350-701 Practice Test 20 — 15 Questions

Question 1

A Cisco FMC administrator needs to create a file policy to detect malware in HTTP downloads. The policy should allow the file to be delivered if it is known clean, block if known malicious, and allow but capture for analysis if unknown. Which combination of actions is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detect Files: Clean = Allow; Malicious = Block; Unknown = Allow and Capture. The file policy can use dispositions from AMP: clean (allow), malicious (block), and unknown (allow but capture for further analysis).

Answer

Detect Files: Clean = Block; Malicious = Allow; Unknown = Block

Answer

Detect Files: Clean = Allow; Malicious = Allow; Unknown = Block

Answer

Intrusion Policy instead of File Policy

Question 2

A security engineer is tuning Snort rules on a Cisco FTD to reduce false positives. Which action should be taken if a rule is generating alerts for legitimate traffic?

Accepted Answer

Disable the rule or set it to 'noalert'.. To reduce false positives, the rule can be disabled (noalert), thresholding can reduce alert frequency, or the rule can be modified to be more specific. Disabling is a common initial step if the rule is not needed.

Answer

Change the rule action to 'reject'.

Answer

Increase the priority of the rule.

Answer

Add the rule to a custom policy with higher precedence.

Question 3

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. MPF consists of class-maps to classify traffic, policy-maps to define actions, and service-policy to apply the policy to interfaces or globally. These are the three core components.

Answer

Route-map

Answer

Access-list

Question 4

Which type of VPN on Cisco ASA is typically used for site-to-site connectivity and encrypts all traffic between two sites?

Accepted Answer

IKEv2 IPsec site-to-site VPN. IKEv2 IPsec site-to-site VPN encrypts traffic between two gateways.

Answer

L2TP VPN

Answer

DTLS VPN

Answer

SSL VPN

Question 5

A security administrator is deploying a Cisco ASA in a DMZ architecture. The inside interface is security 100, outside interface is security 0, and DMZ interface is security 50. Which TWO statements about traffic flow are correct?

Accepted Answer

Traffic from inside to DMZ is allowed by default.. Traffic from higher to lower security levels is allowed by default; lower to higher requires ACLs. Also, traffic from inside to DMZ is allowed, but return traffic is allowed due to stateful inspection.

Answer

Traffic from DMZ to outside is denied by default.

Answer

Traffic from outside to inside is allowed by default without ACL.

Answer

Traffic from DMZ to inside is allowed by default.

Question 6

A security analyst is monitoring the Cisco FMC and notices a high number of false positives from an intrusion rule that detects SQL injection attempts. The legitimate web application frequently generates similar patterns. Which course of action would reduce false positives while maintaining detection for actual attacks?

Accepted Answer

Increase the rule's threshold to reduce frequency.. Modifying the rule's threshold to require a higher number of matches or using a suppression filter for the web server IP can reduce false positives.

Answer

Disable the rule entirely.

Answer

Create a new intrusion rule with opposite logic.

Answer

Change the rule action to 'pass'.

Question 7

A company is deploying Cisco AnyConnect SSL VPN and wants to enforce different access policies based on the endpoint's antivirus status. Which feature should be used?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policy (DAP) allows granular access control based on endpoint attributes such as antivirus status, OS, registry keys, etc. Group policies provide basic settings but not dynamic evaluation.

Answer

Group Policy

Answer

Split Tunneling

Answer

Network Access Control (NAC)

Question 8

An administrator configures a Cisco ASA with a DMZ interface at security level 50. Traffic from the inside (level 100) to the DMZ (level 50) is allowed by default. What additional configuration is needed to allow traffic from the DMZ to the inside?

Accepted Answer

An ACL applied to the DMZ interface permitting traffic to inside.. Traffic from lower to higher security level is blocked by default; an ACL must be applied to the lower security interface (DMZ) to permit traffic to the inside (higher).

Answer

A NAT rule is required.

Answer

An ACL applied to the inside interface permitting traffic from DMZ.

Answer

No additional configuration; it is allowed by default.

Question 9

An organization needs to inspect traffic between two internal zones (e.g., HR and IT) on a Cisco FTD. Which deployment mode is appropriate?

Accepted Answer

Inline mode with an access control policy. Inline mode allows the FTD to actively inspect and block traffic. Passive mode only monitors. The requirement to inspect implies inline for enforcement.

Answer

Switchport mode

Answer

Routed mode without any policy

Answer

Passive mode with an intrusion policy

Question 10

An engineer is configuring a Cisco ASA for site-to-site IKEv2 VPN with a VTI. Which two statements about VTI are true? (Choose two.)

Accepted Answer

VTI can be configured in IKEv2 mode with an IPsec profile.. VTI is a virtual interface that simplifies VPN configuration. It is a tunnel interface that uses IPsec profiles and supports routing protocols over the tunnel.

Answer

VTI requires a separate ACL to define interesting traffic.

Answer

VTI is only supported on the ASA 5500-X series.

Answer

VTI uses a crypto map to define the IPsec policy.

Question 11

A company is deploying Cisco Secure Web (WSA) and wants to integrate with Active Directory for user-based policies. The proxy is in transparent mode. Which technology allows the WSA to identify users transparently without requiring client configuration?

Accepted Answer

Transparent user identification (TUI). Transparent user identification (TUI) on the WSA uses technologies like NTLM authentication or LDAP to identify users without explicit proxy configuration. It can leverage Active Directory and transparently capture user credentials via HTTP authentication or other means.

Answer

Explicit proxy configuration on browsers

Answer

WCCP redirect

Answer

Kerberos authentication proxy

Question 12

Which Snort rule action causes the FTD to drop a packet and generate an alert?

Accepted Answer

drop. The 'alert' action generates an alert but does not drop; 'drop' drops and alerts; 'reject' drops and sends TCP RST; 'pass' ignores the packet.

Answer

reject

Answer

alert

Answer

pass

Question 13

A security administrator is configuring a Cisco FTD device using FMC. The goal is to block traffic from a specific country and allow all other traffic. Which action should be taken in the access control policy?

Accepted Answer

Create an access control rule with source country set to the country and action Block.. Geolocation filtering is configured under access control rules; a rule with block action for the country should be placed before any allow rules.

Answer

Create a pre-filter rule that blocks traffic from the country.

Answer

Create an intrusion rule with a block action for the country.

Answer

Create a file policy that blocks traffic from the country.

Question 14

An engineer is configuring an access control policy on Cisco FMC for FTD. The policy must allow HTTP traffic from the inside zone to the outside zone, but block all other traffic. Which rule configuration is correct?

Accepted Answer

Rule 1: Permit HTTP from inside to outside; Rule 2: Block all traffic.. Access control rules are processed top-down; a trust rule bypasses further inspection but still allows traffic; a permit rule allows traffic with inspection. The scenario requires allowing HTTP only, so a permit rule for HTTP with a default deny rule after is correct.

Answer

Rule 1: Trust HTTP from inside to outside; Rule 2: Block all traffic.

Answer

Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to outside.

Answer

Rule 1: Allow HTTP from inside to outside; no default rule.

Question 15

A network engineer is configuring site-to-site IPsec VPN on a Cisco ASA using IKEv2. Which two components are required for IKEv2 configuration? (Choose two.)

Accepted Answer

IKEv2 proposal. IKEv2 requires an IKEv2 proposal (or policy) defining encryption and authentication for phase 1, and a transform set for IPsec phase 2. Also, a crypto map binds the configuration to an interface. ISAKMP policy is for IKEv1.

Answer

ISAKMP policy

Answer

Group policy

Answer

Dynamic crypto map