350-701 Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Accepted Answer

The file will be allowed because local cache will store an unknown disposition.. When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Answer

The file will be held until the endpoint comes online and a cloud lookup completes.

Answer

The file will be quarantined due to the aggressive exploit prevention level.

Answer

The file will be blocked immediately by scan-on-write.

Question 2

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 3

A security analyst discovers that a user downloaded a CSV file containing social security numbers from a sanctioned cloud storage app, but no alert was generated. The DLP policy shown in the exhibit was applied. What is the most likely reason the policy failed to trigger?

Accepted Answer

The social security numbers in the file did not contain dashes, so the regex did not match.. The DLP policy uses a regex pattern that expects dashes in the social security numbers (e.g., \d{3}-\d{2}-\d{4}). If the CSV file contained SSNs without dashes (e.g., 123456789), the regex would not match, and no alert would be generated. This is the most likely reason the policy failed to trigger, as the data format did not meet the policy's detection criteria.

Answer

The user bypassed the DLP policy using an API call.

Answer

The policy was not applied to the cloud storage app used by the user.

Answer

The policy only notifies the admin and does not block the download.

Question 4

Which TWO configuration steps are required to implement 802.1X authentication on a Cisco switch for wired clients?

Accepted Answer

Configure AAA authentication using RADIUS. Option D is correct because 802.1X requires AAA authentication to be configured on the switch to forward EAP frames to a RADIUS server for user credential verification. Without the 'aaa authentication dot1x default group radius' command, the switch cannot process authentication requests, making this a mandatory step.

Answer

Enable dot1x globally on the switch

Answer

Set the switchport mode to trunk

Answer

Define the RADIUS server IP and shared secret

Question 5

Which TWO actions are recommended best practices for securing web traffic using Cisco Umbrella?

Accepted Answer

Enable IP-layer enforcement for all destinations.. Option C is correct because enabling IP-layer enforcement in Cisco Umbrella ensures that all traffic to destinations that match a blocked category is dropped at the IP layer, even if DNS-based blocking is bypassed (e.g., via direct IP connections). This provides a second layer of protection by inspecting and blocking traffic based on the destination IP address, preventing users from circumventing DNS filtering by using IP addresses directly.

Answer

Configure SSL decryption to always bypass traffic to trusted domains.

Answer

Configure the network to use the root DNS forwarder for all DNS queries.

Answer

Configure local security stack bypass for all internal IP ranges.

Question 6

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

Accepted Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will only authenticate the PC, and any additional device will be denied.. Option D is correct because Gi1/0/1 is configured with the `authentication port-control auto` and `authentication host-mode multi-auth` commands, which allow both the VoIP phone and the PC to authenticate independently. Gi1/0/2 is configured with `authentication host-mode single-host` (the default), which only permits a single authenticated device; any additional device, such as a second PC connected via a hub, will be denied access.

Answer

Both ports will authenticate all connected devices because 802.1X supports multiple hosts by default.

Answer

Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because multi-auth is not supported on access ports.

Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because the tx-period is too long.

Question 7

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Accepted Answer

access-list outside_in extended deny ip host 10.1.1.1 any. Option B is correct because the ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

Answer

access-list outside_in extended deny ip any host 10.1.1.1

Answer

access-list outside_in extended deny tcp any host 10.1.1.1

Answer

access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Question 8

A company is deploying Cisco Umbrella to protect against DNS-based threats. Which deployment method provides the most comprehensive coverage for all devices on the network without requiring per-device configuration?

Accepted Answer

Configure the network's DNS forwarders to point to Umbrella's DNS resolvers.. Option D is correct because configuring the network's DNS forwarders to point to Umbrella's DNS resolvers (typically on the organization's DHCP server or router) ensures that all DNS queries from any device on the network are automatically forwarded to Umbrella for filtering, without requiring any per-device configuration. This method provides comprehensive coverage for all devices, including those that cannot run agents (e.g., IoT devices, printers, guest devices), by intercepting DNS traffic at the network level.

Answer

Install the Umbrella roaming client on every endpoint.

Answer

Configure each device's DNS settings to use Umbrella's resolvers.

Answer

Deploy a PAC file that routes all traffic through a proxy with DNS filtering.

Question 9

A company is migrating critical workloads to AWS and wants to ensure secure connectivity between their on-premises network and the VPC. Which TWO actions should be taken to meet this requirement?

Accepted Answer

Provision an AWS Direct Connect connection for a private, dedicated link.. Option C is correct because AWS Direct Connect provides a private, dedicated network link from on-premises to AWS, bypassing the public internet for consistent latency, higher bandwidth, and enhanced security. This meets the requirement for secure connectivity during a critical workload migration.

Answer

Attach an internet gateway to the VPC and allow all inbound traffic.

Answer

Configure a security group that allows all traffic from the on-premises network.

Answer

Use security groups to allow traffic from the on-premises IP range.

Question 10

A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?

Accepted Answer

Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.. B is correct because Security Group Tags (SGTs) are the fundamental building blocks of Cisco TrustSec, used to classify traffic and enforce role-based access control. SGTs can be defined locally on the switch using the 'cts role-based sgt' command or dynamically assigned via a RADIUS server (such as Cisco ISE) during authentication. Without SGTs, the switch cannot perform the source-based or destination-based policy enforcement that TrustSec relies on.

Answer

Enable MACsec encryption on all trunk links.

Answer

Deploy Cisco ISE as the only policy server.

Answer

Apply IP access-lists on interfaces to filter traffic based on source IP.

Question 11

Refer to the exhibit. An administrator sees that the file invoice_2024.exe was blocked by both Cisco AMP and ESA. However, a user claims the attachment was delivered. What is the most likely cause?

Accepted Answer

The ESA was configured to 'Deliver then alert' for malware detected by AMP.. Option B is correct because when Cisco ESA is configured with 'Deliver then alert' for malware detected by AMP, the email is delivered to the user before the AMP file reputation analysis completes. The ESA sends the file to AMP for analysis, but if the policy is set to deliver first and alert later, the user receives the attachment even if AMP later determines it is malicious. This explains why the administrator sees the block in both AMP and ESA logs, yet the user claims delivery.

Answer

The ESA was not configured to use AMP for file reputation.

Answer

The AMP file reputation check was not performed due to an ACL misconfiguration.

Answer

The file was whitelisted in the AMP policy.

Question 12

A company with 500 employees uses Cisco Web Security Appliance (WSA) as a proxy. They have a policy to block access to social media sites during working hours (9 AM - 5 PM) for all users except the marketing team. The marketing team must have unrestricted access at all times. The WSA is configured with a time-based access policy that blocks the 'Social Networking' category from 9 AM to 5 PM, and an identity policy that identifies the marketing team by Active Directory group. However, marketing users report that they are blocked from social media during working hours. What is the most likely cause?

Accepted Answer

The identity policy for the marketing team has a 'Use Global Policy' action for social networking, which then applies the time-based block.. Option C is correct because when an identity policy is set to 'Use Global Policy' for a specific category, it defers to the global access policy, which in this case includes the time-based block for social networking. Since the marketing team's identity policy does not explicitly override the global policy with an 'Allow' or 'Monitor' action for the 'Social Networking' category, the time-based block applies to them as well.

Answer

The time-based policy is set to block social media from 9 AM to 5 PM, but the marketing team's identity policy is not explicitly set to 'Monitor' or 'Allow' for that category.

Answer

The WSA requires authentication for all users, but marketing users are not prompted to authenticate.

Answer

The marketing team's Active Directory group is not being recognized by the WSA due to a synchronization issue.

Question 13

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Option B is correct because Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 14

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Accepted Answer

Device Trajectory to visualize the timeline of events on an endpoint. Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Answer

Real-time blocking of malicious processes at the endpoint

Answer

Automatic deployment of software patches to endpoints

Question 15

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

350-701 Practice Test 19 — 15 Questions

Exhibit

350-701 Practice Test 19 — 15 Questions

Exhibit