350-701 Practice Test 1 — 10 Questions

Question 1

Which Cisco content security solution provides DNS-layer protection and a cloud proxy to enforce security policies?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Secure Internet Gateway) is the cloud-delivered security platform that provides DNS-layer protection, secure web gateway, cloud firewall, and CASB in a single solution. It is the only option that combines DNS-layer security with a cloud proxy, matching the question's description exactly.

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Question 2

A network administrator configures Cisco ISE to identify devices by analyzing DHCP requests, HTTP user agents, and SNMP queries. Which ISE feature is being used?

Accepted Answer

Profiling. Profiling in ISE uses probes (DHCP, HTTP, SNMP, etc.) to identify device type and attributes.

Answer

TrustSec

Answer

Guest access

Answer

Posture assessment

Question 3

A security team wants to gain visibility into shadow IT usage of SaaS applications and enforce DLP policies for data shared via cloud apps. Which cloud security solution should they deploy?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) sits between users and cloud services to provide visibility into shadow IT (discovering unsanctioned SaaS apps) and enforce DLP policies on data moving to and from cloud applications. CASBs offer API-based and proxy-based modes to inspect cloud traffic and apply granular controls, which is exactly what the team needs.

Answer

Cisco Umbrella Secure Internet Gateway (SIG)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 4

An organization deploys Cisco Secure Firewall (formerly Firepower) in a public cloud environment (AWS). They need to inspect traffic between VPCs. What is the recommended deployment model?

Accepted Answer

Deploy firewall as a centralized virtual appliance in a transit VPC. In a public cloud environment like AWS, deploying Cisco Secure Firewall as a centralized virtual appliance in a transit VPC is the recommended model because it allows traffic between multiple VPCs to be routed through a single inspection point. This architecture leverages VPC peering or AWS Transit Gateway to funnel inter-VPC traffic to the firewall, ensuring consistent policy enforcement and visibility without requiring per-VPC firewall instances. Centralized inspection simplifies management, reduces costs, and avoids the complexity of distributed firewall deployments.

Answer

Install firewall software on each EC2 instance

Answer

Deploy firewall in each VPC with VPC peering

Answer

Use AWS Network Firewall instead

Question 5

An organization is using Microsoft 365 and wants to prevent sensitive data from being shared externally via email and OneDrive. Which Cisco cloud security product should they deploy?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct choice because it is a cloud-native CASB (Cloud Access Security Broker) that integrates with Microsoft 365 to enforce data loss prevention (DLP) policies. It can inspect email attachments and OneDrive files for sensitive data patterns (e.g., credit card numbers, PII) and block external sharing based on policy. Cloudlock uses APIs to scan content at rest and in transit, providing granular control over data residency and sharing permissions.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Answer

Cisco Duo

Question 6

A company uses Cisco WSA to proxy web traffic. After configuring a decryption policy to inspect HTTPS traffic to a specific external site, users report they can still access the site without any warning or interruption. Which action should the administrator take to ensure HTTPS inspection is applied?

Accepted Answer

Change the policy action from 'Passthrough' to 'Decrypt'. The decryption policy must have an action of 'Decrypt' to actually perform HTTPS inspection. If the policy action is set to 'Passthrough', the WSA forwards the traffic without decrypting it, so users experience no warning or interruption. Changing the action to 'Decrypt' forces the WSA to intercept the TLS handshake, decrypt the traffic, and apply security policies.

Answer

Add the site to the 'HTTPS Bypass' list

Answer

Import the WSA root CA certificate into client browsers

Answer

Move the decryption policy to the top of the list

Question 7

Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?

Accepted Answer

Zero Trust. Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 8

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. Option A is correct because the AMP for Endpoints connector policy must be configured to point file submissions to the on-premises Threat Grid appliance, which is done by selecting the private Threat Grid appliance as the analysis destination in the policy's file analysis settings. Option C is correct because the on-premises Threat Grid appliance must be registered with the AMP cloud as a private analysis provider, which establishes the trust and routing so the AMP cloud knows to send files to that appliance for analysis. Option B is incorrect because SSL decryption is unrelated to file submission to Threat Grid and is not a required configuration step. Option D is incorrect because the Threat Grid appliance initiates outbound connections to the AMP cloud and does not require inbound internet traffic to function as a private analysis provider. Option E is incorrect because the Threat Grid Connector is not installed on endpoints; integration is handled through the AMP connector policy and cloud registration.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 9

A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated attempts to guess credentials, often automated, until successful.

Answer

SQL injection

Answer

Man-in-the-middle attack

Answer

Phishing

Question 10

A network engineer is configuring Cisco Umbrella to secure remote users connecting to a SaaS application. The users are not assigned a static public IP and often connect from various locations. Which deployment method best protects these users?

Accepted Answer

Roaming Client. The Roaming Client (Cisco Umbrella Roaming Security Module) is the correct deployment method because it provides DNS-layer security directly on the endpoint, regardless of the user's location or IP address. This ensures that remote users without a static public IP are protected by Umbrella's DNS filtering and threat intelligence, even when connecting from various networks (e.g., home, coffee shop, hotel). The client automatically selects the closest Umbrella data center via Anycast and encrypts DNS queries over HTTPS (DoH) to prevent tampering.

Answer

Virtual Appliances

Answer

DNS forwarding with Network Device binding

Answer

IP layer enforcement with Anycast