350-701 Practice Test 21 — 15 Questions

Question 1

During a security audit, it is discovered that some malware downloads were not blocked by the Cisco WSA even though the Web Reputation score was set to block scores below -5.0. The logs show that the downloads came from sites with a reputation score of -6.2. What is the most likely reason the downloads were not blocked?

Accepted Answer

The file type was not configured for malware inspection. The Cisco WSA uses Web Reputation filtering to block traffic based on reputation scores, but this filtering operates at the URL or domain level, not at the file content level. Even if a site has a very low reputation score (e.g., -6.2), the WSA will only block the download if the file type is included in the malware inspection configuration. If the file type (e.g., .exe, .zip) is not configured for malware inspection, the WSA will allow the download despite the low reputation score, because reputation-based blocking alone does not inspect the content of the file.

Answer

HTTPS decryption was not enabled

Answer

The users were not authenticated

Answer

The Web Reputation threshold was not applied correctly

Question 2

After deploying a Cisco Cloudlock policy, a user reports that a sanctioned application (Salesforce) is being blocked for file downloads. What is the most likely cause?

Accepted Answer

The Cloudlock policy for Salesforce is set to 'Block' due to misconfiguration. Option D is correct because Cloudlock policies are configured to enforce actions such as 'Allow', 'Block', or 'Monitor' on sanctioned applications like Salesforce. If a policy is misconfigured to 'Block' for file downloads, Cloudlock will intercept the API call and deny the download regardless of the file's content. This is a common administrative error when setting granular controls for cloud app activities.

Answer

The Salesforce API token has expired

Answer

The file being downloaded contains sensitive data flagged by DLP

Answer

The user's browser is not configured with the corporate proxy

Question 3

Which THREE of the following are common challenges when securing multi-cloud environments? (Choose three.)

Accepted Answer

Meeting compliance requirements across jurisdictions. Option C is correct because multi-cloud environments span multiple jurisdictions with differing data protection laws (e.g., GDPR, CCPA, LGPD). Meeting compliance requirements becomes a challenge as each cloud provider may have different compliance certifications and data residency controls, requiring careful mapping of data flows and contractual agreements to avoid legal penalties.

Answer

Limited storage capacity in public clouds

Answer

Reducing cloud infrastructure costs

Question 4

Which TWO benefits does the Cisco ESA provide for email security? (Choose two.)

Accepted Answer

Email encryption and data loss prevention. Option A is correct because the Cisco Email Security Appliance (ESA) includes integrated email encryption capabilities via Cisco Registered Envelope Service (CRES) or PGP/SMIME, and it provides Data Loss Prevention (DLP) through pre-defined or custom DLP policies that scan outbound emails for sensitive data patterns such as credit card numbers or PII. These features are core to the ESA's content security functionality.

Answer

DNS-layer security

Answer

Network firewall functionality

Answer

Web content filtering

Question 5

An organization is using Cisco ESA and wants to ensure that outgoing emails containing credit card numbers are blocked before leaving the network. Which feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policies. Cisco ESA uses Data Loss Prevention (DLP) policies to inspect outgoing email content for sensitive data such as credit card numbers. DLP can identify patterns (e.g., 16-digit card numbers) using predefined or custom dictionaries and enforce actions like blocking, quarantining, or encrypting the message before it leaves the network. Anti-Spam, Encryption, and Anti-Virus policies do not perform content-based pattern matching for sensitive data.

Answer

Anti-Spam policies

Answer

Encryption policies

Answer

Anti-Virus scanning

Question 6

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

Accepted Answer

The Web Reputation threshold of -6.0 is blocking the site due to a low reputation score. The exhibit shows a Web Reputation threshold of -6.0, meaning any website with a reputation score lower than -6.0 will be blocked. The banking site 'examplebank.com' likely has a low reputation score (e.g., due to being newly registered or hosting malicious content), causing it to fall below the threshold and be blocked. This is the most direct cause because the WSA applies reputation-based filtering before other policies, and the user's inability to access the site aligns with a reputation block rather than a category or scanning issue.

Answer

The Malware Scanning action is set to 'Scan' but blocks the site

Answer

The user identification is not configured correctly

Answer

The Social Networking category is set to 'Monitor' and is blocking the site

Question 7

Which TWO actions are best practices when configuring a Cisco WSA to block malicious websites? (Choose two.)

Accepted Answer

Configure URL filtering categories to block known malicious categories. Option A is correct because Cisco WSA URL filtering categories allow administrators to block entire groups of known malicious sites, such as malware, phishing, or spyware categories, which are pre-classified by Cisco Talos. This provides a broad, proactive defense against threats without needing to maintain individual URL block lists. Option E is correct because Web Reputation filtering uses a scoring system (1–10, with lower scores being more malicious) to dynamically block or warn users about websites with poor reputation, even if they are not in a specific malicious category, adding a layer of behavioral analysis.

Answer

Set the default action to 'Monitor' for all categories

Answer

Disable user authentication to simplify policy

Answer

Allow all HTTPS traffic to improve performance

Question 8

A company is deploying Cisco Umbrella to enforce security policies for remote users. They want to ensure that DNS requests from roaming clients are routed through Umbrella's DNS resolvers. However, some users are bypassing Umbrella by using third-party DNS servers like Google (8.8.8.8). Which configuration should be applied to prevent this?

Accepted Answer

Enable DNS Policy in the Umbrella roaming client. Option D is correct because the Umbrella roaming client's DNS Policy feature forces all DNS traffic from the endpoint to use Umbrella's DNS resolvers, even if the user manually configures a third-party DNS server like Google (8.8.8.8). This is achieved by intercepting DNS requests at the OS level and redirecting them to the Umbrella resolvers, effectively preventing bypass attempts without relying on network-level blocks.

Answer

Configure Content Filtering to block Google DNS

Answer

Add a firewall rule on each client to block port 53 to all but Umbrella

Answer

Enable IP Layer Enforcement in the Umbrella dashboard

Question 9

Which THREE features are available in Cisco Umbrella to protect against DNS-based threats? (Choose three.)

Accepted Answer

IP-layer enforcement. Cisco Umbrella provides DNS-layer security (option C) as its core function, intercepting DNS queries to block requests to malicious domains before a connection is established. IP-layer enforcement (option A) extends protection by applying policies based on the destination IP address, blocking traffic to known malicious IPs even if DNS resolution is bypassed. Application control (option B) allows administrators to permit or block specific cloud applications (e.g., Dropbox, Facebook) at the DNS level, preventing data exfiltration or unauthorized usage through DNS-based application identification.

Answer

Data Loss Prevention (DLP)

Answer

Anti-virus scanning

Question 10

An organization is using Cisco ESA to protect against email-borne threats. They notice that some phishing emails are not being caught by the anti-spam engine. The emails contain malicious URLs that are rewritten by the ESA. Which feature should be verified to ensure the rewritten URLs are properly analyzed?

Accepted Answer

URL filtering and analysis settings. B is correct because the URL filtering and analysis settings control how the Cisco ESA rewrites and subsequently analyzes malicious URLs. When a phishing email contains a malicious URL, the ESA can rewrite the URL to point to its own proxy for real-time analysis. If this feature is not properly configured or if the analysis settings (such as reputation scoring or time-of-click verification) are disabled, the rewritten URLs may not be inspected, allowing the threat to bypass detection.

Answer

Data Loss Prevention (DLP) policies

Answer

Anti-Virus scanning engine

Answer

Encryption policies

Question 11

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Question 12

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Question 13

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Accepted Answer

Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.. Option B is correct because Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Answer

Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.

Answer

Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.

Answer

Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.

Question 14

Drag and drop the steps to configure NetFlow on a Cisco IOS router for traffic monitoring in the correct order.

Question 15

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

Accepted Answer

Cisco Secure Endpoint (AMP for Endpoints). Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

Answer

Cisco Stealthwatch

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Firepower NGFW