350-701 Practice Exam 2 — 20 Questions

Question 1

An organization uses Cisco ESA and wants to implement a policy that automatically encrypts emails containing credit card numbers before delivery. What feature should be used?

Accepted Answer

DLP policy with encryption action. D is correct because Cisco ESA includes a Data Loss Prevention (DLP) feature that can scan email content for sensitive data patterns, such as credit card numbers (matching Luhn algorithm and known issuer prefixes). When a match is found, the DLP policy can trigger an encryption action, automatically encrypting the email before delivery to protect the sensitive information in transit.

Answer

Anti-spam engine

Answer

Anti-virus engine

Answer

Email authentication (SPF, DKIM)

Question 2

A company uses Cisco ISE for network access control. They want to authenticate users connecting via VPN using multi-factor authentication. Which solution integrates with ISE to provide MFA for AnyConnect VPN?

Accepted Answer

Cisco Duo. Cisco Duo integrates with ISE and AnyConnect to provide multi-factor authentication for VPN access.

Answer

Cisco AMP for Endpoints

Answer

Cisco SecureX

Answer

CyberArk

Question 3

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. HashiCorp Vault is a dedicated secrets management solution that dynamically generates, leases, and revokes secrets, and integrates with cloud-native platforms via sidecars or CSI drivers. It avoids hardcoding secrets in images, environment variables, or repositories by providing secure injection at runtime.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 4

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

Question 5

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Accepted Answer

Enable TCP Intercept with a low threshold. TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.

Answer

Increase the connection timeout

Answer

Implement an access-list to allow only known source IPs

Answer

Configure a static route to null0 for the server's IP

Question 6

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 7

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 8

Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?

Accepted Answer

Ransomware. Ransomware encrypts data and demands ransom.

Answer

RAT

Answer

Keylogger

Answer

Botnet

Question 9

An organization wants to prevent employees from accessing social media websites during work hours. Which Cisco WSA feature should be used to enforce this policy?

Accepted Answer

URL filtering. URL filtering on Cisco WSA allows administrators to block or allow access to websites based on URL categories, including social media. It uses a cloud-based categorization database to enforce acceptable use policies during specified hours. This directly addresses the requirement to prevent social media access.

Answer

SSL/TLS decryption

Answer

AMP file scanning

Answer

AVC (Application Visibility and Control)

Question 10

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. EDR (Endpoint Detection and Response) focuses on detecting, investigating, and responding to threats on endpoints, so process isolation (B) is correct because it lets the agent terminate or suspend a malicious process to stop its execution while preserving forensic state. Remote shell investigation (C) is correct because EDR platforms provide remote access to an endpoint's command shell or live-response console so analysts can run commands, inspect memory, and gather artifacts without disrupting the user. File quarantine (E) is correct because EDR can automatically or manually move malicious files to an isolated location, neutralizing the threat while retaining the sample for analysis. Multi-factor authentication (A) is an identity/access control measure, not an endpoint detection-and-response function, and application whitelisting (D) is a preventive application-control technique rather than an EDR detection/investigation/response capability.

Answer

Multi-factor authentication

Answer

Application whitelisting

Question 11

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The command dot1x system-auth-control is a global configuration command that enables 802.1X authentication on the switch. Without it, the per-interface dot1x pae authenticator and authentication port-control auto commands have no effect because the 802.1X process is not globally enabled. This is why the client sends EAPoL-Start but the switch never responds with EAP-Request/Identity.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 12

Cisco ISE is configured with posture assessment to ensure endpoints meet security requirements before gaining network access. After a posture check, ISE needs to dynamically change the VLAN assignment for a non-compliant endpoint. Which ISE feature enables this real-time change?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically update authentication and authorization attributes such as VLAN assignment.

Answer

TrustSec

Answer

Guest portal

Answer

Profiling

Question 13

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Option C is correct because Cisco CloudLock DLP policies rely on content-matching rules that identify sensitive data such as PII using predefined or custom regex/pattern definitions, which is the detection mechanism required before any alerting can occur. Option D is correct because the scenario specifically requires detecting and alerting on external sharing of PII files, so a policy must be configured with the external-sharing trigger and an alert action tied to the PII DLP rule. Option A is incorrect because the requirement is to detect and alert, not to automatically block, and blocking all external PII sharing exceeds the stated scope. Option B is incorrect because disabling external sharing application-wide is a blunt control that prevents legitimate collaboration and does not provide the required detection and alerting. Option E is incorrect because a transparent proxy inspects network traffic and is not the mechanism used to enforce CloudLock SaaS API-based DLP policies on files shared within a cloud application.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 14

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 15

An engineer is configuring Cisco ISE for 802.1X authentication. The network has many printers and IP phones that do not support 802.1X supplicant software. Which ISE feature should be used to allow these devices to authenticate?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

Answer

Posture assessment

Answer

Guest access with sponsor portal

Answer

Profiling via DHCP probe

Question 16

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation (A) is correct because it enforces granular, identity- and workload-based policies between internal segments, so stolen credentials alone cannot freely reach other servers and lateral movement paths are blocked or alerted. Network behavioral analytics such as Stealthwatch (D) is correct because it baselines normal east-west traffic and uses flow telemetry to detect anomalous internal connections, beaconing, and unusual data transfers indicative of lateral movement and exfiltration. Endpoint detection and response (EDR) (E) is correct because it monitors process, credential, and command activity on hosts, detecting techniques like pass-the-hash, remote service creation, and suspicious lateral tooling, and can isolate the endpoint. A stateful firewall at the perimeter (B) only inspects traffic crossing the network edge and does not see or stop internal east-west lateral movement. SSL inspection (C) decrypts TLS traffic for content inspection but by itself neither segments the internal network nor correlates host/network behavior to detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 17

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 18

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

Accepted Answer

Remote shell investigation. Cisco AMP for Endpoints includes endpoint detection and response (EDR) capabilities such as remote shell, which allows analysts to execute commands on the endpoint for investigation.

Answer

Process isolation

Answer

File quarantine

Answer

IOC scanning

Question 19

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

Accepted Answer

CWPP. CWPP (Cloud Workload Protection Platform) provides security for workloads across clouds.

Answer

CSPM

Answer

CASB

Answer

SIG

Question 20

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Option A is correct because creating custom whitelist exclusions for trusted applications prevents legitimate business software from being quarantined or blocked, directly reducing false positives while still allowing AMP for Endpoints to enforce its policies on unknown or untrusted files. Option B is correct because group-based policies let the engineer tailor detection and blocking rules to specific endpoint populations (for example, developers versus standard users), so aggressive settings are not applied where they would generate unnecessary false positives. Option D is correct because setting file reputation to block only files with a 'Malicious' disposition avoids blocking files with 'Unknown' or 'Clean' verdicts, which are common sources of false positives, while still stopping confirmed threats. Option C is not correct because enabling all exploit prevention rules regardless of environment ignores the need to tune protections to the actual software and workloads in use, which increases false positives. Option E is not correct because disabling file reputation removes a core AMP for Endpoints protection layer and its cloud lookups, weakening detection rather than minimizing false positives while maintaining strong protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries