350-701 Practice Test 17 — 15 Questions

Question 1

An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use prepared statements with parameterized queries. Prepared statements/parameterized queries prevent SQL injection by separating code from data. Input validation and stored procedures (if properly parameterized) also help. WAFs can detect and block SQLi attempts. Disabling error messages prevents information leakage.

Answer

Disable detailed database error messages in production

Answer

Enforce strong password policies for database accounts

Question 2

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

Accepted Answer

SQL Injection. SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Buffer Overflow

Answer

Cross-Site Scripting (XSS)

Question 3

An employee receives an email that appears to be from the company's IT department requesting their login credentials. This is an example of which type of attack?

Accepted Answer

Phishing. Social engineering attacks manipulate individuals into divulging confidential information. Phishing is a common form.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 4

During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?

Accepted Answer

Man-in-the-middle. Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.

Answer

Pass-the-hash

Answer

Replay attack

Answer

DNS tunneling

Question 5

Which encryption algorithm is classified as symmetric?

Accepted Answer

AES. AES is a symmetric encryption algorithm, using the same key for encryption and decryption.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECDSA

Question 6

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

Accepted Answer

Remote Access Trojan (RAT). A RAT (Remote Access Trojan) often uses a command-and-control (C2) channel on high-numbered ports like 4444, allowing attackers to control the host remotely.

Answer

Ransomware

Answer

Botnet C2 client

Answer

Keylogger

Question 7

A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated attempts to guess credentials, often automated, until successful.

Answer

SQL injection

Answer

Man-in-the-middle attack

Answer

Phishing

Question 8

An attacker uses ARP spoofing to intercept traffic between two devices on the same subnet. After successfully becoming a man-in-the-middle, the attacker can then perform which further attack to downgrade HTTPS connections to HTTP?

Accepted Answer

SSL stripping. SSL stripping is a MITM attack that downgrades HTTPS connections to HTTP by intercepting the initial HTTPS request and maintaining a plaintext connection with the client.

Answer

Session hijacking

Answer

DNS cache poisoning

Answer

Typosquatting

Question 9

A security analyst is investigating a malware outbreak. Analysis reveals a remote access trojan (RAT) that communicates with a command-and-control (C2) server. Which TWO behaviors are typical of a RAT? (Choose two.)

Accepted Answer

Logs keystrokes and captures credentials. RATs provide remote control, often allowing data exfiltration and keystroke logging. Ransomware encrypts files, and botnets perform DDoS; those are not typical RAT behaviors.

Answer

Encrypts files and demands ransom

Answer

Steals sensitive data from the system

Answer

Performs distributed denial-of-service attacks

Question 10

Which symmetric encryption algorithm is considered the current standard and is often used in VPNs and SSL/TLS?

Accepted Answer

AES. AES (Advanced Encryption Standard) is widely used and recommended.

Answer

MD5

Answer

3DES

Answer

RSA

Question 11

A company has a site-to-site VPN between two ASA firewalls using IKEv2. The tunnel was working but after an upgrade, it fails. The engineer verifies that the pre-shared keys match, IKE proposals are compatible, and the crypto ACL is correctly defined. What is the next likely cause to investigate?

Accepted Answer

The firewall rules on the intermediate devices are blocking ISAKMP traffic.. The tunnel was working before the upgrade and the engineer has already verified that the pre-shared keys, IKE proposals, and crypto ACL are correct. After an ASA upgrade, intermediate firewall rules or ACLs may be reset or changed, potentially blocking ISAKMP (UDP 500/4500) traffic. Since the tunnel fails to establish, the next logical step is to check if ISAKMP traffic is being permitted through all intermediate devices, as this is a common post-upgrade issue.

Answer

The ACL for interesting traffic is missing.

Answer

The crypto map is not applied to the correct interface.

Answer

The MTU is too high.

Question 12

A company is experiencing an increase in spear-phishing attacks targeting executives. Which TWO Cisco ESA features should be configured to mitigate this threat?

Accepted Answer

BEC impersonation protection. IMPERSONATION PROTECTION (BEC) and DMARC verification help detect spoofed executive emails. Outbreak filters and anti-spam may not catch targeted attacks.

Answer

Anti-spam (SenderBase)

Answer

DLP policies

Answer

Outbreak Filters

Question 13

A company wants to block social media access for employees during work hours. Which Cisco Firepower NGFW feature should be used to achieve this?

Accepted Answer

Application Control. Firepower NGFW application control can block specific application categories such as social media.

Answer

DLP Policies

Answer

URL Filtering

Answer

TLS Server Identity Discovery

Question 14

A security analyst notices that a user is downloading a file from a website. The Cisco WSA is configured to perform AMP file scanning. What happens when the file's SHA-256 hash is not found in the local cache?

Accepted Answer

The file is sent to the cloud for analysis and a verdict is returned.. Cisco WSA AMP file scanning performs a cloud lookup to check the file's reputation; if unknown, it may sandbox the file for analysis.

Answer

The file is allowed immediately.

Answer

The file is quarantined until an administrator reviews it.

Answer

The file is blocked permanently.

Question 15

A company using Cisco ESA receives an email that appears to be from the CEO requesting an urgent wire transfer. The email fails SPF and DKIM checks but passes DMARC. What is the most likely explanation?

Accepted Answer

DMARC policy is set to 'p=none'. DMARC policy can be set to 'none' (monitoring only) or 'quarantine'/'reject' based on SPF/DKIM alignment. If DMARC passes, it means the policy is not enforced, or the SPF/DKIM alignment still passes despite individual failures. However, if SPF and DKIM both fail, DMARC would also fail unless the policy is 'none'. The scenario suggests DMARC is set to 'none', so no action is taken.

Answer

The email passed SPF alignment

Answer

DKIM signature was valid but not aligned

Answer

The sender IP is in the SPF whitelist