350-701 Practice Test 2 — 25 Questions

Question 1

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 2

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 3

Which type of malware is characterized by encrypting files on a victim's system and demanding payment for the decryption key?

Accepted Answer

Ransomware. Ransomware encrypts data and demands ransom.

Answer

RAT

Answer

Keylogger

Answer

Botnet

Question 4

An organization wants to prevent employees from accessing social media websites during work hours. Which Cisco WSA feature should be used to enforce this policy?

Accepted Answer

URL filtering. URL filtering on Cisco WSA allows administrators to block or allow access to websites based on URL categories, including social media. It uses a cloud-based categorization database to enforce acceptable use policies during specified hours. This directly addresses the requirement to prevent social media access.

Answer

SSL/TLS decryption

Answer

AMP file scanning

Answer

AVC (Application Visibility and Control)

Question 5

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. EDR (Endpoint Detection and Response) focuses on detecting, investigating, and responding to threats on endpoints, so process isolation (B) is correct because it lets the agent terminate or suspend a malicious process to stop its execution while preserving forensic state. Remote shell investigation (C) is correct because EDR platforms provide remote access to an endpoint's command shell or live-response console so analysts can run commands, inspect memory, and gather artifacts without disrupting the user. File quarantine (E) is correct because EDR can automatically or manually move malicious files to an isolated location, neutralizing the threat while retaining the sample for analysis. Multi-factor authentication (A) is an identity/access control measure, not an endpoint detection-and-response function, and application whitelisting (D) is a preventive application-control technique rather than an EDR detection/investigation/response capability.

Answer

Multi-factor authentication

Answer

Application whitelisting

Question 6

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The command dot1x system-auth-control is a global configuration command that enables 802.1X authentication on the switch. Without it, the per-interface dot1x pae authenticator and authentication port-control auto commands have no effect because the 802.1X process is not globally enabled. This is why the client sends EAPoL-Start but the switch never responds with EAP-Request/Identity.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 7

Cisco ISE is configured with posture assessment to ensure endpoints meet security requirements before gaining network access. After a posture check, ISE needs to dynamically change the VLAN assignment for a non-compliant endpoint. Which ISE feature enables this real-time change?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically update authentication and authorization attributes such as VLAN assignment.

Answer

TrustSec

Answer

Guest portal

Answer

Profiling

Question 8

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Option C is correct because Cisco CloudLock DLP policies rely on content-matching rules that identify sensitive data such as PII using predefined or custom regex/pattern definitions, which is the detection mechanism required before any alerting can occur. Option D is correct because the scenario specifically requires detecting and alerting on external sharing of PII files, so a policy must be configured with the external-sharing trigger and an alert action tied to the PII DLP rule. Option A is incorrect because the requirement is to detect and alert, not to automatically block, and blocking all external PII sharing exceeds the stated scope. Option B is incorrect because disabling external sharing application-wide is a blunt control that prevents legitimate collaboration and does not provide the required detection and alerting. Option E is incorrect because a transparent proxy inspects network traffic and is not the mechanism used to enforce CloudLock SaaS API-based DLP policies on files shared within a cloud application.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 9

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 10

An engineer is configuring Cisco ISE for 802.1X authentication. The network has many printers and IP phones that do not support 802.1X supplicant software. Which ISE feature should be used to allow these devices to authenticate?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

Answer

Posture assessment

Answer

Guest access with sponsor portal

Answer

Profiling via DHCP probe

Question 11

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation (A) is correct because it enforces granular, identity- and workload-based policies between internal segments, so stolen credentials alone cannot freely reach other servers and lateral movement paths are blocked or alerted. Network behavioral analytics such as Stealthwatch (D) is correct because it baselines normal east-west traffic and uses flow telemetry to detect anomalous internal connections, beaconing, and unusual data transfers indicative of lateral movement and exfiltration. Endpoint detection and response (EDR) (E) is correct because it monitors process, credential, and command activity on hosts, detecting techniques like pass-the-hash, remote service creation, and suspicious lateral tooling, and can isolate the endpoint. A stateful firewall at the perimeter (B) only inspects traffic crossing the network edge and does not see or stop internal east-west lateral movement. SSL inspection (C) decrypts TLS traffic for content inspection but by itself neither segments the internal network nor correlates host/network behavior to detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 12

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 13

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

Accepted Answer

Remote shell investigation. Cisco AMP for Endpoints includes endpoint detection and response (EDR) capabilities such as remote shell, which allows analysts to execute commands on the endpoint for investigation.

Answer

Process isolation

Answer

File quarantine

Answer

IOC scanning

Question 14

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

Accepted Answer

CWPP. CWPP (Cloud Workload Protection Platform) provides security for workloads across clouds.

Answer

CSPM

Answer

CASB

Answer

SIG

Question 15

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Option A is correct because creating custom whitelist exclusions for trusted applications prevents legitimate business software from being quarantined or blocked, directly reducing false positives while still allowing AMP for Endpoints to enforce its policies on unknown or untrusted files. Option B is correct because group-based policies let the engineer tailor detection and blocking rules to specific endpoint populations (for example, developers versus standard users), so aggressive settings are not applied where they would generate unnecessary false positives. Option D is correct because setting file reputation to block only files with a 'Malicious' disposition avoids blocking files with 'Unknown' or 'Clean' verdicts, which are common sources of false positives, while still stopping confirmed threats. Option C is not correct because enabling all exploit prevention rules regardless of environment ignores the need to tune protections to the actual software and workloads in use, which increases false positives. Option E is not correct because disabling file reputation removes a core AMP for Endpoints protection layer and its cloud lookups, weakening detection rather than minimizing false positives while maintaining strong protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 16

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management

Question 17

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 18

An organization is implementing privileged access management (PAM) with Cisco SecureX and CyberArk. Which feature allows administrators to grant temporary elevated privileges for a specific task, after which the privileges are automatically revoked?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Application whitelisting

Answer

Password vaulting

Question 19

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Accepted Answer

List revoked certificates. CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.

Answer

Store private keys

Answer

Validate certificate signatures

Answer

Generate new certificates

Question 20

A security analyst notices that a file previously marked as 'clean' on an endpoint was later determined to be malicious. Using Cisco Secure Endpoint, which feature allows the analyst to see the propagation of that file across the system and understand its impact?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco Secure Endpoint provides a timeline of events showing file propagation and system changes, enabling retrospective analysis.

Answer

IOC scanning

Answer

SHA-256 disposition

Answer

Exploit Prevention