350-701 Practice Test 24 — 15 Questions

Question 1

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

Accepted Answer

Block. When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Answer

Allow

Answer

Quarantine

Answer

Detect

Question 2

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Accepted Answer

Inherence. A fingerprint scanner falls under the inherence factor category because it authenticates based on a physical or behavioral characteristic intrinsic to the user — something the user *is*. Inherence factors include biometrics such as fingerprints, retina/iris scans, voiceprints, and facial recognition. Because the biometric trait cannot be transferred or forgotten like a token or password, it is classified as inherence rather than possession or knowledge.

Answer

Possession

Answer

Knowledge

Answer

Location

Question 3

In Cisco Firepower, a file policy is configured with a rule that detects malware. The action is set to 'Malware Cloud Lookup'. What happens if the SHA-256 hash of a file is unknown to the AMP cloud?

Accepted Answer

The file is allowed and a retrospective alert is generated if later found malicious.. When a file policy rule uses the 'Malware Cloud Lookup' action and the SHA-256 hash is unknown to the AMP cloud, the file is allowed to pass but the hash is stored for retrospective analysis. If the file is later determined to be malicious, a retrospective alert is generated, allowing security teams to investigate and remediate. This behavior balances security with availability, avoiding unnecessary blocking of unknown files while still providing a detection mechanism.

Answer

The file is blocked immediately.

Answer

The file is quarantined until the cloud responds.

Answer

The file is sent for dynamic analysis in a sandbox.

Question 4

Which TWO of the following are common causes of email delivery delays in Cisco Email Security Appliance (ESA)? (Select exactly two.)

Accepted Answer

High volume of email in the delivery queue. A high volume of email in the delivery queue indicates that the ESA is experiencing a backlog of messages awaiting delivery. This can occur due to rate limiting, transient delivery failures, or a large number of messages being processed simultaneously, which directly causes delays in email delivery as the queue must be drained sequentially.

Answer

Too many recipients in a single message

Answer

Incorrect MX record for the destination domain

Answer

Improper SPF record on the sender's domain

Question 5

A network engineer is deploying a Cisco FTD in active/standby high availability. Which statement is true about the configuration synchronization?

Accepted Answer

Configuration changes on the active unit are automatically replicated to the standby unit.. In a Cisco FTD active/standby HA pair managed by FMC, configuration is synchronized automatically from the active unit to the standby unit. The standby is a hot spare that receives replicated config and state, so administrators only configure the active device (or the FMC container) and changes propagate. This ensures both units have identical policy, interfaces, and settings for seamless failover.

Answer

Standby unit must be configured separately with identical settings.

Answer

Both units can be managed independently via FMC.

Answer

Failover is configured on the FTD directly without FMC.

Question 6

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. Option A, 'Never trust, always verify,' is correct because Cisco Zero Trust treats every user, device, and application as untrusted by default, requiring explicit authentication and authorization for each access request regardless of network location. Option B, 'Continuous monitoring and validation,' is correct because Zero Trust requires ongoing verification of identity, device posture, and behavior throughout a session, not just at initial login, using telemetry and analytics to detect anomalies. Option E, 'Least privilege access,' is correct because Zero Trust grants users and devices only the minimum permissions needed for a specific task, typically enforced through micro-segmentation and dynamic policy, limiting lateral movement. Option C, 'Implicit trust for internal traffic,' is incorrect because implicit trust of anything inside the network perimeter is the exact assumption Zero Trust eliminates. Option D, 'Perimeter-based security,' is incorrect because Zero Trust moves away from a single hardened perimeter toward identity- and context-centric controls that protect resources wherever they reside.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 7

Which TWO benefits does the Cisco ESA provide for email security? (Choose two.)

Accepted Answer

Email encryption and data loss prevention. The Cisco Email Security Appliance (ESA) includes integrated email encryption capabilities via Cisco Registered Envelope Service (CRES) or PGP/SMIME, and it provides Data Loss Prevention (DLP) through pre-defined or custom DLP policies that scan outbound emails for sensitive data patterns such as credit card numbers or PII. These features are core to the ESA's content security functionality.

Answer

DNS-layer security

Answer

Network firewall functionality

Answer

Web content filtering

Question 8

A security team is implementing CSPM to ensure cloud compliance. Which three checks would a CSPM tool typically perform? (Choose three.)

Accepted Answer

Verifying that EBS volumes are encrypted. A CSPM (Cloud Security Posture Management) tool continuously assesses cloud configurations against compliance baselines and best practices. Option A is correct because verifying that EBS volumes are encrypted is a standard configuration check for data-at-rest protection in AWS. Option B is correct because checking S3 buckets for public read access is a classic CSPM misconfiguration check that detects unintended data exposure. Option E is correct because ensuring IAM roles follow least privilege is a core identity and access management posture check that CSPM tools evaluate against policies and permissions. Option C does not belong because monitoring user behavior analytics is the domain of UEBA or SIEM tools, not CSPM. Option D does not belong because scanning container images for vulnerabilities is performed by container/image scanning tools (e.g., Amazon ECR image scanning, Trivy), which fall under vulnerability management rather than CSPM configuration posture.

Answer

Monitoring user behavior analytics

Answer

Scanning container images for vulnerabilities

Question 9

A security team deploys Cisco AMP for Endpoints and wants to detect and block memory injection attacks. Which AMP feature should be enabled to achieve this?

Accepted Answer

Exploit Prevention. Cisco AMP for Endpoints' Exploit Prevention module specifically detects and blocks memory injection and other exploit techniques by monitoring process behaviour for suspicious memory operations. It is the feature designed to stop the exact attack class described. Enabling it provides the required protection against memory injection attacks.

Answer

Device Trajectory

Answer

IOC scanning

Answer

File quarantine

Question 10

A Cisco ASA is configured with a modular policy framework to inspect HTTP traffic. The class-map matches HTTP traffic, and the policy-map applies inspection. Which command correctly applies the policy to an interface?

Accepted Answer

service-policy policy-map-name interface inside. On a Cisco ASA, the modular policy framework is activated on an interface using the global configuration command 'service-policy interface '. The policy-map name is a user-defined identifier (not the keyword 'inspect'), and it must be applied to a named interface such as 'inside' or 'outside'. Option A follows this exact syntax and correctly binds the previously defined policy-map to the inside interface.

Answer

service-policy inspect http interface inside

Answer

policy-map service-policy inside

Answer

apply service-policy policy-map-name inside

Question 11

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Accepted Answer

Account takeover (BEC). This scenario describes a Business Email Compromise (BEC) attack via account takeover: the email originated from a compromised internal account, so it passed SPF, DKIM, and DMARC because it was sent from a legitimate domain and server. The attacker used the compromised account to send phishing emails. Malspam is generic spam with malware, spear phishing targets specific individuals but may not involve a compromised account, and whaling targets executives. The key differentiator is the compromised internal account, which is classic BEC/account takeover.

Answer

Malspam

Answer

Spear phishing

Answer

Whaling

Question 12

Which TWO of the following are features of Cisco Umbrella? (Choose two.)

Accepted Answer

Secure web gateway. Cisco Umbrella provides DNS-layer security as a core feature, which blocks requests to malicious domains before a connection is established, effectively preventing malware, phishing, and command-and-control callbacks. It also includes a Secure Web Gateway (SWG) that enforces URL filtering, application controls, and HTTPS inspection to protect users from web-based threats. These two capabilities are fundamental to Umbrella's cloud-delivered security architecture.

Answer

Cloud access security broker

Answer

Next-generation firewall

Answer

Data loss prevention

Question 13

A security engineer is configuring Cisco WSA to block access to a new social media site that is not in any predefined URL category. Which action should the engineer take to ensure the site is blocked for all users?

Accepted Answer

Create a custom URL category with the site and apply a block action in the access policy.. Cisco WSA allows administrators to create custom URL categories for sites not covered by predefined categories. By adding the URL to a custom category and applying a block action in the access policy, the engineer ensures the site is blocked for all users, as access policies evaluate custom categories before predefined ones.

Answer

Disable the URL filtering engine and use only web reputation.

Answer

Add the URL to the existing Social Networking category.

Answer

Enable Dynamic Content Analysis to detect and block the site.

Question 14

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Accepted Answer

IKE_SA_INIT exchange. IKEv2 defines exactly three exchange types: IKE_SA_INIT, IKE_AUTH, and INFORMATIONAL. Option C (IKE_SA_INIT exchange) is correct because it is the initial exchange that negotiates cryptographic algorithms, exchanges nonces, and performs a Diffie-Hellman key exchange to establish the IKE Security Association. Option D (IKE_AUTH exchange) is correct because it authenticates the peers, protects the identities, and creates the first Child SA (IPsec SA) for ESP/AH traffic. Option E (INFORMATIONAL exchange) is correct because it is used after the IKE SA is established to carry control messages such as delete notifications, configuration payloads, and liveness checks (DPD). Options A (Aggressive Mode) and B (Main Mode) are incorrect because those are IKEv1 Phase 1 exchange modes, not IKEv2 exchange types; IKEv2 replaced them with the fixed IKE_SA_INIT/IKE_AUTH sequence.

Answer

Aggressive Mode exchange

Answer

Main Mode exchange

Question 15

A company is using a SaaS application like Office 365. Which security responsibility falls on the customer according to the shared responsibility model?

Accepted Answer

Data classification and access policies. In the shared responsibility model for SaaS, the provider manages the underlying infrastructure, operating system, network, and application, while the customer remains responsible for their data — including data classification, access policies, identity management, and user permissions. This is the core customer-side responsibility in any cloud service model.

Answer

Operating system patching

Answer

Physical security of servers

Answer

Network firewall management