350-701 Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?

Accepted Answer

Change global_sensitivity to medium. The http_inspect preprocessor's global_sensitivity setting controls how aggressively it normalizes HTTP traffic before analysis. Setting it to 'medium' reduces false positives from legitimate HTTP floods by relaxing the threshold for anomalous HTTP behavior, while still allowing the preprocessor to detect real attacks that exhibit more extreme deviations. This is the most targeted change because it directly addresses the flood of HTTP traffic without disabling the preprocessor entirely.

Answer

Disable the http_inspect preprocessor

Answer

Change frag3 policy to bsd

Answer

Change stream5_tcp policy to linux

Question 2

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Accepted Answer

The DHCP snooping database is not updated because interface Gi0/1 is not trusted. The host cannot ping its default gateway because DHCP Snooping marks interface Gi0/1 as untrusted by default. Since the DHCP server is connected to Gi0/1, the switch drops DHCP replies from that interface, preventing the DHCP snooping binding database from being updated with the host's IP address. Without a valid binding, IP Source Guard on Gi0/0 drops all IP traffic from the host, including pings to the gateway.

Answer

The static IP source binding is configured on the wrong VLAN

Answer

ARP inspection is not enabled, so the switch drops ARP replies

Answer

The 'ip verify source' command is missing the 'port-security' keyword

Question 3

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. Option A is correct because 'Never trust, always verify' is the foundational principle of the Cisco Zero Trust security model, which mandates that no user, device, or network segment is trusted by default, regardless of its location relative to the network perimeter. This principle eliminates implicit trust and requires authentication and authorization for every access request, aligning with the Zero Trust architecture defined in NIST SP 800-207.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 4

A security architect is designing a zero-trust architecture for a remote workforce using Cisco SD-WAN. The company requires that all traffic between branch sites and the data center is encrypted and authenticated, and that no device can access resources unless it has a valid certificate. Which technology should be used to enforce device identity?

Accepted Answer

Cisco TrustSec. Cisco TrustSec uses Security Group Tags (SGTs) and device identity based on certificates to enforce access control in a zero-trust architecture. It integrates with SD-WAN to ensure that only devices with valid certificates can communicate, meeting the requirement for encrypted and authenticated traffic between branch sites and the data center.

Answer

802.1X with EAP-TLS

Answer

Network Access Control (NAC)

Answer

IPsec VPN

Question 5

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Accepted Answer

RADIUS. Cisco AnyConnect VPN authentication can be performed using RADIUS, which is a widely supported AAA protocol. RADIUS enables centralized authentication, authorization, and accounting for VPN users, and it is natively integrated with Cisco ASA and Firepower Threat Defense (FTD) appliances for remote access VPNs.

Answer

TACACS+

Answer

OSPF

Answer

SNMP

Question 6

A network security engineer is deploying Cisco Firepower Threat Defense (FTD) in a data center. The requirement is to inspect traffic between two internal VLANs while allowing the firewall to enforce access control policies based on source and destination zones. Which deployment mode should the engineer use?

Accepted Answer

Transparent mode. Transparent mode (Layer 2 mode) is correct because the requirement specifies inspecting traffic between two internal VLANs without routing. In transparent mode, the FTD acts as a bridge, forwarding frames based on MAC addresses while enforcing access control policies based on source and destination zones. This allows the firewall to inspect inter-VLAN traffic without requiring IP address changes or acting as a default gateway.

Answer

Routed mode

Answer

Inline mode

Answer

Hybrid mode

Question 7

An engineer is configuring Cisco Firepower Threat Defense (FTD) with a pre-filter policy to block traffic from known malicious IP addresses before it reaches the access control policy. The pre-filter rules are configured to block traffic from the malicious IPs. However, the engineer notices that some traffic from those IPs is still being allowed. What is the most likely reason?

Accepted Answer

A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it. Pre-filter rules are evaluated in order of priority (lower numbers first). If a rule with a higher priority number (lower priority) is configured to allow traffic, it will be matched before a lower-numbered (higher priority) block rule if the allow rule appears earlier in the sequence. This causes the traffic to be permitted before reaching the intended block rule, which is why some malicious IP traffic is still allowed.

Answer

The pre-filter rules are configured with the wrong source interface

Answer

The access control policy is overriding the pre-filter policy

Answer

The default action for the pre-filter policy is set to 'Allow'

Question 8

A security engineer is implementing Cisco Identity Services Engine (ISE) for 802.1X authentication. The requirement is to allow full network access for corporate devices that pass posture assessment, while providing limited access for guest devices. The engineer configures an authorization policy with conditions based on identity group and posture status. However, guest devices are still getting full access. What is the most likely cause?

Accepted Answer

The authorization rule for corporate devices is placed above the guest rule, and guest devices are matching the corporate rule first. Cisco ISE authorization policies are evaluated in top-down order, and the first matching rule is applied. If the corporate device rule is placed above the guest rule, guest devices that do not meet the posture condition may still match the corporate rule if the condition is not restrictive enough (e.g., if the identity group condition is broad or the posture check is not enforced as a required match). This results in guest devices receiving full access instead of the intended limited access.

Answer

The guest devices are not passing the certificate validation

Answer

MAC Authentication Bypass (MAB) is not enabled for the guest devices

Answer

The RADIUS attributes for dACL are not being sent correctly

Question 9

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

Accepted Answer

The traffic from 10.1.1.100 is entering through a different interface. Option D is correct because ACLs process traffic only on the interface and direction to which they are applied. If the ACL is applied inbound on GigabitEthernet0/0 but the traffic from host 10.1.1.100 to 192.168.1.1 enters through a different interface (e.g., GigabitEthernet0/1), the ACL will never evaluate that traffic, allowing it to pass. This is a fundamental behavior of interface-based ACL filtering in Cisco IOS.

Answer

The deny entry should be placed after the permit entry

Answer

The ACL should be applied outbound instead of inbound

Answer

The ACL is applied to the wrong direction; it should be 'out'

Question 10

A company wants to deploy a site-to-site VPN between two branch offices using Cisco IOS routers. The security policy requires that all traffic between the sites must be encrypted and authenticated using strong encryption. The engineer chooses IPsec with IKEv2. Which IPsec transform set configuration provides the strongest encryption and authentication?

Accepted Answer

transform-set ESP-AES256 ESP-SHA256-HMAC. Option B is correct because it specifies AES-256 encryption, which is the strongest symmetric cipher available in IPsec transform sets, combined with ESP-SHA256-HMAC for integrity and authentication. IKEv2 supports these modern algorithms, and this configuration meets the requirement for strong encryption and authentication.

Answer

transform-set ESP-AES128 ESP-SHA-HMAC

Answer

transform-set ESP-DES ESP-MD5-HMAC

Answer

transform-set ESP-3DES ESP-SHA-HMAC

Question 11

A company is deploying Cisco Web Security Appliance (WSA) to enforce acceptable use policies. Users report that some legitimate websites are being blocked incorrectly. The security team wants to allow these sites while still blocking known malware sites. Which action should the administrator take?

Accepted Answer

Create a custom URL filtering policy to allow the specific URLs.. Option A is correct because the Cisco WSA uses URL filtering policies to control access based on URL categories and individual URLs. By creating a custom URL filtering policy that allows the specific URLs, the administrator can whitelist legitimate sites while the WSA continues to block known malware sites through its reputation-based and category-based filtering. This approach maintains security enforcement without disabling broader protections.

Answer

Disable HTTPS decryption to bypass filtering for encrypted sites.

Answer

Enable Data Loss Prevention (DLP) to allow the sites.

Answer

Increase the HTTPS decryption depth to inspect more content.

Question 12

A network administrator is troubleshooting an issue where users cannot send emails with attachments larger than 10 MB through the Cisco Email Security Appliance (ESA). The ESA is configured with a mail flow policy that has a maximum message size of 20 MB. What is the most likely cause of the issue?

Accepted Answer

The ESA default maximum attachment size is 10 MB.. The Cisco ESA has a built-in default maximum attachment size of 10 MB, which is separate from the mail flow policy's maximum message size. Even though the mail flow policy allows messages up to 20 MB, the attachment size limit is enforced by the ESA's default configuration, which caps individual attachments at 10 MB. This default can be overridden in the mail flow policy or system settings, but if not explicitly changed, it remains the limiting factor.

Answer

The mail flow policy maximum message size is set too low.

Answer

The HAT (Host Access Table) maximum message size is set to 10 MB.

Answer

The outgoing mail policy has a smaller attachment size limit.

Question 13

A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:

1. Allow from any to any (for testing, but currently enabled)
2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443)
3. Block from guest wireless to data center
4. Allow from any to internet (destination any)

Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?

Accepted Answer

Move rule 3 (block guest to data center) above rule 1 (allow all). Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.

Answer

Modify rule 2 to include a deny for the guest subnet

Answer

Change rule 4 to block all traffic from guest network

Answer

Add a new rule after rule 4 to block the specific traffic

Question 14

A company is deploying a cloud-native application using microservices on AWS. They need to ensure that inter-service communication is encrypted and authenticated. The security team wants to use mutual TLS (mTLS) without managing individual certificates. Which solution should they implement?

Accepted Answer

Use AWS Certificate Manager Private CA with a service mesh (e.g., Istio) to issue and rotate certificates for each service.. Option D is correct because AWS Certificate Manager Private CA can integrate with a service mesh like Istio to automatically issue, distribute, and rotate mTLS certificates for each microservice. This eliminates the need for manual certificate management while ensuring encrypted and authenticated inter-service communication via mutual TLS.

Answer

Use AWS IAM roles for each microservice to authenticate via AWS Signature Version 4.

Answer

Store certificates in AWS Secrets Manager and configure sidecar proxies to retrieve them.

Answer

Deploy AWS CloudHSM to generate keys and certificates for each microservice.

Question 15

A company is implementing a cloud security posture management (CSPM) solution. Which TWO of the following are primary functions of CSPM?

Accepted Answer

Detection and remediation of cloud resource misconfigurations (e.g., open S3 buckets).. CSPM is designed to detect and remediate cloud resource misconfigurations, such as publicly accessible S3 buckets, which are a leading cause of data breaches. It continuously assesses cloud infrastructure against security best practices and compliance frameworks like CIS and PCI DSS. Unlike network-based tools, CSPM focuses on the configuration state of cloud resources rather than inspecting traffic or managing identities.

Answer

Real-time inspection of network traffic for malicious patterns.

Answer

Vulnerability scanning of virtual machine operating systems.

Answer

Managing user identities and access permissions.

350-701 Practice Test 13 — 15 Questions

Exhibit

350-701 Practice Test 13 — 15 Questions

Exhibit