350-701 Practice Test 13 — 15 Questions

Question 1

Which Cisco technology uses SenderBase reputation scores (SBRS) to evaluate incoming email?

Accepted Answer

Cisco ESA anti-spam. Cisco Email Security Appliance (ESA) uses SenderBase reputation scores (SBRS) as part of its anti-spam engine to evaluate the reputation of sending hosts and domains before accepting or scoring email. SBRS is a core input to the ESA's spam verdict alongside content filters and Talos rules.

Answer

Cisco Firepower intrusion prevention

Answer

Cisco WSA URL filtering

Answer

Cisco Umbrella DNS security

Question 2

A security administrator is evaluating symmetric encryption algorithms for a new VPN deployment. Which algorithm uses a 128-bit block size and supports key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits.

Answer

3DES

Answer

RSA

Answer

MD5

Question 3

A security engineer is configuring Cisco ISE for 802.1X authentication using EAP-TLS. What must be deployed on the endpoints to support this authentication method?

Accepted Answer

A client certificate. EAP-TLS is a certificate-based mutual authentication method where both the supplicant (endpoint) and the authentication server (ISE) present X.509 digital certificates to prove their identities. The endpoint must have a client certificate issued by a trusted Certificate Authority, along with the corresponding private key, so it can complete the TLS handshake with ISE. Without a client certificate, EAP-TLS cannot proceed because there is no credential for the supplicant to present.

Answer

A username and password

Answer

A TOTP token

Answer

A shared secret

Question 4

A company deploys Cisco Duo for multi-factor authentication to protect VPN access. Employees use AnyConnect to connect to the corporate network. After entering their credentials, they receive a push notification on their mobile device. Which Duo authentication method is being used?

Accepted Answer

Duo Push. Duo Push sends a push notification to the Duo Mobile app on the user's smartphone, where they can approve or deny the authentication request. This matches the scenario where employees receive a push notification after entering credentials.

Answer

Bypass code

Answer

TOTP (Time-based One-Time Password)

Answer

Hardware token

Question 5

A security engineer is deploying Cisco AMP for Endpoints and wants to ensure that the client can detect and block memory injection attacks. Which AMP feature should be enabled to provide this protection?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP focuses on detecting and blocking memory injection attacks, such as buffer overflows and code injection, by monitoring process behavior.

Answer

Device Trajectory

Answer

Endpoint IOC scanning

Answer

File quarantine

Question 6

A company is implementing cloud security posture management (CSPM). Which Cisco product provides CSPM capabilities?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is Cisco's cloud-native cloud security posture management (CSPM) solution. It continuously monitors cloud infrastructure (e.g., AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks, providing automated remediation and visibility into cloud security posture. This directly aligns with the CSPM use case described in the question.

Answer

Cisco Tetration

Answer

Cisco Firepower

Answer

Cisco ISE

Question 7

An organization wants to implement privileged access management (PAM) for critical servers. They require just-in-time access and session recording. Which solution integrates with Cisco SecureX to provide these capabilities?

Accepted Answer

CyberArk. CyberArk is a leading PAM solution that integrates with Cisco SecureX to provide just-in-time access, session recording, and password vaulting.

Answer

Cisco Duo

Answer

Cisco AMP for Endpoints

Answer

Cisco ISE

Question 8

Which TWO of the following are true about MACsec?

Accepted Answer

It uses IEEE 802.1AE standard. MACsec is defined by the IEEE 802.1AE standard, which specifies a security protocol for providing data confidentiality, integrity, and origin authenticity at Layer 2. It operates directly on Ethernet frames, encrypting the payload while preserving the frame header for transparent forwarding. This makes option B correct because the standard is the foundational reference for MACsec.

Answer

It requires a PKI

Answer

It provides data confidentiality only

Answer

It is used for WLAN security

Question 9

An organization is using Cisco ESA to protect against email-borne threats. They notice that some phishing emails are not being caught by the anti-spam engine. The emails contain malicious URLs that are rewritten by the ESA. Which feature should be verified to ensure the rewritten URLs are properly analyzed?

Accepted Answer

URL filtering and analysis settings. B is correct because the URL filtering and analysis settings control how the Cisco ESA rewrites and subsequently analyzes malicious URLs. When a phishing email contains a malicious URL, the ESA can rewrite the URL to point to its own proxy for real-time analysis. If this feature is not properly configured or if the analysis settings (such as reputation scoring or time-of-click verification) are disabled, the rewritten URLs may not be inspected, allowing the threat to bypass detection.

Answer

Data Loss Prevention (DLP) policies

Answer

Anti-Virus scanning engine

Answer

Encryption policies

Question 10

An engineer is deploying Cisco ISE for guest access. The guest portal uses a self-provisioned username and password. To ensure secure credential transmission, which protocol should be enforced on the portal?

Accepted Answer

HTTPS with a valid certificate. HTTPS with a valid certificate ensures that the username and password submitted by the guest are encrypted in transit between the browser and the Cisco ISE portal. This prevents man-in-the-middle attacks and credential sniffing, which is critical for a self-provisioned guest portal where users create their own credentials over an untrusted network.

Answer

DNSSEC

Answer

RADIUS over TLS

Answer

HTTP with redirect to captive portal

Question 11

An administrator reviewed the log entry from the Cisco ESA exhibit. The DLP policy is set to 'Continue (with disclaimer)' for credit card matches. How should the policy be changed to prevent this data leakage?

Accepted Answer

Change the DLP policy action from 'Continue' to 'Drop'.. The current DLP policy action 'Continue (with disclaimer)' allows the email to be delivered after appending a disclaimer, which does not prevent data leakage. Changing the action to 'Drop' will block the email entirely, preventing the credit card data from leaving the organization. This directly addresses the requirement to stop the data leakage.

Answer

Remove the DLP policy assignment for the Finance mail flow.

Answer

Lower the DLP sensitivity threshold.

Answer

Enable TLS encryption on the policy.

Question 12

An ASA firewall is configured as shown. A web server is behind the ASA with IP 10.1.1.100. Which additional configuration is required to allow HTTPS traffic from the internet to the web server?

Accepted Answer

Configure static NAT for the web server. The ASA firewall requires static NAT to translate the public IP address (typically the ASA's outside interface IP or a dedicated public IP) to the private IP address of the web server (10.1.1.100). Without static NAT, the ASA will not perform the necessary destination address translation for inbound HTTPS traffic, and the web server's private IP is not routable on the internet.

Answer

Add a route to the web server's subnet

Answer

Increase the security level of the inside interface

Answer

Apply the access-group to the inside interface

Question 13

In a Cisco TrustSec deployment, you want to dynamically assign SGTs based on user authentication. Which mechanism should you use?

Accepted Answer

CTS identity-based networking (IBNS) with RADIUS CoA. Cisco TrustSec uses IBNS (Identity-Based Networking Services) with 802.1X or MAB authentication to identify users, and the RADIUS server (ISE) returns the SGT as a RADIUS attribute (cisco-av-pair) in the Access-Accept. When a user's authorization changes, RADIUS Change of Authorization (CoA, RFC 5176) dynamically pushes a new SGT to the switch port without requiring re-authentication. This is the only mechanism listed that ties user authentication directly to dynamic SGT assignment.

Answer

CTS SXP

Answer

CTS RBACL

Answer

CTS device classification

Question 14

In the shared responsibility model for PaaS, which component is the customer responsible for managing?

Accepted Answer

Data and applications. In the PaaS shared responsibility model, the cloud provider manages the underlying infrastructure — network, servers, hypervisor, and the runtime/OS — while the customer is responsible for their data and the applications they deploy on top of the platform. This is the defining characteristic of PaaS: the customer focuses on code and data, not infrastructure.

Answer

Network infrastructure

Answer

Hypervisor

Answer

Operating system

Question 15

Which TWO statements about Cisco Umbrella SIG are true?

Accepted Answer

It can enforce URL filtering policies via a cloud proxy. Option B is correct because Cisco Umbrella SIG (Secure Internet Gateway) includes a cloud-delivered secure web gateway that can enforce URL filtering policies through its cloud proxy, inspecting and allowing or blocking web requests based on policy. Option C is correct because Umbrella's foundational capability is a recursive DNS resolver that blocks requests to malicious or unwanted domains at the DNS layer before a connection is established. Option A is wrong because Umbrella protects traffic regardless of VPN, including direct internet-bound traffic from any location. Option D is wrong because Umbrella is a cloud-native service requiring no on-premises hardware. Option E is wrong because Umbrella provides extensive reporting and analytics through its dashboard.

Answer

It only protects traffic that goes through a VPN

Answer

It requires on-premises hardware for deployment

Answer

It does not provide reporting or analytics