350-701 Practice Exam 2 — 20 Questions

Question 1

An administrator notices that some users receive spam messages even though the ESA policy is set to 'Quarantine' for suspected spam. The messages are not found in the user's spam quarantine. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incoming mail is received on a listener that does not apply the anti-spam engine.. If incoming mail is received on a mail policy (listener) that does not have the anti-spam engine enabled, the ESA will not apply any spam filtering to those messages. Even though the global or default policy may be set to 'Quarantine', the listener configuration determines which security services are invoked. Without the anti-spam engine on that listener, messages bypass spam detection entirely and are delivered directly to the user's inbox, never appearing in the spam quarantine.

Answer

The sender's IP is in the allow list.

Answer

The spam threshold is set too low.

Answer

The anti-spam engine signatures are outdated.

Question 2

A company uses FMC to manage FTD devices. After deploying a new intrusion policy, the analyst sees that no events are generated for a known vulnerability, even though the policy includes a rule for it. The analyst checks and the rule is enabled and the policy is applied. What is the most likely cause?

Accepted Answer

The access control policy before the intrusion policy is blocking traffic.. In a Cisco Firepower deployment, the access control policy (ACP) is evaluated before the intrusion policy. If the ACP is configured to block traffic matching the vulnerability's characteristics, the traffic never reaches the intrusion policy for inspection, so no intrusion events are generated even if the intrusion rule is enabled and applied.

Answer

The rule is configured to 'Drop and Generate Events' but the device is in inline tap mode.

Answer

The device has not been rebooted after policy deployment.

Answer

The intrusion policy rule has a false-positive suppression.

Question 3

A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?

Accepted Answer

Install a Certificate Authority (CA) certificate on the WSA and distribute it to clients. The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.

Answer

Create a bypass list for internal sites

Answer

Configure an Access Control List (ACL) to allow decryption

Answer

Configure user authentication

Question 4

You are tasked with securing a new cloud deployment on AWS. The environment consists of a web application running on EC2 instances behind an Application Load Balancer (ALB), with data stored in an RDS database. The security requirements include: (1) protect against web application attacks (SQL injection, XSS), (2) ensure only authorized users can access the application, (3) monitor for anomalous behavior. You have decided to use AWS WAF for web application protection, AWS Cognito for user authentication, and Amazon GuardDuty for threat detection. However, the CISO also wants to integrate with Cisco's security portfolio for centralized management and visibility. Which Cisco product would best integrate with these AWS services to provide centralized security management?

Accepted Answer

Cisco Secure Cloud Analytics (Stealthwatch). Cisco Secure Cloud Analytics (Stealthwatch) is the correct choice because it provides centralized visibility and threat detection across hybrid cloud environments, including AWS. It integrates with AWS CloudWatch and VPC Flow Logs to ingest network telemetry, and it can correlate alerts from AWS GuardDuty, WAF, and Cognito into a single pane of glass for security operations. This aligns with the CISO's requirement for centralized management and visibility using Cisco's security portfolio.

Answer

Cisco Firepower NGFW

Answer

Cisco Cloudlock

Answer

Cisco Tetration

Question 5

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

Accepted Answer

Enable DMARC with reject policy. Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Answer

Disable SPF checking

Answer

Increase the SBRS threshold

Answer

Reduce DLP scanning sensitivity

Question 6

A company wants to implement two-factor authentication for remote VPN access using Cisco AnyConnect. They need a solution that supports push notifications to a mobile app. Which Cisco product meets this requirement?

Accepted Answer

Cisco Duo. Cisco Duo provides multi-factor authentication with push notifications, TOTP, and other methods, and integrates with AnyConnect VPN.

Answer

Cisco SecureX

Answer

Cisco ISE with certificate-based authentication

Answer

Cisco AMP for Endpoints

Question 7

Which TWO actions can be configured in a Cisco ESA DLP policy to respond to a violation involving outbound credit card numbers? (Choose two.)

Accepted Answer

Encrypt the message using a secure policy. Cisco ESA DLP policies can automatically encrypt outbound messages containing sensitive data like credit card numbers. This ensures that even if the message is intercepted, the content remains protected, which is a common compliance requirement for PCI DSS.

Answer

Deliver the message with a CC to the compliance team

Answer

Add a disclaimer that the message is confidential

Answer

Bounce the message back to the sender

Question 8

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Accepted Answer

IKE_SA_INIT exchange. IKEv2 simplifies the Internet Key Exchange process by using only two exchanges to establish an IPsec security association: the IKE_SA_INIT exchange (for negotiating cryptographic parameters and exchanging Diffie-Hellman public values) and the IKE_AUTH exchange (for authenticating the peers and establishing the first child SA). These are the mandatory exchanges defined in RFC 7296, making options C and D correct. The INFORMATIONAL exchange is also a valid component of IKEv2, used for error reporting and deleting SAs, which is why option E is correct.

Answer

Aggressive Mode exchange

Answer

Main Mode exchange

Question 9

A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?

Accepted Answer

The trunk between core and access is not configured for SGT inline tagging. The core switch correctly maps IP 10.1.1.10 to SGT 2, as shown by 'show cts role-based sgt-map'. However, the access switch receives traffic without the SGT, meaning the SGT is not being propagated across the trunk. For SGT inline tagging to work, the trunk between core and access must have 'cts manual' enabled under the interface configuration. Without this, the SGT is stripped from the packet. Option C is correct because the missing 'cts manual' on the trunk prevents the access switch from seeing the SGT tag. Option A is incorrect because ISE policy controls authorization, not packet tagging. Option B is incorrect; the access switch lacking a security group ACL would not prevent the SGT from being present in the packet. Option D is incorrect; the SXP connection between ISE and core is functional since the core has the correct SGT mapping.

Answer

The ISE policy does not allow the traffic from web to app

Answer

The access switch does not have the security group ACL configured

Answer

The SXP connection between ISE and core is not established

Question 10

An organization requires that all endpoint traffic be verified against a security policy before being forwarded. Which Cisco umbrella solution provides this capability?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security service that enforces security policy by intercepting all DNS and IP-layer requests from endpoints and checking them against the organization's security policy before allowing traffic to proceed. This ensures that every connection attempt is verified at the DNS or IP layer, blocking threats before a TCP handshake is completed.

Answer

Cisco AnyConnect

Answer

Cisco Stealthwatch

Answer

Cisco Firepower NGFW

Question 11

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 12

An organization wants to enforce multi-factor authentication (MFA) for VPN access using Cisco AnyConnect. Which Cisco product integrates with AnyConnect to provide MFA via push notifications or one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Answer

Cisco SecureX

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 13

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Accepted Answer

Performs identity NAT between the two networks without port translation. The NAT rule shown in the exhibit is a static identity NAT (also known as NAT exempt or no-translation NAT) that translates the source IP address of traffic from the 192.168.1.0/24 network to the same IP address when going to the 10.0.0.0/24 network. This is achieved by specifying the source address as both the original and translated address, effectively bypassing any address translation while still being processed by the NAT engine. Since no port translation is configured, it performs identity NAT without PAT, which is why option A is correct.

Answer

Translates source IP when traffic goes from outside to inside

Answer

Enables Port Address Translation (PAT)

Answer

Translates destination IP from 192.168.1.0 to a public IP

Question 14

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Accepted Answer

Allow. In Firepower access control policy, the actions are Trust (skip further inspection), Allow (permit and inspect), Block (block traffic), and Interactive Block (present a block page). These are standard actions.

Answer

Log

Answer

Reset

Answer

Redirect

Question 15

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Cisco ISE's profiler service uses the MAC OUI (Organizationally Unique Identifier) to identify the hardware vendor, and DHCP fingerprints (specific option ordering in DHCP requests) to determine the exact operating system or device type. This passive profiling technique allows ISE to classify endpoints without requiring any agent installation.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 16

An engineer is configuring Cisco Secure Endpoint (AMP) connectors. Which deployment is supported for the macOS platform?

Accepted Answer

macOS. Cisco Secure Endpoint connectors are available for Windows, Mac, Linux, Android, and iOS. macOS is supported.

Answer

Android

Answer

Linux

Answer

iOS

Question 17

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Accepted Answer

NetFlow Probe. Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Answer

Syslog

Answer

RADIUS Accounting

Answer

SNMP Polling

Question 18

An endpoint with MAC 0011.2233.4455 and user 'guest' authenticates but fails. However, the device is not assigned to quarantine. Which policy condition is most likely responsible for the unexpected behavior?

Accepted Answer

The device is compliant and the device type is in the allowed list. The condition requires either 'EndPointCompliant EQUALS No' OR device type not in the list. If the device is compliant (posture passed) and the device type is in the list, the condition is false, so the quarantine rule is not applied, and a default permit rule might apply instead. Option A is incorrect because authentication failure would show 'Failed' and not reach authorization. Option B is incorrect because MAB is not in use here. Option D is incorrect because if the device were in quarantine, it would have been assigned.

Answer

The authentication failure overrides authorization

Answer

The quarantine VLAN is not configured on the switch

Answer

The device is authenticated via MAB, bypassing posture

Question 19

Match each security technology to its primary function.

Accepted Answer

Firewall: Filters traffic based on stateful inspection and access control lists.. Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Answer

Firewall: Monitors network traffic for malicious activity and can block or alert.

Answer

VPN: Enforces endpoint compliance and access policies.

Question 20

An administrator is configuring Cisco ISE to profile endpoints. The administrator wants to ensure that endpoints are correctly identified based on MAC address and hostname. Which of the following is a prerequisite for successful profiling?

Accepted Answer

The network devices must have profiling enabled and be configured with SNMP.. C is correct because Cisco ISE uses SNMP to query network devices (switches, wireless LAN controllers) for endpoint attributes such as MAC addresses and hostnames. Profiling must be enabled on the network devices, and SNMP (typically v2c or v3) must be configured so that ISE can collect the necessary data via MIBs like BRIDGE-MIB or ENTITY-MIB to correlate MAC-to-port mappings and hostname information.

Answer

The DHCP server must be configured with option 82.

Answer

The endpoints must have the ISE agent installed.

Answer

The switch must be configured with SNMP v3.