350-701 Practice Test 24 — 15 Questions

Question 1

A large enterprise uses Cisco ISE for network access control with 802.1X authentication (PEAP-MSCHAPv2) on wired ports. Access switches are Cisco Catalyst 3850s running IOS-XE 16.9, and ISE is version 2.7 with all patches. Recently, users in the finance department report intermittent connectivity issues when connecting to the network. The issue is sporadic: a user may connect successfully one day, then fail multiple times the next day. Switch logs show frequent 'EAP timeout' errors for these users. The network team has verified that the RADIUS servers are reachable and have sufficient CPU and memory. The ISE logs show no authentication failures, only that some EAP conversations are dropped mid-exchange. What is the most likely cause of these intermittent failures?

Accepted Answer

The switch is configured with a RADIUS timeout value that is too low.. The EAP timeout errors and intermittent nature point to the RADIUS timeout being too low on the switch, causing it to drop EAP conversations during periods of high latency. Options A, B, and D would cause consistent failures for affected users, not intermittent issues.

Answer

The switch port is configured with a dynamic VLAN assignment that does not exist on the switch.

Answer

The user's machine certificate has expired.

Answer

The ISE server is configured with an incorrect shared secret for the switch.

Question 2

Which two conditions must be met for Cisco Firepower Threat Defense (FTD) to perform SSL decryption?

Accepted Answer

The FTD must have a decryption certificate (server certificate) installed.. SSL decryption requires both a trusted CA certificate to re-sign the server certificate and a decryption certificate (server certificate) to present to the client. Options A, C, and D are not prerequisites.

Answer

The client must be using TLS 1.2 or higher.

Answer

The FTD must have a URL Filtering license.

Answer

The decryption policy must be configured on the FTD device.

Question 3

Refer to the exhibit. A host with IP address 10.0.0.5 sends traffic to destination 192.168.2.10. The traffic is not being translated. What is the most likely cause?

Accepted Answer

The ACL INSIDE_NAT does not permit traffic to the destination network 192.168.2.0/24.. The access-list INSIDE_NAT permits traffic to network 192.168.3.0/24, but the destination is 192.168.2.10, which is not matched. Therefore, NAT is not applied to that traffic. Option A is correct. Options B, C, and D are not relevant because dynamic NAT is allowed, outside interface has an IP, and security-level does not affect NAT.

Answer

The security-level of the inside interface is too high to allow NAT.

Answer

The interface outside does not have a valid IP address assigned.

Answer

The NAT statement uses source dynamic instead of source static; dynamic cannot translate internal IPs.

Question 4

Which TWO of the following are core components of the Cisco Identity Services Engine (ISE) for policy enforcement?

Accepted Answer

Active Directory Integration. The Policy Service Node (PSN) is responsible for policy decision and enforcement, and Active Directory integration is a key component for identity mapping. NAD (Network Access Device) is an external device that ISE controls, not a component of ISE itself. EAP-TLS is an authentication protocol, and Firepower is a separate security product.

Answer

EAP-TLS

Answer

Firepower Threat Defense

Answer

Network Access Device (NAD)

Question 5

Refer to the exhibit. An administrator has configured the router with zone-based firewall rules. Traffic from the DMZ zone to the OUTSIDE zone is being dropped, although traffic from the INSIDE zone to the OUTSIDE zone flows normally. The DMZ zone is configured with security-level 50 and the INSIDE zone with 100. What is the most likely cause of the dropped traffic?

Accepted Answer

No zone-pair is defined for traffic from DMZ to OUTSIDE. The zone-pair is only defined for source INSIDE to destination OUTSIDE, so there is no policy applied to traffic from DMZ to OUTSIDE. The class-default inside the DMZ_OUT_POLICY would drop all traffic, but that policy is not applied to DMZ->OUTSIDE. Option A is correct because the DMZ zone is not included in any zone-pair. Options B and C are incorrect because security-levels are not used in ZBFW, and the policy-map itself is correct. Option D is incorrect because the inspect action is present for matched traffic.

Answer

The inspect action is not applied to the DMZ traffic class

Answer

The class-default action in the policy-map drops all traffic from DMZ

Answer

The DMZ has a lower security-level than the INSIDE zone, causing traffic to be implicitly denied

Question 6

A financial institution with a flat Layer 2 network has experienced a ransomware incident where an infected workstation in the accounting department propagated laterally to a server in the finance department. The network spans 10 switches connected in a star topology with a collapsed core. The IT team wants to implement segmentation to contain such threats in the future, without requiring major hardware upgrades and with minimal change to IP addressing. The network currently uses a single VLAN with /16 subnet. Which of the following approaches would BEST achieve the segmentation goal, considering the constraints?

Accepted Answer

Implement internal firewall zones using a next-generation firewall (NGFW) with application inspection and user identity. Implementing internal firewall zones with a next-generation firewall provides granular, stateful inspection and application-level segmentation. It can filter traffic between departments without changing IP addressing and leverages existing switch infrastructure. VLANs with ACLs on the edge router are stateless and can be bypassed; also they require reconfiguring IP addressing if VLANs are separate subnets, and ACLs on a core router do not provide the depth of inspection needed. Deploying a VPN for all internal traffic is not scalable and adds latency. Using STP and PVLANs on switches can provide some isolation but does not prevent lateral movement at higher layers and is complex to manage across multiple switches without a fabric. Option B is the most effective given the constraints.

Answer

Use Spanning Tree Protocol with Private VLANs on all switches

Answer

Deploy a full-mesh VPN between all departments to encrypt and restrict traffic

Answer

Deploy VLANs for each department and apply ACLs on the core router to restrict inter-VLAN traffic

Question 7

While troubleshooting an issue where Cisco ESA occasionally fails to process inbound messages, the administrator checks the listener settings and sees that the 'Pool of listeners' option is configured. The mail logs show 'Connection refused' errors during peak hours. What is the most likely cause?

Accepted Answer

Listener pool has too few listeners or the pool is misconfigured. The 'Connection refused' error during peak hours indicates that the Cisco ESA's listener service is actively rejecting new SMTP connections because the configured listener pool has reached its maximum capacity. The 'Pool of listeners' option defines a set of listener processes that handle inbound mail; if the pool size is too small for the traffic volume, new connections are refused. This is a resource exhaustion issue specific to the listener pool, not a service outage or external blocking.

Answer

The listener service is stopped

Answer

The sender's IP is blacklisted

Answer

DNS resolution failure for the sending MTA

Question 8

A Cisco ASA firewall is configured with multiple contexts. The administrator needs to allow traffic from a context to pass through the management context for management purposes. Which type of interface should be used for this inter-context communication?

Accepted Answer

Use a shared interface that is allowed in multiple contexts.. In multiple-context mode on a Cisco ASA, inter-context communication (such as allowing a user context to send management traffic to the management context) is achieved by using a shared interface. A shared interface is assigned to multiple security contexts, enabling them to communicate directly without requiring a physical or virtual crossover cable. This design allows the management context to receive traffic from other contexts for monitoring or administrative purposes while maintaining separation of forwarding tables.

Answer

Configure a virtual interface in each context and bridge them.

Answer

Use a dedicated physical interface for each context and route through the backplane.

Answer

Configure a subinterface on the management interface for each context.

Question 9

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Accepted Answer

IKE_SA_INIT exchange. IKEv2 simplifies the Internet Key Exchange process by using only two exchanges to establish an IPsec security association: the IKE_SA_INIT exchange (for negotiating cryptographic parameters and exchanging Diffie-Hellman public values) and the IKE_AUTH exchange (for authenticating the peers and establishing the first child SA). These are the mandatory exchanges defined in RFC 7296, making options C and D correct. The INFORMATIONAL exchange is also a valid component of IKEv2, used for error reporting and deleting SAs, which is why option E is correct.

Answer

Aggressive Mode exchange

Answer

Main Mode exchange

Question 10

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

Accepted Answer

Implement IKEv2 redirect mechanism to direct spokes to the optimal hub.. The IKEv2 redirect mechanism allows a hub to inform a spoke of a more optimal hub based on metrics such as latency or load. The spoke then initiates a new IKEv2 connection to the recommended hub, enabling dynamic hub selection without manual configuration. This is the standard Cisco solution for FlexVPN deployments requiring proximity-based tunnel establishment.

Answer

Configure static priority on each hub and use priority-based selection.

Answer

Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.

Answer

Use DHCP option 121 to push static routes for hub selection.

Question 11

Which TWO of the following are required to configure a site-to-site IPsec VPN on a Cisco IOS router?

Accepted Answer

ISAKMP policy. ISAKMP (Internet Security Association and Key Management Protocol) policy is required to define the parameters for Phase 1 of an IPsec VPN, including encryption, authentication, Diffie-Hellman group, and lifetime. Without an ISAKMP policy, the router cannot establish the secure management tunnel needed to negotiate IPsec Security Associations (SAs).

Answer

NAT exemption for VPN traffic

Answer

AAA new-model

Answer

DHCP pool for remote clients

Question 12

A company has deployed Cisco AnyConnect VPN for remote access. They want to enforce that only company-managed devices with compliant antivirus and disk encryption can connect. Which solution should be added to the ASA?

Accepted Answer

Cisco Identity Services Engine (ISE) with posture assessment. Cisco ISE with posture assessment is the correct solution because it integrates with the ASA to enforce endpoint compliance before granting VPN access. Posture assessment checks for specific conditions such as antivirus status, disk encryption, and OS patch levels, ensuring only company-managed devices that meet security policies can connect via AnyConnect.

Answer

Cisco Firepower Threat Defense (FTD) with intrusion policy

Answer

Cisco Umbrella with DNS filtering

Answer

Cisco Stealthwatch with NetFlow

Question 13

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Accepted Answer

Check the Cisco Umbrella dashboard for the domain, identify the internal IP, and block the domain via policy.. Option A is correct because Cisco Umbrella is a DNS-layer security solution that can log and block DNS queries to malicious domains. The administrator should first check the Umbrella dashboard to identify the internal IP generating the excessive queries, then create a policy to block the domain, which will prevent all subsequent DNS resolutions to that domain without affecting other traffic.

Answer

Create a firewall ACL to block the IP address of the DNS server from the internal user.

Answer

Disable the user's network access temporarily and inform the IT department.

Answer

Enable full packet capture on the internal network and wait for the next occurrence.

Question 14

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They want to enable URL filtering based on user identity from an Active Directory (AD) source. Which configuration steps are required on the FMC?

Accepted Answer

Configure an identity source (AD), create realm and user groups, then configure URL filtering rules with user conditions.. Option B is correct because to enable URL filtering based on user identity from Active Directory, you must first configure an identity source (AD) on the FMC, then create a realm and import user groups. After that, you can configure URL filtering rules within an access control policy that includes user conditions to match traffic against specific AD users or groups. This sequence ensures the FTD can resolve user identity before applying URL category-based actions.

Answer

Create a URL category and associate it with a user group in the access control policy.

Answer

Create URL filtering rules first, then assign to users via dynamic object.

Answer

Configure identity source and NAT policy, then apply URL filtering.

Question 15

A network engineer is trying to establish a site-to-site IPsec VPN between two Cisco routers. The IKEv2 proposal uses AES-256 encryption and SHA-256 hash. On the remote router, the configuration shows only AES-128 and SHA-1. What will happen during IKEv2 negotiation?

Accepted Answer

The IKEv2 negotiation will fail because no common proposal exists.. IKEv2 negotiation requires that both peers have at least one matching proposal (encryption, hash, DH group, etc.) in their configured transform sets. Since the local router offers AES-256/SHA-256 and the remote router only offers AES-128/SHA-1, there is no common proposal. IKEv2 does not perform automatic fallback or mixing of parameters; it simply fails if no match is found.

Answer

The router with stronger proposal will override the other.

Answer

The routers will automatically fall back to IKEv1.

Answer

The routers will negotiate and use AES-128 with SHA-256.