Cisco 300-740 - Questions & Answers

Refer to the exhibit.

{
"name": "Allow HTTP",
"parameters": {
"HTTPS Consumer": {
"type": "Filter",
"description": "Consumer of the HTTP service"
},
"HTTPS Provider": {
"type": "Filter",
"description": "Provider of the HTTP service"
}
},
"default_policies": [
{
<output omitted>
},
{
"action": "BLOCK",
"priority": 100,
"consumer_filter_ref": "HTTPS Consumer",
"provider_filter_ref": "HTTPS Provider",
"l4_params": {}
}
]
}

An engineer must create a segmentation policy in Cisco Secure Workload to block HTTP traffic. The
indicated configuration was applied; however, HTTP traffic is still allowed.

What should be done to meet the requirement?

What helps prevent drive-by compromise?

A security analyst detects an employee endpoint making connections to a malicious IP on the internet and downloaded a file named Test0511127691C.pdf. The analyst discovers the machine is infected by trojan malware.

What must the analyst do to mitigate the threat using Cisco Secure Endpoint?

Refer to the exhibit.

Scope: Apps
Child scope # 1: Apps::IT
Child scope # 2: Apps::HR

Policy Scope: Apps
Rule # 1: ALLOW HR -> IT on TCP port 23 (Default)
Rule # 2: DENY HR -> IT on TCP port 23 (Absolute)
Rule # 3: Catch All - Allow An engineer must analyze a segmentation policy in Cisco Secure Workload.

What is the result of applying the policy?

Refer to the exhibit.

A security engineer deployed Cisco Secure XDR, and during testing, the log entry shows a security incident.

Which action must the engineer take first?

An administrator must deploy an endpoint posture policy for all users. The organization wants to have all endpoints checked against antimalware definitions and operating system updates and ensure that the correct Secure Client modules are installed properly.

How must the administrator meet the requirements?

An engineer configures trusted endpoints with Active Directory with Device Health to determine if an endpoint complies with the policy posture. After a week, an alert is received by one user, reporting problems accessing an application. When the engineer verifies the authentication report, this error is found:

"Endpoint is not trusted because Cisco Secure Endpoint check failed, Check user's endpoint in Cisco Secure Endpoint."

Which action must the engineer take to permit access to the application again?

According to Cisco Security Reference Architecture, which solution provides threat intelligence and malware analytics?

Refer to the exhibit.

"default_policies": [
{
"action": "BLOCK",
"priority": 100,
"consumer_filter_ref": "__rootScope",
"provider_filter_ref": "__workspaceScope",
"l4_params": {
"proto": 6
}
}
]

An engineer configured a default segmentation policy in Cisco Secure Workload to block SMTP traffic.
During testing, it is observed that the SMTP traffic is still allowed.

Which action must the engineer take to complete the configuration?

Which attack mitigation must be in place to prevent an attacker from authenticating to a service using a brute force attack?