350-701 Practice Test 19 — 15 Questions

Question 1

Which THREE steps should the administrator take to troubleshoot slow web browsing when using Cisco WSA? (Choose three.)

Accepted Answer

Check the WSA's network interface statistics for errors or drops. Checking the WSA's network interface statistics for errors or drops helps identify physical-layer issues (e.g., duplex mismatches, CRC errors) that can cause packet loss and retransmissions, directly slowing web browsing. This is a fundamental first step in isolating whether the problem is at the network layer rather than within the proxy itself.

Answer

Restart the proxy services to clear any temporary issues

Answer

Configure the WSA to use a public DNS server like 8.8.8.8

Question 2

Which TWO are common causes for CoA (Change of Authorization) failures in a Cisco ISE deployment? (Choose two.)

Accepted Answer

The switch does not support the CoA protocol.. Options A and C are correct. The switch must support CoA (RFC 3576) for the protocol to work, and the RADIUS shared secret between ISE and the switch must match for CoA packets to be accepted. Option B is not a common cause because ISE and the switch can be in different subnets as long as network connectivity exists. Option D is incorrect because 'authentication periodic' is a feature that triggers reauthentication, not a cause of CoA failure. Option E is incorrect because a wireless controller that proxies RADIUS can still forward CoA packets.

Answer

The ISE node serving the CoA is not in the same subnet as the switch.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The endpoint is connected through a wireless controller that proxies RADIUS.

Question 3

A company has a Cisco ASA firewall configured with multiple access-lists applied to the outside interface. The security team is investigating reports that legitimate HTTPS traffic to a public web server located on a DMZ is intermittently being blocked. The firewall configuration includes an ACL that permits traffic to the web server's IP address on TCP 443, but also includes a general deny rule for all other traffic. The engineer notices that the permit rule is placed after a deny rule that blocks traffic from a specific source subnet that is used by internal users for testing. The internal users report that they can access the web server, but external users sometimes experience timeouts. What is the most likely cause of the intermittent blocking?

Accepted Answer

The permit rule for HTTPS is not hitting because traffic is being matched by a preceding deny rule.. The most likely cause is that the permit rule for HTTPS (TCP 443) is placed after a deny rule that blocks traffic from a specific source subnet. Since ACLs on a Cisco ASA are processed sequentially from top to bottom, if a packet matches the earlier deny rule, it will be dropped before reaching the permit rule. This explains why external users (who may be sourced from the blocked subnet or whose traffic is inadvertently matched by the deny rule due to overlapping or misconfigured source conditions) experience intermittent timeouts, while internal users from a different subnet are not affected.

Answer

The external users are hitting the firewall's connection limit.

Answer

The ASA is performing NAT incorrectly for the web server traffic.

Answer

The ASA is experiencing high CPU utilization causing packet drops.

Question 4

An organization uses Cisco ESA to filter inbound email. The security team notices that some phishing emails are reaching users despite having an anti-spam policy. Further analysis reveals that the emails are sent from a domain that is gray-listed but not blocked. What should the administrator do to prevent these emails without impacting legitimate emails?

Accepted Answer

Create a content filter to quarantine the emails based on malicious URLs or attachment type.. Creating a content filter to quarantine emails based on malicious URLs or attachment type directly addresses the phishing threat without affecting legitimate emails. Since the domain is gray-listed (not blocked), the anti-spam policy considers the sender as suspicious but not malicious; a content filter can inspect the email content for specific indicators of compromise (e.g., known malicious URLs or dangerous attachment types like .exe or .js) and quarantine those emails, bypassing the gray-mail classification.

Answer

Disable the Gray Mail feature in the anti-spam policy.

Answer

Enable Retrospective Scanning to detect the phishing emails after delivery.

Answer

Add the sender IP address to the SenderBase block list.

Question 5

An engineer is configuring a Cisco ASA and needs to ensure that traffic from the outside interface to a web server on the DMZ is allowed. The inside interface is security level 100 and the DMZ is level 50. The outside interface is level 0. Which statement about the default traffic flow is true?

Accepted Answer

Traffic from outside to DMZ is denied implicitly because outside level is lower than DMZ level.. By default, the ASA permits traffic from higher security levels to lower security levels without an ACL. However, traffic from lower to higher levels is implicitly denied. Since outside (0) is lower than DMZ (50), an ACL is required.

Answer

Traffic from outside to DMZ is allowed implicitly because the ASA inspects all interfaces equally.

Answer

Traffic from outside to DMZ is allowed implicitly because outside is level 0 and DMZ is level 50.

Answer

Traffic from outside to DMZ is allowed implicitly because both are lower than inside.

Question 6

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Accepted Answer

show asp drop. The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

Answer

show access-list

Answer

show conn

Answer

show service-policy

Question 7

Which deployment mode allows a Cisco Firepower NGFW to inspect traffic without being in the direct forwarding path?

Accepted Answer

Passive. Inline deployment is in the path; passive mode (or SPAN) monitors a copy of traffic.

Answer

Transparent

Answer

Routed

Answer

Inline

Question 8

Which two conditions must be met for Cisco Firepower Threat Defense (FTD) to perform SSL decryption?

Accepted Answer

The FTD must have a decryption certificate (server certificate) installed.. SSL decryption requires both a trusted CA certificate (to re-sign server certificates) and a decryption certificate (server certificate) to present to the client. Option A and D are correct prerequisites. Option B (TLS 1.2 or higher) is not required; FTD can decrypt older TLS versions. Option C (URL Filtering license) is not needed for decryption. Option E (a decryption policy) is necessary but not sufficient alone; the certificates must also be in place.

Answer

The client must be using TLS 1.2 or higher.

Answer

The FTD must have a URL Filtering license.

Answer

The decryption policy must be configured on the FTD device.

Question 9

An engineer is configuring a Cisco AnyConnect SSL VPN for remote access. Which TWO features are commonly used to control access based on endpoint security posture?

Accepted Answer

Posture assessment (e.g., AnyConnect Posture module). Dynamic Access Policy (DAP) allows access control based on endpoint attributes. Posture assessment checks for compliance. Group policies provide general VPN parameters but not posture-based dynamically.

Answer

IPsec transform set

Answer

Group policy

Answer

Crypto map

Question 10

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They need to create an access control policy that allows traffic from specific source IPs to a web server, but blocks all other traffic. How should the rule base be ordered?

Accepted Answer

Place the permit rule first, then the block rule.. Access control rules are evaluated in order from top to bottom. The first matching rule is applied. Therefore, the permit rule for the specific source IPs must come before the final block rule.

Answer

Place the block rule first, then the permit rule.

Answer

Use a single rule with permit and block conditions combined.

Answer

Order does not matter because FMC processes rules in parallel.

Question 11

A Cisco FTD is deployed in inline mode and is configured with a file policy to detect malware. When a file is transferred, the FTD computes a SHA-256 hash and checks it against AMP cloud. The cloud returns 'unavailable' for the hash. What action will the FTD take by default?

Accepted Answer

Allow the file and log the event.. By default, if the cloud lookup cannot determine the disposition (clean, malware, unknown), the file is allowed but logged.

Answer

Perform a deep packet inspection on the file.

Answer

Detonate the file in a sandbox before deciding.

Answer

Block the file because it could not be verified.

Question 12

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule uses a specific content pattern 'malicious' to match traffic, which is characteristic of signature-based detection. Signature-based IDS relies on predefined patterns or signatures to identify known threats.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 13

A company uses Cisco Firepower with FMC and wants to block access to social media websites for all users. Which feature should be used to create this policy?

Accepted Answer

URL Filtering. URL filtering allows blocking or allowing access based on URL categories (e.g., Social Networking). Application visibility and control (AVC) can block specific applications, but URL filtering is more appropriate for web browsing categories.

Answer

File Policy

Answer

Intrusion Policy

Answer

Application Visibility and Control (AVC)

Question 14

In a Snort intrusion detection rule, which part specifies the action to take when the rule matches?

Accepted Answer

Action. The action is the first field in a Snort rule (e.g., alert, drop, reject).

Answer

Protocol

Answer

Options

Answer

Source IP

Question 15

A security administrator is investigating an alert from an IPS that detected a SQL injection attempt. The alert was triggered by a signature that looks for specific patterns in the traffic. What type of detection method is this?

Accepted Answer

Signature-based detection. Signature-based detection uses predefined patterns (signatures) to identify known attacks. Anomaly-based detection looks for deviations from normal behavior.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection