350-701 Practice Test 23 — 15 Questions

Question 1

An organization wants to implement multi-factor authentication (MFA) for VPN access using Cisco AnyConnect and Duo. Which TWO authentication factors can Duo provide? (Choose two.)

Accepted Answer

TOTP. Duo provides TOTP (Time-based One-Time Password) as an authentication factor by generating a temporary six-digit code based on RFC 6238, which the user enters during the AnyConnect VPN login process. Push notification is another Duo factor, where a request is sent to the user's registered mobile device, and the user approves or denies the login attempt via the Duo Mobile app. Both factors satisfy the requirement for multi-factor authentication by adding a second layer beyond the primary password.

Answer

LDAP

Answer

802.1X

Answer

RADIUS

Question 2

Which THREE of the following are common challenges when securing multi-cloud environments? (Choose three.)

Accepted Answer

Meeting compliance requirements across jurisdictions. Multi-cloud environments span multiple jurisdictions with differing data protection laws (e.g., GDPR, CCPA, LGPD). Meeting compliance requirements becomes a challenge as each cloud provider may have different compliance certifications and data residency controls, requiring careful mapping of data flows and contractual agreements to avoid legal penalties.

Answer

Limited storage capacity in public clouds

Answer

Reducing cloud infrastructure costs

Question 3

Which Snort rule action causes the FTD to drop a packet and generate an alert?

Accepted Answer

drop. In Snort/FTD rule actions, 'drop' instructs the sensor to drop the offending packet and generate an alert, blocking the traffic inline. This is the standard action for IPS mode when you want to both log and prevent the packet from reaching its destination. The other actions either only alert or reject with a TCP reset.

Answer

reject

Answer

alert

Answer

pass

Question 4

Which interface security level is assigned to the inside interface on a Cisco ASA by default?

Accepted Answer

100. On a Cisco ASA, the inside interface is assigned security level 100 by default, the outside interface is 0, and the DMZ is typically 50–70 depending on configuration. Security levels range from 0 (least trusted) to 100 (most trusted), and the ASA uses them to determine default traffic flow: traffic from a higher level to a lower level is permitted by default, while traffic from lower to higher is denied unless explicitly allowed by an ACL. The inside interface's default of 100 reflects its role as the most trusted network segment.

Answer

255

Answer

0

Answer

50

Question 5

A financial services company recently migrated from a legacy web filter to Cisco WSA in explicit proxy mode. The company has 5000 users across three offices, each connected via MPLS. The WSA is deployed in the data center. A week after deployment, users in the remote office report that web pages load extremely slowly, while users in the main office near the data center experience normal speeds. The network team confirms there is no WAN congestion. The WSA administrator checks the logs and sees that the remote users are being authenticated via NTLM and that the WSA's CPU and memory usage are below 50%. However, the number of concurrent connections from the remote office is very high, with many connections in a TIME_WAIT state. What is the most likely cause of the slow web performance for remote users?

Accepted Answer

The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.. The high number of concurrent connections in TIME_WAIT state indicates that TCP connections are being closed after each request instead of being reused. In explicit proxy mode, the WSA can reuse persistent connections to reduce latency, but if connection reuse is not configured, each HTTP request from a remote user requires a new TCP handshake, which adds significant round-trip time (RTT) over the MPLS link. This overhead explains the slow performance for remote users while main office users, with lower latency, are unaffected.

Answer

The WSA's proxy process is overloaded due to high SSL decryption demands.

Answer

Remote users are using an outdated browser that does not support modern protocols.

Answer

NTLM authentication is causing authentication delays over the MPLS link.

Question 6

An engineer wants to configure high availability on a pair of Cisco Firepower Threat Defense (FTD) devices. Which HA mode supports active/standby failover with stateful replication of connection information?

Accepted Answer

Active/standby with stateful failover. FTD high availability supports active/standby failover, and stateful failover is the mode that replicates connection state (including TCP sequence numbers, NAT translations, and VPN state) to the standby unit. This allows existing sessions to survive a failover event without being torn down, which is essential for production environments. Active/standby with stateful failover is the recommended deployment for FTD HA pairs.

Answer

Active/standby without stateful failover

Answer

Active/active with asymmetric routing

Answer

Clustering

Question 7

Refer to the exhibit. An administrator notices that DNS responses larger than 512 bytes are being dropped. Which configuration change should be made to allow larger DNS responses?

Accepted Answer

Increase the message-length maximum under the DNS map. DNS inspection on Cisco ASA/Firepower devices uses a DNS map to enforce a default maximum message length of 512 bytes, which aligns with the original DNS specification (RFC 1035). To allow larger DNS responses (e.g., those using EDNS0, which can exceed 512 bytes), you must increase the message-length maximum under the DNS map. This change permits the firewall to reassemble and forward DNS packets that exceed the default limit without dropping them.

Answer

Remove the DNS inspection policy

Answer

Add an access-list to permit the traffic

Answer

Disable the set connection advanced-options command

Question 8

A company uses Cisco Secure Workload to enforce microsegmentation across multiple AWS accounts. After enabling enforcement, they find that the policies are only applied to workloads in the primary account. What is the most likely reason?

Accepted Answer

The cloud connector is not configured for the secondary accounts. Cisco Secure Workload (formerly Tetration) uses cloud connectors to integrate with AWS accounts and discover workloads. When enforcement is enabled, the policies are applied only to workloads in the primary account because the cloud connector has not been configured for the secondary AWS accounts. Without the connector, the platform cannot manage or enforce policies on workloads outside the primary account.

Answer

The policy labels are not propagated

Answer

The agents in secondary accounts are not registered

Answer

The enforcement scope is limited to a single VPC

Question 9

An organization wants to enforce a policy that blocks outbound emails containing Social Security numbers. Which feature of Cisco ESA should be configured?

Accepted Answer

DLP Policies. Cisco ESA DLP policies inspect message content and attachments for sensitive data patterns such as Social Security numbers, credit card numbers, and custom identifiers, then block, quarantine, or encrypt based on policy. This is the correct feature for enforcing an outbound content-blocking rule. DLP policies can be scoped to specific senders, recipients, and directions.

Answer

Anti-Spam

Answer

AMP for Email

Answer

Outbreak Filters

Question 10

A security engineer is configuring Cisco WSA for HTTPS inspection but notices that some encrypted traffic is being bypassed. The WSA is configured with a decryption policy that excludes traffic to financial websites. What is the most likely reason for the bypass?

Accepted Answer

The decryption policy has an exception for financial services. The question states the decryption policy explicitly excludes traffic to financial websites. That exception is the direct cause: WSA evaluates the decryption policy before attempting TLS interception, and any destination matching the exception list is passed through without decryption. The observed bypass is therefore expected behavior, not a failure.

Answer

The WSA's certificate is not trusted by clients

Answer

The WSA is in explicit proxy mode

Answer

TLS version is incompatible

Question 11

A security engineer is configuring Cisco WSA in explicit proxy mode. Which traffic interception method is being used when each endpoint browser is configured with the proxy address?

Accepted Answer

Explicit proxy. In explicit proxy mode, the client is explicitly configured (via browser settings, PAC file, or WPAD) to send requests to the WSA's IP and port, so the proxy is directly addressed rather than transparently intercepting traffic. This is the defining characteristic of explicit proxy deployment.

Answer

WCCP redirect

Answer

Policy-Based Routing

Answer

Transparent proxy

Question 12

Match each threat type to its definition.

Accepted Answer

DDoS: Overwhelming a system with traffic from multiple sources. Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Answer

DDoS: Malware that encrypts data and demands payment

Answer

Phishing: Overwhelming a system with traffic from multiple sources

Question 13

Which THREE of the following are valid considerations when deploying Cisco Advanced Malware Protection (AMP) for Networks on a Firepower system? (Choose three.)

Accepted Answer

An AMP subscription must be active on the Firepower Management Center.. Option B is correct because AMP for Networks requires a valid AMP subscription (license) to be active on the Firepower Management Center before file reputation and malware analysis features can function. Option C is correct because file inspection must be enabled in the access control policy — specifically by enabling 'Inspect' with file policy/malware inspection configured — otherwise files are not sent for AMP analysis. Option D is correct because the Firepower device (or FMC, depending on configuration) needs outbound internet connectivity to reach the AMP cloud (or a configured AMP cloud proxy) to submit files and retrieve reputation verdicts. Option A is not a valid consideration because AMP for Networks can operate in passive or inline (IPS) deployments, not strictly inline behind the firewall. Option E is not required because a dedicated bridge group is not a prerequisite for AMP for Networks deployment.

Answer

AMP for Networks should be deployed in inline mode behind the firewall.

Answer

A dedicated bridge group must be created on the Firepower device.

Question 14

In the 802.1X authentication process, which component is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X authentication process, the authenticator (typically a switch or wireless access point) is responsible for relaying Extensible Authentication Protocol (EAP) messages between the supplicant (client) and the authentication server (e.g., ISE). The authenticator encapsulates EAP frames into RADIUS packets for transmission to the server, acting as a transparent proxy that does not modify or terminate the EAP conversation. This role is defined in IEEE 802.1X-2010, where the authenticator controls port access based on the authentication result.

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Answer

Supplicant

Question 15

An organization is adopting a zero trust model for cloud access. Which three principles should be implemented? (Select three.)

Accepted Answer

Use conditional access policies based on user, device, and location. Option C is correct because zero trust enforces context-aware, least-privilege decisions through conditional access policies that evaluate signals such as user identity, device compliance/health, and location before granting access. Option D is correct because strong authentication is foundational to zero trust; requiring MFA for all cloud access prevents compromised passwords from being sufficient on their own. Option E is correct because zero trust shifts the security boundary away from the network edge and makes identity the control plane, so every request is authenticated and authorized regardless of network origin. Option A is not correct because a blanket VPN extends implicit network trust rather than eliminating it, which is contrary to zero trust's per-request verification model. Option B is not correct because permanent privileged access violates least privilege and just-in-time/just-enough access principles central to zero trust.

Answer

Deploy a VPN for all remote users

Answer

Grant permanent privileged access to administrators