Refer to the Exhibit Practice Questions

configure terminal
access-list OUTSIDE extended permit tcp any host 203.0.113.10 eq www
access-list OUTSIDE extended permit udp any host 203.0.113.10 eq domain
nat (inside,outside) source dynamic any interface

interface GigabitEthernet0/0
 ip address 10.1.1.1 255.255.255.0
 ip access-group INBOUND in
!
ip access-list extended INBOUND
 deny ip 10.0.0.0 0.255.255.255 any
 permit ip any any
!
interface Serial0/0/0
 ip address 172.16.1.1 255.255.255.252
!
router eigrp 100
 network 10.1.1.0 0.0.0.255
 network 172.16.1.0 0.0.0.3

%ASA-4-106023: Deny tcp src outside:203.0.113.50/443 dst DMZ:10.10.10.10/80 by access-group "OUTSIDE"

Refer to the exhibit.
```
! RADIUS server configuration
radius server MY_RADIUS
 address ipv4 192.168.10.10 auth-port 1812 acct-port 1813
 key cisco123
!
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
```

show running-config | section policy-map
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rpc
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect xdmcp
  inspect sip
  inspect pptp
  inspect icmp
  inspect icmp error
  inspect ip-options
 class class-default
  set connection advanced-options UMBC_Inside

Router1#show crypto ipsec sa peer 10.1.1.2
interface: Tunnel0
    Crypto map tag: VPN-CM, local addr 10.1.1.1
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.2.2.0/255.255.255.0/0/0)
   current_peer 10.1.1.2 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.2
     path mtu 1500, ipsec overhead 66, media mtu 1500
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none
     inbound esp sas:
      spi: 0x0(0)
        transform: esp-aes 256 esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 0, flow_id: 0, sibling_flags 80000040, crypto map: VPN-CM
        sa timing: remaining key lifetime (k/sec): (0/0)
        IV size: 16 bytes
        replay detection support: Y
     inbound ah sas:
     inbound pcp sas:
     outbound esp sas:
      spi: 0x0(0)
        transform: esp-aes 256 esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 0, flow_id: 0, sibling_flags 80000040, crypto map: VPN-CM
        sa timing: remaining key lifetime (k/sec): (0/0)
        IV size: 16 bytes
        replay detection support: Y
     outbound ah sas:
     outbound pcp sas:

Router1#show crypto isakmp sa
dst             src             state          conn-id slot
10.1.1.2        10.1.1.1        MM_NO_STATE    1       0

policy-map type inspect INSPECT-POLICY
 class type inspect BAD_TRAFFIC
  drop
 class type inspect GOOD_TRAFFIC
  inspect
! 
class-map type inspect match-any BAD_TRAFFIC
 match protocol dns
 match protocol ms-sql
! 
class-map type inspect match-any GOOD_TRAFFIC
 match access-group 100
! 
zone security INSIDE
zone security OUTSIDE
zone-pair security ZP-IN-2-OUT source INSIDE destination OUTSIDE
 service-policy type inspect INSPECT-POLICY

Refer to the exhibit.

AMP for Endpoints connector log:

2025-01-15 10:23:45 [INFO] File scan initiated: C:\Users\jdoe\Documents\invoice.pdf
2025-01-15 10:23:46 [INFO] Sending file to cloud for analysis (SHA-256: abc123...)
2025-01-15 10:23:50 [INFO] Cloud analysis result: disposition = Malicious, score = 95
2025-01-15 10:23:50 [INFO] Action taken: Allow (policy rule: "Allow on low confidence")

Refer to the exhibit.

```
{
  "policy": {
    "name": "Default",
    "file_reputation": [
      {
        "threat_score": 100,
        "action": "block"
      },
      {
        "threat_score": 80,
        "action": "quarantine"
      },
      {
        "threat_score": 0,
        "action": "allow"
      }
    ],
    "custom_detections": [
      {
        "sha256": "a1b2c3d4e5f6...",
        "action": "block"
      }
    ]
  }
}
```

Refer to the exhibit.

AMP for Endpoints policy JSON snippet:

{
  "policy": {
    "name": "Windows_Workstations",
    "exclusions": {
      "file": [
        {
          "path": "C:\\Program Files\\FinanceApp\\*.exe",
          "action": "allow"
        }
      ],
      "process": [
        {
          "path": "C:\\Program Files\\FinanceApp\\app.exe",
          "action": "allow"
        }
      ]
    },
    "tetra": {
      "file_reputation": {
        "action_unknown": "block"
      }
    }
  }
}

Refer to the exhibit.

Syslog output from AMP for Endpoints:

<134>Jan 15 11:00:00 C:\Program Files\Cisco\AMP\connector.exe: [TETRA Alert] File: C:\Users\test\Downloads\crack.exe SHA-256: d4e5f6... Disposition: Malicious Action: Blocked by policy (Blocked by TETRA. Policy: Workstations)

Refer to the exhibit.

```
show amp status
Connector Status: Connected
Last Connection: 2024-01-15 10:32:45 UTC
Policy Version: 2.3.4
Private Cloud: Disabled
Network Component: Enabled
Isolated: Yes
```

Refer to the exhibit.

```
2024-01-15 11:00:00 ERROR: Failed to connect to AMP cloud: Connection timed out
2024-01-15 11:01:00 WARNING: Retrying connection in 60 seconds
2024-01-15 11:02:00 INFO: Proxy configured: proxy.company.com:3128
2024-01-15 11:03:00 ERROR: Proxy authentication failed: 407 Proxy Authentication Required
```

Refer to the exhibit.

! Cisco FMC intrusion policy snippet
preprocessor global_sensitivity: sensitivity_level high
preprocessor frag3: frag3_engine policy=first, bind_to=0.0.0.0
preprocessor stream5_global: track_tcp yes, track_udp yes
preprocessor stream5_tcp: policy=windows, use_static_footprint_sizes yes
preprocessor http_inspect: global iis_unicode_map unicode.map 1252
preprocessor http_inspect: default_inspect_http_profiles
preprocessor smtp: ports 25 465 587
!

Refer to the exhibit.

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip verify source
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip verify source
!
ip dhcp snooping vlan 1-100
ip dhcp snooping information option
ip dhcp snooping
!
ip source binding 00:11:22:33:44:55 vlan 10 192.168.1.10 interface GigabitEthernet0/0
!