350-701 Practice Test 12 — 15 Questions

Question 1

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

Accepted Answer

Device Trajectory to review the event timeline.. Option B is correct because the Device Trajectory feature provides a time-ordered sequence of events, including parent-child process relationships. Option A is wrong because File Search only lists files, not process relationships. Option C is wrong because the Dashboard gives a high-level overview. Option D is wrong because the Group Policy shows policy settings, not events.

Answer

Group Policy to check applied policies.

Answer

Dashboard to view overall threat scores.

Answer

File Search to find files with unknown verdict.

Question 2

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Options B, C, and D are correct. Configuring whitelist exclusions (B) prevents legitimate applications from being flagged. Setting different policies for different groups (C) allows tailored rules. Using the 'Disposition' filter to block only malicious files (D) avoids blocking unknown benign files. Option A (Enable all exploit prevention rules) may cause false positives from legitimate applications. Option E (Disable file reputation) reduces protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 3

Which TWO are required to successfully deploy Cisco AMP for Endpoints in a Windows domain environment with Group Policy?

Accepted Answer

Install the AMP connector on each endpoint. Options A and D are correct. The AMP connector must be installed (A) and the policy must be assigned (D). Option B (install on a domain controller) is not required; the connector can be on any endpoint. Option C (configure firewall to block outbound HTTPS) would break connectivity. Option E (join all endpoints to the domain) is not strictly necessary; Group Policy can apply to non-domain machines via local policy.

Answer

Configure the firewall to block outbound HTTPS traffic

Answer

Install the AMP connector on a domain controller

Answer

Ensure all endpoints are joined to the domain

Question 4

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Accepted Answer

Authorization policy. Option C is correct because authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Answer

Profiling policy

Answer

Authentication policy

Answer

Policy set

Question 5

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 6

Drag and drop the steps to configure 802.1X port-based authentication on a Cisco switch in the correct order.

Question 7

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Question 8

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

Question 9

Drag and drop the steps to implement Cisco Umbrella (formerly OpenDNS) for DNS-layer security in the correct order.

Question 10

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Question 11

Drag and drop the steps to recover a lost password on a Cisco IOS router in the correct order.

Question 12

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. Option C is correct because the guest portal settings must be set to 'Sponsor Approval' to require sponsor approval. Option A is wrong because the sponsor account type affects who can sponsor, not the approval process. Option B is wrong because guest report is just for notification. Option D is wrong because self-registration is the opposite of requiring sponsor approval.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device

Question 13

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Accepted Answer

show asp drop. The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

Answer

show access-list

Answer

show conn

Answer

show service-policy

Question 14

Which THREE of the following are common indicators of a DDoS attack at the network layer?

Accepted Answer

A spike in UDP traffic to a single target. A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.

Answer

Unusual traffic on non-standard TCP/UDP ports

Answer

High CPU usage on network devices

Question 15

Which TWO of the following are valid approaches to mitigate ARP spoofing attacks on a switched network?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) on VLANs. Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in a network. It relies on a DHCP snooping binding database to map IP addresses to MAC addresses, and it drops ARP packets that have invalid IP-to-MAC bindings, thereby preventing ARP spoofing attacks on a switched network.

Answer

Enable BPDU Guard on all switchports

Answer

Enable Port Security on all access ports

Answer

Enable DHCP Snooping globally