350-701 Practice Test 4 — 25 Questions

Question 1

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 2

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. A suppression filter tells Snort to stop generating alerts for a specific rule when the traffic matches a defined condition, such as a specific source IP, destination IP, or subnet. This preserves the rule's detection capability for other traffic while eliminating the false positives from the known-benign source.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 3

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 4

An endpoint security engineer wants to protect against memory injection attacks on endpoints running Windows. Which Cisco AMP feature should be enabled?

Accepted Answer

Exploit Prevention. Cisco AMP's Exploit Prevention feature is specifically designed to protect against memory injection and other exploitation techniques by monitoring process behavior and blocking attempts to inject code into running processes. It addresses the exact threat described, making it the correct choice for memory injection attacks on Windows endpoints.

Answer

Retrospective security

Answer

IOC scanning

Answer

Device Trajectory

Question 5

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.

Question 6

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes provides end-to-end visibility into SaaS and internet application performance by running synthetic tests and path visualization from agents to the application, exposing latency, loss, and hop-by-hop issues. It is the designated Cisco tool for SaaS performance monitoring.

Answer

Cisco Firepower URL filtering

Answer

Cisco Umbrella SIG

Answer

Cisco WSA bandwidth controls

Question 7

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) that operates on 128-bit blocks with key sizes of 128, 192, or 256 bits. It is widely used in modern VPNs (e.g., IPsec, OpenVPN, WireGuard) because it is fast, secure, and resistant to known cryptanalytic attacks. AES is the de facto standard for symmetric encryption in network security.

Answer

ECC

Answer

RSA

Answer

3DES

Question 8

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center, now known as Microsoft Defender for Cloud, is correct (A) because it is Microsoft's core CSPM solution that continuously assesses Azure resources against security benchmarks like the Microsoft Cloud Security Benchmark, surfaces secure score, and provides recommendations to remediate misconfigurations. Azure Policy is also correct (B) because it enforces organizational standards and compliance by evaluating resources against built-in or custom policy definitions and applying deny, audit, or deployIfNotExists effects, which is a foundational CSPM control mechanism. Microsoft Entra ID (C) is an identity and access management service, not a posture management tool, so it does not belong. Azure Monitor (D) is a telemetry and observability platform for metrics, logs, and alerts rather than a compliance posture service. Azure WAF (E) is a web application firewall that protects HTTP/S traffic from exploits like SQL injection and XSS, which is workload protection, not CSPM.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 9

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. If guests are auto-approved without sponsor interaction, the guest portal's access setting is likely configured for Self-Registration rather than Sponsor Approval. In Cisco ISE, the guest portal's 'Access setting' determines whether guests self-register or require sponsor approval, so this misconfiguration directly explains the symptom.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device

Question 10

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy values are p=none (monitor only), p=quarantine (treat failing mail as suspicious, typically spam/junk), and p=reject (instruct receivers to reject outright). Since the administrator wants receivers to reject messages that fail SPF or DKIM alignment, p=reject is the correct policy. This is the strictest DMARC enforcement level and provides the strongest protection against spoofing.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 11

A university is using Cisco WSA to filter web traffic for its students and staff. The WSA is configured with transparent proxy mode and uses Active Directory for authentication. Recently, the IT department received complaints that some users cannot access certain educational websites that are correctly categorized as 'Education'. The WSA policy has a default rule that blocks all categories except those explicitly allowed. The 'Education' category is set to 'Allow'. However, affected users are shown a block page with the reason 'Web Reputation: Low Reputation'. The Web Reputation threshold is set to -5.0. The IT team checked the reputation scores of the blocked sites and found they are around -4.5. What is the most likely reason for the block?

Accepted Answer

The Web Reputation action is set to 'Block' for scores below 0, overriding the URL filtering allow. The Web Reputation action configured in the WSA policy overrides the URL category-based allow rule. Even though the 'Education' category is set to 'Allow', the Web Reputation threshold is set to -5.0, and the blocked sites have a reputation score of -4.5 (which is below the threshold, meaning worse reputation). The WSA applies the most restrictive action: if Web Reputation is set to 'Block' for scores below 0, it will block traffic regardless of the category allow action, resulting in the block page showing 'Web Reputation: Low Reputation'.

Answer

The 'Education' category is not included in the allowed list for the specific identification profile

Answer

The users are not authenticated properly and are assigned a default policy that blocks education

Answer

The HTTPS decryption is failing for those sites, causing a block

Question 12

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP (Online Certificate Status Protocol). OCSP (Online Certificate Status Protocol, RFC 6960) lets a client query a responder in real time for the revocation status of a specific certificate, returning 'good', 'revoked', or 'unknown' without downloading the entire CRL. This avoids the latency and bandwidth cost of full CRL downloads and provides fresher status. It is the standard real-time revocation check used in TLS handshakes via the OCSP stapling extension.

Answer

CRL (Certificate Revocation List)

Answer

PKI certificate chain

Answer

SSL/TLS handshake

Question 13

Which Cisco ISE node is responsible for authenticating endpoints and enforcing access policies?

Accepted Answer

Policy Service Node (PSN). The Policy Service Node (PSN) is the Cisco ISE component that performs endpoint authentication, authorization, and accounting (AAA) and enforces access policies by processing RADIUS requests from network access devices (NADs). It handles posture assessment, guest services, and client provisioning, making it the direct enforcement point for network access control.

Answer

Administration Node

Answer

pxGrid

Answer

Monitoring Node

Question 14

A company has deployed Cisco Umbrella with a virtual appliance (VA) for content filtering. Users report that some websites are not loading properly, and the helpdesk suspects that the VA is blocking legitimate traffic. The network administrator checks the VA dashboard and sees that the VA is passing traffic normally. However, the administrator notices that the VA's upstream DNS server is set to a public resolver (208.67.222.222) instead of the company's internal DNS servers. This causes internal hostnames to resolve incorrectly. The company uses Active Directory with domain-joined computers. What should the administrator do to resolve the issue?

Accepted Answer

Change the upstream DNS server in the VA configuration to point to the internal DNS servers.. The virtual appliance (VA) acts as a forwarding proxy; it receives DNS queries from clients, forwards them to its configured upstream DNS server, and applies content filtering policies. When the upstream DNS is set to a public resolver like 208.67.222.222 (OpenDNS), the VA cannot resolve internal Active Directory domain names (e.g., .local or internal FQDNs) because the public resolver has no knowledge of the private DNS zone. Changing the upstream DNS server to the company's internal DNS servers allows the VA to resolve both internal and external names correctly, while still applying Umbrella's content filtering policies to external traffic.

Answer

Add a conditional forwarder in the internal DNS for all .local domains.

Answer

Configure the clients to use Umbrella's DNS directly instead of the VA.

Answer

Disable Umbrella content filtering for internal domain names.

Question 15

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses techniques such as heap spraying protection, stack canary enforcement, and behavioral monitoring to block memory-corruption and other exploitation attempts that target unpatched or unknown vulnerabilities, which is exactly what zero-day attacks leverage. Malware Analytics with sandboxing (C) is correct because it detonates suspicious files in an isolated cloud or on-premises sandbox and uses retrospective verdicts and continuous file analysis to detect never-before-seen malicious behavior, catching zero-day malware that signature-based methods miss. File Reputation (A) is not correct here because it relies on known file hashes and cloud lookups, so it cannot identify a brand-new zero-day binary with no prior reputation record. Application Control (D) is not correct because it enforces allow/block lists of known applications rather than detecting exploitation of unknown vulnerabilities. Device Control (E) is not correct because it governs peripheral usage such as USB mass storage, not zero-day exploit or malware detection.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 16

An organization wants to implement Privileged Access Management (PAM) using Cisco SecureX and CyberArk. Which THREE capabilities are typically associated with PAM solutions? (Choose three.)

Accepted Answer

Password vaulting. Password vaulting (B) is a core PAM capability because it securely stores privileged credentials in an encrypted repository, enforcing policies for checkout, rotation, and access control. CyberArk's Vault, for example, uses AES-256 encryption and integrates with Cisco SecureX to provide centralized credential management, ensuring that passwords are never exposed in plaintext.

Answer

Endpoint isolation

Answer

File quarantine

Question 17

In the shared responsibility model, which is the customer's responsibility in a SaaS model?

Accepted Answer

Data classification and access control. In the SaaS shared responsibility model, the cloud provider owns everything up to the application layer — physical security, network infrastructure, hypervisor, and application patching. The customer remains responsible for their data: classifying it, controlling who can access it, managing identities, and configuring tenant-level security settings. Data classification and access control are always customer responsibilities regardless of service model.

Answer

Network security

Answer

Physical data center security

Answer

Application security patches

Question 18

A security engineer is configuring Cisco Firepower NGFW to block social media applications. Which feature should be used to achieve this?

Accepted Answer

Application control. Firepower uses application control to identify and block specific applications like social media.

Answer

URL filtering

Answer

Intrusion prevention

Answer

TLS server identity discovery

Question 19

In Cisco ESA, which feature uses TALOS intelligence to provide real-time protection against newly identified email threats before signature updates are available?

Accepted Answer

Outbreak Filters. Outbreak Filters in Cisco ESA use Talos intelligence to provide real-time protection against newly identified email threats before signature updates are available. They analyze email traffic patterns and use heuristics, reputation, and Talos threat data to quarantine or delay suspicious messages until signatures are updated. This proactive approach blocks fast-moving outbreaks that traditional signature-based filters might miss.

Answer

DLP Policies

Answer

Anti-Spam

Answer

AMP for Email

Question 20

What is the primary difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Signature-based uses patterns of known attacks; anomaly-based uses behavior baselines.. Signature-based intrusion detection compares network traffic or system activity against a database of known attack patterns (signatures), so it reliably identifies previously documented threats with low false positives. Anomaly-based detection instead builds a baseline of normal behavior and flags deviations from that baseline, allowing it to catch novel or zero-day attacks that have no existing signature. Thus, the core difference is that signature-based relies on known attack patterns while anomaly-based relies on behavioral baselines.

Answer

Signature-based has higher false positive rate than anomaly-based.

Answer

Signature-based detects unknown attacks; anomaly-based detects known attacks.

Answer

Both methods are identical in operation.