350-701 Practice Test 25 — 15 Questions

Question 1

A company uses a Cisco FMC to manage multiple FTD devices. They want to decrypt SSL/TLS traffic from internal users to external websites using a known private key. Which SSL decryption method should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decrypt-resign. Decrypt-known-key is used when the firewall has the server's private key (e.g., for internal servers), but for outbound traffic, decrypt-resign is typically used to re-sign certificates. However, the question specifies 'using a known private key', which implies the server's key is known, but for outbound inspection, the firewall generates a new cert. The correct method for outbound inspection with a known key is not standard; actually, decrypt-resign uses a CA to re-sign. The best answer is decrypt-resign because decrypt-known-key is for inbound traffic to servers where the key is known.

Answer

Bypass decryption

Answer

Decrypt-known-key

Answer

Decrypt-unknown-key

Question 2

A company has a hybrid cloud environment with workloads in AWS and Azure, and an on-premises data center. They use Cisco Tetration for micro-segmentation and Cisco CloudCenter for orchestration. Recently, they deployed a new multi-tier application in AWS: a web tier, an application tier, and a database tier, all across multiple Availability Zones. After deployment, the application is unreachable. The security team reviews Tetration policies and finds that a policy is in place to allow traffic between tiers, but the web tier cannot communicate with the application tier. The Tetration agent status shows all agents are healthy. The administrator checks the AWS security groups and notices that the web tier's security group allows inbound HTTP from 0.0.0.0/0, but the application tier's security group does not allow inbound traffic from the web tier's subnet. The application tier's security group only allows inbound traffic from the on-premises CIDR block in error. The network team requests a fix that does not impact other ongoing audits. What should the administrator do?

Accepted Answer

Update the AWS security group for the application tier to allow inbound traffic from the web tier's subnet.. The root cause is that the AWS security group for the application tier is misconfigured to only allow inbound traffic from the on-premises CIDR block, rather than from the web tier's subnet. Cisco Tetration enforces micro-segmentation policies at the host level via agents, but it does not override or bypass native cloud security groups; both layers must permit the traffic. Updating the security group to allow inbound traffic from the web tier's subnet resolves the connectivity issue without affecting other audits, as it is a targeted, non-disruptive change.

Answer

Redeploy the application using Cisco CloudCenter to ensure proper security group association.

Answer

Configure Tetration to use 'full enforcement' mode for all policies, which overrides AWS security groups.

Answer

Remove the Tetration policy for the application tier to allow all traffic.

Question 3

A university is deploying 802.1X authentication for wired access using Cisco ISE. The network consists of Cisco Catalyst switches. The authentication is working for most users, but some users in a specific building are experiencing frequent authentication failures, especially during peak hours. The switches in that building are configured with RADIUS settings pointing to ISE. ISE logs show that authentication requests are being sent but sometimes time out. The network team suspects that the issue is related to RADIUS server load balancing, as the ISE deployment includes two nodes in a distributed model. What is the most likely cause of the timeouts?

Accepted Answer

The ISE nodes are not configured for load balancing, causing one node to be overwhelmed.. The symptoms—intermittent timeouts during peak hours in a specific building—point to a load-balancing issue. In a distributed ISE deployment, if the switches are not configured with multiple RADIUS server entries or if ISE nodes are not properly load-balanced (e.g., using a single primary server or missing secondary server configuration), one node can become overwhelmed with authentication requests, leading to timeouts. The fact that authentication works for most users but fails during peak hours in one building strongly suggests that the switches in that building are sending all requests to a single ISE node that cannot handle the load.

Answer

The RADIUS shared secret is misconfigured on some switches.

Answer

The switches are not configured with the correct VLAN assignments.

Answer

The switches are using the wrong RADIUS accounting port.

Question 4

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Accepted Answer

Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.. The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Answer

Restart the Cisco AMP for Endpoints connector service on the affected endpoints.

Answer

Change the update policy interval from 4 hours to 1 hour to force more frequent checks.

Answer

Check if the firewall is blocking the signature update port 443 for those specific endpoints.

Question 5

Which TWO of the following are authentication methods used for wired network access in Cisco ISE?

Accepted Answer

802.1X. Options D and E are correct because 802.1X and MAC Authentication Bypass (MAB) are the primary authentication methods used for wired network access in Cisco ISE. Option A (TACACS+) is used for device administration, not network access. Option B (NetFlow) is a network monitoring tool. Option C (RADIUS) is a protocol that underpins authentication methods but is not itself an authentication method.

Answer

TACACS+

Answer

NetFlow

Answer

RADIUS

Question 6

An organization is deploying Cisco Secure Endpoint (AMP) in a high-security environment where endpoints are air-gapped from the internet. The security team needs to maintain up-to-date threat intelligence without direct cloud access. They have a dedicated local server that can download feeds from the AMP cloud once and distribute to endpoints. The server runs the AMP Private Cloud software. However, after installation, endpoints are not receiving updates. The team verifies that the Private Cloud server can reach the AMP cloud via a managed proxy. The endpoints can communicate with the Private Cloud server on TCP 443. What is the most likely cause of the update failure?

Accepted Answer

The Private Cloud appliance has not been registered and licensed in the AMP console.. The Private Cloud must be registered and licensed with Cisco to receive updates. Without registration, it cannot download threat intelligence. Option A (proxy misconfiguration) is possible but the team verified the proxy works. Option C (endpoint certificate issue) is less likely; endpoints authenticate via policy. Option D (Private Cloud out of disk space) would log errors, but not the primary cause if the server is newly set up.

Answer

The proxy is not properly configured to allow HTTPS from the Private Cloud to the AMP cloud.

Answer

The endpoints are using an incorrect certificate to authenticate to the Private Cloud.

Answer

The Private Cloud server's disk is full, preventing new update downloads.

Question 7

A small business uses Cisco ISE to authenticate employees via Active Directory. The company has a single ISE node and two Catalyst 2960-X switches. Employees connect to the network and are successfully authenticated using 802.1X with PEAP. The business wants to provide guest wireless access using a separate SSID with a captive portal. The engineer configures a new WLAN on the WLC (Cisco 2504) pointing to the same ISE node. Guest users can associate to the WLAN and get an IP address, but when they open a browser, they do not see the captive portal page; instead, they get a 'Connection refused' error. The engineer verifies that the guest portal is enabled on ISE and the WLC is configured to use ISE for RADIUS. What is the most likely cause?

Accepted Answer

The WLC is not configured with the ISE portal IP address for redirection. The captive portal requires the guest traffic to be redirected to ISE's portal service. Typically, this is done by the WLC redirecting HTTP traffic to the ISE IP. If the DNS resolution for the portal fails or the WLC does not know the portal address, the redirect fails. Option C is correct because the WLC must be configured with the portal IP (or domain) for redirection. Option A would affect all authentication. Option B might be needed but without proper redirect, portal won't show. Option D is irrelevant.

Answer

The ISE guest portal service is not running

Answer

The guest user's device does not have a valid DNS server

Answer

The guest WLAN does not have a pre-authentication ACL

Question 8

A company is deploying a new remote access solution for teleworkers. They need to ensure that only company-owned devices can connect, and that the devices meet security posture requirements. Which combination of technologies should be used?

Accepted Answer

Cisco AnyConnect VPN with posture assessment. Cisco AnyConnect VPN with posture assessment is correct because it provides both device authentication (ensuring only company-owned devices connect) and security posture checks (e.g., OS patch level, antivirus status, firewall enabled) via the Cisco Secure Client (formerly AnyConnect) and ISE (Identity Services Engine). This combination enforces compliance before granting network access, meeting the requirement for teleworker remote access.

Answer

IPsec VPN with pre-shared keys

Answer

DMVPN

Answer

SSL VPN without client

Question 9

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

Accepted Answer

Block. When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Answer

Allow

Answer

Quarantine

Answer

Detect

Question 10

What is the primary difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Signature-based uses patterns of known attacks; anomaly-based uses behavior baselines.. Signature-based detection compares traffic against known attack patterns; anomaly-based detection establishes a baseline and flags deviations.

Answer

Signature-based has higher false positive rate than anomaly-based.

Answer

Signature-based detects unknown attacks; anomaly-based detects known attacks.

Answer

Both methods are identical in operation.

Question 11

A security engineer deploys Cisco Advanced Malware Protection (AMP) for Endpoints with cloud-based detection. After installation, a sample malware is executed on a test endpoint, but the AMP console shows no detection or trajectory data. The endpoint shows a 'Connected' status. What is the most likely reason for the lack of detection?

Accepted Answer

The endpoint's network connection to the AMP cloud is intermittent, causing files to be evaluated locally instead of being sent for analysis.. When the AMP for Endpoints connector detects intermittent connectivity to the AMP cloud, it falls back to local file evaluation using only the local signature cache. Since cloud-based detection relies on sending file hashes and behavioral telemetry for advanced analysis, a disrupted connection prevents the cloud from performing deep analysis, resulting in no detection or trajectory data despite the endpoint showing a 'Connected' status.

Answer

The AMP cloud subscription has expired, but the console still shows connectivity.

Answer

The AMP connector version is outdated and does not support the malware family.

Answer

The malware is packed and requires a signature update that is not yet available.

Question 12

During a security audit, a penetration tester discovers that a Cisco ASA firewall is configured with a rule that permits traffic from the inside interface with a source IP address in the RFC 1918 range to the outside interface. The rule uses the 'inspect' command for HTTP and FTP. Which potential vulnerability does this configuration introduce?

Accepted Answer

The firewall may allow IP spoofing if antispoofing is not enabled. The configuration permits traffic from RFC 1918 private IP addresses on the inside interface to the outside interface without any explicit antispoofing or Unicast Reverse Path Forwarding (uRPF) check. This allows an attacker on the inside network to spoof source IP addresses that appear to come from the inside subnet, bypassing the firewall's intended security boundary. Without antispoofing, the ASA will not verify that the source IP actually belongs to the inside network, enabling IP spoofing attacks.

Answer

FTP inspection permits anonymous login commands

Answer

The configuration allows traffic without network address translation (NAT)

Answer

The HTTP inspection may allow SQL injection attacks to bypass the firewall

Question 13

An organization is adopting a zero trust model for cloud access. Which three principles should be implemented? (Select three.)

Accepted Answer

Use conditional access policies based on user, device, and location. Zero trust includes identity as the perimeter, MFA, and conditional access based on context.

Answer

Deploy a VPN for all remote users

Answer

Grant permanent privileged access to administrators

Question 14

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

Accepted Answer

Securing the application code and data. In PaaS, the provider manages the runtime, middleware, OS, and infrastructure. The customer is responsible for the application code and data. Network controls and hypervisor are provider responsibilities.

Answer

Securing the hypervisor

Answer

Patching the underlying operating system

Answer

Managing network firewall rules

Question 15

A security administrator is evaluating Cisco Umbrella for cloud-delivered security. Which TWO capabilities are provided by the Secure Internet Gateway (SIG) feature? (Choose two.)

Accepted Answer

Cloud-delivered firewall. Cisco Umbrella SIG includes a cloud-delivered firewall and a web proxy for URL filtering. DNS-layer security is a separate feature, and VPN is not part of SIG. DLP is typically a CASB function.

Answer

Data loss prevention for SaaS

Answer

DNS-layer security

Answer

Site-to-site VPN connectivity