350-701 Practice Test 25 — 15 Questions

Question 1

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC. They want to create a rule that blocks access to social media applications regardless of port or protocol. Which policy should be used?

Accepted Answer

Access Control Policy with Application and URL filtering. An Access Control Policy with Application and URL filtering is the correct choice because it allows the security engineer to create a rule that blocks social media applications based on application signatures, independent of the port or protocol used. This policy inspects traffic at Layer 7, using the Cisco Firepower application detector database to identify and block applications like Facebook or Twitter even if they use non-standard ports or encryption.

Answer

Intrusion Policy

Answer

Prefilter Policy

Answer

SSL Policy

Question 2

A network administrator is configuring 802.1X authentication on Cisco switches for wired endpoints. Which protocol is used between the client (supplicant) and the switch (authenticator)?

Accepted Answer

EAP over LAN (EAPoL). In 802.1X authentication, the client (supplicant) communicates with the switch (authenticator) using EAP over LAN (EAPoL), which is defined in IEEE 802.1X-2004. EAPoL encapsulates EAP frames in Ethernet frames, allowing the supplicant to send authentication credentials to the authenticator before granting network access. The authenticator then relays these EAP messages to the authentication server (typically a RADIUS server) using RADIUS, but the direct protocol between client and switch is EAPoL.

Answer

RADIUS

Answer

EAP over UDP

Answer

TACACS+

Question 3

Which TWO are valid considerations for deploying Cisco Firepower NGIPS with inline mode? (Choose two.)

Accepted Answer

Inline interfaces can drop malicious packets based on signatures and anomalies.. Option C is correct because inline mode in Cisco Firepower NGIPS allows the system to actively drop malicious packets based on signature matches and anomaly detection. Unlike passive monitoring, inline interfaces sit directly in the traffic path, enabling the IPS engine to enforce blocking actions in real time.

Answer

Inline mode automatically decrypts SSL traffic without configuration.

Answer

The IPS engine inspects all traffic regardless of prefilter policies.

Answer

Inline mode requires the use of passive interfaces for failover.

Question 4

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

Accepted Answer

Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.. Option B is correct because it uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.

Answer

Create an ACL that permits all inbound and outbound traffic between DMZ and internet.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.

Question 5

A network engineer is configuring OSPF on a Cisco router and needs to enable authentication between neighbors. The authentication type should be MD5. Which configuration step is required?

Accepted Answer

ip ospf authentication message-digest under the interface. Option B is correct because to enable OSPF MD5 authentication on a Cisco router, the 'ip ospf authentication message-digest' command must be applied under the specific interface. This command tells OSPF to use MD5 (message-digest) authentication for that interface, and it must be paired with an 'ip ospf message-digest-key' command to define the actual key. The authentication type is configured at the interface level, not globally under the OSPF routing process.

Answer

ospf authentication-key under router ospf

Answer

area 0 authentication command in router configuration

Answer

ip ospf authentication null

Question 6

Which TWO are best practices for securing Cisco ASA remote access VPN? (Choose two.)

Accepted Answer

Enforce multi-factor authentication (MFA) for VPN users.. Option C is correct because enforcing multi-factor authentication (MFA) for VPN users adds an additional layer of security beyond just a password, significantly reducing the risk of credential theft and unauthorized access. Cisco ASA supports MFA integration with RADIUS servers (e.g., Cisco ISE, Duo Security) that can require a one-time password (OTP) or push notification, aligning with the principle of defense-in-depth for remote access VPNs.

Answer

Disable clientless SSL VPN to force full-tunnel client.

Answer

Use pre-shared keys for user authentication to simplify deployments.

Answer

Use L2TP/IPsec for legacy compatibility.

Question 7

An administrator is configuring a Cisco ASA 5500-X to perform SSL inspection for outbound traffic. The users must be able to access HTTPS websites without certificate errors. Which configuration step is essential for the ASA to perform decryption?

Accepted Answer

Generate a trusted root CA certificate on the ASA and distribute it to all client machines.. Option D is correct because for the ASA to perform SSL inspection (a man-in-the-middle proxy), it must generate a trusted root CA certificate that is installed as a trusted root on all client machines. This allows the ASA to dynamically sign the web server's certificate during the SSL handshake, so clients trust the re-encrypted traffic without certificate errors.

Answer

Configure the ASA to use a self-signed certificate without distribution.

Answer

Import the web server's private key onto the ASA.

Answer

Configure AAA authentication for SSL inspection.

Question 8

A security engineer is evaluating a web application firewall (WAF) rule set. The application uses a custom REST API that accepts JSON payloads. Which WAF rule is most effective at preventing SQL injection attacks while minimizing false positives?

Accepted Answer

Use a rule that parses JSON and checks for abnormal structures that indicate injection. Option D is correct because JSON-based APIs require context-aware parsing to detect SQL injection within structured payloads. A rule that parses JSON and checks for abnormal structures can identify injection attempts (e.g., nested objects or unexpected keys) without relying on simple keyword matching, which reduces false positives. This approach aligns with the WAF's ability to decode and inspect JSON fields for malicious SQL patterns while ignoring benign data.

Answer

Apply a generic SQL injection signature set from the WAF vendor

Answer

Block requests containing 'SELECT' or 'UNION' in the URL

Answer

Set the maximum request size to 10 MB

Question 9

A company wants to provide both corporate and guest wireless access using the same access points. They require that guest users be placed into a separate VLAN and have internet-only access. Which Cisco solution should be used?

Accepted Answer

Cisco Identity Services Engine (ISE) with dACL and VLAN assignment. Cisco ISE with downloadable ACLs (dACL) and VLAN assignment is the correct solution because it enables dynamic per-user policy enforcement. When a guest user authenticates, ISE can place them into a dedicated guest VLAN and apply a dACL that restricts traffic to internet-only access, while corporate users remain in their native VLAN with full internal access. This leverages RADIUS CoA (Change of Authorization) and 802.1X to dynamically assign VLANs and filter traffic at the access point or switch.

Answer

Cisco Prime Infrastructure

Answer

Cisco Flexible NetFlow

Answer

Cisco TrustSec with SGT

Question 10

An administrator is troubleshooting authentication failures for VPN users. The RADIUS server is reachable via ping, but users receive 'AAA authentication failed'. Which command should be used to test communication with the RADIUS server?

Accepted Answer

test aaa group radius user password. Option C is correct because the 'test aaa group radius user password' command is specifically designed to simulate an authentication attempt against a RADIUS server, allowing the administrator to verify whether the RADIUS server is properly processing credentials. Since the RADIUS server is reachable via ping but users still fail, this command isolates whether the issue lies in the AAA authentication process itself, such as incorrect shared secret, user credentials, or RADIUS attribute mismatches.

Answer

aaa new-model

Answer

show radius server statistics

Answer

debug radius authentication

Question 11

An administrator is configuring Cisco ISE to profile endpoints. The administrator wants to ensure that endpoints are correctly identified based on MAC address and hostname. Which of the following is a prerequisite for successful profiling?

Accepted Answer

The network devices must have profiling enabled and be configured with SNMP.. C is correct because Cisco ISE uses SNMP to query network devices (switches, wireless LAN controllers) for endpoint attributes such as MAC addresses and hostnames. Profiling must be enabled on the network devices, and SNMP (typically v2c or v3) must be configured so that ISE can collect the necessary data via MIBs like BRIDGE-MIB or ENTITY-MIB to correlate MAC-to-port mappings and hostname information.

Answer

The DHCP server must be configured with option 82.

Answer

The endpoints must have the ISE agent installed.

Answer

The switch must be configured with SNMP v3.

Question 12

A company is designing a remote access VPN solution using Cisco ASA with load balancing. Which three features are essential for high availability and redundancy? (Choose three.)

Accepted Answer

Failover. Failover is essential for high availability in Cisco ASA remote access VPN solutions. It allows a standby ASA to take over seamlessly if the primary unit fails, maintaining VPN sessions and ensuring uninterrupted remote access. This is achieved through stateful or stateless failover, where configuration and connection state are synchronized between the paired units.

Answer

Split tunneling

Answer

AnyConnect profiles

Question 13

A network engineer is configuring a new firewall to enforce security policies between two internal VLANs. The goal is to allow only HTTP traffic from the finance VLAN to the HR VLAN, while blocking all other traffic. Which type of firewall rule should be applied to achieve this requirement with minimal administrative overhead?

Accepted Answer

Explicit deny rule. Option A is correct because an explicit deny rule is required to block all traffic except HTTP from finance to HR. While firewalls have an implicit deny at the end of the rulebase, the requirement to 'block all other traffic' with minimal administrative overhead is best met by creating an explicit deny rule that matches the specific traffic flows to be blocked, ensuring clarity and preventing unintended implicit allow behavior. This approach avoids relying on the implicit deny, which could be overridden by a later default-permit rule or misconfiguration.

Answer

Implicit deny rule

Answer

Stateful rule

Answer

Default-permit rule

Question 14

An administrator is migrating an ASA firewall to a cloud environment and wants to use FlexConfig to push additional configuration. After applying the FlexConfig, the ASA does not show the expected commands. Which of the following is a likely reason?

Accepted Answer

The FlexConfig is not associated with the device in ASDM.. FlexConfig is a feature of Cisco ASDM that allows administrators to push additional CLI commands to an ASA that are not natively supported by the ASDM GUI. For FlexConfig to work, the configuration template must be explicitly associated with the target device within ASDM. If this association is missing, the ASA will not receive or apply the FlexConfig commands, even if the template is correctly written and the device supports the feature.

Answer

The ASA model does not support FlexConfig.

Answer

The ASA must be rebooted for FlexConfig to take effect.

Answer

The FlexConfig contains syntax errors that are silently ignored.

Question 15

A remote user is unable to connect to the corporate VPN using Cisco AnyConnect. The user has internet access and can reach the ASA's public IP. The ASA administrator checks and sees that the remote access VPN configuration is correct. What is the most likely client-side issue?

Accepted Answer

The client's certificate is expired or not trusted.. The user can reach the ASA's public IP and has internet access, which rules out basic connectivity issues. Since the ASA's VPN configuration is correct, the problem is likely on the client side. A common cause is an expired or untrusted certificate, as AnyConnect uses certificate-based authentication for the SSL/TLS handshake; if the client does not trust the server's certificate or the client's own certificate is expired, the VPN tunnel will fail to establish.

Answer

The client is using an outdated version of AnyConnect.

Answer

The client's DNS is not resolving the VPN hostname.

Answer

The client's firewall is blocking TCP port 443.