350-701 Practice Test 17 — 15 Questions

Question 1

A company wants to prevent sensitive data such as credit card numbers from being sent via email. Which Cisco ESA feature should be enabled?

Accepted Answer

Data Loss Prevention (DLP). C is correct because Data Loss Prevention (DLP) is the Cisco ESA feature specifically designed to inspect email content and attachments for sensitive data patterns, such as credit card numbers, and enforce policies to prevent their unauthorized transmission. DLP uses predefined or custom dictionaries and message filters to detect and block or quarantine such data, directly addressing the requirement to prevent sensitive data from being sent via email.

Answer

Anti-Spam

Answer

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Answer

Anti-Malware

Question 2

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Accepted Answer

Deploy the AMP connector to all endpoints, including servers and desktops.. Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Answer

Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.

Answer

Set the default policy action to 'Block' for all file types to maximize security from day one.

Question 3

An administrator is configuring Cisco ISE to profile endpoints. The administrator wants to ensure that endpoints are correctly identified based on MAC address and hostname. Which of the following is a prerequisite for successful profiling?

Accepted Answer

The network devices must have profiling enabled and be configured with SNMP.. C is correct because Cisco ISE uses SNMP to query network devices (switches, wireless LAN controllers) for endpoint attributes such as MAC addresses and hostnames. Profiling must be enabled on the network devices, and SNMP (typically v2c or v3) must be configured so that ISE can collect the necessary data via MIBs like BRIDGE-MIB or ENTITY-MIB to correlate MAC-to-port mappings and hostname information.

Answer

The DHCP server must be configured with option 82.

Answer

The endpoints must have the ISE agent installed.

Answer

The switch must be configured with SNMP v3.

Question 4

A company with 5000 endpoints uses Cisco Secure Endpoint (AMP) and Cisco ISE. Users report that legitimate software installations are being quarantined, causing delays. The security team receives many alerts for file executions. The AMP policy is set to "High Security" with "Block Unknown" enabled. Network traffic is monitored by Cisco Stealthwatch. The team wants to reduce operational overhead while maintaining security. What should they do?

Accepted Answer

Create an AMP exclusion for software installation directories and enable "File Reputation" with "Cloud Lookups". The issue is that legitimate software installations are being quarantined due to the 'Block Unknown' setting in the High Security AMP policy. To reduce operational overhead while maintaining security, the team should create an exclusion for software installation directories and enable File Reputation with Cloud Lookups. This allows known legitimate files to be allowed while still blocking malicious ones, leveraging Cisco Talos intelligence. This approach balances security and usability.

Answer

Disable "Block Unknown" and rely solely on Stealthwatch for threat detection

Answer

Change AMP policy to "Medium Security" and enable "Application Blocking with Allow List"

Answer

Disable AMP and use only ISE for endpoint posture checks

Question 5

An engineer is configuring Cisco ISE for 802.1X authentication in a corporate network. A printer that does not support 802.1X needs to be granted network access. Which method should the engineer use to authenticate the printer?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct method for devices like printers that do not support 802.1X supplicant software. MAB uses the device's MAC address as the credential, which Cisco ISE checks against its identity store or external database. This allows non-802.1X-capable devices to be authenticated and granted appropriate network access without requiring a supplicant.

Answer

Guest Portal

Answer

PEAP-MSCHAPv2

Answer

EAP-TLS

Question 6

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

Accepted Answer

The connector is in a quarantine mode due to a loss of cloud connectivity.. In Cisco AMP (Advanced Malware Protection) for Endpoints, the 'Isolated: Yes' status indicates that the connector has entered quarantine mode because it has lost connectivity to the AMP cloud. This is a security feature that prevents the endpoint from communicating with other hosts on the network while still allowing outbound traffic to the cloud for reconnection attempts. The connector remains functional but isolated to contain potential threats until cloud connectivity is restored.

Answer

The connector is disconnected from the cloud and requires a reboot.

Answer

The connector is permanently blocked by a firewall and needs manual reconfiguration.

Answer

The network component is disabled, preventing network traffic monitoring.

Question 7

An organization is deploying Cisco Firepower Threat Defense (FTD) in a high-availability (HA) pair in active/standby mode. Which statement about state synchronization is true?

Accepted Answer

Connection states are synchronized from active to standby over the failover link.. In an FTD active/standby HA pair, the active unit owns all traffic flows and synchronizes connection state (including TCP sequence numbers, NAT translations, and inspection state) to the standby unit over the failover link. This allows the standby to take over seamlessly during failover without dropping established sessions. Configuration is also synchronized, but the key differentiator is that stateful connection data is replicated, not just config.

Answer

The standby unit mirrors all traffic and builds its own connection table.

Answer

Both units process traffic simultaneously and share states via the control link.

Answer

Only configuration is synchronized; connection states are not replicated.

Question 8

A Cisco FTD device is configured with an access control policy that has multiple rules. The first rule is 'Allow' for all traffic from the internal network to the internet. The second rule is 'Block' for traffic from a specific internal host to any destination. However, the administrator notices that the specific host can still access the internet. What is the most likely cause?

Accepted Answer

The block rule is placed after the allow rule.. Cisco FTD access control policies evaluate rules top-down and stop at the first match, so an 'Allow' rule placed above a 'Block' rule will match all internal-to-internet traffic first, including traffic from the specific host. The block rule is never reached because the allow rule already matched. To block the host, the block rule must be moved above the allow rule (or the allow rule must exclude that host).

Answer

The block rule is not applied to the correct interface.

Answer

The block rule is configured with 'Trust' action.

Answer

The block rule has a lower priority than the allow rule.

Question 9

Which TWO of the following are components of Cisco TrustSec?

Accepted Answer

Security Group Tag (SGT). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on identity and enforce access control policies. SGTs are 16-bit values assigned to users or devices, and they are carried in the packet header (e.g., via Cisco Metadata or inline tagging) to allow policy enforcement at the network layer.

Answer

802.1X

Answer

MACsec

Answer

IPsec

Question 10

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Accepted Answer

access-list outside_in extended deny ip host 10.1.1.1 any. The ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

Answer

access-list outside_in extended deny ip any host 10.1.1.1

Answer

access-list outside_in extended deny tcp any host 10.1.1.1

Answer

access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Question 11

Which TWO are common causes for CoA (Change of Authorization) failures in a Cisco ISE deployment? (Choose two.)

Accepted Answer

The switch does not support the CoA protocol.. Option A is correct because CoA requires the NAD (switch) to support the CoA protocol (RFC 5176, typically implemented as RADIUS Disconnect or CoA-Request messages); if the switch does not support CoA, ISE cannot send the Change of Authorization packet and the reauthentication/remediation action fails. Option C is correct because CoA messages are RADIUS packets that must be authenticated with the same shared secret configured between ISE and the switch; a mismatched RADIUS shared secret causes the switch to silently discard or reject the CoA-Request, resulting in CoA failure. Option B is not required — CoA is a normal RADIUS packet routed over IP, so ISE and the switch do not need to be in the same subnet as long as IP reachability and the correct RADIUS/CoA ports (UDP 3799 for CoA) are open. Option D is incorrect because 'authentication periodic' (via RADIUS reauthentication timers) actually enables periodic reauthentication and does not cause CoA failures; it is a valid configuration. Option E is incorrect because a wireless controller proxying RADIUS is a normal deployment model and does not inherently cause CoA failures, provided the WLC supports and forwards CoA to the correct AP/client.

Answer

The ISE node serving the CoA is not in the same subnet as the switch.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The endpoint is connected through a wireless controller that proxies RADIUS.

Question 12

A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?

Accepted Answer

Cisco ESA with AMP. Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.

Answer

Cisco AMP for Endpoints

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Question 13

Which protocol does Cisco ISE use to communicate with the pxGrid controller for sharing contextual data?

Accepted Answer

JSON-RPC over certificate-based TLS. Cisco ISE uses the JSON-RPC protocol over certificate-based TLS to communicate with the pxGrid controller for sharing contextual data. This ensures encrypted, authenticated, and structured messaging between ISE and other pxGrid-enabled services, such as Cisco Threat Response or third-party integrations.

Answer

REST API over HTTPS

Answer

TACACS+

Answer

RADIUS

Question 14

Which symmetric encryption algorithm is considered the current standard and is often used in VPNs and SSL/TLS?

Accepted Answer

AES. AES (Advanced Encryption Standard) is widely used and recommended.

Answer

MD5

Answer

3DES

Answer

RSA

Question 15

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch is the network visibility and traffic analytics product that uses NetFlow and IPFIX to monitor network traffic, detect anomalies, and provide security intelligence. It collects flow data from routers and switches to build a comprehensive view of network behavior. This matches the requirement exactly.

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella

Answer

Cisco ISE