Security: Free ENCOR 350-401 Practice Questions

Question 1

What does Cisco AMP for Endpoints use Indicators of Compromise (IoCs) for?

To authenticate endpoint devices and assign security group tags for network access control To encrypt endpoint communications and ensure secure data transmission across the network To enforce posture compliance policies and validate endpoint software update requirements To identify patterns of malicious activity on endpoints based on known threat intelligence

Correct Answer: To identify patterns of malicious activity on endpoints based on known threat intelligence

Cisco AMP (Advanced Malware Protection) for Endpoints uses Indicators of Compromise (IoCs) to detect and flag patterns of malicious activity on endpoints by correlating observed behaviors and artifacts against known threat intelligence from sources like Cisco Talos.

Encrypting endpoint communications is a function of VPNs or TLS, not IoCs. Enforcing posture compliance is handled by Cisco ISE posture assessment, not AMP IoCs. Authenticating devices and assigning security group tags relates to TrustSec and 802.1X, which are network access control mechanisms unrelated to malware detection.

Key concept tested: understanding the role of Indicators of Compromise in endpoint threat detection within Cisco AMP.

Question 2

A network administrator is asked to list the key functions of a Next-Generation Firewall (NGFW) during a team meeting. Which of the following is a core capability provided by an NGFW?

Application awareness and control that identifies traffic by application type Intrusion detection based solely on matching static port numbers to known services Application awareness and control that identifies traffic by MAC address only NetFlow export and bandwidth shaping that prioritizes traffic by VLAN tagging

Correct Answer: Application awareness and control that identifies traffic by application type

A core capability of a Next-Generation Firewall is application awareness and control, which allows it to identify and filter traffic based on the specific application generating it, regardless of port or protocol used, going far beyond traditional stateful firewall inspection.

NetFlow export and VLAN-based bandwidth shaping are not defining NGFW functions but rather features associated with routers and switches. Identifying traffic by MAC address only is a Layer 2 function and far too limited for application-level awareness. Matching static port numbers to known services describes legacy stateful firewalls, which NGFWs were specifically designed to surpass by performing deep packet inspection.

Key concept tested: understanding the distinguishing capabilities of Next-Generation Firewalls versus traditional firewalls.

Question 3

A network administrator has just configured 'aaa new-model' on a router. They want all lines (console, VTY, and auxiliary) to authenticate users against the local database. Which single command accomplishes this for all lines at once?

aaa authorization exec default local aaa authentication login local default aaa authentication login default local aaa authentication login default local-case enable

Correct Answer: aaa authentication login default local

The command 'aaa authentication login default local' creates a default method list that applies automatically to all lines (console, VTY, and auxiliary) without needing to explicitly assign it, using the local username database for authentication.

The first wrong option has incorrect syntax because 'local' and 'default' are in the wrong order, as 'default' must follow 'login' as the named method list. The authorization option configures EXEC authorization rather than login authentication, which is a different AAA function. The option with 'local-case' adds case-sensitive username matching and unnecessarily includes 'enable' as a fallback method, which is not what the question requires.

Key concept tested: AAA default method list configuration and its automatic application to all lines.

Security

ENCOR 350-401 - Security Example Questions

Question 1

Question 2

Question 3

Advance to CCNP Enterprise