350-701 Practice Exam 3 — 20 Questions

Question 1

A company uses Cisco ISE for network access control. They want to allow employee-owned devices to access the guest network after a simple registration, while corporate devices get full access. Which ISE configuration best achieves this?

Accepted Answer

Use MAB for unknown devices, then perform posture assessment; redirect to registration portal if needed.. Option D is correct because MAB for unknown devices with posture check is a common BYOD flow. Option A forces 802.1X on all devices, which may not be supported on guest devices. Option B uses PSK which is less secure. Option C is for corporate devices.

Answer

Use 802.1X with PEAP and machine certificates for all devices.

Answer

Use MAB only for corporate devices and deny all others.

Answer

Configure a single PSK for the guest SSID.

Question 2

Which type of firewall is best suited to inspect application-layer traffic and protect against exploits like SQL injection?

Accepted Answer

Next-generation firewall with IPS and application visibility. A next-generation firewall (NGFW) with IPS and application visibility is best suited to inspect application-layer traffic and protect against exploits like SQL injection because it combines deep packet inspection (DPI), signature-based IPS, and application-level awareness. Unlike simpler firewalls, an NGFW can decode HTTP/HTTPS payloads, match patterns against SQL injection signatures (e.g., ' OR 1=1 --), and block malicious traffic at Layer 7 while maintaining stateful inspection.

Answer

Stateful firewall

Answer

Application proxy firewall

Answer

Packet-filtering firewall

Question 3

After applying a new extended ACL inbound on an interface, users report they can no longer reach a critical server on a different subnet. The ACL permits the server's IP and required ports. What is the most likely cause?

Accepted Answer

The ACL is missing a permit for necessary traffic (e.g., return traffic or ARP), triggering the implicit deny.. When an extended ACL is applied inbound on an interface, it filters traffic entering that interface before the routing decision. Even if the ACL permits the destination server's IP and required ports, it must also permit the return traffic (e.g., TCP acknowledgments, ICMP replies) from the server back to the users. If the ACL does not explicitly permit this return traffic, the implicit deny at the end of the ACL will drop it, breaking connectivity. This is the most common cause of connectivity loss after applying an inbound ACL.

Answer

The router has run out of memory for ACL processing.

Answer

The ACL is applied in the outbound direction instead of inbound.

Answer

The ACL is applied to the wrong interface.

Question 4

Which TWO methods can be used to enforce least privilege within a network infrastructure? (Choose two.)

Accepted Answer

Use Cisco TrustSec with SGTs and security group policies.. Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity, not just IP addresses. Security group policies then enforce least privilege by allowing or denying communication between SGTs, ensuring that only necessary traffic flows between endpoints.

Answer

Use a single administrator account with full privileges for all IT staff.

Answer

Place all users in the same VLAN without ACLs.

Answer

Configure source NAT on the firewall to hide internal addresses.

Question 5

Refer to the exhibit. An IPsec VPN tunnel between two routers is not passing traffic. IKE phase 1 is not complete (MM_NO_STATE). Phase 2 has no SA. Which issue is most likely causing the problem?

Accepted Answer

IKE policy mismatch (e.g., encryption, hash, or pre-shared key) causes phase 1 failure.. The IKE phase 1 state is MM_NO_STATE, which indicates that the Internet Key Exchange (IKE) Main Mode negotiation has not completed. This typically occurs when the peers cannot agree on the IKE policy parameters (encryption, hash, Diffie-Hellman group, authentication method, or pre-shared key). Since phase 2 (IPsec SA) depends on a successful phase 1, the failure cascades, making an IKE policy mismatch the most likely root cause.

Answer

The remote peer is not reachable due to a routing issue.

Answer

The ACL defining interesting traffic is misconfigured.

Answer

Mismatched IPsec transform sets between the peers.

Question 6

Refer to the exhibit. A network engineer applies a zone-based firewall policy to a router. Users in the INSIDE zone report they can access HTTP servers on the OUTSIDE zone but cannot resolve DNS names or access MS-SQL servers. What does the policy do to DNS and MS-SQL traffic?

Accepted Answer

They are dropped because the BAD_TRAFFIC class explicitly drops them.. The correct answer is B because the zone-based firewall policy explicitly defines a class map (BAD_TRAFFIC) that matches DNS (UDP/53) and MS-SQL (TCP/1433) traffic and applies the 'drop' action. Since the policy-map uses a 'class-default' action of 'inspect' for GOOD_TRAFFIC, any traffic not matching GOOD_TRAFFIC but matching BAD_TRAFFIC is dropped before inspection can occur. The users' symptoms confirm that DNS and MS-SQL are being dropped, while HTTP (matched by GOOD_TRAFFIC) is inspected and allowed.

Answer

They are allowed because no 'inspect' action is applied to the class.

Answer

They are inspected and allowed through the firewall.

Answer

They are dropped because they do not match the GOOD_TRAFFIC class.

Question 7

A company deploys Cisco ASA with clientless SSL VPN to provide remote access to internal web-based applications. Users connect via a web browser and authenticate using RADIUS. The security policy requires that users re-authenticate after 15 minutes of inactivity. The administrator configures the group-policy with 'vpn-idle-timeout 15' and 'vpn-session-timeout 60'. After testing, the administrator finds that users can still access the internal web applications even after the VPN session has timed out. The administrator checks the ASA logs and confirms that the VPN session is indeed terminated. The web applications are standard HTTP-based and do not have their own session timeout mechanisms. What is the most likely cause of this issue?

Accepted Answer

The web applications use persistent cookies that do not require re-authentication.. Option A is correct because clientless SSL VPN uses a web portal that relies on cookies to maintain the user's authenticated state. When the VPN session times out, the ASA terminates the VPN tunnel, but the web browser still holds the authentication cookie for the internal web application. Since the web application itself has no session timeout, the cookie remains valid, allowing the user to continue accessing the application without re-authentication. The ASA's vpn-idle-timeout and vpn-session-timeout only control the VPN tunnel, not the application-layer cookies.

Answer

The clientless SSL VPN portal uses 'application-specific' timeout settings.

Answer

The RADIUS server is sending the 'Session-Timeout' attribute that overrides the ASA configuration.

Answer

The ASA is configured with 'webvpn' and 'cache' enabled, which caches the application pages.

Question 8

Match each 802.1X component to its role.

Question 9

A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?

Accepted Answer

API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.. Option B is correct because API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.

Answer

Forward proxy mode, which intercepts user traffic and inspects it before it reaches the SaaS application.

Answer

Reverse proxy mode, which sits in front of the SaaS application and inspects incoming traffic.

Answer

Web application firewall (WAF) mode, which filters HTTP traffic to the application.

Question 10

A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?

Accepted Answer

Install a Certificate Authority (CA) certificate on the WSA and distribute it to clients. The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.

Answer

Create a bypass list for internal sites

Answer

Configure an Access Control List (ACL) to allow decryption

Answer

Configure user authentication

Question 11

An email administrator sees the above log entry in the Cisco ESA. What will happen to the email?

Accepted Answer

The email will be quarantined and an administrator will review it. The log entry indicates that the email triggered a content filter action set to 'quarantine' in the Cisco ESA. When an email is quarantined, it is held in a designated quarantine mailbox for administrative review, allowing the administrator to release, delete, or further analyze the message. This is the default behavior for policies that require human intervention before delivery.

Answer

The email will be dropped and not delivered

Answer

The email will be encrypted before delivery

Answer

The email will be delivered with a warning

Question 12

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Option A is correct because Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 13

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 14

During a cloud migration, an administrator notices that a workload in Azure is generating outbound traffic that is being blocked by the cloud security group. The workload requires connectivity to a specific SaaS application (Office 365) using TLS. The security group denies all outbound traffic except to specific IP ranges. Which action should the administrator take?

Accepted Answer

Add the Office 365 IP ranges and FQDNs to the allowed list. Option C is correct because the administrator needs to allow outbound traffic to Office 365, which uses TLS over TCP/443. Since the security group denies all outbound traffic except to specific IP ranges, the most direct and secure method is to add the published Office 365 IP ranges and FQDNs to the allowed list. This ensures the workload can reach the SaaS application without bypassing security controls or introducing additional latency.

Answer

Implement a proxy server

Answer

Use Azure Private Link

Answer

Disable the security group temporarily

Question 15

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. Option D is correct because AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 16

A company is planning to use Cisco Umbrella to secure internet access for branch offices. They already have Cisco Meraki MX appliances at each branch. What is the best way to send DNS traffic from the branches to Umbrella?

Accepted Answer

Enable the Umbrella integration in Meraki dashboard. Option D is correct because Meraki MX can automatically integrate with Umbrella via the built-in connector. Option A is wrong because IPSec tunnel is more complex and not native. Option B is wrong because an on-premises virtual appliance adds infrastructure. Option C is wrong because the roaming client is for endpoints, not branch networks.

Answer

Deploy the Umbrella virtual appliance at each branch

Answer

Install the Umbrella Roaming Client on each user device

Answer

Configure IPSec tunnels between branches and Umbrella data centers

Question 17

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Option A is correct because zero trust architecture operates on the principle of 'never trust, always verify,' which includes assuming that a breach has already occurred or is inevitable. This assumption drives continuous validation of every access request, regardless of source, and enforces least-privilege access to limit lateral movement. In cloud environments, this means treating every API call, workload, and user session as potentially compromised until proven otherwise.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 18

A small business uses Cisco Duo for multi-factor authentication. They want to ensure that employees accessing cloud apps from personal devices are compliant with device security policies. Which Duo feature should they use?

Accepted Answer

Duo Device Health. D is correct because Duo Device Health checks device security posture (OS version, encryption, etc.) before allowing access. A is for SSO. B is for VPN. C is the authenticator app.

Answer

Duo Mobile

Answer

Duo Network Gateway

Answer

Duo Access Gateway

Question 19

A cloud security architect is designing a zero-trust architecture for an enterprise using AWS and Azure. They need to enforce micro-segmentation between application tiers. Which Cisco solution is most appropriate?

Accepted Answer

Cisco Secure Workload. B is correct because Cisco Secure Workload provides micro-segmentation based on application dependencies. A is for firewall, not workload-centric. C is for secure internet gateway. D is for cloud security posture.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Firewall

Answer

Cisco Secure Cloud Analytics

Question 20

A company wants to use Cisco DUO for MFA to protect access to its Azure AD applications. Which authentication method should be configured for cloud applications?

Accepted Answer

Secondary authentication via DUO after Azure AD. When integrating Cisco DUO with Azure AD for MFA, the recommended approach is to configure DUO as a secondary authentication provider after Azure AD handles primary authentication. This is achieved by using DUO's Azure AD integration, which acts as a custom control or a conditional access policy that triggers DUO MFA after the user has already authenticated against Azure AD. This ensures that Azure AD remains the identity provider (IdP) for primary authentication, while DUO provides an additional layer of security via a secondary push, phone call, or passcode.

Answer

DUO for RADIUS authentication

Answer

DUO as a SAML identity provider

Answer

Primary authentication via DUO