350-701 Practice Test 24 — 15 Questions

Question 1

Which of the following is a characteristic of anomaly-based intrusion detection compared to signature-based detection?

Accepted Answer

Higher false positive rate. Anomaly-based detection baselines normal behavior and flags deviations, which can lead to higher false positives because legitimate variations may be flagged. Signature-based detection has lower false positives but cannot detect unknown attacks.

Answer

Lower false negative rate for known attacks

Answer

Cannot detect zero-day attacks

Answer

Requires frequent signature updates

Question 2

A Cisco FTD is configured with a file policy to detect malware. The policy includes a rule to block files with a SHA-256 hash that is known to be malicious. Which component provides the SHA-256 disposition?

Accepted Answer

Cisco AMP cloud. Cisco AMP (Advanced Malware Protection) cloud provides threat intelligence including SHA-256 dispositions (clean, malicious, unknown). The FTD queries the AMP cloud for file disposition.

Answer

Network discovery database

Answer

Local malware cache

Answer

Snort rules

Question 3

An engineer needs to allow inbound HTTP traffic from the internet to a web server in the DMZ on a Cisco ASA. The DMZ interface security level is 50, and the outside interface is 0. Which interface direction should the access control entry be applied?

Accepted Answer

Inbound on the outside interface. Traffic from outside (level 0) to DMZ (level 50) is inbound to the DMZ interface, so the ACL should be applied inbound on the outside interface or outbound on the DMZ interface; the standard approach is inbound on the lower security interface.

Answer

Outbound on the DMZ interface

Answer

Outbound on the outside interface

Answer

Inbound on the DMZ interface

Question 4

An engineer wants to configure high availability on a pair of Cisco Firepower Threat Defense (FTD) devices. Which HA mode supports active/standby failover with stateful replication of connection information?

Accepted Answer

Active/standby with stateful failover. Active/standby HA with stateful failover syncs connection states. Active/active is typically for routed mode with asymmetric routing.

Answer

Active/standby without stateful failover

Answer

Active/active with asymmetric routing

Answer

Clustering

Question 5

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?

Accepted Answer

PAT (overload). PAT (Port Address Translation) or overload uses unique source ports to distinguish sessions from multiple internal hosts sharing one public IP.

Answer

Identity NAT

Answer

Static NAT

Answer

Dynamic NAT

Question 6

A multinational corporation is implementing ISE for wired network access using 802.1X with EAP-TLS certificate authentication. Their Windows 10 laptops have certificates issued by an internal PKI. During testing, some users report that they are repeatedly prompted to select a certificate after connecting, and eventually authentication fails. ISE logs show 'Authentication failed - No matching certificate found'. The engineer checks the client machine and sees multiple certificates, including the correct one, in the personal store. The ISE endpoint identity store is populated with the user's AD credentials. What is the most likely cause of this failure?

Accepted Answer

The client certificates lack the 'Client Authentication' extended key usage (EKU). EAP-TLS requires the client to present a certificate that ISE can validate. If the client has multiple certificates and ISE receives one that does not contain the 'Client Authentication' extended key usage (EKU), ISE will reject it, logging 'No matching certificate found'. The correct answer is D because the client certificates must have the EKU for client authentication; otherwise, even if the certificates are trusted and valid, ISE will not accept them for 802.1X. Option A (expired certificate) would cause a different error. Option B (registry modification) is not standard for Windows 10 supplicant. Option C (missing trusted CA) would cause ISE to not trust any client certificate, affecting all users, not just some.

Answer

The client's certificate is expired

Answer

The Windows supplicant requires a registry modification to enable auto-selection

Answer

ISE trusted CA certificate list does not include the issuing CA

Question 7

An enterprise uses multiple IaaS providers (AWS, Azure, GCP). They need a single solution to enforce consistent security policies across all cloud environments. Which Cisco product provides multi-cloud security posture management?

Accepted Answer

Cisco Secure Cloud Analytics. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is the correct answer because it provides multi-cloud security posture management by ingesting flow logs, API telemetry, and configuration data from AWS, Azure, and GCP to detect misconfigurations, anomalous behavior, and compliance violations. It uses machine learning to establish baselines and alert on deviations, enabling consistent policy enforcement across heterogeneous cloud environments without requiring agents or changes to existing infrastructure.

Answer

Cisco Defense Orchestrator

Answer

Cisco ISE

Answer

Cisco Firepower NGFW

Question 8

An administrator configures a Cisco ASA with the following Modular Policy Framework (MPF) commands:

class-map type inspect http match any
policy-map type inspect http http_policy
 parameters
 protocol-violation action reset
service-policy http_policy global

What is the result of this configuration?

Accepted Answer

Creates an HTTP inspection policy that resets connections that violate HTTP protocol. The MPF configuration applies a protocol violation action to HTTP traffic; when a violation is detected, the ASA sends a TCP reset.

Answer

Blocks all HTTP traffic globally

Answer

Enables HTTP deep inspection and logs all HTTP requests

Answer

Applies the policy only on the inside interface

Question 9

Which three actions are available in a Cisco Firepower access control rule? (Choose three.)

Accepted Answer

Allow. The main actions in access control rules are Trust (bypass inspection), Allow (permit with inspection), Block (deny), and Interactive Block (block with user interaction). Monitor is not an action; it is a logging option.

Answer

Decrypt

Answer

Monitor

Question 10

A Cisco FTD is deployed in a data center and needs to provide intrusion prevention and application control. Which two actions are available in an access control rule? (Choose two.)

Accepted Answer

Trust. In Cisco FTD access control policy, actions include: TRUST (bypass further inspection), ALLOW (permit with inspection), BLOCK (deny), and INTERACTIVE BLOCK (block with user notification).

Answer

Monitor

Answer

Encrypt

Answer

Redirect

Question 11

A company uses Cisco AnyConnect for remote access VPN. Which two components are used to enforce policies based on endpoint posture? (Choose two.)

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policies (DAP) and Group Policies are used with AnyConnect. DAP evaluates endpoint attributes (like antivirus status) to assign access policies, while Group Policies define VPN parameters.

Answer

Transform set

Answer

ISAKMP policy

Answer

Crypto map

Question 12

An engineer is configuring a Cisco ASA to allow inbound HTTPS traffic from the outside to a web server on the DMZ. The outside interface has security level 0, the DMZ interface has security level 50, and the inside has security level 100. Which set of commands correctly allows the traffic considering stateful inspection?

Accepted Answer

static (dmz,outside) tcp 192.168.1.10 443 10.1.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 192.168.1.10 eq 443; access-group OUTSIDE_IN in interface outside. By default, ASA allows traffic from higher to lower security levels without ACL, but for lower to higher an ACL is needed. Static NAT is required for inbound access, and an ACL permitting HTTPS from outside to DMZ is needed on the outside interface.

Answer

static (outside,dmz) tcp 10.1.1.10 443 192.168.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside

Answer

nat (dmz,outside) static 192.168.1.10; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface dmz

Answer

access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside; static (inside,outside) tcp 10.1.1.10 443 10.1.1.10 443 netmask 255.255.255.255

Question 13

An organization is using Cisco FMC with FTD devices. They want to detect and block malware in HTTP traffic. Which policy component must be configured to inspect files and submit SHA-256 hashes to AMP cloud for disposition?

Accepted Answer

File Policy. File policy is used to inspect files, and it can be configured to send SHA-256 hashes to AMP cloud for malware detection. Intrusion policy is for signatures, access control policy for traffic flow, and network discovery for host detection.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

Intrusion Policy

Question 14

A small business uses Cisco AMP for Endpoints with a cloud-based console. The owner receives an email from Cisco that the AMP connector on a specific endpoint has gone offline. The endpoint is a Windows 10 laptop used for remote work. The owner checks the AMP console and sees the endpoint's last check-in was three days ago. The owner contacts the remote user, who says the laptop is running normally and they can access the internet. What should the owner do to resolve the issue?

Accepted Answer

Instruct the user to restart the AMP connector service (Cisco AMP for Endpoints Connector).. The AMP connector on the endpoint may have a stopped or crashed service. Restarting the Cisco AMP for Endpoints Connector service will re-establish communication with the cloud console. Option A (disable firewall) is unnecessary and could reduce security; internet access works so firewall is likely not blocking. Option B (install Windows updates) is unrelated to the connector's offline status. Option C (reinstall connector) is an extreme measure that should only be attempted after simpler steps like restarting the service fail.

Answer

Instruct the user to disable Windows Firewall temporarily.

Answer

Ask the user to install the latest Windows updates.

Answer

Ask the user to uninstall and reinstall the AMP connector.

Question 15

An organization wants to enforce granular data loss prevention (DLP) policies for SaaS applications like Google Drive and Salesforce. Which Cisco product provides cloud access security broker (CASB) functionality with DLP capabilities?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is a cloud access security broker (CASB) that provides granular data loss prevention (DLP) for SaaS applications like Google Drive and Salesforce. It uses API-based inspection to scan data at rest and in motion, applying policies to prevent unauthorized sharing or leakage of sensitive information.

Answer

Cisco Firepower Threat Defense

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch