350-701 Practice Exam 4 — 20 Questions

Question 1

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

Accepted Answer

The authentication server is unreachable and the port is using the critical VLAN. The 'CRITICAL' state in 'show authentication sessions' indicates that the switch port has lost connectivity to the authentication server (RADIUS) and has fallen back to the configured critical VLAN. This is a failover mechanism defined in IEEE 802.1X and Cisco's critical-auth feature, where the port is placed into a pre-configured VLAN to maintain network access for the host despite the server being unreachable.

Answer

The host is being authenticated via MAB

Answer

The port is administratively down

Answer

The authentication attempt was rejected by the RADIUS server

Question 2

In the 802.1X authentication process, which component is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X authentication process, the authenticator (typically a switch or wireless access point) is responsible for relaying Extensible Authentication Protocol (EAP) messages between the supplicant (client) and the authentication server (e.g., ISE). The authenticator encapsulates EAP frames into RADIUS packets for transmission to the server, acting as a transparent proxy that does not modify or terminate the EAP conversation. This role is defined in IEEE 802.1X-2010, where the authenticator controls port access based on the authentication result.

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Answer

Supplicant

Question 3

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

Accepted Answer

SQL injection. SQL injection occurs when user input is not sanitized and alters SQL query structure.

Answer

Cross-site scripting (XSS)

Answer

Buffer overflow

Answer

CSRF

Question 4

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Accepted Answer

Enable TCP Intercept with a low threshold. TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.

Answer

Increase the connection timeout

Answer

Implement an access-list to allow only known source IPs

Answer

Configure a static route to null0 for the server's IP

Question 5

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 6

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

Accepted Answer

Simple or advanced custom detections (Application Control). Simple or advanced custom detections (Application Control) allow administrators to create hash-based or path-based rules that explicitly block execution of specific files. This directly meets the requirement to prevent sensitive files from ever running on endpoints, as Application Control enforces allow/block policies at the file execution level, not just at the network or signature level.

Answer

Outbreak Control (file extension blocking)

Answer

Exclusion lists

Answer

Behavioral analysis and engine protection

Question 7

An organization wants to enforce micro-segmentation in a data center to isolate application tiers. Which Cisco technology allows defining security policies based on endpoint groups rather than IP addresses?

Accepted Answer

Cisco TrustSec with Security Group Tags (SGTs). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on endpoint groups (e.g., application tiers) rather than IP addresses. This allows micro-segmentation by enforcing policies that follow the traffic regardless of IP changes, using SGTs carried in the packet via Cisco Metadata (CMD) or inline tagging.

Answer

Cisco ASA with access-lists

Answer

Cisco ISE with guest services

Answer

Cisco Firepower NGFW with URL filtering

Question 8

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

Accepted Answer

NetFlow probe. (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Answer

DHCP probe

Answer

HTTP probe

Answer

DNS probe

Question 9

An administrator is configuring DLP on the Cisco ESA to block social security numbers (SSNs) in outgoing email. The policy is set to 'Drop' for SSN matches, but some emails containing SSNs are still being delivered. What step should the administrator take to troubleshoot?

Accepted Answer

Verify that the DLP policy is enabled and assigned to the outgoing mail policy.. The most likely reason SSNs are still being delivered is that the DLP policy is not actually applied to the outgoing mail policy. Even if the DLP policy is configured to 'Drop' for SSN matches, it will have no effect unless it is enabled and explicitly assigned to the mail policy that governs outbound messages. Without this assignment, the ESA will not inspect messages against the DLP dictionary, allowing SSNs to pass through.

Answer

Increase the message size limit in the mail flow policy.

Answer

Ensure that TLS is enabled for outgoing mail.

Answer

Add additional SSN patterns to the DLP dictionary.

Question 10

A DevOps team is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run. Which solution should they integrate with Kubernetes to enforce image trust and scanning?

Accepted Answer

Cisco Cloud Workload Protection (CWP). Cisco Cloud Workload Protection (CWP) is the correct solution because it provides integrated image scanning, vulnerability assessment, and trust enforcement for containerized workloads in Kubernetes. CWP uses a policy-based admission controller to block deployments of unauthorized or vulnerable images before they run, directly addressing the requirement to ensure only authorized images are executed.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Firepower Next-Generation Firewall

Answer

Cisco Umbrella

Question 11

During an email security audit, it is discovered that encrypted emails sent between two partners are being silently dropped by the Cisco ESA. The ESA uses a policy that decrypts incoming S/MIME messages for scanning. What is the most likely cause of the dropped messages?

Accepted Answer

The ESA cannot decrypt the messages because the sender's certificate is not trusted by the ESA.. The Cisco ESA decrypts incoming S/MIME messages to perform content scanning. If the sender's certificate is not trusted by the ESA (i.e., not in the ESA's trusted certificate store or the certificate chain cannot be validated), the ESA cannot decrypt the message. This causes the message to be silently dropped because the policy requires decryption for scanning, and failure to decrypt results in the message being discarded rather than delivered.

Answer

The ESA is configured to re-encrypt outbound messages that were decrypted.

Answer

The messages contain encrypted attachments that exceed size limits.

Answer

The ESA is using TLS to receive the messages and the partner's certificate is untrusted.

Question 12

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

Accepted Answer

Active scanning. ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.

Answer

Passive OSINT

Answer

ARP spoofing

Answer

DNS cache poisoning

Question 13

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security solution that blocks malicious domains and provides secure internet gateway.

Answer

Cisco AMP

Answer

Cisco ESA

Answer

Cisco WSA

Question 14

A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?

Accepted Answer

Cisco ESA with AMP. Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.

Answer

Cisco AMP for Endpoints

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Question 15

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

Accepted Answer

Least privilege access. Zero Trust core principles: never trust, always verify; least privilege; microsegmentation. Defense in depth is a separate concept.

Answer

Single sign-on (SSO)

Answer

Defense in depth

Question 16

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Accepted Answer

Never trust, always verify. Zero Trust is based on 'never trust, always verify' and least privilege access.

Answer

Single-factor authentication

Answer

Perimeter-based security

Answer

Implicit trust for internal networks

Question 17

Which of the following is a characteristic of a zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every request must be verified regardless of source.

Answer

Implicit trust for internal users

Answer

Trust but verify

Answer

Trust based on network location

Question 18

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 19

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 20

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Accepted Answer

Profiling. Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.

Answer

Application visibility

Answer

NetFlow analysis