Cisco Updated 350-701 Exam Questions and Answers by finnian

 EPP solutions solely focus on the perimeter of the network, which is the boundary between the internal and external networks. The perimeter is where most of the endpoints, such as laptops, desktops, mobile devices, and IoT devices, are located and connected to the network. EPP solutions aim to prevent, detect, and remediate security threats on these endpoints by using technologies such as antivirus, data encryption, and data loss prevention. EPP solutions rely on signatures and other indicators of intrusion by known threats to block malicious activity and malware on the endpoints12.

EDR solutions do not focus on the perimeter, but rather on the entire network, including the core and the East-West gateways. The core is the central part of the network that connects different segments and provides high-speed data transmission. The East-West gateways are the points of communication between different segments within the network, such as between different data centers or cloud environments. EDR solutions provide continuous and comprehensive visibility into endpoint activities across the network by using threat hunting tools for behavior-based endpoint threat detection. EDR solutions monitor and record endpoint data, detect anomalies and malicious behavior, and respond to threats that EPP and other security tools did not catch. EDR solutions also enable security teams to proactively investigate and contain incidents by using incident data search, alert triage, threat validation, and malicious activity blocking134.

References := 1: EPP vs. EDR: Why You Need Both - CrowdStrike 2: Comparing endpoint security: EPP vs. EDR vs. XDR | Infosec 3: EDR vs EPP: What is the Difference? - Exabeam 4: EDR vs EPP: Key Features, Differences, and How They Work Together

Diagram Description automatically generated

 Transparent mode is a Cisco ASA deployment model that allows the ASA to act as a bump in the wire, or a stealth firewall. In this mode, the ASA does not have an IP address on the network, and it does not participate in routing. Instead, it filters traffic between hosts in the same IP subnet using higher-level protocols such as TCP, UDP, and ICMP. Transparent mode is useful when you want to apply security policies without readdressing the network or changing the default gateway of the hosts. Some of the benefits of transparent mode are:

• It preserves the original source and destination IP addresses of the packets, which can be useful for logging and auditing purposes.
• It simplifies the configuration of the ASA, as you do not need to configure routing protocols, NAT, or DHCP.
• It allows the ASA to inspect non-IP traffic, such as ARP, STP, and CDP.
• It supports multiple contexts, which can provide logical separation of traffic for different tenants or customers.

Some of the limitations of transparent mode are:

• It does not support VPN, dynamic routing, multicast routing, or QoS.
• It requires the use of EtherType ACLs to filter non-IP traffic, which can be complex and cumbersome.
• It requires the use of bridge groups and bridge domains to define the interfaces and VLANs that belong to the same broadcast domain.
• It requires the use of MAC address learning and aging to maintain a MAC address table for each bridge group.

References :=

Some possible references are:

• Cisco ASA Series Firewall CLI Configuration Guide, 9.10 - Transparent Firewall Mode
• Deploying ASA - Cisco
• Cisco ASA 5500-X Series Firewalls - Configuration Guides - Cisco

 To add switches into the fabric, administrators can use PowerOn Auto Provisioning (POAP) or Seed IP methods. POAP is a feature that automates the process of upgrading software images and installing configuration files on Cisco switches that are being deployed in the network for the first time. Seed IP is a method that allows administrators to specify the IP address of a switch that is already part of the fabric, and then use it to discover and add other switches that are connected to it. Both methods enable administrators to control how switches are added into DCNM for private cloud management. References:

• POAP, section “PowerOn Auto Provisioning (POAP)”.
• Seed IP, section “Add Switches”.

https://www.cisco.com/c/en /us/td/docs/security/ise/1-4-1/admin_guide/b_ise_admin_guide_141/b_ise_admin_guide_141_chapter_01110.html