350-701 Practice Questions

REST stands for Representational State Transfer, which is an architectural style for designing web

services. RESTful web services use HTTP as the application protocol and support the standard HTTP

methods, such as GET, PUT, POST, and DELETE, to perform CRUD (Create, Read, Update, Delete)

operations on resources. Cisco DNA Center exposes its functionality through a set of RESTful APIs

that allow external applications to interact with the network controller and automate various

tasks. The RESTful architecture used within Cisco DNA Center has the following characteristics12:

It is simple, extensible, and secure to use. The APIs are based on open standards and use JSON as the

data format. The APIs also support HTTPS for secure communication and authentication.

It is stateless, meaning that each request contains all the information necessary to process it, and the

server does not store any session or client state. This improves scalability and performance of the

web services.

It is resource-oriented, meaning that each API endpoint represents a logical entity or a resource that

can be manipulated by the HTTP methods. For example, the /dna/intent/api/v1/network-

device endpoint represents the network devices resource, and the GET method can be used to

retrieve the list of network devices from Cisco DNA Center.

It is uniform, meaning that the same interface and conventions are used across all the APIs. For

example, the APIs use the same authentication mechanism, error handling, pagination, filtering, and

sorting parameters. Reference:

1: Introduction to Cisco DNA Center REST APIs - Cisco DevNet Learning Labs

2: Cisco DNA Center Platform User Guide, Release 2.2.3

Worms are distinct from viruses because they are self-replicating malware that propagate across networks automatically, requiring no host file or human intervention. Spam is the abuse of electronic messaging systems to send unsolicited, often bulk, messages. A Botnet (robot network) consists of multiple compromised devices controlled remotely by an attacker to perform malicious tasks like DDoS attacks. Phishing is a social engineering attack involving deceptive communications designed to trick users into revealing sensitive data like login credentials or financial information.

NIST Special Publication 800-83 Revision 1, Guide to Malware Incident Prevention and Handling, Section 2.1 (Malware Categories), page 2-1. (Defines Worms as self-replicating programs that spread without human intervention).

NIST Interagency Report 7298 Revision 3, Glossary of Key Information Security Terms, page 16 (Botnet), page 148 (Phishing), page 191 (Spam).

Cisco Networking Academy, Cybersecurity Essentials, Chapter 1: Cybersecurity: A World of Experts and Criminals. (Defines Botnets and Phishing concepts).

RFC 4949, Internet Security Glossary, Version 2, pages 310-311 (Worm definition emphasizing independence from host programs).

IKEv1 negotiates the Phase 1 tunnel using either Main Mode, which exchanges six packets for identity protection, or Aggressive Mode, which uses three packets for faster establishment. In contrast, IKEv2 simplifies the process by establishing the IKE SA (Phase 1 equivalent) and the first Child SA (Phase 2 equivalent) in a combined four-packet exchange. Furthermore, IKEv2 natively includes NAT-Traversal (NAT-T) in the core standard, whereas it was an extension for IKEv1. IKEv2 also introduces built-in support for EAP (Extensible Authentication Protocol) for client authentication, replacing the XAUTH mechanism often used in IKEv1.

RFC 7296 (IKEv2 Standard):

Section 1.2 "Initial Exchanges": Details the four-packet exchange (IKE_SA_INIT and IKE_AUTH) used to create the IKE SA and the first Child SA.

Section 2.23 "NAT Traversal": Confirms that NAT discovery and traversal are built into the IKEv2 protocol core.

Section 2.16 "Extensible Authentication Protocol (EAP) Methods": Documents the use of EAP for authentication.

Source: Kaufman, C., et al. (2014). Internet Key Exchange Protocol Version 2 (IKEv2). RFC 7296. https://doi.org/10.17487/RFC7296

RFC 2409 (IKEv1 Standard):

Section 5 "Exchanges": Defines the packet flow for Main Mode (6 messages) and Aggressive Mode (3 messages).

Source: Harkins, D., & Carrel, D. (1998). The Internet Key Exchange (IKE). RFC 2409. https://doi.org/10.17487/RFC2409

Cisco Systems Official Documentation:

Technote: "IKEv1 generally calculates a hash... IKEv2 allows the use of EAP for authentication." & "IKEv2... supports NAT-Traversal."

Source: Cisco Systems. (2023). FlexVPN and IKEv2 Configuration Guide, Cisco IOS XE 17.x. "IKEv2 Overview".

Cross-Site Scripting (XSS) attacks are prevented by treating all user-provided data as untrusted. The two primary, complementary strategies are input sanitization and output encoding.

1. HTML Sanitization (D): When an application must accept and display rich content (HTML) from users, the input must be processed by a sanitization engine. This engine parses the HTML and removes potentially malicious elements and attributes (e.g., <script>, onerror) while permitting a whitelist of safe tags.

2. Contextual Output Encoding (B): This is the most critical defense. Before rendering any user-supplied data into the HTML output, it must be encoded or "escaped." This process converts special characters (like , ', ") into their HTML entity equivalents (e.g., <, >). This ensures the browser interprets the data as plain text to be displayed, not as executable code.

A. Enabling scripts on a per-domain basis describes a browser-level control (like Content Security Policy), which is a valuable defense-in-depth layer but not as fundamental as encoding or sanitization.

C. Disabling security inspections is counter-intuitive and not a recognized XSS prevention technique. Secure cookie attributes like HttpOnly are used to mitigate XSS impact, not prevent it.

E. The SameSite cookie attribute is a crucial security feature for preventing Cross-Site Request Forgery (CSRF), not XSS. Disabling it would weaken security.

1. MIT OpenCourseWare. (2014). Lecture 10: Web Security

6.858 Computer Systems Security. Massachusetts Institute of Technology. Slides 32-33. The lecture notes explicitly state the two main defenses against XSS are to "Filter/sanitize untrusted data on input" and "Escape untrusted data on output." This directly supports options D and B.

2. Cisco. (2016). Cisco SAFE Reference Guide. Document ID: 118323. In the "Application Security" section

when discussing XSS

the guide states

"The best way to protect against XSS is by contextually encoding all output that can contain untrusted data." This directly supports option B. The guide also emphasizes validating all input

which is the principle behind sanitization (Option D).

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education. Chapter 9

"Web Security

" section 9.3

"Attacks on Web Servers and Web Applications

" details Cross-Site Scripting. It identifies filtering user input (sanitization) and escaping output characters (encoding) as the primary countermeasures.

Advanced Malware Protection (AMP) is specifically designed to detect, block, and remediate malware, including zero-day attacks, through continuous analysis. Full Context Awareness aggregates data on users, devices, applications, and operating systems, providing the visibility necessary to create and enforce granular security policies. Collective Security Intelligence (powered by Cisco Talos) provides the system with real-time updates on global threat intelligence (IP, URL, and domain reputation) to block attacks proactively. Finally, the Next-Generation Intrusion Prevention System (NGIPS) utilizes this context and intelligence to provide comprehensive threat prevention and mitigation against both known exploits and unknown vulnerabilities.

Cisco Systems. (2015). Cisco ASA with Firepower Services Data Sheet. Retrieved from Cisco.com. (Section: "Features and Benefits", specifically Table 1 which maps features like "Full Context Awareness" to visibility/policy enforcement and "AMP" to malware remediation).

Cisco Systems. Cisco Firepower Management Center Configuration Guide, Version 6.0. "Chapter: Security Intelligence and Content Blocking". (Discusses the role of Collective Security Intelligence in real-time threat blocking).

Cisco Systems. Cisco ASA with Firepower Services - At-a-Glance. (Explicitly links NGIPS to comprehensive threat prevention and AMP to malware remediation).

The provided Python script uses the requests library to send an authenticated GET request to the Cisco AMP for Endpoints API endpoint https://api.amp.cisco.com/v1/computers. According to the Cisco Secure Endpoint API documentation, this specific endpoint retrieves a list of all computer objects managed by the platform. The script then iterates through the JSON response, printing the hostname, ip, and mac for each computer. This data—hostname, IP address, and MAC address—constitutes the network interface information for the endpoints that AMP manages.

A. The /v1/computers API endpoint provides identity and network information, not real-time process or PID details. Accessing process information would require a different endpoint, such as the trajectory endpoint.

B. The script uses a REST API over HTTPS, which is a client-initiated pull mechanism. It does not use or create an SNMP (Simple Network Management Protocol) mechanism, which is a different protocol.

C. "Network telemetry" is a broad term. While the gathered data is a form of telemetry, option D is more specific and accurately describes the exact information (hostname, IP, MAC) being retrieved by the script.

1. Cisco Secure Endpoint API v1 Documentation

GET /v1/computers: The official documentation specifies that this endpoint returns a list of computer objects. The response body for each object includes the hostname and a networkaddresses array containing ip and mac addresses

which directly corresponds to the data being parsed by the script.

Source: Cisco DevNet

"Secure Endpoint API

" Computers section. https://developer.cisco.com/docs/secure-endpoint/#!computers/get-computers (Refer to the "Response" section for the data structure).

2. Cisco Security APIs Foundational (SECFND) v1.0 Courseware: This course material explains how to use APIs for security automation. It details how REST APIs

like the one for AMP for Endpoints

are used to programmatically retrieve information such as endpoint identity and asset inventory

which includes network interface details.

Source: Cisco Learning Network

"Understanding and Using APIs

" Module 4: "Using APIs for Security Automation." (This courseware describes the fundamental use case of querying endpoints for asset information).

aaa new-model: This command must be entered first to enable the AAA (Authentication, Authorization, and Accounting) subsystem on the Cisco device. Without this, no other AAA commands (like defining servers or method lists) will be available or functional.

tacacs-server host 10.1.1.10: This defines the specific external TACACS+ server IP address (10.1.1.10) as required by the scenario.

tacacs-server key: This configures the shared secret key used to encrypt traffic between the switch and the TACACS+ server. (Note: While global key and host commands can often be entered in either order, defining the host and its associated key is the logical setup phase).

aaa authentication ppp test group tacacs+ local: This creates the authentication method list named "test" for PPP. The group tacacs+ local syntax specifically satisfies the requirement to try the TACACS+ server first and fall back to the local database if the server is unreachable.

Cisco Systems, Inc., "Authentication, Authorization, and Accounting Configuration Guide, Cisco IOS Release 15M&T" - Configuring Authentication.

Reference: "The aaa new-model command enables the AAA access control model."

Cisco Systems, Inc., "Security Command Reference: Commands A to C, Cisco IOS XE Release 3S" - aaa authentication ppp.

Reference: Syntax description: aaa authentication ppp {default | list-name} method1 [method2...]. The keyword group tacacs+ specifies the TACACS+ server group, and local specifies the local username database.

Cisco Systems, Inc., "Cisco IOS Security Configuration Guide: Securing User Services, Release 12.2" - Configuring TACACS+.

Reference: Details the usage of tacacs-server host to specify the IP and tacacs-server key to specify the authentication key.

Step 1 (Prerequisites): Cisco Express Forwarding (CEF) is a mandatory prerequisite for NetFlow operation on most modern Cisco platforms. Additionally, IP routing must be active for the router to process Layer 3 flows effectively.

Step 2 (Data Source): The Top Talkers feature analyzes data from the NetFlow cache. Therefore, you must first populate this cache by enabling NetFlow on at least one interface using the ip flow (or ip route-cache flow) command.

Step 3 (Enter Mode): Use the global configuration command ip flow-top-talkers to enter the specific configuration sub-mode for this feature.

Step 4 (Define Count): Within the sub-mode, standard Cisco documentation procedures list the top <number> command next to specify how many heavy traffic users to retain in the report.

Step 5 (Define Sort): Finally, use the sort-by <bytes | packets> command to define the criteria for ordering the list.

Cisco IOS NetFlow Configuration Guide, Release 12.4T, "Configuring NetFlow Top Talkers".

Section: Prerequisites for NetFlow Top Talkers - States that "Cisco Express Forwarding (CEF) or distributed CEF (dCEF) is a prerequisite for NetFlow" and "You must configure NetFlow on at least one interface."

Section: Summary Steps - Explicitly lists the configuration order:

enable

configure terminal

ip flow-top-talkers

top number

sort-by [bytes | packets]

Cisco IOS NetFlow Command Reference, "ip flow-top-talkers".

describes the usage of the command to enter the configuration mode where top and sort-by are subsequently entered.

Version 1: This is the original format and is widely considered obsolete. Cisco documentation explicitly states it should be used "only for legacy systems."

Version 5: This is the standard fixed-field format. It exports data directly from the main cache and does not support the router-based aggregation schemes introduced later.

Version 8: This version was specifically developed to support aggregation caches (such as AS, Protocol, Source/Destination Prefix aggregation) to reduce the volume of data exported compared to Version 5.

Version 9: This is a template-based format that is flexible and allows for new fields to be added without changing the underlying format, thus introducing extensibility. It is the basis for the IPFIX standard.

Cisco IOS NetFlow Configuration Guide, Release 12.2

Context: Describes the NetFlow export versions.

Quote: "Version 9 export format... is a flexible and extensible format... Version 8 export format... available only for export from aggregation caches... Version 5 export format... suitable only for the main cache... Version 1 export format... legacy collection system..."

Source: Cisco.com - NetFlow Data Export Format

Cisco NetFlow Services Solutions Guide

Section: "NetFlow Version 9 Flow-Record Format"

Context: Discusses the evolution of NetFlow versions.

Quote: "NetFlow Version 9 is a flexible and extensible export format... Version 8... supports aggregation of flows."

Source: Cisco.com - NetFlow Services Solutions Guide

RFC 3954 - Cisco Systems NetFlow Services Export Version 9

Context: The official IETF document describing Version 9.

Quote: "NetFlow Version 9 provides a flexible, extensible method for transferring NetFlow data."

: