350-701 Practice Test 4 — 25 Questions

Question 1

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Accepted Answer

Never trust, always verify. Zero Trust is based on 'never trust, always verify' and least privilege access.

Answer

Single-factor authentication

Answer

Perimeter-based security

Answer

Implicit trust for internal networks

Question 2

Which of the following is a characteristic of a zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every request must be verified regardless of source.

Answer

Implicit trust for internal users

Answer

Trust but verify

Answer

Trust based on network location

Question 3

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 4

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 5

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Accepted Answer

Profiling. Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.

Answer

Application visibility

Answer

NetFlow analysis

Question 6

A company is designing a network segmentation strategy using firewalls. Which THREE considerations are important for a defense-in-depth approach?

Accepted Answer

Use a DMZ to host public-facing services.. Defense-in-depth involves multiple layers: DMZ for public services, internal segmentation to limit lateral movement, and inbound strict rules.

Answer

Allow all outbound traffic from internal users.

Answer

Place all servers in the same segment for easier management.

Question 7

A company uses AWS Organizations with multiple accounts. They need to enforce that all S3 buckets have encryption enabled. Which AWS service can centrally audit and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config conformance packs. AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions as a single entity. By using a conformance pack that includes the 's3-bucket-server-side-encryption-enabled' managed rule, you can continuously audit all S3 buckets across your AWS Organization for encryption compliance and automatically trigger remediation (e.g., via AWS Systems Manager Automation) to enable encryption on non-compliant buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 8

An organization wants to protect their web application hosted on AWS from common exploits like SQL injection. Which Cisco service should they use?

Accepted Answer

Cisco Firepower Next-Generation Firewall (NGFW). Cisco Firepower Next-Generation Firewall (NGFW) with Intrusion Prevention System (IPS) can detect and block SQL injection attacks by inspecting HTTP traffic for malicious payloads. It provides application-layer protection through signature-based and behavioral analysis. The other options: ISE is for identity and access management, Stealthwatch for network visibility, and WSA is a web proxy without native WAF capabilities.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Stealthwatch

Answer

Cisco Web Security Appliance (WSA)

Question 9

A company is deploying Cisco Umbrella to protect against DNS-based threats. Which deployment method provides the most comprehensive coverage for all devices on the network without requiring per-device configuration?

Accepted Answer

Configure the network's DNS forwarders to point to Umbrella's DNS resolvers.. Configuring the network's DNS forwarders to point to Umbrella's DNS resolvers (typically on the organization's DHCP server or router) ensures that all DNS queries from any device on the network are automatically forwarded to Umbrella for filtering, without requiring any per-device configuration. This method provides comprehensive coverage for all devices, including those that cannot run agents (e.g., IoT devices, printers, guest devices), by intercepting DNS traffic at the network level.

Answer

Install the Umbrella roaming client on every endpoint.

Answer

Configure each device's DNS settings to use Umbrella's resolvers.

Answer

Deploy a PAC file that routes all traffic through a proxy with DNS filtering.

Question 10

A Cisco FTD is configured with SSL/TLS inspection using the 'decrypt-known-key' method. Which traffic can be decrypted with this method?

Accepted Answer

Traffic to internal servers whose private key is imported into FTD. Decrypt-known-key is used when the FTD has the server's private key, typically for internal servers.

Answer

Traffic to any website on the internet

Answer

Traffic using self-signed certificates only

Answer

All SSL traffic regardless of certificate

Question 11

Which protocol does Cisco ISE use to communicate with the pxGrid controller for sharing contextual data?

Accepted Answer

JSON-RPC over certificate-based TLS. Cisco ISE uses the JSON-RPC protocol over certificate-based TLS to communicate with the pxGrid controller for sharing contextual data. This ensures encrypted, authenticated, and structured messaging between ISE and other pxGrid-enabled services, such as Cisco Threat Response or third-party integrations.

Answer

REST API over HTTPS

Answer

TACACS+

Answer

RADIUS

Question 12

An organization is planning to deploy Cisco FTD in a high-availability pair. Which two statements about active/active failover are true? (Choose two.)

Accepted Answer

It requires multiple context mode.. Active/active failover requires multiple context mode and both units can process traffic simultaneously. Stateful failover is supported only in active/standby.

Answer

Stateful failover is supported.

Answer

It is the default failover mode.

Answer

Configuration is not synchronized.

Question 13

Refer to the exhibit. An administrator in us-west-2 tries to launch an instance. The policy allows only us-east-1. What should the administrator do to successfully launch the instance?

Accepted Answer

Launch the instance in us-east-1. The IAM policy explicitly restricts the ec2:RunInstances action to the us-east-1 region using a Condition block with ec2:Region set to 'us-east-1'. Since the administrator is attempting to launch the instance in us-west-2, the only way to comply with the policy is to launch in us-east-1. AWS IAM policies are evaluated based on the principal, action, resource, and condition; if any condition is not met, the request is denied by default.

Answer

Modify the resource ARN to include us-west-2

Answer

Change the policy to allow all regions

Answer

Remove the condition from the policy

Question 14

Which THREE of the following are common indicators of a DDoS attack at the network layer?

Accepted Answer

A spike in UDP traffic to a single target. A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.

Answer

Unusual traffic on non-standard TCP/UDP ports

Answer

High CPU usage on network devices

Question 15

A security engineer is evaluating a web application firewall (WAF) rule set. The application uses a custom REST API that accepts JSON payloads. Which WAF rule is most effective at preventing SQL injection attacks while minimizing false positives?

Accepted Answer

Use a rule that parses JSON and checks for abnormal structures that indicate injection. JSON-based APIs require context-aware parsing to detect SQL injection within structured payloads. A rule that parses JSON and checks for abnormal structures can identify injection attempts (e.g., nested objects or unexpected keys) without relying on simple keyword matching, which reduces false positives. This approach aligns with the WAF's ability to decode and inspect JSON fields for malicious SQL patterns while ignoring benign data.

Answer

Apply a generic SQL injection signature set from the WAF vendor

Answer

Block requests containing 'SELECT' or 'UNION' in the URL

Answer

Set the maximum request size to 10 MB

Question 16

A network engineer is troubleshooting an issue where users on a specific VLAN cannot access the internet through a Cisco ASA firewall. The ASA has a default route pointing to the ISP router. The security policy includes an ACL that permits all traffic from the inside interface to the outside interface. What is the most likely cause of the problem?

Accepted Answer

NAT (Network Address Translation) is not configured. The most likely cause is that NAT is not configured. Even though the ACL permits all traffic from inside to outside, the Cisco ASA requires NAT (or a NAT exemption rule) to translate private IP addresses to a routable public IP address when traffic traverses from a higher-security interface (inside) to a lower-security interface (outside). Without NAT, the ASA will drop the packets because it cannot determine how to route the private source addresses on the public internet, and the return traffic would have no way to reach the internal hosts.

Answer

The default route is misconfigured

Answer

DNS is not resolving domain names

Answer

The ACL is blocking the traffic

Question 17

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

Accepted Answer

Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.. Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.

Answer

Install a next-generation firewall at the internet edge and enable IPS.

Answer

Upgrade all access switches to support Private VLANs (PVLANs).

Answer

Deploy 802.1X with dynamic VLAN assignment across all wired ports.

Question 18

A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?

Accepted Answer

Check the ISE authentication logs for failure reasons.. The correct first step is to check the ISE authentication logs for failure reasons because the switch port is already in an unauthorized state, meaning the 802.1X authentication process has failed. ISE (the RADIUS server) logs provide the most granular failure reason, such as invalid credentials, unknown client, or EAP method mismatch, which directly pinpoints the root cause. Checking the switch's RADIUS reachability or endpoint configuration would be premature without first understanding why authentication was denied.

Answer

Check the switch's RADIUS server reachability.

Answer

Check the endpoint's supplicant configuration.

Answer

Check the CA server for certificate issues.

Question 19

An organization wants to restrict administrative access to Cisco network devices based on the time of day and source IP address. Which technology should be used?

Accepted Answer

TACACS+ with per-command authorization. TACACS+ is the correct choice because it supports per-command authorization, which allows an administrator to define granular access policies based on attributes such as time of day and source IP address. This is achieved through the TACACS+ authorization process, where the AAA server evaluates the user's request against configured authorization rules before granting access to specific commands or sessions.

Answer

SNMPv3 with ACLs

Answer

802.1X with EAP-TLS

Answer

IPsec VPN with extended authentication

Question 20

A security analyst wants to detect misconfigurations in cloud storage buckets using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). What must be configured first?

Accepted Answer

Connect to the cloud provider's API. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) relies on API integration with the cloud provider (AWS, Azure, GCP) to pull metadata about cloud resources, including storage bucket configurations. By connecting to the cloud provider's API, the platform can continuously monitor for misconfigurations such as public read/write access, unencrypted buckets, or improper logging settings. Without this API connection, the platform cannot access the cloud provider's resource inventory or configuration state, making bucket misconfiguration detection impossible.

Answer

Enable flow log export to the analytics platform

Answer

Install a sensor in the cloud VPC

Answer

Deploy a syslog collector