350-701 Practice Test 15 — 15 Questions

Question 1

Which type of VPN on Cisco ASA is typically used for site-to-site connectivity and encrypts all traffic between two sites?

Accepted Answer

IKEv2 IPsec site-to-site VPN. An IKEv2 IPsec site-to-site VPN on Cisco ASA is specifically designed for connecting two sites and encrypting all traffic between them. It uses IKEv2 for key exchange and IPsec for encryption, providing a secure tunnel for site-to-site connectivity. The other options are either client-based or not typically used for site-to-site.

Answer

L2TP VPN

Answer

DTLS VPN

Answer

SSL VPN

Question 2

Which Cisco Firepower management option allows direct device management without a separate server, using a web interface on the FTD itself?

Accepted Answer

FDM. FDM (Firepower Device Manager) is the on-box management solution for FTD, running directly on the device.

Answer

ASDM

Answer

CLI

Answer

FMC

Question 3

A company deploys a Cisco ASAv in AWS for VPN termination. They need to enforce multi-factor authentication (MFA) for remote access VPN users. Which Cisco solution integrates with ASAv to provide MFA?

Accepted Answer

Cisco Duo. Cisco Duo is the correct solution because it is a cloud-based MFA platform that integrates directly with the Cisco ASAv via the AnyConnect VPN client or the ASA's authentication proxy. Duo acts as a RADIUS or LDAP proxy, intercepting authentication requests and prompting users for a second factor (e.g., push notification, OTP) after primary credentials are validated. This provides the required multi-factor authentication for remote access VPN users without requiring additional on-premises infrastructure.

Answer

Cisco Umbrella

Answer

Cisco ISE

Answer

Cisco Cloudlock

Question 4

An administrator configures a Cisco ASA with a DMZ interface at security level 50. Traffic from the inside (level 100) to the DMZ (level 50) is allowed by default. What additional configuration is needed to allow traffic from the DMZ to the inside?

Accepted Answer

An ACL applied to the DMZ interface permitting traffic to inside.. On a Cisco ASA, security levels determine default traffic flow: traffic from a higher security level to a lower security level is permitted by default, while traffic from a lower security level to a higher security level is denied by default. To allow traffic from the DMZ (level 50) to the inside (level 100), an ACL must be applied to the DMZ interface permitting that traffic. This is the standard ASA configuration pattern for permitting lower-to-higher security level flows.

Answer

A NAT rule is required.

Answer

An ACL applied to the inside interface permitting traffic from DMZ.

Answer

No additional configuration; it is allowed by default.

Question 5

A small business uses Cisco Umbrella to protect its 50 employees. One employee reports that they cannot access a specific website (www.example.com) that is required for their work. The administrator checks the Umbrella dashboard and sees that the domain is categorized as 'Social Networking' and is blocked by the company's policy. However, the employee argues that the website is actually a business tool. The administrator verifies that the website is indeed legitimate. What is the best course of action to restore access while maintaining security?

Accepted Answer

Create a policy override to allow the specific domain while keeping the category blocked.. Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

Answer

Contact Cisco Umbrella support to re-categorize the domain.

Answer

Disable the 'Social Networking' category blocking policy.

Answer

Remove the user from the Umbrella policy entirely.

Question 6

An organization needs to inspect traffic between two internal zones (e.g., HR and IT) on a Cisco FTD. Which deployment mode is appropriate?

Accepted Answer

Inline mode with an access control policy. Inline mode on a Cisco FTD places the device directly in the traffic path between two internal zones, allowing it to inspect and block traffic based on an access control policy. This is the appropriate deployment mode when the requirement is to inspect traffic between internal zones such as HR and IT. Inline mode supports access control, intrusion prevention, and malware inspection, making it the correct choice for enforcing security policy between internal segments.

Answer

Switchport mode

Answer

Routed mode without any policy

Answer

Passive mode with an intrusion policy

Question 7

A company is deploying Cisco AnyConnect SSL VPN and wants to enforce different access policies based on the endpoint's antivirus status. Which feature should be used?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policy (DAP) on Cisco ASA and FTD allows administrators to define granular access policies that are evaluated at connection time based on endpoint attributes such as antivirus status, OS version, registry keys, and posture assessment results. DAP records can match on these attributes and apply different permissions, ACLs, or restrictions per user session. This makes DAP the correct feature for enforcing access policies based on endpoint antivirus status in an AnyConnect SSL VPN deployment.

Answer

Group Policy

Answer

Split Tunneling

Answer

Network Access Control (NAC)

Question 8

Which Cisco FTD feature provides application visibility and control (AVC) to identify and block applications like Facebook or Skype?

Accepted Answer

Access control policy with application conditions. Application visibility and control (AVC) on Cisco FTD is delivered through the Access Control Policy using application conditions, which leverage Snort-based Layer 7 inspection and Cisco's application detectors to identify and block applications such as Facebook or Skype regardless of port or IP. URL filtering only sees URLs, not application behavior.

Answer

URL filtering policy

Answer

Intrusion policy

Answer

SSL decryption policy

Question 9

An organization uses Cisco ISE for guest access. They want to allow guests to create their own accounts through a web portal while requiring approval from a sponsor before network access is granted. Which guest access method should be configured?

Accepted Answer

Self-registration with sponsor approval. Self-registration with sponsor approval allows guests to create accounts, but access is only granted after a sponsor approves the request. This is a common guest access scenario in ISE.

Answer

Hotspot guest access

Answer

Self-registration without approval

Answer

Sponsor portal

Question 10

An engineer observes that the Cisco ASA connection table shows a consistent number of entries for UDP traffic, but the xlate table shows no entries. What is the most likely reason?

Accepted Answer

NAT is not configured for this traffic. On a Cisco ASA, the connection table tracks all active flows (TCP, UDP, ICMP), while the xlate (translation) table only has entries when NAT is configured for that traffic. If UDP connections appear but no xlate entries exist, the most likely explanation is that no NAT rule applies to that traffic — the ASA is forwarding it without translation, so no xlate is created. This is consistent behavior: connection entries are created for stateful inspection regardless of NAT, but xlate entries require a NAT configuration.

Answer

The traffic is being dropped by ACLs

Answer

The ASA is in transparent mode

Answer

UDP traffic does not create connections

Question 11

A security engineer is configuring a Cisco Firepower NGFW to detect and block a new malware variant that communicates with a command-and-control server using encrypted DNS queries. Which Cisco security product is best suited to provide visibility into this malicious DNS traffic?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security service that can block malicious domains and provide visibility into DNS queries.

Answer

Cisco ASA

Answer

Cisco AMP

Answer

Cisco Stealthwatch

Question 12

An organization requires that endpoints must have antivirus running and up-to-date patches before being granted full network access. Cisco ISE is used for authentication. Which ISE component enforces these requirements?

Accepted Answer

Posture assessment. C is correct because Cisco ISE Posture Assessment is the component specifically designed to check endpoints for compliance with security policies, such as having antivirus running and up-to-date patches. It evaluates the endpoint's state before granting full network access, and can enforce remediation or restrict access based on the results.

Answer

Guest access

Answer

TrustSec

Answer

Profiling

Question 13

A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:

1. Allow from any to any (for testing, but currently enabled)
2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443)
3. Block from guest wireless to data center
4. Allow from any to internet (destination any)

Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?

Accepted Answer

Move rule 3 (block guest to data center) above rule 1 (allow all). Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.

Answer

Modify rule 2 to include a deny for the guest subnet

Answer

Change rule 4 to block all traffic from guest network

Answer

Add a new rule after rule 4 to block the specific traffic

Question 14

A security engineer is configuring Cisco Umbrella to block malicious domains. They need to ensure that internal DNS queries from remote users using Cisco AnyConnect are protected. Which deployment method should they use?

Accepted Answer

Install the Umbrella Roaming Client on all endpoints. The Umbrella Roaming Client (now part of Cisco Secure Client) is the correct deployment method because it provides DNS-layer security directly on endpoints, including remote users connecting via AnyConnect. It intercepts DNS queries on the local machine and forwards them to Umbrella's cloud-based DNS resolvers, ensuring protection even when the user is off-network or behind a VPN. This is the only option that covers remote users without relying on network-level appliances or firewalls.

Answer

Configure DNS Layer Security in the office firewall

Answer

Enable Cisco Cloudlock integration

Answer

Deploy the Umbrella virtual appliance at headquarters

Question 15

A security team is implementing DevSecOps practices. Which TWO actions should be taken to secure secrets (e.g., API keys, passwords) in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault. Option C is correct because a dedicated secrets management tool such as HashiCorp Vault centralizes storage, enforces access control, and can dynamically issue short-lived credentials, so API keys and passwords are never embedded in code or pipeline files. Option D is correct because scanning repositories with tools like git-secrets detects accidentally committed credentials early in the CI/CD pipeline, allowing them to be revoked and rotated before they are exploited. Option A is wrong because email is an unencrypted, unauditable channel that exposes secrets to unintended recipients and violates least-privilege handling. Option B is wrong because hardcoding secrets in source code permanently exposes them to anyone with repository access and to history scraping. Option E is wrong because environment variables in pipeline configuration are often stored in plaintext, visible in logs or job definitions, and lack the rotation, auditing, and fine-grained access control that a proper secrets manager provides.

Answer

Share secrets via email to team members

Answer

Hardcode secrets in the source code with comments to remind developers

Answer

Store secrets in environment variables in the pipeline configuration