350-701 Practice Exam 4 — 20 Questions

Question 1

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

Question 2

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Option C, 'Never trust, always verify,' is a foundational zero-trust principle because zero-trust treats every access request as untrusted regardless of source, requiring continuous authentication and authorization of users, devices, and sessions before granting access to resources. Option E, 'Least privilege access,' is also core to zero-trust because it enforces just-enough-access (JEA) and just-in-time (JIT) permissions so identities receive only the minimum rights needed, limiting lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: A, 'Single perimeter defense,' reflects the traditional castle-and-moat model that zero-trust explicitly replaces with microsegmentation and identity-centric controls; B, 'Implicit trust for internal networks,' is the opposite of zero-trust, which assumes no implicit trust based on network location; and D, 'Trust but verify,' is a legacy governance phrase, not a zero-trust principle, since zero-trust starts from 'never trust' rather than granting trust first.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 3

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule matches on a literal content string ('malicious') within TCP traffic, which is the defining characteristic of signature-based detection. Snort rules that use the content keyword look for known byte patterns or strings associated with malicious traffic. This is a static pattern match, not a behavioral or statistical model.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 4

An FTD device is deployed in passive mode. Which statement about its traffic processing is true?

Accepted Answer

It receives traffic from a network tap or SPAN port and cannot block traffic.. An FTD device in passive mode receives a copy of traffic from a network tap or SPAN port rather than sitting inline in the traffic path. Because it is not inline, it cannot drop or reset packets; it can only analyze, alert, and log. Therefore, it cannot block malicious traffic, and statements claiming it can send TCP resets or apply Block actions are false.

Answer

It can block malicious traffic by sending TCP resets.

Answer

It operates as a transparent firewall with inline inspection.

Answer

It can use the 'Block' action in access control rules.

Question 5

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 6

During a security incident, an analyst needs to isolate a compromised endpoint and perform remote forensic analysis using Cisco AMP for Endpoints. Which capability allows the analyst to execute commands on the endpoint remotely?

Accepted Answer

Remote shell investigation. Remote shell investigation is the correct answer because Cisco AMP for Endpoints includes a feature that allows an analyst to establish a secure, encrypted shell session directly with the compromised endpoint. This enables the execution of arbitrary commands for live remote forensic analysis without requiring additional tools or manual intervention on the endpoint.

Answer

Device Trajectory

Answer

File quarantine

Answer

Process isolation

Question 7

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 8

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a cryptographic signature added to outgoing email headers, which the receiving server verifies against a public key published in DNS. This provides cryptographic authentication that the message was sent by the domain and was not altered in transit. The question specifically asks for a cryptographic signature, which is the defining characteristic of DKIM.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 9

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 10

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Answer

SHA-256 file disposition

Question 11

In Cisco ISE, which protocol is used for EAP-TLS authentication, and what is the primary requirement for the client to successfully authenticate?

Accepted Answer

EAP-TLS, requiring a client certificate. EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) uses mutual certificate-based authentication, meaning both the client and the server present X.509 certificates. The primary client requirement is a valid client certificate issued by a trusted CA, which ISE validates during the TLS handshake.

Answer

EAP-FAST, requiring a PAC file

Answer

LEAP, requiring a shared secret

Answer

PEAP-MSCHAPv2, requiring username and password

Question 12

An organization wants to enforce multi-factor authentication (MFA) for VPN access using Cisco AnyConnect. Which Cisco product integrates with AnyConnect to provide MFA via push notifications or one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Answer

Cisco SecureX

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 13

A network administrator is configuring 802.1X on a Cisco switch for corporate Windows laptops. The organization uses certificates for authentication. Which EAP method should be configured on the supplicant and ISE to provide certificate-based mutual authentication?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST

Question 14

A security analyst notices that a user is downloading a file from a website. The Cisco WSA is configured to perform AMP file scanning. What happens when the file's SHA-256 hash is not found in the local cache?

Accepted Answer

The file is sent to the cloud for analysis and a verdict is returned.. When Cisco WSA performs AMP file scanning and the file's SHA-256 hash is not found in the local cache, the file is sent to the Cisco Talos cloud for analysis. Talos returns a verdict based on its global threat intelligence, and the WSA enforces the configured policy, which may allow, block, or quarantine the file. This cloud lookup is the core mechanism of AMP for file reputation.

Answer

The file is allowed immediately.

Answer

The file is quarantined until an administrator reviews it.

Answer

The file is blocked permanently.

Question 15

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Accepted Answer

ISE has not synchronized the latest AD group membership. ISE uses Active Directory (AD) as an identity source and must synchronize group membership changes before it can map the new user to the correct Security Group Tag (SGT). If the AD group membership has not been refreshed via the scheduled or manual sync, ISE will not know the new user belongs to the 'Finance' group, resulting in a default SGT of 0 (unknown/untrusted). Other users already in the group work fine because their membership was present during the last successful sync.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 16

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 17

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. A suppression filter tells Snort to stop generating alerts for a specific rule when the traffic matches a defined condition, such as a specific source IP, destination IP, or subnet. This preserves the rule's detection capability for other traffic while eliminating the false positives from the known-benign source.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 18

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 19

An endpoint security engineer wants to protect against memory injection attacks on endpoints running Windows. Which Cisco AMP feature should be enabled?

Accepted Answer

Exploit Prevention. Cisco AMP's Exploit Prevention feature is specifically designed to protect against memory injection and other exploitation techniques by monitoring process behavior and blocking attempts to inject code into running processes. It addresses the exact threat described, making it the correct choice for memory injection attacks on Windows endpoints.

Answer

Retrospective security

Answer

IOC scanning

Answer

Device Trajectory

Question 20

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.