350-701 Practice Test 14 — 15 Questions

Question 1

A company is using Cisco WSA with explicit proxy mode. The security team wants to enforce HTTPS inspection for all web traffic from the finance department to detect malicious content in encrypted connections. However, they want to exclude traffic to financial institutions' websites due to compliance reasons. Which configuration approach should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a policy for the finance department with HTTPS inspection enabled and add a bypass rule for the Financial Services URL category.. In Cisco WSA explicit proxy mode, HTTPS inspection is controlled per-identity/group via access policies, and exclusions are handled with bypass rules or URL category exceptions. Creating a policy that applies to the finance department with HTTPS decryption enabled, then adding a bypass for the Financial Services URL category, satisfies both the inspection mandate and the compliance carve-out. This is the standard WSA configuration pattern for selective SSL decryption.

Answer

Disable HTTPS inspection globally and enable it only for the finance department using a custom policy.

Answer

Configure SSL/TLS decryption on the firewall instead of the WSA.

Answer

Use transparent proxy mode with WCCP redirect to bypass inspection for financial sites.

Question 2

In Cisco ISE, profiling is used to identify device types. Which probe must be enabled for ISE to determine the operating system of a device by analyzing DHCP options?

Accepted Answer

DHCP Probe. DHCP Probe analyzes DHCP packet options (e.g., option 55) to identify the device's OS or vendor class, enabling ISE to profile the device type.

Answer

Device Sensor

Answer

HTTP Probe

Answer

SNMP Probe

Question 3

A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.

Answer

Cisco ISE

Answer

Cisco Firepower

Answer

Cisco ASA

Question 4

Which TWO Cisco solutions provide virtual firewall capabilities in public cloud environments? (Choose two.)

Accepted Answer

Cisco ASAv. Cisco ASAv (option A) is a virtualized version of the ASA firewall image that can be deployed as an EC2 instance in AWS, Azure, or other public clouds, providing stateful firewall, VPN, and IPS capabilities in a virtual form factor. Cisco Firepower Threat Defense (FTD) for AWS (option D) is the virtual FTD appliance offered in the AWS Marketplace, delivering NGFW, IPS, and URL filtering as a cloud-deployed virtual firewall. Cisco DNA Center (option B) is a network controller and assurance platform for campus/enterprise fabrics, not a firewall. Cisco Umbrella (option C) is a cloud-delivered DNS-layer security and secure web gateway service, not a virtual firewall appliance. Cisco ISE (option E) is an identity and access-control (NAC/RADIUS) policy server, not a firewall.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 5

A security engineer is configuring Cisco Umbrella to block HTTPS traffic to malicious sites. However, they want to inspect SSL-encrypted traffic selectively to avoid breaking applications. Which Umbrella feature should they use?

Accepted Answer

Intelligent Proxy. Cisco Umbrella's Intelligent Proxy is the selective SSL inspection feature designed to decrypt and inspect only the traffic that matters — specifically, it performs selective proxy of HTTP/HTTPS requests to domains that are not yet categorized or that are suspected malicious, while allowing known-good traffic to bypass inspection. This avoids the performance and application-breaking issues caused by full TLS interception. It works in tandem with DNS-layer security, which blocks most threats before a connection is even made.

Answer

DNS-layer security

Answer

Umbrella Roaming Client

Answer

Secure Internet Gateway (SIG)

Question 6

A security team is implementing secure access for remote users connecting from untrusted networks. They want to enforce DNS-layer security even when users are off the corporate network. Which Cisco Umbrella feature should be deployed on the endpoints?

Accepted Answer

Umbrella Roaming Client. The Umbrella Roaming Client is a lightweight endpoint agent that enforces DNS-layer security on devices even when they are off the corporate network, forwarding DNS queries to Umbrella's global network for policy enforcement. This directly addresses the requirement to protect remote users on untrusted networks at the DNS layer.

Answer

Secure Internet Gateway (SIG)

Answer

Intelligent Proxy

Answer

Virtual Appliance

Question 7

A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?

Accepted Answer

The proxy target rules in ISE do not match the WLC's NAS-IP-Address. The error 'Internal error - unable to find a suitable proxy target' indicates that ISE could not match the incoming RADIUS request to a configured proxy target rule. Proxy target rules are based on attributes like NAS-IP-Address, and if the WLC's NAS-IP-Address does not match any rule, ISE cannot forward the request to the correct authentication node. Thus, the most likely cause is that the proxy target rules do not match the WLC's NAS-IP-Address.

Answer

The WLC is not configured to use the ISE proxy nodes as RADIUS servers

Answer

The RADIUS shared secret is mismatched between WLC and ISE

Answer

ISE node CPU is overloaded due to high authentication load

Question 8

An engineer is configuring a Cisco ASA and needs to ensure that traffic from the outside interface to a web server on the DMZ is allowed. The inside interface is security level 100 and the DMZ is level 50. The outside interface is level 0. Which statement about the default traffic flow is true?

Accepted Answer

Traffic from outside to DMZ is denied implicitly because outside level is lower than DMZ level.. Cisco ASA assigns security levels 0-100, and the default implicit rule permits traffic from a higher security level to a lower one while denying traffic from a lower level to a higher level. The outside interface (level 0) is lower than the DMZ (level 50), so traffic from outside to DMZ is implicitly denied. Any permitted outside-to-DMZ traffic must be explicitly allowed via an ACL.

Answer

Traffic from outside to DMZ is allowed implicitly because the ASA inspects all interfaces equally.

Answer

Traffic from outside to DMZ is allowed implicitly because outside is level 0 and DMZ is level 50.

Answer

Traffic from outside to DMZ is allowed implicitly because both are lower than inside.

Question 9

A company is moving workloads to Google Cloud and needs private connectivity between its on-premises data center and VPC without traversing the internet. Which service should be used?

Accepted Answer

Google Cloud Dedicated Interconnect. Google Cloud Dedicated Interconnect provides direct private physical connections between on-premises and GCP VPCs.

Answer

Azure ExpressRoute

Answer

AWS Direct Connect

Answer

Cloud VPN

Question 10

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

Answer

The Policy editor with file blacklist

Answer

TETRA traffic analysis

Answer

The AMP Dashboard with event filters

Question 11

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

Accepted Answer

The new device is not authenticated and remains unauthorized. When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.

Answer

The new device is allowed to pass traffic due to fallback

Answer

The switch sends a CoA to ISE to free up a session

Answer

The port is automatically shut down

Question 12

Which THREE are key components of Cisco's Cloud Security architecture? (Choose three.)

Accepted Answer

Cisco Duo. Cisco Duo (A) is a core component of Cisco's Cloud Security architecture because it delivers zero-trust identity and multi-factor authentication (MFA) with device trust for cloud and SaaS access, verifying users before granting application access. Cisco Secure Firewall (virtual) (C) is correct because virtualized NGFW instances (e.g., Secure Firewall Threat Defense Virtual) provide consistent policy enforcement, IPS, and URL filtering for workloads and traffic in public clouds and hybrid environments. Cisco Secure Cloud Analytics, formerly Stealthwatch Cloud (E), is correct because it provides cloud-native network traffic visibility, behavioral analytics, and threat detection across AWS, Azure, GCP, and on-premises, which is central to Cisco's cloud security portfolio. The unmarked options do not belong: Cisco Catalyst switches (B) and Cisco Meraki access points (D) are campus/branch networking hardware, not cloud security architecture components, even though Meraki offers some security features.

Answer

Cisco Catalyst switches

Answer

Cisco Meraki access points

Question 13

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They need to create an access control policy that allows traffic from specific source IPs to a web server, but blocks all other traffic. How should the rule base be ordered?

Accepted Answer

Place the permit rule first, then the block rule.. Cisco FTD access control policies evaluate rules top-down, first-match. The permit rule for specific source IPs must appear before the block rule so that matching traffic is allowed; the subsequent block rule then catches all remaining traffic. If the block rule were first, it would match all traffic (including the intended permitted sources) and drop it, making the permit rule unreachable.

Answer

Place the block rule first, then the permit rule.

Answer

Use a single rule with permit and block conditions combined.

Answer

Order does not matter because FMC processes rules in parallel.

Question 14

A company uses Cisco Firepower with FMC and wants to block access to social media websites for all users. Which feature should be used to create this policy?

Accepted Answer

URL Filtering. URL Filtering in Cisco Firepower (FMC) is the feature designed to categorize and control access to websites based on URL category, including social media. It uses Cisco Talos URL categories and can be applied within an access control policy to block or allow categories. This directly satisfies the requirement to block social media for all users.

Answer

File Policy

Answer

Intrusion Policy

Answer

Application Visibility and Control (AVC)

Question 15

A security engineer is tuning Snort rules on a Cisco FTD to reduce false positives. Which action should be taken if a rule is generating alerts for legitimate traffic?

Accepted Answer

Disable the rule or set it to 'noalert'.. When a Snort rule on Cisco FTD generates alerts for legitimate traffic (false positives), the correct tuning action is to disable the rule or change its action to 'noalert' so it stops generating alerts without blocking legitimate traffic. This preserves visibility into the rule's behavior while eliminating the noise. Changing the action to 'reject' would actively block legitimate traffic, which is the opposite of what's needed.

Answer

Change the rule action to 'reject'.

Answer

Increase the priority of the rule.

Answer

Add the rule to a custom policy with higher precedence.