350-701 Practice Exam 3 — 20 Questions

Question 1

An organization wants to deploy AMP for Endpoints in an offline environment where endpoints cannot connect to the internet. Which deployment option is appropriate?

Accepted Answer

Install a Cisco AMP Private Cloud appliance within the local network and point connectors to it.. Cisco AMP for Endpoints offers a Private Cloud appliance that can be deployed on-premises in an offline environment. This appliance replicates all cloud-based threat intelligence and analysis locally, allowing endpoints to communicate with it via the AMP connector without requiring internet access. The Private Cloud appliance handles all file disposition, retrospective alerts, and policy updates within the local network.

Answer

Deploy the AMP connectors with a local proxy caching all AMP communications.

Answer

Configure the AMP connectors in 'Standalone' mode to operate without cloud communication.

Answer

Use Cisco ESA as an intermediary to proxy AMP requests from endpoints.

Question 2

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to send updates to the network device to change VLAN, ACL, or other attributes without requiring the endpoint to re-authenticate.

Answer

MAB

Answer

Profiling

Answer

TrustSec

Question 3

A Cisco FTD device is deployed in inline mode and configured with an SSL policy to decrypt traffic. The policy uses 'Decrypt - Known Key' for traffic to an internal server. What is required for this decryption to work?

Accepted Answer

The FTD must have the server's private key imported.. 'Decrypt - Known Key' requires the server's private key to be imported into the FTD so it can decrypt the traffic by impersonating the server.

Answer

The FTD must generate a new certificate for each session.

Answer

The server's certificate must be signed by a public CA.

Answer

The client must trust the FTD's CA certificate.

Question 4

An organization wants to deploy endpoint hardening by allowing only approved applications to run. Which technology should be implemented to achieve this?

Accepted Answer

Application whitelisting. Application whitelisting is the correct technology because it enforces endpoint hardening by explicitly allowing only approved applications to execute, blocking all others by default. This is a fundamental principle of least privilege and is often implemented using tools like Windows AppLocker or Cisco AMP's application control, which maintain a hash-based or path-based allow list.

Answer

EDR

Answer

Host-based IPS

Answer

Antivirus software

Question 5

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Accepted Answer

1. Check IP reachability between peers. 2. Verify UDP port 500 is open. 3. Compare IKE proposals. 4. Verify pre-shared keys. 5. Use debug commands.. Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Answer

1. Verify pre-shared keys. 2. Check IP reachability. 3. Compare IKE proposals. 4. Verify UDP port 500 is open. 5. Use debug commands.

Answer

1. Use debug commands immediately. 2. Verify UDP port 500 is open. 3. Check IP reachability. 4. Compare IKE proposals. 5. Verify pre-shared keys.

Answer

1. Check IP reachability. 2. Compare IKE proposals. 3. Verify UDP port 500 is open. 4. Use debug commands. 5. Verify pre-shared keys.

Question 6

Match each Cisco security solution to its primary use case.

Accepted Answer

Cisco ASA: Provides stateful firewall and VPN capabilities.. Cisco ASA is a firewall/VPN solution, Firepower is NGFW/IPS, and ISE handles network access control. Common confusions involve mixing ASA with ISE or Firepower with Umbrella.

Answer

Cisco ASA: Enforces network access control and policy.

Answer

Cisco Firepower: Provides DNS-layer security for internet traffic.

Question 7

An organization wants to deploy endpoint hardening measures. Which three of the following are considered endpoint hardening techniques? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting, host-based IPS, and EDR capabilities are all endpoint hardening techniques that protect endpoints by controlling what runs, detecting threats, and enabling response.

Answer

RADIUS authentication

Answer

SNMP polling

Question 8

An enterprise wants to prevent data exfiltration from its SaaS applications to unauthorized personal cloud storage. Which Cisco solution should be deployed?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct solution because it is a cloud-native CASB (Cloud Access Security Broker) specifically designed to protect SaaS applications like Office 365 and Salesforce. It provides data loss prevention (DLP) policies that can detect and block the exfiltration of sensitive data to unauthorized personal cloud storage services by inspecting API traffic and user activities in real time.

Answer

Cisco Umbrella

Answer

Cisco Duo

Answer

Cisco Firepower NGFW

Question 9

A network administrator needs to provide network access to a legacy printer that does not support 802.1X. Which Cisco ISE feature should be used to authenticate this device?

Accepted Answer

MAC Authentication Bypass. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicant software to authenticate based on their MAC address. ISE can be configured to accept the MAC address as the credential.

Answer

Posture assessment

Answer

Guest access with self-registration

Answer

Profiling using DHCP probe

Question 10

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

Accepted Answer

The request is blocked if the domain is identified as malicious by Umbrella's threat intelligence. Umbrella's DNS-layer security can block domains based on intelligence feeds, including newly observed malicious domains. It does not need categorization; it uses real-time threat intelligence. The intelligent proxy is separate.

Answer

The request is redirected to a captive portal for user awareness

Answer

The request is allowed because the domain is not categorized

Answer

The request is proxied through the intelligent proxy for inspection

Question 11

A security engineer is configuring Duo for VPN authentication with AnyConnect. Which authentication factor does Duo provide in addition to the user's primary credentials?

Accepted Answer

Second-factor authentication (push, TOTP, etc.). Duo provides second-factor authentication, typically via push notification, TOTP, or hardware token, which is used after the user enters their primary credentials (e.g., LDAP password).

Answer

RADIUS accounting

Answer

SAML assertion

Answer

Machine certificate validation

Question 12

A network administrator is configuring 802.1X on a Cisco switch for corporate Windows laptops. The organization uses certificates for authentication. Which EAP method should be configured on the supplicant and ISE to provide certificate-based mutual authentication?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST

Question 13

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. A dedicated secrets management tool like HashiCorp Vault securely stores and provides access to secrets (API keys, passwords) without embedding them in code or environment variables. Azure Key Vault and AWS Secrets Manager are also valid, but Vault is a common cross-platform solution. The other options are insecure.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 14

A company wants to implement network access control for IoT devices that do not support 802.1X. Which Cisco ISE feature can be used to grant these devices network access based on their MAC address?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.

Answer

Guest access

Answer

Profiling

Answer

Posture assessment

Question 15

A DevOps team is deploying containers in Kubernetes and needs to enforce network security policies between pods. Which Cisco solution is designed for this?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Secure Workload (formerly Tetration) is the correct answer because it provides micro-segmentation and network policy enforcement for containerized environments like Kubernetes. It uses agent-based and agentless sensors to map all inter-pod traffic flows and enforce whitelist-based policies at the kernel level via eBPF or iptables, ensuring zero-trust between pods without requiring changes to the underlying network fabric.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Question 16

A university is using Cisco ESA to manage email for 20,000 students and staff. They have implemented anti-spam and anti-virus policies. Recently, the IT helpdesk has been receiving complaints that legitimate emails from external senders (such as admissions notifications) are being marked as spam and quarantined. The administrators check the ESA and find that these emails are being flagged with a spam score above the threshold, but the content appears to be legitimate. The sending domains are not on any blacklist. The ESA is using default anti-spam settings. What should the administrator do to reduce false positives without compromising security?

Accepted Answer

Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).. Adding the legitimate sender domains or IPs to the ESA's SenderBase whitelist explicitly bypasses anti-spam scanning for those trusted sources, reducing false positives while maintaining security for all other inbound email. This approach leverages the ESA's reputation-based filtering to allow known good senders without lowering the global spam threshold or disabling protection entirely.

Answer

Create a content filter to allow any email with 'admissions' in the subject.

Answer

Disable anti-spam scanning for all inbound email.

Answer

Lower the spam threshold to decrease sensitivity.

Question 17

A network engineer is configuring Cisco ISE for wireless 802.1X authentication. The company wants to use certificate-based authentication for all corporate devices. Which EAP method should be configured?

Accepted Answer

EAP-TLS. EAP-TLS uses digital certificates for mutual authentication between the client and the server, providing strong security without requiring passwords.

Answer

EAP-MD5

Answer

PEAP-MSCHAPv2

Answer

LEAP

Question 18

A company uses Cisco WSA to proxy web traffic. After configuring a decryption policy to inspect HTTPS traffic to a specific external site, users report they can still access the site without any warning or interruption. Which action should the administrator take to ensure HTTPS inspection is applied?

Accepted Answer

Change the policy action from 'Passthrough' to 'Decrypt'. The decryption policy must have an action of 'Decrypt' to actually perform HTTPS inspection. If the policy action is set to 'Passthrough', the WSA forwards the traffic without decrypting it, so users experience no warning or interruption. Changing the action to 'Decrypt' forces the WSA to intercept the TLS handshake, decrypt the traffic, and apply security policies.

Answer

Add the site to the 'HTTPS Bypass' list

Answer

Import the WSA root CA certificate into client browsers

Answer

Move the decryption policy to the top of the list

Question 19

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

Accepted Answer

The posture policy requires a specific version that is not installed.. The log indicates a missing application, but it is installed. This often occurs when the posture policy requires a specific version or patch level. Option A is incorrect because antivirus definitions are separate. Option C is incorrect because agent version would cause a different error. Option D is incorrect because firewall blocking would prevent scan results.

Answer

The NAC Agent is running an outdated version.

Answer

The endpoint's firewall is blocking the ISE posture probe.

Answer

The antivirus definition file is outdated.

Question 20

A network security engineer is configuring site-to-site IPsec VPN between two Cisco ASA firewalls using IKEv2. Which of the following configuration elements is required to define the encryption and integrity algorithms for the IPsec SA?

Accepted Answer

Transform set. In IKEv2, the IPsec SA parameters (encryption, integrity, etc.) are defined in the transform set. IKEv2 uses a single transform set. ISAKMP policy is for IKEv1 phase 1. Crypto map binds the transform set to a peer and interface. VTI is a virtual interface for routing but not for algorithm definition.

Answer

Crypto map

Answer

Virtual Tunnel Interface (VTI)

Answer

ISAKMP policy