350-701 Practice Test 25 — 15 Questions

Question 1

An administrator configures Cisco ISE for guest access with a sponsor portal. What is the primary purpose of the sponsor portal?

Accepted Answer

Allow sponsors to create and manage guest accounts. The sponsor portal in Cisco ISE is specifically designed to allow authorized users (sponsors) to create, manage, and approve guest accounts. This enables controlled guest access where a sponsor, such as an employee or administrator, provisions credentials for visitors, ensuring accountability and policy enforcement without requiring guests to self-register.

Answer

Provide network access for non-supplicant devices

Answer

Enable guests to authenticate with MFA

Answer

Allow guests to self-register

Question 2

Which of the following is a characteristic of anomaly-based intrusion detection compared to signature-based detection?

Accepted Answer

Higher false positive rate. Anomaly-based intrusion detection establishes a baseline of normal network or system behavior and flags any deviation as potential malicious activity. Because legitimate traffic patterns can vary widely and baselines are imperfect, this approach generates a higher false positive rate compared to signature-based detection, which only alerts on known patterns. Thus, the correct characteristic is a higher false positive rate.

Answer

Lower false negative rate for known attacks

Answer

Cannot detect zero-day attacks

Answer

Requires frequent signature updates

Question 3

Refer to the exhibit. What is the most likely reason for the high number of 'No route to host' drops on a Cisco ASA?

Accepted Answer

Missing static route on the ASA. The 'No route to host' drop on a Cisco ASA indicates that the firewall has no valid route in its routing table to reach the destination IP address of the packet. Option C is correct because a missing static route (or dynamic route) for the destination network prevents the ASA from performing a route lookup, causing it to drop the packet with this specific syslog message. This is a Layer 3 forwarding issue, not a policy or NAT problem.

Answer

Firewall is in transparent mode

Answer

Interface is down

Answer

Incorrect NAT rule

Question 4

An organization uses Cisco AMP for Endpoints and wants to perform a remote investigation on an infected endpoint. The security analyst needs to isolate the endpoint from the network while collecting forensic data. Which AMP feature should be used?

Accepted Answer

Endpoint Isolation and Remote Shell. Cisco AMP for Endpoints provides endpoint isolation and remote shell capabilities, allowing analysts to isolate a compromised endpoint from the network and perform forensic investigation remotely.

Answer

Device Trajectory

Answer

File Quarantine

Answer

Orbital Advanced Search

Question 5

A network engineer is configuring 802.1X on a switch port that connects to a VoIP phone and a PC behind the phone. Which authentication method should be used to authenticate both devices separately?

Accepted Answer

Multi-domain authentication (MDA). Multi-domain authentication (MDA) allows a switch port to authenticate multiple devices (e.g., phone and PC) separately, each with its own VLAN.

Answer

Single-host authentication

Answer

MAC Authentication Bypass (MAB)

Answer

Guest VLAN

Question 6

An engineer is designing a cloud security solution using Cisco SD-WAN with cloud on-ramp. They want to ensure that traffic to a specific IaaS provider is inspected by the Cisco Umbrella SIG. Which configuration is necessary on the SD-WAN edge?

Accepted Answer

Configure a service insertion policy for the cloud security provider. To direct specific traffic to Cisco Umbrella SIG for cloud security inspection, you must configure a service insertion policy on the SD-WAN edge. This policy intercepts traffic based on match criteria (e.g., destination IaaS provider IP/subnet) and forwards it to the cloud security service via a secure tunnel (e.g., IPsec or TLS). Without this policy, the SD-WAN edge will not redirect traffic to Umbrella for inspection.

Answer

Apply a DNS security policy

Answer

Set up a site-to-site VPN to the IaaS

Answer

Enable direct internet access for the branch

Question 7

Which THREE of the following are capabilities of Cisco Email Security Appliance (ESA) for content filtering? (Choose three.)

Accepted Answer

Anti-spam filtering. B is correct because Cisco ESA includes a sophisticated anti-spam filtering engine that uses multiple techniques such as SenderBase reputation, contextual analysis, and signature-based detection to identify and block unwanted email messages. This is a core content security capability of the ESA, operating at the email gateway to filter inbound and outbound traffic.

Answer

Intrusion Prevention System (IPS)

Answer

Zero-day malware protection using sandboxing

Question 8

A network administrator is deploying Cisco AMP for Endpoints to protect against advanced malware. They want to ensure that if a file is initially allowed but later determined to be malicious, the file is automatically blocked and quarantined on all endpoints that have executed it. Which AMP feature should be configured?

Accepted Answer

Retrospective Security (Retrospective). Retrospective Security (Retrospective) is the correct feature because it allows Cisco AMP for Endpoints to re-evaluate files that were initially allowed based on local or cloud reputation. If a file is later determined to be malicious via updated threat intelligence, Retrospective Security automatically blocks and quarantines that file on all endpoints that have executed it, even after the initial execution. This provides continuous protection against advanced malware that evades initial detection.

Answer

TETRA (Technique Extraction and Retrospective Analysis)

Answer

File Analysis via the AMP cloud

Answer

Exclude List for known good files

Question 9

In Cisco ASA modular policy framework, what is the function of a class-map?

Accepted Answer

Classify traffic into different flows. In Cisco ASA Modular Policy Framework (MPF), a class-map identifies and classifies traffic into flows based on match criteria such as ACLs, protocols, or ports. It is the first of three MPF components (class-map, policy-map, service-policy) and answers the question 'what traffic are we talking about?' before any action is applied.

Answer

Apply the policy to an interface

Answer

Configure NAT rules

Answer

Define the action to take on traffic

Question 10

A Cisco Firepower administrator configures an access control policy with a rule that trusts traffic from a specific source network. What is the effect of the trust action on the traffic?

Accepted Answer

The traffic is allowed without further inspection.. In a Cisco Firepower access control policy, the Trust action allows the traffic to pass without any further inspection by intrusion, file, or other deep-inspection policies. It is effectively a fast-path allow that bypasses the rest of the inspection pipeline. This is useful for trusted internal traffic where inspection overhead is unnecessary.

Answer

The traffic is blocked and logged.

Answer

The traffic is allowed and inspected by the intrusion policy.

Answer

The traffic is allowed but subject to file policy.

Question 11

A security engineer is tuning an IPS to reduce false positives. They notice that legitimate traffic is triggering a signature for a worm that uses a specific HTTP GET request. The engineer wants to disable the signature for that specific traffic pattern but keep it enabled for other traffic. What is the best approach?

Accepted Answer

Create a rule suppression for the specific source/destination.. Rule suppression (also called event filtering or exception rules) allows the engineer to keep the signature active globally while excluding a narrowly defined traffic flow — typically identified by source IP, destination IP, subnet, or specific host pair. This preserves detection coverage for the worm signature across the rest of the network while eliminating the false positive only for the legitimate traffic pattern. It is the surgical, best-practice tuning method in Cisco IPS/NGIPS deployments.

Answer

Increase the signature threshold.

Answer

Disable the signature globally.

Answer

Change the action to 'alert' instead of 'drop'.

Question 12

An organization wants to deploy endpoint hardening by allowing only approved applications to run. Which technology should be implemented to achieve this?

Accepted Answer

Application whitelisting. Application whitelisting is the correct technology because it enforces endpoint hardening by explicitly allowing only approved applications to execute, blocking all others by default. This is a fundamental principle of least privilege and is often implemented using tools like Windows AppLocker or Cisco AMP's application control, which maintain a hash-based or path-based allow list.

Answer

EDR

Answer

Host-based IPS

Answer

Antivirus software

Question 13

A company wants to implement network access control for IoT devices that do not support 802.1X. Which Cisco ISE feature can be used to grant these devices network access based on their MAC address?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.

Answer

Guest access

Answer

Profiling

Answer

Posture assessment

Question 14

An organization wants to enforce micro-segmentation in a data center to isolate application tiers. Which Cisco technology allows defining security policies based on endpoint groups rather than IP addresses?

Accepted Answer

Cisco TrustSec with Security Group Tags (SGTs). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on endpoint groups (e.g., application tiers) rather than IP addresses. This allows micro-segmentation by enforcing policies that follow the traffic regardless of IP changes, using SGTs carried in the packet via Cisco Metadata (CMD) or inline tagging.

Answer

Cisco ASA with access-lists

Answer

Cisco ISE with guest services

Answer

Cisco Firepower NGFW with URL filtering

Question 15

A security team wants to enforce data loss prevention (DLP) policies across multiple sanctioned cloud applications used by employees. Which cloud security solution is best suited for this task?

Accepted Answer

CASB (Cloud Access Security Broker). A CASB sits between users and cloud services and enforces policy — including DLP — across sanctioned SaaS applications via API or inline proxy modes. It can inspect data in transit and at rest in cloud apps, apply DLP rules (e.g., block credit card numbers or PII), and enforce access controls, making it the right tool for multi-cloud-app DLP enforcement.

Answer

CWPP (Cloud Workload Protection Platform)

Answer

Cisco Umbrella SIG

Answer

CSPM (Cloud Security Posture Management)