350-701 Practice Test 10 — 10 Questions

Question 1

A network engineer is troubleshooting an issue where users on a specific VLAN cannot access the internet through a Cisco ASA firewall. The ASA has a default route pointing to the ISP router. The security policy includes an ACL that permits all traffic from the inside interface to the outside interface. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT (Network Address Translation) is not configured. The most likely cause is that NAT is not configured. Even though the ACL permits all traffic from inside to outside, the Cisco ASA requires NAT (or a NAT exemption rule) to translate private IP addresses to a routable public IP address when traffic traverses from a higher-security interface (inside) to a lower-security interface (outside). Without NAT, the ASA will drop the packets because it cannot determine how to route the private source addresses on the public internet, and the return traffic would have no way to reach the internal hosts.

Answer

The default route is misconfigured

Answer

DNS is not resolving domain names

Answer

The ACL is blocking the traffic

Question 2

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

Accepted Answer

Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.. Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.

Answer

Install a next-generation firewall at the internet edge and enable IPS.

Answer

Upgrade all access switches to support Private VLANs (PVLANs).

Answer

Deploy 802.1X with dynamic VLAN assignment across all wired ports.

Question 3

A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?

Accepted Answer

Check the ISE authentication logs for failure reasons.. The correct first step is to check the ISE authentication logs for failure reasons because the switch port is already in an unauthorized state, meaning the 802.1X authentication process has failed. ISE (the RADIUS server) logs provide the most granular failure reason, such as invalid credentials, unknown client, or EAP method mismatch, which directly pinpoints the root cause. Checking the switch's RADIUS reachability or endpoint configuration would be premature without first understanding why authentication was denied.

Answer

Check the switch's RADIUS server reachability.

Answer

Check the endpoint's supplicant configuration.

Answer

Check the CA server for certificate issues.

Question 4

An organization wants to restrict administrative access to Cisco network devices based on the time of day and source IP address. Which technology should be used?

Accepted Answer

TACACS+ with per-command authorization. TACACS+ is the correct choice because it supports per-command authorization, which allows an administrator to define granular access policies based on attributes such as time of day and source IP address. This is achieved through the TACACS+ authorization process, where the AAA server evaluates the user's request against configured authorization rules before granting access to specific commands or sessions.

Answer

SNMPv3 with ACLs

Answer

802.1X with EAP-TLS

Answer

IPsec VPN with extended authentication

Question 5

A security analyst wants to detect misconfigurations in cloud storage buckets using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). What must be configured first?

Accepted Answer

Connect to the cloud provider's API. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) relies on API integration with the cloud provider (AWS, Azure, GCP) to pull metadata about cloud resources, including storage bucket configurations. By connecting to the cloud provider's API, the platform can continuously monitor for misconfigurations such as public read/write access, unencrypted buckets, or improper logging settings. Without this API connection, the platform cannot access the cloud provider's resource inventory or configuration state, making bucket misconfiguration detection impossible.

Answer

Enable flow log export to the analytics platform

Answer

Install a sensor in the cloud VPC

Answer

Deploy a syslog collector

Question 6

Which Cisco NGFW technology can be used to block social media categories such as Facebook and Twitter during business hours?

Accepted Answer

URL Filtering. Firepower URL filtering allows blocking by category, including social media.

Answer

TLS Server Identity Discovery

Answer

Intrusion Prevention

Answer

Application Control

Question 7

An organization wants to implement URL filtering based on user identity. The Cisco WSA must integrate with which directory service to apply policies per user or group?

Accepted Answer

Active Directory. Cisco WSA integrates with Active Directory for identity-based policies.

Answer

RADIUS

Answer

TACACS+

Answer

LDAP

Question 8

A SOC analyst notices that a user downloaded a malicious file from a website. The Cisco WSA is configured with AMP file scanning. However, the file was not blocked. Which scenario best explains why AMP failed to detect the file?

Accepted Answer

The file was a zero-day malware not yet analyzed by AMP. AMP uses SHA-256 cloud lookup and sandboxing. If the file is new and unknown (zero-day), the cloud may not have a disposition, and if sandboxing is not enabled or the file type is not analyzed, it could be allowed.

Answer

The file was cached from a previous scan

Answer

The file was less than 10 KB

Answer

SSL decryption was disabled

Question 9

A security analyst is investigating a Business Email Compromise (BEC) attack. Which two indicators are commonly associated with BEC attacks? (Choose two.)

Accepted Answer

Spoofed email address resembling a legitimate executive. BEC attacks often involve spoofed email addresses (domain lookalikes) and urgent requests for wire transfers or sensitive data.

Answer

Malicious attachment with ransomware

Answer

Presence of a phishing URL

Answer

Encrypted ZIP file attachment

Question 10

A company is using Cisco WSA with transparent proxy via WCCP. The security team wants to identify which users are accessing banned websites and also enforce bandwidth limits for video streaming. Which TWO features should be configured on the WSA?

Accepted Answer

Identity-based policies with AD integration. Identity-based policies allow user identification via AD, and bandwidth controls can limit traffic per user or group.

Answer

AMP file scanning

Answer

SSL/TLS decryption

Answer

URL filtering categories