350-701 Practice Test 20 — 15 Questions

Question 1

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

Accepted Answer

The port will remain in an unauthorized state, blocking all traffic. When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Answer

The port will be placed in a critical authentication VLAN

Answer

The port will be error-disabled due to authentication failure

Answer

The port will be placed in VLAN 10 with restricted access

Question 2

A company is migrating a web application to AWS and wants to protect against DDoS attacks at the application layer. Which Cisco security solution should they deploy?

Accepted Answer

Cisco WAF (Web Application Firewall). A Web Application Firewall (WAF) is the correct solution because it specifically inspects and filters HTTP/HTTPS traffic at the application layer (Layer 7), protecting against DDoS attacks such as HTTP floods, SQL injection, and cross-site scripting. Cisco WAF (often delivered via Cisco Secure Web Application or integrated with AWS WAF) can rate-limit requests, block malicious payloads, and enforce positive security models to mitigate application-layer DDoS. This directly addresses the requirement to protect a web application migrating to AWS against Layer 7 attacks.

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Question 3

An enterprise wants to prevent data exfiltration from its SaaS applications to unauthorized personal cloud storage. Which Cisco solution should be deployed?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct solution because it is a cloud-native CASB (Cloud Access Security Broker) specifically designed to protect SaaS applications like Office 365 and Salesforce. It provides data loss prevention (DLP) policies that can detect and block the exfiltration of sensitive data to unauthorized personal cloud storage services by inspecting API traffic and user activities in real time.

Answer

Cisco Umbrella

Answer

Cisco Duo

Answer

Cisco Firepower NGFW

Question 4

Which TWO of the following are features of Cisco Umbrella? (Choose two.)

Accepted Answer

Secure web gateway. Cisco Umbrella provides DNS-layer security as a core feature, which blocks requests to malicious domains before a connection is established, effectively preventing malware, phishing, and command-and-control callbacks. It also includes a Secure Web Gateway (SWG) that enforces URL filtering, application controls, and HTTPS inspection to protect users from web-based threats. These two capabilities are fundamental to Umbrella's cloud-delivered security architecture.

Answer

Cloud access security broker

Answer

Next-generation firewall

Answer

Data loss prevention

Question 5

A security architect is designing a hybrid cloud with AWS and on-premises data center. They need to enforce consistent security policies across both environments. Which approach is most effective?

Accepted Answer

Use Cisco Secure Cloud Analytics (Stealthwatch) with AWS Cloud integration. Option B is correct because Cisco Secure Cloud Analytics (Stealthwatch) integrates with AWS Cloud via API to ingest flow logs, VPC logs, and NetFlow, enabling centralized visibility and consistent policy enforcement across hybrid environments. This approach avoids policy fragmentation by applying a unified security analytics layer that can detect anomalies and enforce responses in both AWS and on-premises networks without requiring separate policy management.

Answer

Deploy separate Cisco Firepower instances in AWS and on-prem, each with independent policies

Answer

Use AWS CloudTrail and AWS Config for on-premises resources

Answer

Establish a site-to-site VPN and use AWS Security Groups for both environments

Question 6

An organization uses AWS with a VPC and wants to inspect all traffic between instances in the same subnet using Cisco Firepower. What must be implemented?

Accepted Answer

AWS Traffic Mirroring to send traffic to a Firepower appliance. AWS Traffic Mirroring captures and forwards network traffic from Elastic Network Interfaces (ENIs) to a security appliance, such as a Cisco Firepower instance, for inspection. This allows the organization to monitor all traffic between instances within the same subnet without requiring changes to the routing table or placing the Firepower inline, which is not possible in a VPC without a gateway appliance. Option B is correct because Traffic Mirroring is the native AWS feature designed for out-of-band traffic inspection.

Answer

Configure VPC Endpoints to route traffic through Firepower

Answer

Use AWS Security Groups and log to Firepower

Answer

Deploy Firepower as a transparent bridge in the subnet

Question 7

A DevOps team is deploying containers in Kubernetes and needs to enforce network security policies between pods. Which Cisco solution is designed for this?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Secure Workload (formerly Tetration) is the correct answer because it provides micro-segmentation and network policy enforcement for containerized environments like Kubernetes. It uses agent-based and agentless sensors to map all inter-pod traffic flows and enforce whitelist-based policies at the kernel level via eBPF or iptables, ensuring zero-trust between pods without requiring changes to the underlying network fabric.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Question 8

Refer to the exhibit. A user is unable to access Dropbox, which is a high-risk application. The administrator wants to allow Dropbox but still block other high-risk apps. What is the most efficient way to achieve this?

Accepted Answer

Create a new Cloudlock policy that allows Dropbox for all users, placed with higher priority. Option C is correct because Cisco Cloudlock uses a policy-based approach where policies are evaluated in order of priority. By creating a new policy with higher priority that explicitly allows Dropbox, the administrator can override the existing block policy for that specific application while maintaining the block on all other high-risk apps. This is the most efficient method as it avoids modifying or deleting the original policy.

Answer

Add the user to a group that is exempt from the policy

Answer

Delete the existing policy and create separate policies for each high-risk app

Answer

Modify the existing policy to change risk level to 'Medium'

Question 9

A company is implementing cloud security posture management (CSPM). Which Cisco product provides CSPM capabilities?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is Cisco's cloud-native cloud security posture management (CSPM) solution. It continuously monitors cloud infrastructure (e.g., AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks, providing automated remediation and visibility into cloud security posture. This directly aligns with the CSPM use case described in the question.

Answer

Cisco Tetration

Answer

Cisco Firepower

Answer

Cisco ISE

Question 10

During a cloud migration, an organization notices increased latency in AWS workloads when using Cisco Firepower for traffic inspection. What is the most likely cause?

Accepted Answer

The Firepower instance is undersized for the traffic volume. When using Cisco Firepower for traffic inspection in AWS, the Firepower instance must process all traffic traversing the virtual appliance. If the instance type (e.g., m5.large) is undersized relative to the throughput demands (e.g., exceeding 1 Gbps), packet processing will queue, causing increased latency. This is a common scaling issue in cloud migrations where on-premises traffic patterns are replicated without adjusting instance sizing.

Answer

The VPC routing table is misconfigured, causing traffic to hairpin

Answer

AWS WAF is conflicting with Firepower rules

Answer

Firepower is inspecting encrypted traffic without SSL decryption

Question 11

Refer to the exhibit. A security analyst notices this CloudTrail log entry. Which security best practice is being violated?

Accepted Answer

RDP access is allowed from any IP address (0.0.0.0/0). The CloudTrail log shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing RDP (port 3389) from `0.0.0.0/0`, which means any IP on the internet. This violates the security best practice of restricting administrative access to trusted IP addresses only. Allowing RDP from all sources exposes the instance to brute-force attacks and unauthorized access attempts.

Answer

SSH access is allowed from a single IP

Answer

Port 22 is open to the internet

Answer

The user identity is an admin account

Question 12

Which TWO of the following are benefits of using Cisco Cloudlock for cloud security? (Choose two.)

Accepted Answer

Shadow IT discovery. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into cloud application usage. Option A is correct because Cloudlock's Shadow IT discovery feature identifies unauthorized cloud applications being used by employees, allowing administrators to assess risk and enforce policies. This is a core CASB function that discovers and categorizes cloud apps based on user traffic patterns.

Answer

DDoS protection

Answer

Network firewall capabilities

Answer

Identity and access management

Question 13

A company uses Cisco Umbrella to enforce web security. After deploying a new policy that blocks all social media sites, users report that they cannot access a corporate Salesforce instance that uses a social login feature. Which Umbrella setting should be adjusted to resolve the issue without weakening the policy?

Accepted Answer

Add Salesforce to the Application Settings allowed list. Option D is correct because the social login feature for Salesforce is being blocked by the Social Networking content category in Cisco Umbrella. By adding Salesforce to the Application Settings allowed list, you permit the specific application traffic while keeping the broader social media policy intact. This granular control ensures that only the required Salesforce instance bypasses the block, without weakening the overall security posture.

Answer

Create a bypass code for users to access Salesforce

Answer

Disable the Social Networking category under Content Categories

Answer

Configure Intelligent Proxy to inspect Salesforce traffic

Question 14

An engineer is troubleshooting a Cisco WSA that is failing to block malware downloads from a specific cloud storage website. The URL filtering policy is set to block the 'Cloud Storage' category, and the Web Reputation score is set to block scores below -5.0. Users can still download files. What is the most likely cause?

Accepted Answer

The file type is not configured for malware inspection. The Cisco WSA can block malware downloads only if it inspects the file content. If the file type is not configured for malware inspection, the WSA will allow the download even if the URL category and reputation score are set to block. This is because malware inspection requires explicit configuration of file types (e.g., .exe, .zip) to scan for threats, and without it, the WSA bypasses deep content analysis.

Answer

HTTPS proxy decryption is not configured

Answer

The L4 Traffic Monitor is not enabled

Answer

The users are not authenticated

Question 15

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

350-701 Practice Test 20 — 15 Questions

Exhibit

350-701 Practice Test 20 — 15 Questions

Exhibit