350-701 Practice Test 19 — 15 Questions

Question 1

Cisco ISE posture assessment requires that endpoints meet certain security requirements before being granted network access. Which of the following is a typical posture requirement?

Accepted Answer

Antivirus definition file version. Posture assessment checks for compliance with security policies, such as having antivirus software installed and up-to-date, patch levels, and disk encryption enabled.

Answer

SGT assignment

Answer

Device type identification via profiling

Answer

MAC address registration

Question 2

A security engineer is implementing a zero trust architecture. Which TWO principles are foundational to zero trust? (Choose two.)

Accepted Answer

Least privilege access. Option D (Least privilege access) is correct because zero trust grants users and workloads only the minimum permissions needed for their specific tasks, limiting lateral movement if credentials are compromised. Option E (Never trust, always verify) is correct because zero trust explicitly authenticates and authorizes every request regardless of network location, using continuous verification of identity, device health, and context rather than assuming trust from being inside the corporate network. Option A (Implicit trust for internal users) is wrong because it directly contradicts the zero trust model, which eliminates implicit trust based on network location. Option B (Single perimeter defense) is wrong because zero trust abandons the castle-and-moat single-perimeter model in favor of microsegmentation and identity-centric controls. Option C (All traffic must be inspected by a firewall) is wrong because while inspection may be part of an implementation, it is not a foundational zero trust principle; zero trust is defined by identity-based verification and least privilege, not by mandating firewall inspection of all traffic.

Answer

Implicit trust for internal users

Answer

Single perimeter defense

Answer

All traffic must be inspected by a firewall

Question 3

A Cisco FTD is configured with a file policy to detect malware. The policy includes a rule to block files with a SHA-256 hash that is known to be malicious. Which component provides the SHA-256 disposition?

Accepted Answer

Cisco AMP cloud. The Cisco AMP cloud is the authoritative source for file dispositions, including SHA-256 hash reputation. When a file policy on Cisco FTD detects a file, it computes the SHA-256 hash and queries the AMP cloud to determine if the hash is known malicious. The AMP cloud maintains a vast database of file signatures and threat intelligence, enabling real-time verdicts. Thus, the SHA-256 disposition is provided by the Cisco AMP cloud.

Answer

Network discovery database

Answer

Local malware cache

Answer

Snort rules

Question 4

An organization wants to provide network access to guest users through Cisco ISE. Guests must register themselves and accept an acceptable use policy before gaining internet-only access. Which guest access method should be configured?

Accepted Answer

Self-registration. Self-registration is the correct guest access method because it allows guest users to create their own credentials and accept an acceptable use policy (AUP) before being granted internet-only access. Cisco ISE's self-registration portal handles the entire workflow: user provides details, accepts the AUP, and ISE provisions a temporary account with restricted access, typically via a sponsored or direct access policy.

Answer

802.1X with PEAP-MSCHAPv2

Answer

MAB

Answer

Sponsor portal

Question 5

A security team wants to gain visibility into Shadow IT usage of SaaS applications and enforce data loss prevention policies. Which cloud security solution should they deploy?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is specifically designed to provide visibility into SaaS usage (including Shadow IT discovery) and enforce DLP policies on cloud traffic. It sits between users and cloud services, using APIs or proxies to inspect data and apply granular controls. CSPM, CWPP, and Umbrella address different layers and do not provide the combined SaaS visibility plus DLP enforcement required here.

Answer

CSPM

Answer

Cisco Umbrella

Answer

CWPP

Question 6

Which statement accurately describes the difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Anomaly-based detection compares traffic against a baseline of normal behavior.. Signature-based detection matches known attack patterns; anomaly-based detects deviations from a baseline of normal traffic.

Answer

Signature-based detection generates fewer false positives than anomaly-based detection.

Answer

Anomaly-based detection is more effective against known attacks than signature-based.

Answer

Signature-based detection uses machine learning to identify unknown attacks.

Question 7

A security engineer is deploying Cisco AMP for Endpoints in an organization. To ensure that any malicious file that was initially allowed but later determined to be malicious can be traced, which feature should be used?

Accepted Answer

Device Trajectory. Cisco AMP for Endpoints' Device Trajectory feature provides a historical record of file and process activity on an endpoint, allowing security teams to trace the origin and spread of a file that was initially allowed but later determined to be malicious. It shows the sequence of events, including file creation, execution, and network connections, enabling retrospective analysis.

Answer

SHA-256 file disposition

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Question 8

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 9

Which two Cisco solutions can be used to provide cloud-based content security including DNS-layer protection and cloud proxy? (Choose two.)

Accepted Answer

Cisco Umbrella DNS-layer security. Cisco Umbrella DNS-layer security (C) is correct because it is a cloud-delivered security service that blocks malicious domains and IPs at the DNS resolution layer before a connection is ever established, providing the DNS-layer protection described in the scenario. Cisco Umbrella SIG (E) is also correct because Secure Internet Gateway extends Umbrella's cloud security to include a cloud proxy (SWG) for full URL inspection, plus CASB, FWaaS, and DNS-layer security in a single cloud service. Cisco ThousandEyes (A) is a network intelligence and digital experience monitoring platform, not a content security or DNS filtering solution. Cisco ESA (B) is an on-premises or virtual email security appliance that filters email traffic, not general web/DNS content security. Cisco WSA (D) is a web security appliance that can be deployed on-premises or as a virtual appliance, but it is not the cloud-based DNS-layer plus cloud proxy solution the question asks for.

Answer

Cisco ThousandEyes

Answer

Cisco ESA

Answer

Cisco WSA

Question 10

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

Accepted Answer

The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.. The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Answer

The AMP license has expired.

Answer

Inbound firewall rules block incoming connections to the AMP connector.

Answer

The AMP connector service is stopped on the endpoint.

Question 11

An engineer is configuring Cisco ISE for 802.1X authentication. The organization has a mix of devices, including some that do not support 802.1X supplicants. Which method should the engineer use to allow these non-supplicant devices to authenticate?

Accepted Answer

Enable MAC Authentication Bypass on the authenticator. MAC Authentication Bypass (MAB) is the correct method for allowing non-supplicant devices to authenticate on an 802.1X network. MAB uses the device's MAC address as the credential, which the authenticator (switch) sends to the authentication server (Cisco ISE) for verification. This allows devices like printers, cameras, or older systems that lack 802.1X supplicant software to gain network access.

Answer

Deploy Cisco AMP connectors on all endpoints

Answer

Configure a guest portal for self-registration

Answer

Use EAP-TLS with device certificates

Question 12

A security engineer is configuring a Cisco FTD high availability pair in active/standby mode. Which statement is true about the failover configuration?

Accepted Answer

The standby unit must have the same hardware and software version. In a Cisco FTD active/standby failover pair, the two appliances must be identical in hardware model, interface configuration, and software version so that the standby can seamlessly take over the active role. The standby continuously receives state and configuration synchronization from the active unit, which is only possible when the platforms match. This ensures that when a failover event occurs, the standby can assume traffic processing without compatibility issues.

Answer

Failover is triggered only by manual intervention

Answer

Configuration changes are made independently on each unit

Answer

Both units process traffic simultaneously

Question 13

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

Accepted Answer

Use the 'capture' command with trace option to see packet flow and drop reason.. The 'capture' command with the 'trace' option on Cisco FTD provides a detailed, packet-level analysis of how traffic is processed through the firewall pipeline. It shows each step (e.g., ingress, routing, access control, NAT, egress) and explicitly states the drop reason, such as 'action-drop' due to intrusion prevention, URL filtering, or security intelligence, even when the access control policy appears to allow the traffic. This is the only option that directly identifies the specific cause of a drop in the data path.

Answer

Check the 'show access-list' output for the hit count.

Answer

Check the 'show route' output for routing issues.

Answer

Check the 'show conn' output for the connection state.

Question 14

Refer to the exhibit. A network administrator applies the ACL to the interface. What is the effect on traffic inbound to the interface?

Accepted Answer

Only TCP traffic destined to 192.168.1.100 on port 80 is permitted; all other IP traffic is denied. The ACL is applied inbound on the interface and contains a single entry that permits TCP traffic from any source to destination 192.168.1.100 on port 80. Because there is an implicit deny all at the end of every standard and extended ACL, only traffic matching this specific permit statement is allowed; all other IP traffic is denied.

Answer

All TCP traffic is permitted; other IP traffic is denied

Answer

All IP traffic is permitted

Answer

The ACL is applied outbound, so it has no effect on inbound traffic

Question 15

Which security principle ensures that a user or system is granted only the minimum permissions necessary to perform a specific function?

Accepted Answer

Least privilege. The principle of least privilege dictates that a user, process, or system should be granted only the minimum permissions necessary to perform a specific function. In Cisco security contexts, this is enforced through features like Role-Based Access Control (RBAC) on Cisco IOS devices, where privilege levels (0-15) are assigned to restrict command access, or via TrustSec Security Group Tags (SGTs) that limit traffic flows to only required resources.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth