350-701 Practice Test 23 — 15 Questions

Question 1

Match each security technology to its primary function.

Question 2

Match each Cisco ASA feature to its description.

Question 3

Match each Cisco security product to its category.

Question 4

Match each Cisco security solution to its primary use case.

Question 5

Match each VPN type to its characteristic.

Question 6

Match each Cisco security command to its function.

Question 7

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 8

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Accepted Answer

Application Control. Application Control (C) is correct because it allows administrators to define a whitelist of approved software, blocking all other executables from running on endpoints. Lockdown Mode (D) is correct because it enforces a strict policy where only pre-approved applications can execute, effectively preventing any unapproved software from running. Together, these features provide comprehensive control over executable files in a large enterprise environment.

Answer

Exploit Prevention

Answer

Malware Analytics

Answer

File Reputation

Question 9

A security engineer is configuring Cisco Web Security Appliance (WSA) to block downloads of potentially malicious file types such as .exe and .scr. The engineer wants to ensure that these files are blocked even if they are hosted on trusted websites. Which TWO actions should the engineer take?

Accepted Answer

Create an access policy that enables file reputation filtering.. Option B (file reputation filtering) and Option D (file type control) are correct because they allow the WSA to block specific file types based on reputation or file type, regardless of the source URL. Option A is incorrect because URL categories are for categorizing websites, not file types. Option C (DLP) is designed for data loss prevention, not file type blocking. Option E (HTTPS proxy) enables inspection of encrypted traffic but does not itself block file types.

Answer

Create a custom URL category for the file types.

Answer

Configure HTTPS proxy to decrypt traffic for file inspection.

Answer

Enable Data Loss Prevention (DLP) on the access policy.

Question 10

Refer to the exhibit. The engineer configured a file type filter for executables on access policy Policy_A. However, .exe files from trusted_sites are still being allowed. What is the most likely reason for this behavior?

Accepted Answer

The file type filter action is set to 'monitor' instead of 'block'.. Option C is correct because the file type filter action is set to 'monitor' (which only logs) instead of 'block'. The access policy action is 'allow', so without a block action in the file type filter, executables are allowed. Option A is wrong because the file type filter is applied to Policy_A. Option B is wrong because the filter is on executables category, not URL. Option D is wrong because policy order is not shown to be an issue.

Answer

The file type filter is applied to the wrong access policy.

Answer

The URL category for trusted_sites is blocking the file type filter from being evaluated.

Answer

The access policy order is incorrect; a less specific policy is matching before Policy_A.

Question 11

Which THREE of the following are recommended best practices for configuring Cisco AMP for Endpoints to minimize false positives while maintaining strong detection?

Accepted Answer

Enable file reputation scanning with cloud lookups. Options A, C, and D are correct. Option A (File Reputation scanning) validates files against cloud intelligence, reducing false positives by allowing known good files. Option C (Application blocking with whitelist) ensures only approved applications run, minimizing false alerts. Option D (Exclusions for trusted applications) prevents scanning of benign software, lowering false positives while maintaining detection for unknowns. Option B is wrong because disabling exploit prevention weakens security. Option E is wrong because maximum scan level increases false positives without significant detection gain.

Answer

Set scan level to maximum for all file types

Answer

Disable exploit prevention to reduce false positives

Question 12

Based on the exhibit, what is the most likely reason that traffic matching the AMP_block access-list is not being blocked?

Accepted Answer

The access-list is not referenced in any policy-map or class-map. Option D is correct. The AMP_block access-list is defined but not referenced in any policy-map, so it is not applied to traffic. Option A is wrong because the policy-map uses inspect commands, which do not automatically apply access-lists. Option B is wrong because remarks do not affect functionality. Option C is wrong because an access-list applied globally on an FTD does not require an interface; however, the issue is that it is not referenced in a policy, not that an interface is missing.

Answer

The remark command is incorrectly formatted

Answer

The policy-map does not include a pass or block action for the access-list

Answer

The access-list is not applied to an interface

Question 13

Refer to the exhibit. Based on the exhibit, what is the current state of the client and what action should the network administrator take to allow full network access?

Accepted Answer

The client is in a quarantine state due to posture assessment failure; the administrator should check the ISE posture policy and ensure the client meets compliance.. Option D is correct because the output shows "Authz Success" but the presence of a URL redirect to a guest portal and a dACL named "PERMIT_QUARANTINE" along with SGT value 2 (commonly quarantine) indicates the client is in a quarantine state, likely due to posture assessment failure. The administrator should check the ISE posture policy. Option A is wrong because the redirect and quarantine dACL imply limited access. Option B is wrong because simply disabling the redirect would not resolve the underlying compliance issue. Option C is wrong because the dACL is assigned by ISE based on policy, not manually configured on the switch.

Answer

The client's authentication succeeded but authorization is incomplete; the administrator should configure a new dACL on the switch.

Answer

The client is being redirected to a guest portal; the administrator should disable the URL redirect and assign a new VLAN.

Answer

The client is fully authenticated and authorized; no action is needed.

Question 14

A network administrator is configuring 802.1X for wired access on a Cisco switch. The switch is configured for RADIUS using a Cisco ISE server. During testing, a client that supports 802.1X is unable to authenticate and fails to gain network access. The administrator checks the switch logs and sees "Authentication failed: invalid EAP code received". What is the most likely cause?

Accepted Answer

The client is using an unsupported EAP method (e.g., EAP-TLS instead of PEAP).. Option C is correct because the error "invalid EAP code received" indicates that the switch received an EAP packet with a code it does not support, typically due to an unsupported EAP method. Option A is wrong because a shared secret mismatch would produce a different RADIUS error. Option B is wrong because trunk port configuration would cause VLAN issues, not EAP parsing errors. Option D is wrong because RADIUS unreachability would cause timeouts or no response.

Answer

The RADIUS server is unreachable.

Answer

The switch is configured with the wrong shared secret for RADIUS.

Answer

The switch port is configured as a trunk port rather than an access port.

Question 15

A Cisco TrustSec deployment is being implemented to enforce micro-segmentation. The security team needs to ensure that Security Group Tags (SGTs) are propagated across the network. Which THREE methods can be used to distribute SGT information in a TrustSec environment? (Choose three.)

Accepted Answer

SGT over SXP (SGT Exchange Protocol). The correct methods are SGT over SXP (SGT Exchange Protocol), SGT over VXLAN, and SGT inline tagging in the Ethernet header. SGT over MPLS is not a standard TrustSec propagation method. SGT over CDP is not supported; CDP is used for device discovery, not SGT propagation.

Answer

SGT over Cisco Discovery Protocol (CDP)

Answer

SGT over MPLS