CCNP SCOR 350-701 practice questions, every option explained

Answer: D. It can hide from tools on the infected OS, so detect it from outside and rebuild the host.. Kernel privilege lets the rootkit filter what process lists, connection tables, file listings and even local security agents report. Detect it from outside (network telemetry, offline or memory scans, boot integrity measurements) and rebuild from known-good media, because a cleanup run on a compromised kernel cannot be trusted. A rootkit hides an attacker's access by altering the operating system: user-mode rootkits replace programs or libraries, kernel-mode rootkits run as modules or drivers, and bootkits or firmware rootkits load before the OS. The clues come from outside the host: NetFlow, offline scans, Secure Boot and measured boot. The reliable fix is to reimage, and to reflash firmware when it is involved.

Answer: A. Domain and category rules still work; file inspection and DLP see no content. Without decryption the proxy still knows the destination host (from the TLS SNI or the CONNECT request), so it can allow or block by domain and category. Files, uploads and the URL path stay inside the encrypted stream, hidden from file inspection and DLP. Decryption lets the SWG see URL paths, files and form data, so file inspection, file type control, IPS, DLP and isolation depend on it. Exempt only what law, policy or certificate pinning requires, and accept that exempted sites get domain-level control only. Category-based exemptions are only as good as the categorization.

Answer: D. A cluster of FTD units joined by a cluster control link. Clustering joins several units into one logical device: the control unit pushes one configuration, all units forward traffic, and flow ownership and state are kept consistent over the cluster control link. High availability (active/standby) is about redundancy: one unit forwards, the other waits with a synchronized configuration and, over the state link, replicated connection state. Clustering is about scale: several units act as one device, all forward traffic, and the cluster control link keeps flow ownership consistent.

Answer: B. PaaS app: the customer updates an open-source library that its developers packaged with the code.. In PaaS the provider runs and patches the operating system and runtime, but the application code and every dependency the developers ship with it belong to the customer, who must update the library and redeploy. Responsibility moves up the stack with the service model. IaaS: the provider owns physical security, network and hypervisor; the customer owns the guest OS and everything above it. PaaS: the provider also runs the OS and runtime; the customer owns the code, its dependencies and its configuration. In every model, including SaaS, the customer still owns its data, identities and access, and its endpoints.

Answer: A. It runs the file in a monitored VM and records what it does, so a file with no reputation can be judged. Dynamic analysis detonates the sample in a monitored virtual machine and records processes, file and registry changes and network traffic. Behavioral indicators and a threat score then judge the file by its behaviour rather than its reputation. A hash lookup only knows files that have already been seen and judged. Dynamic analysis runs the file in an instrumented sandbox and scores what it does (behavioral indicators with severity and confidence, network activity, dropped files), so new or modified malware can be identified. Sandbox-aware malware may stay quiet, so a low score is not proof that a file is clean.