350-701 Practice Exam 3 — 20 Questions

Question 1

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management

Question 2

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 3

An organization is implementing privileged access management (PAM) with Cisco SecureX and CyberArk. Which feature allows administrators to grant temporary elevated privileges for a specific task, after which the privileges are automatically revoked?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Application whitelisting

Answer

Password vaulting

Question 4

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Accepted Answer

List revoked certificates. CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.

Answer

Store private keys

Answer

Validate certificate signatures

Answer

Generate new certificates

Question 5

A security analyst notices that a file previously marked as 'clean' on an endpoint was later determined to be malicious. Using Cisco Secure Endpoint, which feature allows the analyst to see the propagation of that file across the system and understand its impact?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco Secure Endpoint provides a timeline of events showing file propagation and system changes, enabling retrospective analysis.

Answer

IOC scanning

Answer

SHA-256 disposition

Answer

Exploit Prevention

Question 6

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

Accepted Answer

Zero Trust. Zero Trust assumes no implicit trust and verifies every access request.

Answer

Defense in depth

Answer

Least privilege

Answer

Network segmentation

Question 7

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

Answer

EST

Answer

SCEP

Answer

CRL

Question 8

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Accepted Answer

Install a trusted root CA certificate on all client devices. Option A is correct because HTTPS decryption on the Cisco WSA requires the WSA's certificate authority to be trusted by clients; otherwise browsers will show certificate warnings and the decrypted traffic will be rejected, so the WSA root CA (or a subordinate CA) must be installed in each client's trusted root store. Option B is correct because the administrator explicitly wants to decrypt HTTPS traffic for the social media and streaming video categories; this is done by enabling HTTPS/SSL decryption in the WSA's decryption policy and applying it to those URL categories. Option C is correct because blocking access to social media and streaming video is accomplished through URL filtering by selecting the 'Social Networking' and 'Streaming Media' categories in an access policy and setting the action to Block. Option D is not required because AMP file scanning is a malware/file reputation feature and does not enforce acceptable use or category-based blocking. Option E is not required because WCCP is only one possible method of redirecting client traffic to the WSA (typically on a router or Layer 4 switch); it is a deployment/redirection choice, not a required configuration step for filtering and decrypting these categories.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 9

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Accepted Answer

Zero Trust. Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Answer

CIA triad

Answer

AAA model

Answer

Defense in depth

Question 10

An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?

Accepted Answer

Knowledge and inherence. Password is a knowledge factor, fingerprint is an inherence (biometric) factor.

Answer

Knowledge and possession

Answer

Inherence and location

Answer

Possession and inherence

Question 11

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

Accepted Answer

SQL injection. SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Answer

Cross-site scripting (XSS)

Question 12

A company wants to implement Zero Trust principles in their cloud environment. Which THREE of the following are key Zero Trust tenets?

Accepted Answer

Assume breach (minimize blast radius). Option A (Assume breach, minimize blast radius) is a core Zero Trust tenet because it directs architects to segment networks, limit lateral movement, and contain incidents under the assumption that attackers are already inside. Option C (Use least privilege access) is correct because Zero Trust requires just-in-time and just-enough-access (JIT/JEA) so identities receive only the minimum permissions needed, reducing the attack surface. Option D (Verify explicitly) is correct because Zero Trust demands continuous authentication and authorization of every request using all available signals (identity, device health, location, data sensitivity) rather than trusting based on network location. Option B (MFA everywhere) is a valuable identity control that supports Zero Trust but is an implementation mechanism, not one of the three foundational tenets themselves. Option E (Assume the perimeter is secure) directly contradicts Zero Trust, which rejects the castle-and-moat model and assumes no implicit trust from network location.

Answer

Implement multifactor authentication (MFA) everywhere

Answer

Assume that the perimeter is secure

Question 13

A Cisco FTD device managed by FMC is processing traffic. An access control rule is configured with the action 'Interactive Block'. What behavior does this action trigger?

Accepted Answer

The user is shown a block page and can click to bypass the block for a specified time.. The Interactive Block action in a Cisco FTD access control rule is designed to give users a chance to override a block decision. When traffic matches the rule, the user's browser is presented with a customizable block page that includes a button allowing them to bypass the block for a configurable time period (default 600 seconds). This is distinct from a hard Block, which silently drops traffic, and from Allow, which permits it outright.

Answer

The packet is dropped and logged without any user notification.

Answer

The connection is reset and the source IP is added to a block list permanently.

Answer

The traffic is allowed but inspected more closely.

Question 14

Which component in the 802.1X architecture is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (e.g., switch or wireless LAN controller) acts as a proxy, forwarding EAP messages between the supplicant (client) and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication Server

Answer

Policy Service Node

Question 15

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the external interface. The most likely issue is that the crypto map is not applied to the external interface. In IPsec VPN configuration, the crypto map must be applied to the interface that sends and receives encrypted traffic (typically the outside/public-facing interface). Without this application, the router does not know which traffic to protect or how to negotiate the IPsec tunnel, even if the tunnel is established (e.g., IKE Phase 1 completes). The tunnel may show as up due to successful ISAKMP negotiation, but no traffic will be encrypted because the crypto map's policy (including the access-list and transform set) is never enforced on the interface.

Answer

The transform set uses wrong encryption

Answer

The access-list is too permissive

Answer

The peer address is wrong

Question 16

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

Accepted Answer

CASB. CASB solutions can inspect data in transit and at rest within SaaS applications to enforce DLP policies.

Answer

Cisco Umbrella

Answer

CSPM

Answer

CWPP

Question 17

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

Accepted Answer

UDP flood. UDP flood (A) is volumetric because it blasts the target with massive numbers of User Datagram Protocol packets, consuming bandwidth and processing resources without needing a handshake. DNS amplification (B) is volumetric because small spoofed DNS queries trigger large responses from open resolvers, multiplying traffic volume and saturating the victim's link. ICMP flood (D) is volumetric because it sends enormous volumes of ICMP Echo Request packets (e.g., ping floods) that fill the bandwidth pipe. HTTP GET flood (C) is an application-layer (Layer 7) attack that exhausts web server resources with seemingly legitimate requests rather than raw bandwidth. SYN flood (E) is a protocol/state-exhaustion attack that depletes TCP connection tables via half-open connections, not primarily a volumetric bandwidth flood.

Answer

HTTP GET flood

Answer

SYN flood

Question 18

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. The Modular Policy Framework on a Cisco ASA is built from three core building blocks: class-map, policy-map, and service-policy. Option C (Class-map) is correct because it defines the traffic classification criteria (for example, matching an ACL, a TCP/UDP port, or an inspection default class) that identifies which traffic the MPF will act upon. Option E (Policy-map) is correct because it binds actions to those classes, such as inspect, police, priority, or set connection parameters, thereby defining what happens to the matched traffic. Option A (Service-policy) is correct because it activates the policy-map by attaching it to an interface and direction (global, interface, or a specific direction), which is what actually enforces the MPF configuration on the ASA. Option B (Route-map) is not part of MPF; it is used for route redistribution and policy-based routing on routers, not for ASA traffic inspection. Option D (Access-list) is also not an MPF component by itself; although ACLs can be referenced inside a class-map to match traffic, the ACL is a separate matching tool and not one of the three MPF building blocks.

Answer

Route-map

Answer

Access-list

Question 19

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints was later determined to be malicious after execution. Which feature allows the administrator to see the file's propagation and impact on endpoints?

Accepted Answer

Device Trajectory. Device Trajectory is the correct answer because it provides a chronological timeline of a file's activity across all endpoints, showing its origin, propagation, and actions taken after execution. This feature is specifically designed to visualize the impact and spread of malicious files that were initially unknown but later determined to be malicious by Cisco AMP for Endpoints.

Answer

Exploit Prevention

Answer

Endpoint IOC Scanning

Answer

SHA-256 Disposition

Question 20

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Accepted Answer

show asp drop. The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

Answer

show access-list

Answer

show conn

Answer

show service-policy