350-701 Exam Dumps - Implementing and Operating Cisco Security Core Technologies (SCOR 350-701 v2.0)

 The Python script accomplishes the following tasks:

It imports the required libraries for HTTP, base64, SSL, and sys modules.

It takes the host, user, and password information from the command line arguments and assigns them to variables.

It creates an HTTPS connection object using the host and port 9060, and specifies the SSL protocol as TLSv1_2.

It encodes the user and password information in base64 format for basic HTTP authentication.

It sets the headers for the HTTP request, including the accept, authorization, and cache-control fields.

It sends a GET request to the Cisco ISE server to retrieve information from the “/ers/config/internaluser/” endpoint, which returns the list of internal users configured on Cisco ISE.

It reads the response from the server and prints the status, headers, and body in a human-readable format.

The script authenticates to the Cisco ISE server using the username of ersad and the password of Password1, and retrieves the internal user information from the server.

WannaCry ransomware is a type of malware that encrypts the files on the infected devices and demands a ransom for their decryption. It exploits a vulnerability in the Windows SMB protocol that allows remote code execution. To prevent WannaCry ransomware from spreading to all clients, IT should take the following precautions:

Ensure that noncompliant endpoints are segmented off to contain any potential damage. This means that any device that is not patched, managed, or compliant with the security policies should be isolated from the rest of the network and given limited access to resources. This can be done using Cisco Identity Services Engine (ISE) and Cisco TrustSec, which can enforce dynamic segmentation based on the device’s identity, posture, and context. This way, IT can prevent the ransomware from infecting other devices and reduce the impact of the attack12

Perform a posture check to allow only network access to those Windows devices that are already patched. This means that IT should verify that the devices have installed the latest security updates from Microsoft that fix the SMB vulnerability. This can be done using Cisco AnyConnect Secure Mobility Client, which offers a VPN Posture/HostScan Module and an ISE Posture Module. Both modules can assess the endpoint’s compliance for things like operating system, patches, antivirus, antispyware, and firewall software. If the device is not patched, it can be denied access to the network or redirected to a remediation portal13

 1: Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.0 - Configure Posture 2: Can We Trust Your Device? Checking Security Posture - Cisco 3: Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.10 - Configure Posture

Crypto agility is the capability to replace cryptographic algorithms, protocols, key sizes, libraries, certificates, and implementations quickly while minimizing operational disruption. This is essential for quantum readiness because algorithms considered secure today may become vulnerable, requiring organizations to migrate to post-quantum alternatives without redesigning every dependent system. Therefore, A is correct. Zero trust concerns continuous verification, explicit authorization, and least-privilege access rather than cryptographic replacement. Network slicing creates logically isolated services over shared infrastructure. Key escrow places cryptographic keys with an authorized custodian for recovery or lawful access; it does not provide the flexibility to replace algorithms throughout an environment. Crypto-agile architectures reduce dependency on specific cryptographic implementations and enable controlled migration as standards and threats evolve. Cisco post-quantum cryptography guidance

================

Explanation

Explanation

Cryptographic algorithms defined for use with IPsec include:

+ HMAC-SHA1/SHA2 for integrity protection and authenticity.

+ TripleDES-CBC for confidentiality

+ AES-CBC and AES-CTR for confidentiality.

+ AES-GCM and ChaCha20-Poly1305 providing confidentiality and authentication together efficiently.

The decisive message is TS_UNACCEPTABLE, followed by “Traffic selector negotiation failed.” During IKEv2 CHILD_SA creation, the peers negotiate traffic selectors defining the protected local and remote address ranges. RFC 7296 defines TS_UNACCEPTABLE as indicating that the proposed traffic selectors are unacceptable. The displayed encryption, integrity, and PFS parameters do not produce an algorithm-rejection notification; Phase 1 has already completed, and the failure occurs while negotiating selectors for the CHILD_SA. The engineer must make the protected-network definitions complementary on both FTD peers—for example, one peer’s local network must equal the other peer’s remote network, with compatible masks. Changing AES, extending the IKE lifetime, or removing the PFS group does not correct mismatched encryption domains. RFC 7296—IKEv2

================