350-701 Practice Test 5 — 10 Questions

Question 1

A company uses Cisco ISE for network access control. They want to allow employee-owned devices to access the guest network after a simple registration, while corporate devices get full access. Which ISE configuration best achieves this?

Accepted Answer

Use MAB for unknown devices, then perform posture assessment; redirect to registration portal if needed.. Option D is correct because MAB for unknown devices with posture check is a common BYOD flow. Option A forces 802.1X on all devices, which may not be supported on guest devices. Option B uses PSK which is less secure. Option C is for corporate devices.

Answer

Use 802.1X with PEAP and machine certificates for all devices.

Answer

Use MAB only for corporate devices and deny all others.

Answer

Configure a single PSK for the guest SSID.

Question 2

Which type of firewall is best suited to inspect application-layer traffic and protect against exploits like SQL injection?

Accepted Answer

Next-generation firewall with IPS and application visibility. A next-generation firewall (NGFW) with IPS and application visibility is best suited to inspect application-layer traffic and protect against exploits like SQL injection because it combines deep packet inspection (DPI), signature-based IPS, and application-level awareness. Unlike simpler firewalls, an NGFW can decode HTTP/HTTPS payloads, match patterns against SQL injection signatures (e.g., ' OR 1=1 --), and block malicious traffic at Layer 7 while maintaining stateful inspection.

Answer

Stateful firewall

Answer

Application proxy firewall

Answer

Packet-filtering firewall

Question 3

After applying a new extended ACL inbound on an interface, users report they can no longer reach a critical server on a different subnet. The ACL permits the server's IP and required ports. What is the most likely cause?

Accepted Answer

The ACL is missing a permit for necessary traffic (e.g., return traffic or ARP), triggering the implicit deny.. When an extended ACL is applied inbound on an interface, it filters traffic entering that interface before the routing decision. Even if the ACL permits the destination server's IP and required ports, it must also permit the return traffic (e.g., TCP acknowledgments, ICMP replies) from the server back to the users. If the ACL does not explicitly permit this return traffic, the implicit deny at the end of the ACL will drop it, breaking connectivity. This is the most common cause of connectivity loss after applying an inbound ACL.

Answer

The router has run out of memory for ACL processing.

Answer

The ACL is applied in the outbound direction instead of inbound.

Answer

The ACL is applied to the wrong interface.

Question 4

Which TWO methods can be used to enforce least privilege within a network infrastructure? (Choose two.)

Accepted Answer

Use Cisco TrustSec with SGTs and security group policies.. Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity, not just IP addresses. Security group policies then enforce least privilege by allowing or denying communication between SGTs, ensuring that only necessary traffic flows between endpoints.

Answer

Use a single administrator account with full privileges for all IT staff.

Answer

Place all users in the same VLAN without ACLs.

Answer

Configure source NAT on the firewall to hide internal addresses.

Question 5

Refer to the exhibit. An IPsec VPN tunnel between two routers is not passing traffic. IKE phase 1 is not complete (MM_NO_STATE). Phase 2 has no SA. Which issue is most likely causing the problem?

Accepted Answer

IKE policy mismatch (e.g., encryption, hash, or pre-shared key) causes phase 1 failure.. The IKE phase 1 state is MM_NO_STATE, which indicates that the Internet Key Exchange (IKE) Main Mode negotiation has not completed. This typically occurs when the peers cannot agree on the IKE policy parameters (encryption, hash, Diffie-Hellman group, authentication method, or pre-shared key). Since phase 2 (IPsec SA) depends on a successful phase 1, the failure cascades, making an IKE policy mismatch the most likely root cause.

Answer

The remote peer is not reachable due to a routing issue.

Answer

The ACL defining interesting traffic is misconfigured.

Answer

Mismatched IPsec transform sets between the peers.

Question 6

Refer to the exhibit. A network engineer applies a zone-based firewall policy to a router. Users in the INSIDE zone report they can access HTTP servers on the OUTSIDE zone but cannot resolve DNS names or access MS-SQL servers. What does the policy do to DNS and MS-SQL traffic?

Accepted Answer

They are dropped because the BAD_TRAFFIC class explicitly drops them.. The correct answer is B because the zone-based firewall policy explicitly defines a class map (BAD_TRAFFIC) that matches DNS (UDP/53) and MS-SQL (TCP/1433) traffic and applies the 'drop' action. Since the policy-map uses a 'class-default' action of 'inspect' for GOOD_TRAFFIC, any traffic not matching GOOD_TRAFFIC but matching BAD_TRAFFIC is dropped before inspection can occur. The users' symptoms confirm that DNS and MS-SQL are being dropped, while HTTP (matched by GOOD_TRAFFIC) is inspected and allowed.

Answer

They are allowed because no 'inspect' action is applied to the class.

Answer

They are inspected and allowed through the firewall.

Answer

They are dropped because they do not match the GOOD_TRAFFIC class.

Question 7

A company deploys Cisco ASA with clientless SSL VPN to provide remote access to internal web-based applications. Users connect via a web browser and authenticate using RADIUS. The security policy requires that users re-authenticate after 15 minutes of inactivity. The administrator configures the group-policy with 'vpn-idle-timeout 15' and 'vpn-session-timeout 60'. After testing, the administrator finds that users can still access the internal web applications even after the VPN session has timed out. The administrator checks the ASA logs and confirms that the VPN session is indeed terminated. The web applications are standard HTTP-based and do not have their own session timeout mechanisms. What is the most likely cause of this issue?

Accepted Answer

The web applications use persistent cookies that do not require re-authentication.. Option A is correct because clientless SSL VPN uses a web portal that relies on cookies to maintain the user's authenticated state. When the VPN session times out, the ASA terminates the VPN tunnel, but the web browser still holds the authentication cookie for the internal web application. Since the web application itself has no session timeout, the cookie remains valid, allowing the user to continue accessing the application without re-authentication. The ASA's vpn-idle-timeout and vpn-session-timeout only control the VPN tunnel, not the application-layer cookies.

Answer

The clientless SSL VPN portal uses 'application-specific' timeout settings.

Answer

The RADIUS server is sending the 'Session-Timeout' attribute that overrides the ASA configuration.

Answer

The ASA is configured with 'webvpn' and 'cache' enabled, which caches the application pages.

Question 8

Match each 802.1X component to its role.

Question 9

A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?

Accepted Answer

API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.. Option B is correct because API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.

Answer

Forward proxy mode, which intercepts user traffic and inspects it before it reaches the SaaS application.

Answer

Reverse proxy mode, which sits in front of the SaaS application and inspects incoming traffic.

Answer

Web application firewall (WAF) mode, which filters HTTP traffic to the application.

Question 10

A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?

Accepted Answer

Install a Certificate Authority (CA) certificate on the WSA and distribute it to clients. The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.

Answer

Create a bypass list for internal sites

Answer

Configure an Access Control List (ACL) to allow decryption

Answer

Configure user authentication