350-701 Practice Test 20 — 15 Questions

Question 1

Which TWO are valid considerations for deploying Cisco Firepower NGIPS with inline mode? (Choose two.)

Accepted Answer

Inline interfaces can drop malicious packets based on signatures and anomalies.. Option C is correct because in inline (routed or transparent) NGIPS deployment, traffic actually flows through the inspection interfaces, so the IPS engine can drop packets that match signatures or anomaly-based detections rather than merely alerting on a copy of the traffic. Option E is correct because specific Firepower appliances (for example, certain 3D7000/8000 series and NGIPS appliances with supported bypass NICs) provide hardware bypass, which physically bridges the inline interfaces if the device loses power or fails, preserving network continuity. Option A is wrong because SSL decryption is never automatic; it requires configuring SSL policies with certificates and, typically, a resigning CA. Option B is wrong because prefilter policies can bypass or fastpath traffic before deep inspection, so not all traffic is necessarily inspected by the IPS engine. Option D is wrong because inline deployments use inline interface pairs (or inline sets), not passive interfaces, for failover; passive interfaces are used for IDS/monitoring-only deployments.

Answer

Inline mode automatically decrypts SSL traffic without configuration.

Answer

The IPS engine inspects all traffic regardless of prefilter policies.

Answer

Inline mode requires the use of passive interfaces for failover.

Question 2

A Cisco FTD device is deployed inline and configured with an access control policy that includes a rule to block traffic from a specific source IP address. However, traffic from that IP is still passing through. What is the most likely cause?

Accepted Answer

A trust rule exists before the block rule in the policy. In Cisco Firepower access control policies, rules are evaluated in order from top to bottom. If a trust rule (which allows traffic without further inspection) appears before the block rule, the traffic from the specific source IP will match the trust rule first and be allowed, bypassing the subsequent block rule. This is the most likely cause of the traffic still passing.

Answer

The rule is assigned to the wrong interface

Answer

The intrusion policy is overriding the block action

Answer

The device is in passive mode

Question 3

An organization is adopting a zero-trust model for cloud access. Which component enforces conditional access policies based on user, device, location, and risk level in Azure AD?

Accepted Answer

Azure AD Conditional Access. Microsoft Entra Conditional Access is the policy engine that evaluates signals such as user identity, device compliance, location, and risk level to enforce access controls. It acts as the decision point in zero-trust, applying if-then policies to grant or block access and require additional verification like MFA. Unlike other tools, it directly enforces conditional access policies in real time.

Answer

Azure AD Identity Protection

Answer

Azure Security Center

Answer

Privileged Identity Management (PIM)

Question 4

Which THREE of the following are common indicators of a DDoS attack at the network layer?

Accepted Answer

A spike in UDP traffic to a single target. A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.

Answer

Unusual traffic on non-standard TCP/UDP ports

Answer

High CPU usage on network devices

Question 5

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

Accepted Answer

Block execution of the file. Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Answer

Allow the file after a scan

Answer

Encrypt the file to prevent harm

Answer

Delete the file

Question 6

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

Accepted Answer

The authentication server is unreachable and the port is using the critical VLAN. The 'CRITICAL' state in 'show authentication sessions' indicates that the switch port has lost connectivity to the authentication server (RADIUS) and has fallen back to the configured critical VLAN. This is a failover mechanism defined in IEEE 802.1X and Cisco's critical-auth feature, where the port is placed into a pre-configured VLAN to maintain network access for the host despite the server being unreachable.

Answer

The host is being authenticated via MAB

Answer

The port is administratively down

Answer

The authentication attempt was rejected by the RADIUS server

Question 7

A network architect is designing a DMZ for a web server farm. The ASA firewall will have three interfaces: inside (level 100), DMZ (level 50), and outside (level 0). They want to allow HTTP traffic from the internet to the DMZ web servers and also allow the web servers to initiate connections to the inside for database updates. What is the minimal ACL configuration to achieve this?

Accepted Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.. The ASA assigns security levels to interfaces and by default permits traffic from higher to lower security levels, but traffic from lower to higher (outside to DMZ, DMZ to inside) requires an explicit ACL. To allow internet-to-DMZ HTTP, an ACL on the outside interface inbound is needed; to allow DMZ-to-inside database traffic, an ACL on the DMZ interface inbound is needed. Option D matches this minimal configuration.

Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on inside interface inbound permitting database traffic from DMZ.

Answer

No ACL needed because traffic from higher to lower is implicitly allowed.

Answer

ACL on inside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.

Question 8

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

Accepted Answer

Create an application exception in Exploit Prevention policy. Cisco AMP for Endpoints' Exploit Prevention engine uses behavioral analysis to block suspicious activities, and legitimate software may trigger these heuristics. Creating an application exception in the Exploit Prevention policy allows the specific software to run without disabling the entire engine, preserving protection against other exploits. This targeted exception maintains maximum security by only exempting the known legitimate application from exploit detection rules.

Answer

Disable Exploit Prevention entirely on affected endpoints

Answer

Add the software's executable hash to the file exclusion list

Answer

Set Exploit Prevention to 'Audit' mode

Question 9

A security administrator is tasked with implementing a solution that provides single sign-on (SSO) for users accessing multiple enterprise applications. The solution must support SAML 2.0 and integrate with the existing Microsoft Active Directory. Which component is essential for this architecture?

Accepted Answer

Identity Provider (IdP). An Identity Provider (IdP) is the essential component that authenticates users against Microsoft Active Directory and issues SAML 2.0 assertions to enable single sign-on (SSO) across multiple enterprise applications. The IdP acts as the trusted source of identity, validating credentials and generating signed SAML tokens that Service Providers (SPs) accept without requiring separate logins.

Answer

Certificate Authority (CA)

Answer

RADIUS server

Answer

Service Provider (SP)

Question 10

A network team is configuring Cisco FTD for a new branch office. They want to allow outbound web traffic but block all inbound traffic except for a specific public server. Which policy type should be used to allow the return traffic for outbound connections?

Accepted Answer

A stateful access rule. Cisco FTD uses a stateful firewall engine that tracks the state of outbound connections. When a stateful access rule permits outbound web traffic, the firewall automatically creates a dynamic pinhole for the return traffic, eliminating the need for explicit inbound rules. This is the correct policy type because it maintains session state and allows only related return packets, aligning with the requirement to block all other inbound traffic.

Answer

A stateless ACL

Answer

A NAT rule

Answer

SSL decryption

Question 11

An organization uses Cisco ISE with TrustSec to assign Security Group Tags (SGTs) to endpoints based on their role. An endpoint initially receives an SGT for 'Employees' but after a posture check reveals missing antivirus updates, ISE changes the SGT to 'Quarantine'. Which ISE feature dynamically updates the SGT?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) is the correct answer because it is the RADIUS-based mechanism (RFC 5176) that allows Cisco ISE to dynamically update an endpoint's Security Group Tag (SGT) after a posture check. When the posture assessment detects missing antivirus updates, ISE sends a CoA request to the network access device (e.g., switch or wireless LAN controller) to reauthenticate the session or push a new SGT, effectively moving the endpoint from 'Employees' to 'Quarantine' without requiring the user to manually reconnect.

Answer

Posture assessment

Answer

Guest access

Answer

Profiling

Question 12

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Accepted Answer

1. Check IP reachability between peers. 2. Verify UDP port 500 is open. 3. Compare IKE proposals. 4. Verify pre-shared keys. 5. Use debug commands.. Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Answer

1. Verify pre-shared keys. 2. Check IP reachability. 3. Compare IKE proposals. 4. Verify UDP port 500 is open. 5. Use debug commands.

Answer

1. Use debug commands immediately. 2. Verify UDP port 500 is open. 3. Check IP reachability. 4. Compare IKE proposals. 5. Verify pre-shared keys.

Answer

1. Check IP reachability. 2. Compare IKE proposals. 3. Verify UDP port 500 is open. 4. Use debug commands. 5. Verify pre-shared keys.

Question 13

Which TWO of the following are correct about Cisco Umbrella's multi-layered security approach? (Choose two.)

Accepted Answer

DNS-layer security. DNS-layer security is a core component of Cisco Umbrella's multi-layered approach. It blocks requests to malicious domains at the earliest stage of the connection, before any IP address resolution occurs, by inspecting DNS queries against threat intelligence feeds. This prevents users from reaching known phishing, malware, or command-and-control (C2) domains.

Answer

Firewall as a Service

Answer

IP reputation filtering

Answer

Sandboxing for malicious file analysis

Question 14

An organization uses Cisco Umbrella to protect remote users. The security team notices that some malicious domains are not blocked because users are bypassing the DNS layer by using direct IP connections or non-DNS protocols. Which Cisco Umbrella feature should be enabled to inspect all traffic, including non-web traffic, and enforce policies regardless of DNS resolution?

Accepted Answer

Secure Internet Gateway (SIG). Cisco Umbrella Secure Internet Gateway (SIG) is the correct answer because it extends protection beyond DNS-layer security to inspect all traffic, including non-web and non-DNS protocols, by acting as a cloud-based secure web gateway. SIG provides full Layer 3/4 and Layer 7 inspection, enforcing policies on direct IP connections, non-standard ports, and protocols like SSH or FTP that bypass DNS filtering. This ensures that even if a user attempts to connect directly to a malicious IP, the traffic is still inspected and blocked according to policy.

Answer

Intelligent Proxy

Answer

Umbrella Roaming Client

Answer

DNS-layer Security

Question 15

Which TWO of the following are required to configure a site-to-site IPsec VPN on a Cisco IOS router?

Accepted Answer

ISAKMP policy. Option A (ISAKMP policy) is correct because a site-to-site IPsec VPN on Cisco IOS requires Phase 1 IKE negotiation parameters — encryption, hash, authentication, and Diffie-Hellman group — which are defined in the ISAKMP (IKE) policy via the crypto isakmp policy command. Option B (ACL to define interesting traffic) is correct because the crypto ACL identifies which packets are protected by IPsec through the crypto map's match address statement, determining what traffic gets encrypted and tunneled between the peers. Option C (NAT exemption for VPN traffic) is not required to configure the VPN itself; it is only needed when NAT is also configured on the router and would otherwise translate VPN-bound traffic, so it is a conditional add-on rather than a mandatory element. Option D (AAA new-model) is not required — AAA is used for authentication, authorization, and accounting of users, not for establishing site-to-site IPsec tunnels, which rely on pre-shared keys or certificates. Option E (DHCP pool for remote clients) is not required because site-to-site VPNs connect two gateways with static peer addresses and do not involve remote access clients needing DHCP-assigned addresses.

Answer

NAT exemption for VPN traffic

Answer

AAA new-model

Answer

DHCP pool for remote clients