Which two methods are available in Cisco Secure Web Appliance to process client requests when configured in Transparent mode? (Choose two.)
Correct Answer: B,C
WCCP (Web Cache Communication Protocol): This protocol is used to redirect traffic from routers or Layer 3 devices to the web appliance transparently. PBR (Policy-Based Routing): This is a technique where routers or Layer 3 devices are configured to redirect specific traffic to the Secure Web Appliance based on policies, such as traffic destined for certain ports like HTTP (80) or HTTPS (443).
Question 502
Which feature is used to configure an encrypted route-based site-to-site VPN from a Cisco router to a cloud environment?
Correct Answer: C
A virtual tunnel interface (VTI) is used to configure an encrypted, route-based site-to-site VPN on Cisco routers, allowing secure connections between the router and cloud environments. VTIs provide a virtual interface for IPsec, making it easier to manage and route traffic over encrypted tunnels without needing to configure complex access control lists (ACLs) for each connection. This method is widely used for VPN connections to cloud environments, where route-based VPNs are commonly supported.
Question 503
Refer to the exhibit. The DHCP snooping database resides on router R1, and dynamic ARP inspection is configured only on switch SW2. Which ports must be configured as untrusted so that dynamic ARP inspection operates normally?
Correct Answer: D
P2, P3, and P6 only. Dynamic ARP inspection (DAI) is a security feature that validates ARP packets in a network and prevents ARP spoofing attacks. DAI relies on the DHCP snooping database to verify the IP-to- MAC bindings of hosts on the network. DAI operates on untrusted ports, which are ports that connect to hosts or devices that generate ARP traffic. Trusted ports are ports that connect to other switches or routers that do not generate ARP traffic. In this scenario, the DHCP snooping database resides on router R1, which means that switch SW2 needs to trust the port P3 that connects to R1. This way, SW2 can receive the DHCP snooping information from R1 and populate its own database. The port P4 that connects to switch SW3 also needs to be trusted, because SW3 does not generate ARP traffic. The ports P2 and P6 that connect to hosts P6 and P7 need to be untrusted, because they generate ARP traffic and need to be validated by DAI. The port P1 that connects to host P5 does not need to be configured as untrusted, because DAI is not enabled on switch SW1. To understand the concept of DAI and how to configure it, you can refer to the following sections of the source book: * Section 1.1.2: Describe the concepts of network security * Section 1.1.2.8: Describe the concepts of DAI * Section 1.1.2.9: Describe the concepts of DHCP snooping * Section 1.1.2.10: Describe the concepts of trusted and untrusted ports * Section 1.1.2.11: Describe the concepts of DAI configuration References: Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0 Understanding and Configuring Dynamic ARP Inspection DHCP Snooping and Dynamic ARP Inspection
Question 504
In which scenario is downloading Umbrella Dynamic IP Updater a configuration step?
Correct Answer: D
The Umbrella Dynamic IP Updater is a tool used in environments with dynamic IPv4 addresses. Since the external IP address of the network may change frequently, this tool ensures that Cisco Umbrella can keep track of the network's current IP address for applying security policies.
Question 505
Refer to the exhibit. What does this Python script accomplish?
Correct Answer: C
The Python script accomplishes the following tasks: * It imports the required libraries for HTTP, base64, SSL, and sys modules. * It takes the host, user, and password information from the command line arguments and assigns them to variables. * It creates an HTTPS connection object using the host and port 9060, and specifies the SSL protocol as TLSv1_2. * It encodes the user and password information in base64 format for basic HTTP authentication. * It sets the headers for the HTTP request, including the accept, authorization, and cache-control fields. * It sends a GET request to the Cisco ISE server to retrieve information from the "/ers/config/internaluser /" endpoint, which returns the list of internal users configured on Cisco ISE. * It reads the response from the server and prints the status, headers, and body in a human-readable format. The script authenticates to the Cisco ISE server using the username of ersad and the password of Password1, and retrieves the internal user information from the server. References: Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0, Module 5: Secure Network Access, Lesson 2: Cisco Identity Services Engine, Topic: Cisco ISE REST API Cisco Identity Services Engine API Reference Guide, Release 2.7 - Cisco ISE ERS API Overview [Cisco Identity Services Engine] Python 3 - HTTP Client - Tutorialspoint
