- (Exam Topic 3)
An engineer is configuring their router to send NetfFow data to Stealthwatch which has an IP address of 1 1 11 using the flow record Stea!thwatch406397954 command Which additional command is required to complete the flow record?

1. A. transport udp 2055
2. B. match ipv4 ttl
3. C. cache timeout active 60
4. D. destination 1.1.1.1

Correct Answer: B

- (Exam Topic 1)
Why would a user choose an on-premises ESA versus the CES solution?

1. A. Sensitive data must remain onsite.
2. B. Demand is unpredictable.
3. C. The server team wants to outsource this service.
4. D. ESA is deployed inline.

Correct Answer: A

- (Exam Topic 1)
An administrator wants to ensure that all endpoints are compliant before users are allowed access on the corporate network. The endpoints must have the corporate antivirus application installed and be running the latest build of Windows 10.
What must the administrator implement to ensure that all devices are compliant before they are allowed on the network?

1. A. Cisco Identity Services Engine and AnyConnect Posture module
2. B. Cisco Stealthwatch and Cisco Identity Services Engine integration
3. C. Cisco ASA firewall with Dynamic Access Policies configured
4. D. Cisco Identity Services Engine with PxGrid services enabled

Correct Answer: A

- (Exam Topic 1)
Refer to the exhibit.

What does the API do when connected to a Cisco security appliance?

1. A. get the process and PID information from the computers in the network
2. B. create an SNMP pull mechanism for managing AMP
3. C. gather network telemetry information from AMP for endpoints
4. D. gather the network interface information about the computers AMP sees

Correct Answer: D
Reference:
https://api-docs.amp.cisco.com/api_actions/details?api_action=GET+%2Fv1%2Fcomputers&api_host=api.apjc.

- (Exam Topic 3)
Refer to the exhibit.

What will occur when this device tries to connect to the port?

1. A. 802.1X will not work, but MAB will start and allow the device on the network.
2. B. 802.1X will not work and the device will not be allowed network access
3. C. 802 1X will work and the device will be allowed on the network
4. D. 802 1X and MAB will both be used and ISE can use policy to determine the access level

Correct Answer: B