Sensor, in order to provide visibility and effectively identify active threats, and monitors user and device behavior within onpremises networks.
The Stealthwatch Cloud PNM Sensor is an extremely flexible piece of technology, capable of being utilized in a number of different deployment scenarios. It can be deployed as a complete Ubuntu based virtual appliance on different hypervisors (e.g. -VMware, VirtualBox). It can be deployed on hardware running a number of different Linux-based operating systems.
NEW QUESTION 103
An organization is receiving SPAM emails from a known malicious domain. What must be configured in order to prevent the session during the initial TCP communication?
- A. Configure the Cisco ESA to drop the malicious emails
- B. Configure policies to stop and reject communication
- C. Configure policies to quarantine malicious emails
- D. Configure the Cisco ESA to reset the TCP connection
Answer: A
NEW QUESTION 104
What is a key difference between Cisco Firepower and Cisco ASA?
- A. Cisco ASA provides SSL inspection while Cisco Firepower does not.
- B. Cisco Firepower natively provides intrusion prevention capabilities while Cisco ASA does not.
- C. Cisco Firepower provides identity-based access control while Cisco ASA does not.
- D. Cisco ASA provides access control while Cisco Firepower does not.
Answer: B
Explanation:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-firepowerservices/200451-Configure-Intrusion-Policy-and-Signature.html
NEW QUESTION 105
What are two DDoS attack categories? (Choose two)
- A. screen-based
- B. sequential
- C. volume-based
- D. protocol
- E. database
Answer: C,D
Explanation:
There are three basic categories of attack:
+ volume-based attacks, which use high traffic to inundate the network bandwidth
+ protocol attacks, which focus on exploiting server resources
+ application attacks, which focus on web applications and are considered the most sophisticated and serious type of attacks Reference: https://www.esecurityplanet.com/networks/types-of-ddos-attacks/ There are three basic categories of attack:
+ volume-based attacks, which use high traffic to inundate the network bandwidth
+ protocol attacks, which focus on exploiting server resources
There are three basic categories of attack:
+ volume-based attacks, which use high traffic to inundate the network bandwidth
+ protocol attacks, which focus on exploiting server resources
+ application attacks, which focus on web applications and are considered the most sophisticated and serious type of attacks Reference: https://www.esecurityplanet.com/networks/types-of-ddos-attacks/
NEW QUESTION 106
Refer to the exhibit.
A network administrator configured a site-to-site VPN tunnel between two Cisco IOS routers, and hosts are unable to communicate between two sites of VPN. The network administrator runs the debug crypto isakmp sa command to track VPN status What is the problem according to this command output?
- A. encryption algorithm mismatch
- B. interesting traffic was not applied
- C. hashing algorithm mismatch
- D. authentication key mismatch
Answer: D
NEW QUESTION 107
What provides visibility and awareness into what is currently occurring on the network?
- A. Prime Infrastructure
- B. CMX
- C. WMI
- D. Telemetry
Answer: D
Explanation:
Explanation : Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks. Reference: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/activethreat-analytics-premier.pdf Explanation:
Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks.
Explanation : Telemetry - Information and/or data that provides awareness and visibility into what is occurring on the network at any given time from networking devices, appliances, applications or servers in which the core function of the device is not to generate security alerts designed to detect unwanted or malicious activity from computer networks. Reference: https://www.cisco.com/c/dam/en_us/about/doing_business/legal/service_descriptions/docs/activethreat-analytics-premier.pdf
NEW QUESTION 108
Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two)
- A. malware
- B. eavesdropping
- C. ARP spoofing
- D. denial-of-service attacks
- E. exploits
Answer: A,E
Explanation:
Malware means "malicious software", is any software intentionally designed to cause damage to a computer, server, client, or computer network. The most popular types of malware includes viruses, ransomware and spyware. Virus Possibly the most common type of malware, viruses attach their malicious code to clean code and wait to be run.
Ransomware is malicious software that infects your computer and displays messages demanding a fee to be paid in order for your system to work again.
Spyware is spying software that can secretly record everything you enter, upload, download, and store on your computers or mobile devices. Spyware always tries to keep itself hidden.
An exploit is a code that takes advantage of a software vulnerability or security flaw.
Exploits and malware are two risks for endpoints that are not up to date. ARP spoofing and eavesdropping are attacks against the network while denial-of-service attack is based on the flooding of IP packets.
NEW QUESTION 109
An engineer is trying to securely connect to a router and wants to prevent insecure algorithms from being used.
However, the connection is failing. Which action should be taken to accomplish this goal?
- A. Disable telnet using the no ip telnet command.
- B. Enable the SSH server using the ip ssh server command.
- C. Generate the RSA key using the crypto key generate rsa command.
- D. Configure the port using the ip ssh port 22 command.
Answer: C
Explanation:
Explanation
https://learningnetwork.cisco.com/s/question/0D53i00000KsrhK/rsa-key
NEW QUESTION 110
What is a benefit of using telemetry over SNMP to configure new routers for monitoring purposes?
- A. Telemetry uses push and pull, which makes it more scalable than SNMP
- B. Telemetry uses a pull, method which makes it more reliable than SNMP
- C. Telemetry uses push and pull which makes it more secure than SNMP
- D. Telemetry uses a push method which makes it faster than SNMP
Answer: A
NEW QUESTION 111
Which suspicious pattern enables the Cisco Tetration platform to learn the normal behavior of users?
- A. file access from a different user
- B. user login suspicious behavior
- C. privilege escalation
- D. interesting file access
Answer: B
Explanation:
The various suspicious patterns for which the Cisco Tetration platform looks in the current release are:
+ Shell code execution: Looks for the patterns used by shell code.
+ Privilege escalation: Watches for privilege changes from a lower privilege to a higher privilege in the process lineage tree.
+ Side channel attacks: Cisco Tetration platform watches for cache-timing attacks and page table fault bursts.
Using these, it can detect Meltdown, Spectre, and other cache-timing attacks.
+ Raw socket creation: Creation of a raw socket by a nonstandard process (for example, ping).
+ User login suspicious behavior: Cisco Tetration platform watches user login failures and user login methods.
+ Interesting file access: Cisco Tetration platform can be armed to look at sensitive files.
+ File access from a different user: Cisco Tetration platform learns the normal behavior of which file is accessed by which user.
+ Unseen command: Cisco Tetration platform learns the behavior and set of commands as well as the lineage of each command over time. Any new command or command with a different lineage triggers the interest of the Tetration Analytics platform.
The various suspicious patterns for which the Cisco Tetration platform looks in the current release are:
+ Shell code execution: Looks for the patterns used by shell code.
+ Privilege escalation: Watches for privilege changes from a lower privilege to a higher privilege in the process lineage tree.
+ Side channel attacks: Cisco Tetration platform watches for cache-timing attacks and page table fault bursts.
Using these, it can detect Meltdown, Spectre, and other cache-timing attacks.
+ Raw socket creation: Creation of a raw socket by a nonstandard process (for example, ping).
+ User login suspicious behavior: Cisco Tetration platform watches user login failures and user login methods.
+ Interesting file access: Cisco Tetration platform can be armed to look at sensitive files.
+ File access from a different user: Cisco Tetration platform learns the normal behavior of which file is accessed by which user.
+ Unseen command: Cisco Tetration platform learns the behavior and set of commands as well as the lineage of each command over time. Any new command or command with a different lineage triggers the interest of the Tetration Analytics platform.
The various suspicious patterns for which the Cisco Tetration platform looks in the current release are:
+ Shell code execution: Looks for the patterns used by shell code.
+ Privilege escalation: Watches for privilege changes from a lower privilege to a higher privilege in the process lineage tree.
+ Side channel attacks: Cisco Tetration platform watches for cache-timing attacks and page table fault bursts.
Using these, it can detect Meltdown, Spectre, and other cache-timing attacks.
+ Raw socket creation: Creation of a raw socket by a nonstandard process (for example, ping).
+ User login suspicious behavior: Cisco Tetration platform watches user login failures and user login methods.
+ Interesting file access: Cisco Tetration platform can be armed to look at sensitive files.
+ File access from a different user: Cisco Tetration platform learns the normal behavior of which file is accessed by which user.
+ Unseen command: Cisco Tetration platform learns the behavior and set of commands as well as the lineage of each command over time. Any new command or command with a different lineage triggers the interest of the Tetration Analytics platform.
NEW QUESTION 112
......
Latest 2021 Realistic Verified 350-701 Dumps: https://www.test4cram.com/350-701_real-exam-dumps.html
Pass 350-701 Exam Updated 358 Questions: https://drive.google.com/open?id=1WwTlZo9a6kAz11YaBACXJ-4y5bk2qdJP