350-701 Practice Test 2 — 10 Questions

Question 1

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. 'Never trust, always verify' is the foundational principle of the Cisco Zero Trust security model, which mandates that no user, device, or network segment is trusted by default, regardless of its location relative to the network perimeter. This principle eliminates implicit trust and requires authentication and authorization for every access request, aligning with the Zero Trust architecture defined in NIST SP 800-207.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 2

An organization uses Cisco Umbrella to block malicious domains. What is the primary security benefit of DNS-layer security?

Accepted Answer

It blocks malicious domains before a connection is made. DNS-layer security blocks requests to malicious domains at the DNS level, preventing the connection from being established.

Answer

It performs deep packet inspection on all traffic

Answer

It provides SSL decryption for all web traffic

Answer

It encrypts all DNS traffic to prevent eavesdropping

Question 3

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. ISE caches user credentials for efficiency, including the password used during 802.1X authentication. When a user changes their domain password, ISE may still have the old password cached and will attempt to authenticate with it until the cache expires (typically up to 30 minutes). Option A is incorrect because DNS updates are not related to cached passwords; stale DNS records would affect all users, not just those with recent password changes. Option C is incorrect because wireless controllers do not cache passwords for 802.1X; they forward credentials to the RADIUS server (ISE). Option D is incorrect because the RADIUS server (ISE) is the one caching credentials, not the wireless controller.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 4

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 5

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Accepted Answer

Inherence. Fingerprints are inherent characteristics of a person, placing them in the 'inherence' category (something you are).

Answer

Possession

Answer

Knowledge

Answer

Location

Question 6

A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?

Accepted Answer

Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT. Cisco TrustSec Security Group Tags (SGTs) provide granular, scalable segmentation based on logical groups rather than IP addresses. They are stateful and can be used to allow traffic from web servers to database servers based on source SGT. This is more effective than stateless ACLs or subnet-level controls, and Cisco CloudLock is primarily a CASB, not for network segmentation.

Answer

Use Cisco ASA access-lists to allow inbound traffic to web servers from 0.0.0.0/0 and deny all traffic to database servers

Answer

Place web servers in a public subnet and database servers in a private subnet, and use a Cisco Firepower access control policy to block all traffic to the private subnet

Answer

Use Cisco CloudLock to restrict access to database servers based on source IP

Question 7

An organization wants to enforce multi-factor authentication for remote VPN access. Cisco AnyConnect is used as the VPN client. Which Cisco product integrates with AnyConnect to provide MFA capabilities such as push notifications and one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo is the correct answer because it is the Cisco product specifically designed to integrate with AnyConnect for multi-factor authentication (MFA). Duo provides push notifications, one-time passwords (OTP), and other MFA methods by acting as an authentication proxy that validates secondary factors via RADIUS or SAML before allowing VPN access.

Answer

Cisco ISE

Answer

Cisco SecureX

Answer

Cisco AMP for Endpoints

Question 8

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Accepted Answer

access-list outside_in extended deny ip host 10.1.1.1 any. The ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

Answer

access-list outside_in extended deny ip any host 10.1.1.1

Answer

access-list outside_in extended deny tcp any host 10.1.1.1

Answer

access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Question 9

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

Accepted Answer

Transparent user identification using Active Directory agent. Transparent user identification on WSA can be achieved via NTLM authentication or Kerberos, but the most common transparent method is using NTLM challenge/response, or via AD agent. However, the question asks for transparent identification without client software; typical methods include using the AD agent or IP-based mapping. The best answer is 'NTLM authentication with browser integration' which is transparent to the user after initial login. But among options, 'Transparent user identification using Active Directory agent' is correct.

Answer

LDAP bind with user credentials

Answer

Explicit proxy with PAC file

Answer

Kerberos authentication with keytab file

Question 10

An organization wants to prevent users from accessing known malicious websites. Which Cisco WSA feature should be configured to block access based on website reputation?

Accepted Answer

URL Filtering. Cisco WSA uses Cisco Talos web reputation scores to block access to malicious websites based on their reputation.

Answer

SSL/TLS Decryption

Answer

AMP File Scanning

Answer

AVC (Application Visibility and Control)