350-701 Practice Test 12 — 15 Questions

Question 1

An engineer is troubleshooting a Cisco WSA that is failing to block malware downloads from a specific cloud storage website. The URL filtering policy is set to block the 'Cloud Storage' category, and the Web Reputation score is set to block scores below -5.0. Users can still download files. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file type is not configured for malware inspection. The Cisco WSA can block malware downloads only if it inspects the file content. If the file type is not configured for malware inspection, the WSA will allow the download even if the URL category and reputation score are set to block. This is because malware inspection requires explicit configuration of file types (e.g., .exe, .zip) to scan for threats, and without it, the WSA bypasses deep content analysis.

Answer

HTTPS proxy decryption is not configured

Answer

The L4 Traffic Monitor is not enabled

Answer

The users are not authenticated

Question 2

Which Cisco technology uses SHA-256 file hashes to determine if a file is malicious by querying a cloud database?

Accepted Answer

AMP for Email. AMP for Email uses SHA-256 cloud lookup to compare file hashes against known threats.

Answer

DLP Policies

Answer

Outbreak Filters

Answer

SenderBase Reputation

Question 3

An organization uses Cisco Firepower NGFW to enforce content security policies. The security team wants to block all social media traffic during business hours but allow access during lunch breaks. Additionally, they want to detect and alert on any SSL connections to unknown destinations that might indicate data exfiltration. Which THREE capabilities of the NGFW should be combined to achieve these objectives?

Accepted Answer

URL filtering based on time schedules. URL filtering blocks categories by time, application control enforces policies per app, and TLS server identity discovery detects unknown destinations in encrypted traffic.

Answer

Intrusion prevention system (IPS)

Answer

AMP file scanning

Question 4

Which Cisco technology uses SenderBase reputation scores (SBRS) to evaluate incoming email?

Accepted Answer

Cisco ESA anti-spam. Cisco ESA uses IronPort SenderBase reputation to assign a score (-10 to +10) to senders to determine spam likelihood.

Answer

Cisco Firepower intrusion prevention

Answer

Cisco WSA URL filtering

Answer

Cisco Umbrella DNS security

Question 5

A company is deploying Cisco Umbrella SIG to protect against malware and phishing. The security team wants to ensure that even if a user clicks on a malicious link in an email, the traffic is inspected and blocked if needed. Which TWO features of Umbrella can be used to provide this protection?

Accepted Answer

Cloud proxy with URL filtering. DNS security blocks malicious domains at the DNS lookup stage, and cloud proxy can inspect HTTP/HTTPS traffic to block malicious content even if DNS is bypassed.

Answer

SSL/TLS decryption on the proxy

Answer

ThousandEyes agents

Answer

AMP for mobile devices

Question 6

An organization is deploying Cisco WSA in explicit proxy mode. Which three considerations are important for this deployment? (Choose three.)

Accepted Answer

Client browsers must be configured to use the proxy. Explicit proxy requires browser configuration (PAC file or manual), supports authentication, and can apply identity-based policies. Transparent proxy does not require client configuration.

Answer

Network changes are required on all endpoints

Answer

The proxy IP address must be configured on the router for WCCP

Question 7

A Cisco WSA administrator wants to prioritize bandwidth for video conferencing applications while limiting recreational streaming. Which feature should be configured?

Accepted Answer

Bandwidth Controls. Bandwidth controls on Cisco WSA allow setting bandwidth limits per application (via AVC) to prioritize critical applications and limit others.

Answer

SSL/TLS Decryption

Answer

Application Visibility and Control (AVC)

Answer

URL Filtering

Question 8

A security analyst notices that emails from a trusted partner's domain are being quarantined by the Cisco ESA. The analyst wants to verify the email authentication status. Which TWO authentication mechanisms should be checked?

Accepted Answer

DKIM. SPF and DKIM are used to authenticate email senders and verify domain ownership.

Answer

SenderBase

Answer

DMARC

Answer

TALOS

Question 9

Which two Cisco solutions can be used to provide cloud-based content security including DNS-layer protection and cloud proxy? (Choose two.)

Accepted Answer

Cisco Umbrella DNS-layer security. Cisco Umbrella offers both DNS security and cloud proxy (SIG). Cisco ThousandEyes is for performance, not security. WSA and ESA are on-premises.

Answer

Cisco ThousandEyes

Answer

Cisco ESA

Answer

Cisco WSA

Question 10

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A CASB provides visibility and control over SaaS applications, including DLP policies to detect and block unauthorized sharing of sensitive data. CSPM focuses on cloud infrastructure posture, CWPP on workloads, and WAF on web application attacks.

Answer

Web Application Firewall (WAF)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 11

Which TWO of the following are required to configure a site-to-site IPsec VPN on a Cisco IOS router?

Accepted Answer

ISAKMP policy. ISAKMP (Internet Security Association and Key Management Protocol) policy is required to define the parameters for Phase 1 of an IPsec VPN, including encryption, authentication, Diffie-Hellman group, and lifetime. Without an ISAKMP policy, the router cannot establish the secure management tunnel needed to negotiate IPsec Security Associations (SAs).

Answer

NAT exemption for VPN traffic

Answer

AAA new-model

Answer

DHCP pool for remote clients

Question 12

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints has been later determined to be malicious. Which Cisco AMP feature allows the administrator to see the file's propagation and impacts across endpoints?

Accepted Answer

Device Trajectory. Device Trajectory provides a timeline view of file and process activity, showing the propagation of a threat after it is discovered to be malicious.

Answer

SHA-256 Disposition

Answer

IOC Scanning

Answer

Exploit Prevention

Question 13

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.

Question 14

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

Accepted Answer

Remote shell investigation. Cisco AMP for Endpoints includes endpoint detection and response (EDR) capabilities such as remote shell, which allows analysts to execute commands on the endpoint for investigation.

Answer

Process isolation

Answer

File quarantine

Answer

IOC scanning

Question 15

An organization wants to implement zero trust principles for cloud access. Which of the following is a key component of a zero trust architecture in the cloud?

Accepted Answer

Multi-factor authentication (MFA) for all access. Zero trust assumes no implicit trust and requires continuous verification. Identity is the new perimeter, and MFA is a core enforcement mechanism. VPNs create a trusted network model, which is contrary to zero trust. Perimeter firewalls are less relevant. Single password only is inadequate.

Answer

Site-to-site VPN to cloud

Answer

Strong perimeter firewall

Answer

Single sign-on with one password