- (Exam Topic 3)
Which Cisco ISE feature helps to detect missing patches and helps with remediation?

1. A. posture assessment
2. B. profiling policy
3. C. authentication policy
4. D. enabling probes

Correct Answer: B

- (Exam Topic 3)
An engineer has been tasked with configuring a Cisco FTD to analyze protocol fields and detect anomalies in the traffic from industrial systems. What must be done to meet these requirements?

1. A. Implement pre-filter policies for the CIP preprocessor
2. B. Enable traffic analysis in the Cisco FTD
3. C. Configure intrusion rules for the DNP3 preprocessor
4. D. Modify the access control policy to trust the industrial traffic

Correct Answer: C
"configure INTRUSION RULES for DNP3" -> Documentation states, that enabling INTRUSION RULES is mandatory for CIP to work + required preprocessors (in Network Access Policy - NAP) will be enabled automatically:
"If you want the CIP preprocessor rules listed in the following table to generate events, you MUST enable them. See Setting Intrusion Rule States for information on enabling rules."
"If the Modbus, DNP3, or CIP preprocessor is disabled, and you enable and deploy an intrusion rule that requires one of these preprocessors, the system automatically uses the required preprocessor, with its current settings, although the preprocessor remains disabled in the web interface for the corresponding network analysis policy."
[1]
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/scada

- (Exam Topic 3)
An engineer is implementing DHCP security mechanisms and needs the ability to add additional attributes to profiles that are created within Cisco ISE Which action accomplishes this task?

1. A. Define MAC-to-lP address mappings in the switch to ensure that rogue devices cannot get an IP address
2. B. Use DHCP option 82 to ensure that the request is from a legitimate endpoint and send the information to Cisco ISE
3. C. Modify the DHCP relay and point the IP address to Cisco ISE.
4. D. Configure DHCP snooping on the switch VLANs and trust the necessary interfaces

Correct Answer: D

- (Exam Topic 1)
Which feature within Cisco Umbrella allows for the ability to inspect secure HTTP traffic?

1. A. File Analysis
2. B. SafeSearch
3. C. SSL Decryption
4. D. Destination Lists

Correct Answer: C
Reference:
https://support.umbrella.com/hc/en-us/articles/115004564126-SSL-Decryption-in-the-IntelligentProxy

- (Exam Topic 2)
What are two Trojan malware attacks? (Choose two)

1. A. Frontdoor
2. B. Rootkit
3. C. Smurf
4. D. Backdoor
5. E. Sync

Correct Answer: BD