350-701 Practice Test 22 — 15 Questions

Question 1

An engineer configures a Cisco ASA in a DMZ architecture. The DMZ hosts web servers that need to be accessible from the internet. Which security level should be assigned to the DMZ interface to ensure proper traffic flow without additional ACLs for return traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

50. For internet-to-DMZ traffic, the DMZ interface should have a security level higher than outside (0) but lower than inside (100) to allow return traffic from DMZ to outside without explicit ACLs. Level 50 is common.

Answer

255

Answer

0

Answer

100

Question 2

An organization is deploying Cisco Firepower Threat Defense (FTD) in a high-availability (HA) pair in active/standby mode. Which statement about state synchronization is true?

Accepted Answer

Connection states are synchronized from active to standby over the failover link.. In active/standby HA, the active unit replicates connection states to the standby unit so that if a failover occurs, the standby can take over without disrupting existing connections. Stateful failover requires synchronization of connection tables.

Answer

The standby unit mirrors all traffic and builds its own connection table.

Answer

Both units process traffic simultaneously and share states via the control link.

Answer

Only configuration is synchronized; connection states are not replicated.

Question 3

An engineer is configuring Cisco Firepower Threat Defense (FTD) in inline NGFW mode. The access control policy must block all traffic from geolocation 'North Korea' and allow all other traffic. Which type of rule should be used and in what order should it be placed?

Accepted Answer

Block rule with source geolocation North Korea, placed at the top of the policy.. Geolocation filtering is applied in access control rules. The block rule must be placed before any allow rules to ensure traffic from North Korea is blocked. Rule order is top-down.

Answer

Intrusion policy with geolocation filter, placed before access control rules.

Answer

Block rule with source geolocation North Korea, placed at the bottom of the policy.

Answer

Permit rule with destination geolocation North Korea, placed at the top.

Question 4

A security administrator is configuring a Cisco Firepower system for network discovery and wants to identify hosts and services on the network. Which two actions must be configured to enable network discovery? (Choose two.)

Accepted Answer

Configure an Access Control Policy with an 'Allow' rule for discovery traffic.. Network discovery requires enabling discovery in the FMC and configuring the FTD to perform discovery by applying an access control policy that allows discovery traffic or by configuring discovery settings. Also, the FTD must be in an appropriate mode (inline or passive) and have the necessary policies applied.

Answer

Enable SSL/TLS inspection for all traffic.

Answer

Configure a file policy with malware detection.

Answer

Deploy the FTD in inline mode only.

Question 5

A company is using Cisco ASA with AnyConnect VPN. They want to implement Dynamic Access Policy (DAP) to enforce access based on device compliance. Which two attributes can DAP use to evaluate endpoint posture? (Choose two.)

Accepted Answer

Antivirus software version and real-time protection status. DAP can use attributes from the AnyConnect client such as antivirus status, firewall status, and operating system. It can also use AAA attributes from RADIUS or LDAP. The Secure Endpoint (formerly AMP) connector provides device compliance data.

Answer

Cisco ISE authorization profile

Answer

User group membership from Active Directory

Answer

Source IP address

Question 6

A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?

Accepted Answer

Connection table (conn). The ASA checks the connection table (conn table) first for stateful inspection. The xlate table is used for NAT translation, but connection table is checked for session state.

Answer

ACL table

Answer

NAT table (xlate)

Answer

Routing table

Question 7

Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?

Accepted Answer

Static NAT. Static NAT creates a one-to-one mapping between an internal private IP and an external public IP, translating both source and destination addresses symmetrically. It is commonly used to make internal servers accessible from the outside.

Answer

Identity NAT

Answer

PAT (Port Address Translation)

Answer

Dynamic NAT

Question 8

An engineer is deploying Cisco Firepower Threat Defense (FTD) in inline mode and needs to decrypt SSL traffic for inspection. Which two methods are supported by FTD for SSL decryption? (Choose two.)

Accepted Answer

Decrypt - Resign: The FTD re-signs the server certificate with its own CA.. FTD supports decrypting traffic using a known private key (e.g., from a web server) or by re-signing certificates using a CA certificate installed on the device. The other options are not valid SSL decryption methods.

Answer

Decrypt - Passthrough: SSL traffic is allowed without inspection.

Answer

Decrypt - Monitor: SSL traffic is monitored but not decrypted.

Answer

Decrypt - Block: SSL traffic is blocked if decryption fails.

Question 9

In Cisco Firepower, an access control policy has multiple rules. Rule 1: Allow HTTP from any to any. Rule 2: Block HTTP from 10.0.0.0/8 to any. A packet from 10.0.0.1 to 192.168.1.1 with destination port 80 is inspected. What action is taken?

Accepted Answer

The packet is allowed because Rule 1 is matched first.. Rules are evaluated top-down. The packet matches Rule 1 first (Allow HTTP), so it is allowed. Even though Rule 2 would block it, Rule 1 is matched first.

Answer

The packet is allowed only if no intrusion policy triggers.

Answer

The packet is blocked because Rule 2 is more specific.

Answer

The packet is blocked and an alert is generated.

Question 10

A Cisco FTD device is configured with an access control policy that has multiple rules. The first rule is 'Allow' for all traffic from the internal network to the internet. The second rule is 'Block' for traffic from a specific internal host to any destination. However, the administrator notices that the specific host can still access the internet. What is the most likely cause?

Accepted Answer

The block rule is placed after the allow rule.. Access control rules are evaluated in order. The first rule allows all internal traffic, and since rules are processed top-down, the first match applies. The second rule is never reached because the first rule already matched. To block the specific host, the more specific rule must be placed before the general allow rule.

Answer

The block rule is not applied to the correct interface.

Answer

The block rule is configured with 'Trust' action.

Answer

The block rule has a lower priority than the allow rule.

Question 11

A network architect is designing a DMZ for a web server farm. The ASA firewall will have three interfaces: inside (level 100), DMZ (level 50), and outside (level 0). They want to allow HTTP traffic from the internet to the DMZ web servers and also allow the web servers to initiate connections to the inside for database updates. What is the minimal ACL configuration to achieve this?

Accepted Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.. Traffic from higher to lower security is implicitly allowed, so from inside (100) to DMZ (50) is allowed by default. Traffic from DMZ (50) to inside (100) is blocked by default, so an ACL on the DMZ interface inbound (or inside interface outbound) is needed to permit the database updates. For traffic from outside (0) to DMZ (50), it is from lower to higher, so an ACL on the outside interface inbound is needed to permit HTTP.

Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on inside interface inbound permitting database traffic from DMZ.

Answer

No ACL needed because traffic from higher to lower is implicitly allowed.

Answer

ACL on inside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.

Question 12

An engineer is configuring a Cisco ASA to allow traffic from the inside (security level 100) to the outside (security level 0). They create an access list permitting HTTP traffic from inside to outside and apply it to the inside interface inbound. What is the expected behavior?

Accepted Answer

The traffic will be allowed because the ACL permits it.. On Cisco ASA, when an ACL is applied inbound on the higher security interface (inside), traffic is evaluated before the stateful inspection. Since traffic from higher to lower security is implicitly allowed by default (based on security levels), the ACL does not need to explicitly permit it; however, applying an ACL inbound on the higher interface can restrict traffic. The ACL as described permits HTTP, so the traffic will be allowed.

Answer

The traffic will be blocked because the ACL is applied inbound on the inside interface.

Answer

The traffic will be blocked because the ACL should be applied outbound on the outside interface.

Answer

The traffic will be allowed only if a NAT rule exists.

Question 13

In Cisco ASA modular policy framework, what is the function of a class-map?

Accepted Answer

Classify traffic into different flows. Class-maps identify traffic based on match criteria (e.g., ACL, protocol).

Answer

Apply the policy to an interface

Answer

Configure NAT rules

Answer

Define the action to take on traffic

Question 14

A Cisco FTD device is configured with an SSL decryption rule using 'Decrypt - Known Key'. In which scenario is this action appropriate?

Accepted Answer

Decrypting traffic to an internal server whose private key is imported. Decrypt - Known Key is used when the firewall has the server's private key, typically for inbound connections to an internal server.

Answer

Decrypting traffic to any HTTPS site using a self-signed certificate

Answer

Decrypting traffic to an external website

Answer

Decrypting traffic without inspecting the certificate

Question 15

A security engineer is tuning an IPS to reduce false positives. They notice that legitimate traffic is triggering a signature for a worm that uses a specific HTTP GET request. The engineer wants to disable the signature for that specific traffic pattern but keep it enabled for other traffic. What is the best approach?

Accepted Answer

Create a rule suppression for the specific source/destination.. In Snort-based IPS, you can create a rule suppression or use a pass rule with a higher priority to skip inspection for that traffic. Alternatively, you can modify the rule to add a 'pcre' condition or use 'tag', but the simplest is to create a suppression or use a rule override to disable the specific signature for that source/destination.

Answer

Increase the signature threshold.

Answer

Disable the signature globally.

Answer

Change the action to 'alert' instead of 'drop'.