350-701 Practice Test 21 — 15 Questions

Question 1

An administrator is configuring Dynamic Access Policies (DAP) on a Cisco ASA for AnyConnect VPN. Which two attributes can be used to create DAP rules? (Choose two.)

Accepted Answer

Anti-virus software version. DAP can use endpoint attributes like antivirus status, registry entries, or connection attributes like group policy. Certificate issuer is not a standard DAP attribute.

Answer

Client IP address

Answer

Certificate issuer

Answer

Time of day

Question 2

An administrator is configuring a site-to-site IKEv2 VPN between two Cisco ASAs. Which configuration component defines the encryption and authentication algorithms for the IPsec SA?

Accepted Answer

Transform set. The transform set specifies the IPsec SA parameters (encryption, authentication, etc.). IKEv2 uses proposals and transforms within the transform set.

Answer

Crypto map

Answer

IPsec profile

Answer

ISAKMP policy

Question 3

A company uses Cisco AnyConnect for remote access VPN. They want to allow only specific Active Directory groups to access the corporate network. Which feature on the ASA or FTD should be configured to enforce this?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policies (DAP) can evaluate user attributes from AD to assign access rights.

Answer

Connection profile with LDAP attribute map

Answer

AAA server group

Answer

Group Policy with filter on group membership

Question 4

Which Cisco FTD feature provides application visibility and control (AVC) to identify and block applications like Facebook or Skype?

Accepted Answer

Access control policy with application conditions. Application visibility and control is achieved through the access control policy using application filters and the application database. Intrusion policy handles threats, not application identification.

Answer

URL filtering policy

Answer

Intrusion policy

Answer

SSL decryption policy

Question 5

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. Using a suppression filter allows the rule to remain active but suppresses alerts for specific source/destination IPs or ports.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 6

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy options are: none (monitor), quarantine (send to spam), or reject (block). To reject failing messages, the administrator sets p=reject in the DMARC DNS record.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 7

An engineer is configuring a Modular Policy Framework (MPF) on a Cisco ASA to inspect HTTP traffic and apply QoS. The engineer creates a class-map to match HTTP traffic using the 'match port tcp 80' command. However, the policy is not being applied correctly. What is the most likely reason?

Accepted Answer

The default global inspection policy already inspects HTTP traffic, and the new policy may be overridden.. The default inspection policy (global_policy) already inspects HTTP. Applying a new policy for HTTP with default actions may conflict or be overridden. Also, class-map matching on port alone may not be sufficient if traffic is already handled by default inspection. But the most common mistake is that the default policy already inspects HTTP traffic, and the new policy must be applied with higher priority or modified.

Answer

The class-map should use 'match any' instead of 'match port tcp 80'.

Answer

The ASA does not support HTTP inspection via MPF.

Answer

The service-policy must be applied globally, not to an interface.

Question 8

A Cisco FTD is configured with an access control policy that includes an intrusion policy. Which three actions can be set in an access control rule regarding intrusion inspection? (Choose three.)

Accepted Answer

Allow with intrusion inspection. Access control rules can be set to 'Allow' with intrusion inspection, 'Allow' without inspection, 'Trust' (bypass inspection), 'Block', or 'Interactive Block'. The question asks for actions regarding intrusion inspection; 'Allow' with inspection, 'Allow' without, and 'Trust' are three possible actions.

Answer

Block with intrusion inspection

Answer

Interactive Block with intrusion inspection

Question 9

Which interface security level is assigned to the inside interface on a Cisco ASA by default?

Accepted Answer

100. The Cisco ASA assigns security level 100 to the inside interface, 0 to the outside, and intermediate values for DMZ interfaces.

Answer

255

Answer

0

Answer

50

Question 10

An engineer observes that the Cisco ASA connection table shows a consistent number of entries for UDP traffic, but the xlate table shows no entries. What is the most likely reason?

Accepted Answer

NAT is not configured for this traffic. The xlate table holds NAT translations; if no NAT is configured, traffic passes without xlate entries, but connections are still tracked.

Answer

The traffic is being dropped by ACLs

Answer

The ASA is in transparent mode

Answer

UDP traffic does not create connections

Question 11

A network engineer is configuring a site-to-site VPN between two Cisco ASAs using IKEv2. Which component defines the encryption and hash algorithms for Phase 2?

Accepted Answer

Transform set. Transform sets define the Phase 2 parameters such as encryption and integrity algorithms.

Answer

IKEv2 proposal

Answer

Crypto map

Answer

ISAKMP policy

Question 12

A security administrator is configuring URL filtering on Cisco FTD. Which three categories are commonly used in URL filtering policies? (Choose three.)

Accepted Answer

Social Networking. Common URL categories include Social Networking, Malware, and Adult Content. Phishing is a subcategory of Malware, but Malware is a top-level category. Streaming Media is also a standard category.

Answer

Encrypted Traffic

Answer

Phishing

Question 13

A Cisco Firepower administrator configures an access control policy with a rule that trusts traffic from a specific source network. What is the effect of the trust action on the traffic?

Accepted Answer

The traffic is allowed without further inspection.. The trust action in Firepower bypasses further inspection (IPS, file, etc.) for matching traffic. It allows the traffic without any deep inspection, similar to a permit with fast-path.

Answer

The traffic is blocked and logged.

Answer

The traffic is allowed and inspected by the intrusion policy.

Answer

The traffic is allowed but subject to file policy.

Question 14

An organization wants to deploy Cisco Firepower in a high-availability pair with active/standby failover. Which management solution allows this configuration?

Accepted Answer

FMC. FMC (Firepower Management Center) supports high-availability configurations for FTD devices.

Answer

CLI only

Answer

FDM (on-box management)

Answer

ASDM

Question 15

Which Cisco Firepower management option is used for on-box management of a single FTD device, without a separate management center?

Accepted Answer

FDM (Firepower Device Manager). Firepower Device Manager (FDM) is the on-box management interface for a single FTD device. FMC is a centralized management platform for multiple devices.

Answer

Cisco Defense Orchestrator

Answer

FMC (Firepower Management Center)

Answer

ASA CLI