350-701 Practice Test 23 — 15 Questions

Question 1

A security analyst is investigating a potential intrusion and suspects that the IPS is missing some attacks (false negatives). Which two factors can contribute to false negatives in signature-based IPS? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The attack uses a new exploit for which no signature exists.. False negatives occur when the IPS fails to detect an actual attack. Common causes include outdated signatures, encrypted traffic that cannot be inspected, and evasion techniques like fragmentation or encoding that the IPS cannot reassemble. Also, if the sensor is in passive mode and misses traffic due to asymmetric routing, it can cause false negatives.

Answer

The IPS is in inline mode and blocks malicious traffic.

Answer

The signature threshold is set too low.

Answer

The IPS is configured to drop packets that match a signature.

Question 2

An organization is deploying Cisco AnyConnect VPN with split tunneling. They want to ensure that only traffic destined for the corporate network goes through the VPN tunnel, while internet-bound traffic goes directly. Which configuration element on the ASA controls this?

Accepted Answer

Group policy with split tunneling settings. Split tunneling is configured in the group policy. The group policy specifies which networks are tunneled (via split-tunnel-policy and split-tunnel-network-list).

Answer

Dynamic Access Policy (DAP)

Answer

Network (or client) profile on the ASA

Answer

Connection profile

Question 3

A network administrator is configuring a site-to-site VPN between two Cisco ASA firewalls using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec SA?

Accepted Answer

Transform set. In IKEv2, IPsec SA parameters like encryption and authentication are defined in a transform set, which is then associated with a crypto map or VTI.

Answer

Crypto map

Answer

Group policy

Answer

ISAKMP policy

Question 4

A security engineer is configuring a Cisco FTD high availability pair in active/standby mode. Which statement is true about the failover configuration?

Accepted Answer

The standby unit must have the same hardware and software version. In active/standby failover for FTD, the standby unit monitors the active unit's health via failover link and takes over if the active fails. Configuration synchronization is automatic from active to standby.

Answer

Failover is triggered only by manual intervention

Answer

Configuration changes are made independently on each unit

Answer

Both units process traffic simultaneously

Question 5

A company wants to deploy a DMZ segment accessible from the internet. Which THREE considerations are critical for firewall zone design and security?

Accepted Answer

Use separate firewall interfaces for inside, outside, and DMZ. DMZ should have its own interface with a security level between inside and outside. Traffic from outside to DMZ should be restricted to necessary services. Inside to DMZ traffic should be permitted for management but initiated from inside.

Answer

DMZ interface should have a security level of 100

Answer

Allow all traffic from inside to DMZ without inspection

Question 6

A security analyst notices a high number of false positives from an intrusion detection system (IDS) using signature-based detection. Which action would best reduce false positives while maintaining detection of real threats?

Accepted Answer

Disable all signatures with a high false positive rate. False positives can be reduced by tuning signatures, such as adjusting thresholds or disabling specific signatures that are known to trigger incorrectly, rather than reducing sensor sensitivity broadly.

Answer

Increase the sensor sensitivity level

Answer

Switch to anomaly-based detection

Answer

Decrease the severity threshold for alerts

Question 7

Which of the following is a characteristic of a stateful firewall like Cisco ASA?

Accepted Answer

It maintains a state table of active connections.. Stateful firewalls track the state of active connections and make decisions based on the state of the session.

Answer

It filters traffic based solely on packet headers.

Answer

It can only filter based on source IP address.

Answer

It requires a separate proxy for each application.

Question 8

In Cisco Firepower, a file policy is configured with a rule that detects malware. The action is set to 'Malware Cloud Lookup'. What happens if the SHA-256 hash of a file is unknown to the AMP cloud?

Accepted Answer

The file is allowed and a retrospective alert is generated if later found malicious.. When the hash is unknown, the file may be submitted for static or dynamic analysis depending on the disposition. If the hash is unknown, the file may be allowed or blocked based on additional configuration; typically it is allowed pending analysis.

Answer

The file is blocked immediately.

Answer

The file is quarantined until the cloud responds.

Answer

The file is sent for dynamic analysis in a sandbox.

Question 9

A Cisco FTD sensor is deployed in passive mode (IDS) and is receiving traffic via a network tap. The access control policy is configured with an intrusion policy set to 'Security over Connectivity'. However, the administrator notices that the sensor is not generating alerts for some attacks that were identified by a previous inline sensor. What is the most likely reason?

Accepted Answer

The sensor is in passive mode and cannot see return traffic due to asymmetric routing.. In passive mode, the sensor cannot block traffic, but it should still detect and alert. If it's not alerting, perhaps the traffic is not being seen correctly (e.g., due to asymmetric routing or tap issues) or the intrusion policy is not applied correctly. However, given the scenario, a common issue is that passive deployment can miss attacks if traffic is not visible to the sensor.

Answer

The access control policy requires an 'allow' action to perform intrusion inspection.

Answer

The intrusion policy is set to 'Security over Connectivity', which reduces false positives but may miss some attacks.

Answer

The intrusion policy is not configured to generate alerts.

Question 10

A Cisco FTD device is deployed inline and configured with an access control policy that includes a rule to block traffic from a specific source IP address. However, traffic from that IP is still passing through. What is the most likely cause?

Accepted Answer

A trust rule exists before the block rule in the policy. In Cisco FTD, the access control policy rules are evaluated in order. If a rule earlier in the order permits the traffic (e.g., a trust rule), subsequent block rules are not evaluated. The rule order must be correct.

Answer

The rule is assigned to the wrong interface

Answer

The intrusion policy is overriding the block action

Answer

The device is in passive mode

Question 11

An engineer is tuning an IPS on a Cisco FTD to reduce false positives. Which three techniques are effective? (Choose three.)

Accepted Answer

Add source and destination IP filters to signatures. Tuning to reduce false positives includes adjusting thresholds, disabling specific signatures, using rule filtering by source/destination, and customizing rules. Monitoring without dropping (monitor mode) also helps evaluate impact.

Answer

Increase the global sensitivity slider to maximum

Answer

Enable all built-in rules to maximize coverage

Question 12

An engineer wants to block traffic from a specific country on a Cisco FTD. Which feature should be used in the access control policy?

Accepted Answer

Geolocation filtering. Geolocation filtering allows blocking or allowing traffic based on source or destination country. It is configured as a condition in access control rules.

Answer

Intrusion policy

Answer

Application visibility and control (AVC)

Answer

URL filtering

Question 13

Which VPN technology allows Cisco AnyConnect clients to use UDP for transport to avoid TCP overhead and improve performance?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is used by AnyConnect to provide a UDP-based SSL VPN, reducing latency compared to TCP.

Answer

IPsec

Answer

L2TP

Answer

IKEv2

Question 14

Which component of a Snort rule specifies the action to take when the rule conditions are matched?

Accepted Answer

Action. In Snort, the first part of the rule header is the action (e.g., alert, drop, reject).

Answer

Rule options

Answer

Source address

Answer

Protocol

Question 15

In a Cisco FTD deployment, which management option allows on-box management without the need for a separate FMC server?

Accepted Answer

FDM (Firepower Device Manager). FDM (Firepower Device Manager) is the on-box management interface for FTD devices. FMC is a centralized management server. CDO is cloud-based. ASDM is for ASA.

Answer

FMC (Firepower Management Center)

Answer

ASDM (Adaptive Security Device Manager)

Answer

CDO (Cisco Defense Orchestrator)