350-701 Practice Test 13 — 15 Questions

Question 1

A security team is implementing AWS WAF to protect a web application. They want to block requests that contain SQL injection patterns in the query string. Which AWS WAF component should be used?

Accepted Answer

Managed rule group for SQL injection. AWS WAF uses managed rule groups (e.g., the SQL injection rule group) to detect common attack patterns. Custom rules can also be written but the easiest is to use the managed rule group. NACLs and security groups operate at network level, not application layer.

Answer

Security group allowing only HTTPS

Answer

Network ACL with deny rule for port 80

Answer

Custom rule matching on source IP

Question 2

In the shared responsibility model for cloud computing, which responsibility is managed by the customer in all service models (IaaS, PaaS, SaaS)?

Accepted Answer

Data and access management. In all cloud service models, the customer is always responsible for their own data and access management, including who has access to the data and how it is protected.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor patching

Question 3

A company is moving its on-premises applications to AWS EC2 instances. According to the shared responsibility model, which of the following is the customer's responsibility?

Accepted Answer

Patching the guest operating system. In IaaS, the cloud provider manages the physical infrastructure (hosts, network, hypervisor), while the customer is responsible for securing the guest OS, applications, and data. Patching the OS is a customer responsibility.

Answer

Hypervisor security

Answer

Network infrastructure hardening

Answer

Physical security of the data center

Question 4

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

Accepted Answer

CWPP. CWPP (Cloud Workload Protection Platform) provides security for workloads across clouds.

Answer

CSPM

Answer

CASB

Answer

SIG

Question 5

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

Accepted Answer

CASB. CASB solutions can inspect data in transit and at rest within SaaS applications to enforce DLP policies.

Answer

Cisco Umbrella

Answer

CSPM

Answer

CWPP

Question 6

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center (now Defender for Cloud) provides CSPM capabilities including continuous assessment and secure score. Azure Policy enforces compliance rules. Azure AD is identity, WAF is application protection, and Monitor is monitoring.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 7

An administrator configures Cisco Email Security Appliance (ESA) with an outbreak filter to handle a new ransomware variant. The outbreak filter is set to 'Quarantine' for messages with a threat score above 70. After deployment, some legitimate emails with a threat score of 75 are quarantined. The administrator wants to reduce false positives without compromising security. Which configuration change should be made?

Accepted Answer

Configure the outbreak filter to 'Analyze' instead of 'Quarantine' for scores between 70 and 80.. It allows the administrator to apply a graduated response: messages with threat scores between 70 and 80 are analyzed (e.g., delivered with a warning or delayed) rather than quarantined, reducing false positives while still providing security. The outbreak filter in Cisco ESA supports multiple actions per score range, enabling a tiered policy that avoids an all-or-nothing approach. This maintains protection against truly high-risk messages (score >80) while sparing borderline legitimate traffic.

Answer

Disable the outbreak filter temporarily to allow all emails.

Answer

Increase the threat score threshold to 80 or higher.

Answer

Create a content filter to bypass outbreak filtering for known good senders.

Question 8

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management

Question 9

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 10

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

Accepted Answer

CoA (Change of Authorization). Change of Authorization (CoA) allows ISE to send real-time authorization changes (e.g., VLAN change) to the NAD using RADIUS Disconnect or Change of Authorization messages, without requiring the client to reauthenticate.

Answer

TrustSec SGT assignment

Answer

RADIUS Accounting

Answer

MAB

Question 11

An organization is implementing privileged access management (PAM) with Cisco SecureX and CyberArk. Which feature allows administrators to grant temporary elevated privileges for a specific task, after which the privileges are automatically revoked?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Application whitelisting

Answer

Password vaulting

Question 12

In Cisco AMP for Endpoints, which technology prevents exploit techniques such as code injection and memory corruption at runtime without relying on signatures?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP uses exploit mitigation techniques like memory protection and injection detection to block common exploit methods (e.g., buffer overflows, DLL injection) without needing signatures.

Answer

Indicators of Compromise (IOC)

Answer

File Reputation

Answer

Orbital Advanced Search

Question 13

Which component in the 802.1X architecture is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (e.g., switch or wireless LAN controller) acts as a proxy, forwarding EAP messages between the supplicant (client) and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication Server

Answer

Policy Service Node

Question 14

In Cisco ISE, profiling is used to identify device types. Which probe must be enabled for ISE to determine the operating system of a device by analyzing DHCP options?

Accepted Answer

DHCP Probe. DHCP Probe analyzes DHCP packet options (e.g., option 55) to identify the device's OS or vendor class, enabling ISE to profile the device type.

Answer

Device Sensor

Answer

HTTP Probe

Answer

SNMP Probe

Question 15

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Accepted Answer

List revoked certificates. CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.

Answer

Store private keys

Answer

Validate certificate signatures

Answer

Generate new certificates