350-701 Practice Test 3 — 25 Questions

Question 1

A security engineer is configuring Duo for VPN authentication with AnyConnect. Which authentication factor does Duo provide in addition to the user's primary credentials?

Accepted Answer

Second-factor authentication (push, TOTP, etc.). Duo provides second-factor authentication, typically via push notification, TOTP, or hardware token, which is used after the user enters their primary credentials (e.g., LDAP password).

Answer

RADIUS accounting

Answer

SAML assertion

Answer

Machine certificate validation

Question 2

A network administrator is configuring 802.1X on a Cisco switch for corporate Windows laptops. The organization uses certificates for authentication. Which EAP method should be configured on the supplicant and ISE to provide certificate-based mutual authentication?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST

Question 3

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. A dedicated secrets management tool like HashiCorp Vault securely stores and provides access to secrets (API keys, passwords) without embedding them in code or environment variables. Azure Key Vault and AWS Secrets Manager are also valid, but Vault is a common cross-platform solution. The other options are insecure.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 4

A company wants to implement network access control for IoT devices that do not support 802.1X. Which Cisco ISE feature can be used to grant these devices network access based on their MAC address?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.

Answer

Guest access

Answer

Profiling

Answer

Posture assessment

Question 5

A DevOps team is deploying containers in Kubernetes and needs to enforce network security policies between pods. Which Cisco solution is designed for this?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Secure Workload (formerly Tetration) is the correct answer because it provides micro-segmentation and network policy enforcement for containerized environments like Kubernetes. It uses agent-based and agentless sensors to map all inter-pod traffic flows and enforce whitelist-based policies at the kernel level via eBPF or iptables, ensuring zero-trust between pods without requiring changes to the underlying network fabric.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Question 6

A university is using Cisco ESA to manage email for 20,000 students and staff. They have implemented anti-spam and anti-virus policies. Recently, the IT helpdesk has been receiving complaints that legitimate emails from external senders (such as admissions notifications) are being marked as spam and quarantined. The administrators check the ESA and find that these emails are being flagged with a spam score above the threshold, but the content appears to be legitimate. The sending domains are not on any blacklist. The ESA is using default anti-spam settings. What should the administrator do to reduce false positives without compromising security?

Accepted Answer

Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).. Adding the legitimate sender domains or IPs to the ESA's SenderBase whitelist explicitly bypasses anti-spam scanning for those trusted sources, reducing false positives while maintaining security for all other inbound email. This approach leverages the ESA's reputation-based filtering to allow known good senders without lowering the global spam threshold or disabling protection entirely.

Answer

Create a content filter to allow any email with 'admissions' in the subject.

Answer

Disable anti-spam scanning for all inbound email.

Answer

Lower the spam threshold to decrease sensitivity.

Question 7

A network engineer is configuring Cisco ISE for wireless 802.1X authentication. The company wants to use certificate-based authentication for all corporate devices. Which EAP method should be configured?

Accepted Answer

EAP-TLS. EAP-TLS uses digital certificates for mutual authentication between the client and the server, providing strong security without requiring passwords.

Answer

EAP-MD5

Answer

PEAP-MSCHAPv2

Answer

LEAP

Question 8

A company uses Cisco WSA to proxy web traffic. After configuring a decryption policy to inspect HTTPS traffic to a specific external site, users report they can still access the site without any warning or interruption. Which action should the administrator take to ensure HTTPS inspection is applied?

Accepted Answer

Change the policy action from 'Passthrough' to 'Decrypt'. The decryption policy must have an action of 'Decrypt' to actually perform HTTPS inspection. If the policy action is set to 'Passthrough', the WSA forwards the traffic without decrypting it, so users experience no warning or interruption. Changing the action to 'Decrypt' forces the WSA to intercept the TLS handshake, decrypt the traffic, and apply security policies.

Answer

Add the site to the 'HTTPS Bypass' list

Answer

Import the WSA root CA certificate into client browsers

Answer

Move the decryption policy to the top of the list

Question 9

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

Accepted Answer

The posture policy requires a specific version that is not installed.. The log indicates a missing application, but it is installed. This often occurs when the posture policy requires a specific version or patch level. Option A is incorrect because antivirus definitions are separate. Option C is incorrect because agent version would cause a different error. Option D is incorrect because firewall blocking would prevent scan results.

Answer

The NAC Agent is running an outdated version.

Answer

The endpoint's firewall is blocking the ISE posture probe.

Answer

The antivirus definition file is outdated.

Question 10

A network security engineer is configuring site-to-site IPsec VPN between two Cisco ASA firewalls using IKEv2. Which of the following configuration elements is required to define the encryption and integrity algorithms for the IPsec SA?

Accepted Answer

Transform set. In IKEv2, the IPsec SA parameters (encryption, integrity, etc.) are defined in the transform set. IKEv2 uses a single transform set. ISAKMP policy is for IKEv1 phase 1. Crypto map binds the transform set to a peer and interface. VTI is a virtual interface for routing but not for algorithm definition.

Answer

Crypto map

Answer

Virtual Tunnel Interface (VTI)

Answer

ISAKMP policy

Question 11

An engineer notices that the 'show authentication sessions' command on a switch shows a session in 'CRITICAL' state. What does this indicate?

Accepted Answer

The authentication server is unreachable and the port is using the critical VLAN. The 'CRITICAL' state in 'show authentication sessions' indicates that the switch port has lost connectivity to the authentication server (RADIUS) and has fallen back to the configured critical VLAN. This is a failover mechanism defined in IEEE 802.1X and Cisco's critical-auth feature, where the port is placed into a pre-configured VLAN to maintain network access for the host despite the server being unreachable.

Answer

The host is being authenticated via MAB

Answer

The port is administratively down

Answer

The authentication attempt was rejected by the RADIUS server

Question 12

In the 802.1X authentication process, which component is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X authentication process, the authenticator (typically a switch or wireless access point) is responsible for relaying Extensible Authentication Protocol (EAP) messages between the supplicant (client) and the authentication server (e.g., ISE). The authenticator encapsulates EAP frames into RADIUS packets for transmission to the server, acting as a transparent proxy that does not modify or terminate the EAP conversation. This role is defined in IEEE 802.1X-2010, where the authenticator controls port access based on the authentication result.

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Answer

Supplicant

Question 13

A web application accepts user input and directly includes it in SQL queries without sanitization. An attacker submits a single quote (') to cause a syntax error. What is this attack called?

Accepted Answer

SQL injection. SQL injection occurs when user input is not sanitized and alters SQL query structure.

Answer

Cross-site scripting (XSS)

Answer

Buffer overflow

Answer

CSRF

Question 14

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Accepted Answer

Enable TCP Intercept with a low threshold. TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.

Answer

Increase the connection timeout

Answer

Implement an access-list to allow only known source IPs

Answer

Configure a static route to null0 for the server's IP

Question 15

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 16

An organization wants to enforce that specific sensitive files are never executed on endpoints. Which AMP for Endpoints feature is most appropriate?

Accepted Answer

Simple or advanced custom detections (Application Control). Simple or advanced custom detections (Application Control) allow administrators to create hash-based or path-based rules that explicitly block execution of specific files. This directly meets the requirement to prevent sensitive files from ever running on endpoints, as Application Control enforces allow/block policies at the file execution level, not just at the network or signature level.

Answer

Outbreak Control (file extension blocking)

Answer

Exclusion lists

Answer

Behavioral analysis and engine protection

Question 17

An organization wants to enforce micro-segmentation in a data center to isolate application tiers. Which Cisco technology allows defining security policies based on endpoint groups rather than IP addresses?

Accepted Answer

Cisco TrustSec with Security Group Tags (SGTs). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on endpoint groups (e.g., application tiers) rather than IP addresses. This allows micro-segmentation by enforcing policies that follow the traffic regardless of IP changes, using SGTs carried in the packet via Cisco Metadata (CMD) or inline tagging.

Answer

Cisco ASA with access-lists

Answer

Cisco ISE with guest services

Answer

Cisco Firepower NGFW with URL filtering

Question 18

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

Accepted Answer

NetFlow probe. (NetFlow probe) because when endpoints do not send DHCP requests, the DHCP probe cannot collect any data. The NetFlow probe analyzes network traffic flows to identify endpoints based on IP addresses, ports, and protocols, even without DHCP activity. This allows Cisco ISE to profile endpoints by observing their communication patterns, such as HTTP or DNS traffic, which still occur even if DHCP is not used.

Answer

DHCP probe

Answer

HTTP probe

Answer

DNS probe

Question 19

An administrator is configuring DLP on the Cisco ESA to block social security numbers (SSNs) in outgoing email. The policy is set to 'Drop' for SSN matches, but some emails containing SSNs are still being delivered. What step should the administrator take to troubleshoot?

Accepted Answer

Verify that the DLP policy is enabled and assigned to the outgoing mail policy.. The most likely reason SSNs are still being delivered is that the DLP policy is not actually applied to the outgoing mail policy. Even if the DLP policy is configured to 'Drop' for SSN matches, it will have no effect unless it is enabled and explicitly assigned to the mail policy that governs outbound messages. Without this assignment, the ESA will not inspect messages against the DLP dictionary, allowing SSNs to pass through.

Answer

Increase the message size limit in the mail flow policy.

Answer

Ensure that TLS is enabled for outgoing mail.

Answer

Add additional SSN patterns to the DLP dictionary.

Question 20

A DevOps team is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run. Which solution should they integrate with Kubernetes to enforce image trust and scanning?

Accepted Answer

Cisco Cloud Workload Protection (CWP). Cisco Cloud Workload Protection (CWP) is the correct solution because it provides integrated image scanning, vulnerability assessment, and trust enforcement for containerized workloads in Kubernetes. CWP uses a policy-based admission controller to block deployments of unauthorized or vulnerable images before they run, directly addressing the requirement to ensure only authorized images are executed.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Firepower Next-Generation Firewall

Answer

Cisco Umbrella