CESA, NVM Questions

 

Question 1 -  As your company's employees work both on and off-premises, you plan to collect flow context from the endpoints to gain visibility into user behaviors. Since you have already deployed Cisco Secure Client, you plan to add NVM and ingest the related events into Splunk for advanced security analytics. Which Splunk app/add-on should you use for this purpose?

Top of Form

• The Cisco Security Cloud app
• The Cisco SNA app
• The Cisco Endpoint Threat Defense app and Cisco Endpoint Threat Defense add-on
• The CESA app and CESA Add-OnBottom of Form

 

Question 2 - You are planning to transition the Cisco security legacy apps that you use in Splunk with the Cisco Secure Cloud app. Which three are benefits provided by the Cisco Security Cloud app? (Choose three.)

Top of Form

• Consistent index creation and data parsing that ensures efficient processing of ingested data of each product.
• One index that is used for the ingested data from the supported Cisco products.
• A specific dashboard for each product that facilitates on-time and detailed analysis of ingested data.
• One built-in dashboard that shows all the possible integrations in one place for events analysis.
• Integration with Splunk SOAR for automated responses to threats.
• Software updates and compatibility with the latest Splunk platform versions.

 

 

Question 3 - For which legacy app setup do you need to copy the certificate and specify the required certificate name in Splunk so it can authenticate with the server for data ingestion?

Top of Form

• Duo Splunk Connector
• Cisco Secure Network Analytics (Stealthwatch) App for Splunk Enterprise
• Cisco Secure eStreamer Client Add-On for Splunk
• Cisco Secure Malware Analytics

Bottom of Form

 

Question 4 - You are using Cisco Secure Network Analytics for contextual visibility and monitoring of your private network and public cloud. You plan to ingest data from the Secure Network Analytics Management Console into Splunk and want to try the legacy app first and explore built-in dashboards so you can compare it with the Cisco Security Cloud later on. Which legacy app can you use?

Top of Form

• Cisco Cloud Security App
• Cisco Secure Network Analytics (Stealthwatch) App
• Cisco Stealthwatch App
• Cisco Netflow Analytics App for Splunk

 

 

Question 5 - What is the primary function of a Splunk Technology Add-on (TA)?

Top of Form

• To provide comprehensive dashboards and reports for end-users.
• To manage user authentication and authorization within Splunk.
• To execute ad-hoc searches and generate alerts based on raw data.
• To facilitate the onboarding, parsing, and normalization of data from specific sources.

Question 6 - You are searching Splunkbase for the Cisco Secure Firewall app for Splunk to see whether this app has reached end-of-life. Which two provide information for the end-of-life notice on the app page in Splunkbase? (Choose two.)

Top of Form

• In the description under the app name
• In the Compatibility field
• In the Support field
• In the Version History tab
• In the Summary tab
• In the Installation tab

 

 

Question 7 - Which app requires a technology add-on for data ingestion of the supported Cisco security product?

Top of Form

• Duo Splunk Connector
• Splunk for Cisco ISE
• Cisco Security Cloud  
• Cisco Secure Malware Analytics
• Cisco Email Threat Defense connector for Splunk

Bottom of Form

Question 8 - you have enabled ingestion of your Cisco ISE events into Splunk and installed the Splunk for Cisco ISE app for analyses. Which type of users can you inspect using this app?

Top of Form

• Wired and wireless users
• Wired and VPN users
• Wireless and VPN users
• Wired, wireless, and VPN users

 

Question 9 - Which three top level menu items are available in the Cisco ISE app in Splunk? (Choose three.)

Top of Form

• Authentications
• BYOD
• ISE Profiler
• TACACS+
• TrustSec
• Device Summary

Question 10 - You are setting up Cisco ISE to send Syslog events to Splunk. You have configured the Splunk server as a remote logging target, what else do you need to do?

Top of Form

• Configure the shared secret password.
• Install the Cisco ISE system certificate to be used for the Syslog service.
• Choose the logging categories for the Splunk logging target.
• Create the logging policy rules under the Admin Policy Set.

Bottom of Form

Question 11 - you are working as a SOC analyst, and you are integrating Cisco NVM on the endpoints with Splunk. You have set up the NVM Collector, and you need to configure Splunk to ingest the three feeds streamed from the collector. Which action should you take?

• Configure three UDP data inputs, each with the port for the respective feed. 
• Configure one UDP data input that includes all three ports for the feeds.
•  Configure three TCP data inputs, each with the port for the respective feed. 
• Configure one Syslog data input that includes all three ports for the feeds. 
• Configure three Syslog data inputs, each with the port for the respective feed.

 

 

 

Question 12 - The employees in your organization connect to your corporate network through VPN from various locations, and you want to obtain insights into the traffic that is sent through the tunnel using the CESA app in Splunk. Which two options in the Zero Trust – VPN Split Tunneling/Network Monitor dashboard can you use to filter the display of information that is related to the traffic in the VPN tunnels? (Choose two.)

Top of Form

• Wired
• Untrusted
• Virtual
• VPN
• Trusted

 

Question 13 - During the verification of the NVM integration with Splunk, you need to confirm that the NVM collector status is active (running). This will help you ensure that the NVM collector is continuously receiving IPFIX data from the NVM endpoints. Which command should you use on the NVM Collector?

Top of Form

• sudo systemctl status acnvm.collector
• sudo systemctl status nvm.collector
• sudo systemctl status acnvm.service
• sudo systemctl status nvm.service

Bottom of Form

Question 14 - You need to modify the Splunk IP address in the NVM Collector configuration file. Which two options specify the name of the configuration file and the path where it is located? (Choose two.)

Top of Form

• /opt/cisco/nvm
• /opt/acnvm/conf/
• /opt/nvm/conf/
• nvm.conf
• nvm.xml
• acnvm.conf

 

Question 16 - Which CESA App homepage category provides access to dashboards that visualize application behavior, such as top applications by volume and flow, top source and destination ports, as well as utilization data and integrated view of application processes?

Top of Form

• Devices
• Applications
• Users
• Locations

Bottom of Form

 

Bottom of Form

 

Question 17 - You have installed Cisco Enterprise Networking for Splunk Platform on Splunk to use the app's built-in dashboards to analyze events ingested from your enterprise environment. Which three Cisco products do the app dashboards support? (Choose three.)

Cisco ISE

Cisco Duo

Cisco Secure Endpoint

 Cisco Catalyst SD-WAN

Cisco Secure Firewall

Cisco Catalyst Center Bottom of Form

 

 

Question 18 - You have Cisco ISE and Splunk in your environment, and you want to try the Cisco ISE Data Connect to query Cisco ISE from Splunk for analysis and report creation. Which two components do you need for the integration? (Choose two.)

 Splunk DB Connect Splunk for Cisco ISE

Splunk Add-on for Cisco Identity Services

Splunk DBX Add-on for MySQL JDBC

Splunk DBX Add-on for Oracle JDBC

 

 

 

Question 19 - You have integrated Cisco NVM on the endpoints with Splunk to obtain deep endpoint visibility using the CESA app. Which two types of analyses can you perform with the built-in dashboards in the CESA app? (Choose two.)

Top of Form

• CPU usage on endpoints
• Data and traffic across VPN and split tunnels
• Suspicious emails containing phishing links
• Endpoints using unapproved or block listed applications
• System performance metrics for virtual servers

 

Which file contains the three following ports used between the Cisco NVM Collector and Splunk? "syslog_flowdata_server_port" : 20519 "syslog_sysdata_server_port" : 20520 "syslog_intdata_server_port" : 20521

Top of Form

• acnvm.conf file on the Cisco NVM Collector
• NVM_ServiceProfile.xml file on the Cisco NVM Collector
• acnvm.conf file on the Client running Cisco NVM
• NVM_ServiceProfile.xml file on the Client running Cisco NVM

Bottom of Form