350-701 Practice Test 15 — 15 Questions

Question 1

Which security model mandates that access decisions should be based on context, device posture, and user identity, and never trust any entity by default?

Accepted Answer

Zero Trust. Zero Trust architecture requires continuous verification and least privilege access, never trusting any user or device automatically.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 2

Which THREE attributes can be used in an ISE authorization policy based on endpoint identity?

Accepted Answer

Certificate subject DN. Options A, B, and E are correct because endpoint identity attributes include the device's MAC address, its certificate subject DN (from certificates), and its Active Directory user group membership. Option C is incorrect because time of day is an environmental attribute, not an endpoint identity attribute. Option D is incorrect because switch IP address is a network location attribute, not endpoint identity.

Answer

Time of day

Answer

Switch IP address

Question 3

A security engineer is configuring Cisco ISE to enforce SGT-based access control. The engineer creates an SGACL on the switch that permits traffic from SGT 10 to SGT 20. However, traffic from SGT 10 to SGT 20 is still being dropped. The engineer verifies that the SGTs are correctly assigned. What is a possible reason for the drop?

Accepted Answer

There is a deny SGACL with a higher priority that matches the traffic. Cisco ISE enforces SGT-based access control using Security Group ACLs (SGACLs) that are evaluated in priority order. Even if a permit SGACL exists for SGT 10 to SGT 20, a deny SGACL with a higher priority (lower sequence number) that matches the same traffic will take precedence and cause the traffic to be dropped. The engineer must check the full SGACL list and their sequence numbers on the switch to identify conflicting rules.

Answer

SXP is not configured

Answer

The CTRL protocol is not enabled

Answer

The PAC on the switch is expired

Question 4

An administrator is troubleshooting authentication failures for VPN users. The RADIUS server is reachable via ping, but users receive 'AAA authentication failed'. Which command should be used to test communication with the RADIUS server?

Accepted Answer

test aaa group radius user password. The 'test aaa group radius user password' command is specifically designed to simulate an authentication attempt against a RADIUS server, allowing the administrator to verify whether the RADIUS server is properly processing credentials. Since the RADIUS server is reachable via ping but users still fail, this command isolates whether the issue lies in the AAA authentication process itself, such as incorrect shared secret, user credentials, or RADIUS attribute mismatches.

Answer

aaa new-model

Answer

show radius server statistics

Answer

debug radius authentication

Question 5

A security administrator is configuring a Cisco Firepower NGFW to detect and block application-layer DDoS attacks. Which type of DDoS attack is characterized by overwhelming a server with incomplete HTTP requests, causing resource exhaustion?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.

Answer

UDP Flood

Answer

ICMP Flood

Answer

SYN Flood

Question 6

An administrator wants to block the download of executable files (.exe) via HTTP using Cisco WSA. Which approach is most effective?

Accepted Answer

Create a URL filtering policy with action 'Block' for the category 'Executable Files'. Cisco WSA's URL filtering policies include a predefined content category called 'Executable Files' that specifically targets file extensions like .exe, .dll, and .msi. By setting the action to 'Block' for this category, the administrator can prevent HTTP downloads of executable files without affecting other traffic. This is the most direct and effective method as it operates at the application layer, inspecting the URL path for file extensions.

Answer

Enable Anti-Malware scanning for executables

Answer

Configure a Web Reputation policy to block low-reputation sites

Answer

Use a PAC file to bypass the proxy for executable downloads

Question 7

A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)

Accepted Answer

Never trust, always verify. Zero Trust is built on the principles of never trust, always verify; least privilege; and microsegmentation to enforce granular access controls.

Answer

Trust but verify

Answer

Defense in depth

Question 8

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

Accepted Answer

Zero Trust. Zero Trust assumes no implicit trust and verifies every access request.

Answer

Defense in depth

Answer

Least privilege

Answer

Network segmentation

Question 9

A security administrator is evaluating symmetric encryption algorithms for a new VPN deployment. Which algorithm uses a 128-bit block size and supports key sizes of 128, 192, and 256 bits?

Accepted Answer

AES. AES is a symmetric block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits.

Answer

3DES

Answer

RSA

Answer

MD5

Question 10

A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)

Accepted Answer

Cisco ESA (Email Security Appliance). Cisco Email Security Appliance (ESA) and Cisco Secure Email (formerly Cloud Email Security) are dedicated email security solutions.

Answer

Cisco Stealthwatch

Answer

Cisco ISE (Identity Services Engine)

Answer

Cisco WSA (Web Security Appliance)

Question 11

A security engineer is configuring a Cisco Firepower NGFW to detect and block a new malware variant that communicates with a command-and-control server using encrypted DNS queries. Which Cisco security product is best suited to provide visibility into this malicious DNS traffic?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security service that can block malicious domains and provide visibility into DNS queries.

Answer

Cisco ASA

Answer

Cisco AMP

Answer

Cisco Stealthwatch

Question 12

An attacker uses Shodan to discover internet-facing ICS devices and then performs banner grabbing. This is an example of which type of attack?

Accepted Answer

Passive OSINT. Passive OSINT involves collecting publicly available information without directly interacting with the target. Banner grabbing is active scanning, but the question emphasizes the initial passive phase. However, Shodan is a passive OSINT tool.

Answer

Social engineering

Answer

Active reconnaissance

Answer

Exploitation

Question 13

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

Answer

EST

Answer

SCEP

Answer

CRL

Question 14

A company deploys a solution that uses a root certificate authority (CA) and intermediate CAs to issue certificates. What is the term for the hierarchical structure of certificates from the root CA to the end entity?

Accepted Answer

Certificate chaining. Certificate chaining refers to the path from the root CA through intermediates to the end-entity certificate.

Answer

Certificate signing request

Answer

Certificate revocation list

Answer

Public key infrastructure

Question 15

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Accepted Answer

Zero Trust. Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Answer

CIA triad

Answer

AAA model

Answer

Defense in depth