350-701 Practice Test 5 — 25 Questions

Question 1

A company is deploying a cloud-native application using microservices on AWS. They need to ensure that inter-service communication is encrypted and authenticated. The security team wants to use mutual TLS (mTLS) without managing individual certificates. Which solution should they implement?

Accepted Answer

Use AWS Certificate Manager Private CA with a service mesh (e.g., Istio) to issue and rotate certificates for each service.. Option D is correct because AWS Certificate Manager Private CA can integrate with a service mesh like Istio to automatically issue, distribute, and rotate mTLS certificates for each microservice. This eliminates the need for manual certificate management while ensuring encrypted and authenticated inter-service communication via mutual TLS.

Answer

Use AWS IAM roles for each microservice to authenticate via AWS Signature Version 4.

Answer

Store certificates in AWS Secrets Manager and configure sidecar proxies to retrieve them.

Answer

Deploy AWS CloudHSM to generate keys and certificates for each microservice.

Question 2

A company is implementing a cloud security posture management (CSPM) solution. Which TWO of the following are primary functions of CSPM?

Accepted Answer

Detection and remediation of cloud resource misconfigurations (e.g., open S3 buckets).. CSPM is designed to detect and remediate cloud resource misconfigurations, such as publicly accessible S3 buckets, which are a leading cause of data breaches. It continuously assesses cloud infrastructure against security best practices and compliance frameworks like CIS and PCI DSS. Unlike network-based tools, CSPM focuses on the configuration state of cloud resources rather than inspecting traffic or managing identities.

Answer

Real-time inspection of network traffic for malicious patterns.

Answer

Vulnerability scanning of virtual machine operating systems.

Answer

Managing user identities and access permissions.

Question 3

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. Option C is correct because ISE caches credentials for a period; if the password is changed, the cached version may still be used until the cache expires. Option A is wrong because RADIUS servers do not typically cache credentials by default. Option B is wrong because DNS issues would affect all users, not just those with password changes. Option D is wrong because the wireless controller does not cache passwords; it passes through to ISE.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 4

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Option A is correct because Cisco ISE's profiler service uses the MAC OUI (Organizationally Unique Identifier) to identify the hardware vendor, and DHCP fingerprints (specific option ordering in DHCP requests) to determine the exact operating system or device type. This passive profiling technique allows ISE to classify endpoints without requiring any agent installation.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 5

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Accepted Answer

authentication event no-response action authorize vlan 100. Option A is correct because the 'authentication event no-response action authorize vlan 100' command configures the switch port to place the endpoint into a restricted VLAN (e.g., VLAN 100) when the supplicant fails to respond to 802.1X authentication requests. This is a valid method for handling authentication failures, specifically a 'no-response' scenario, by authorizing the port with a limited-access VLAN instead of denying all traffic.

Answer

dot1x critical profile

Answer

authentication event server dead action reinitialize

Answer

authentication port-control force-authorized

Question 6

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

Accepted Answer

The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails. The 'authentication fallback final mab' command configures the switch to treat MAB as the final fallback method. When both 802.1X and MAB fail, the 'final' keyword causes the port to be placed in an authorized state (forwarding) regardless of the MAB result. This is why the port is forwarding despite both authentication methods failing.

Answer

The device is using a MAC address that matches a static CAM entry

Answer

The switch has 'aaa authentication dot1x default local' which allows local fallback

Answer

The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

Answer

The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

Question 7

A company is deploying Cisco Email Security Appliance (ESA) to protect against phishing attacks. The security team wants to implement two security features to detect malicious URLs in emails. Which two features should be enabled? (Choose two.)

Accepted Answer

URL reputation filtering. URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

Answer

DomainKeys Identified Mail (DKIM) signing

Answer

Sender Policy Framework (SPF) verification

Answer

Domain-based Message Authentication, Reporting & Conformance (DMARC)

Question 8

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting

Question 9

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Accepted Answer

authentication host-mode multi-domain. Option A is correct because the `authentication host-mode multi-domain` command allows one device in the voice domain (IP phone) and one device in the data domain (PC) to authenticate on the same switch port. This is the standard Cisco configuration for a phone-PC daisy-chain topology, where the phone acts as a bridge and the switch must distinguish between the two devices using separate VLANs (voice and data).

Answer

dot1x pae authenticator

Answer

authentication violation restrict

Answer

authentication host-mode multi-auth

Question 10

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Accepted Answer

Exploit prevention with ransomware rollback. Option A is correct because Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Answer

File reputation scanning

Answer

Device flow telemetry

Answer

Application blocking via policy

Question 11

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. Option A is correct because the 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 12

An administrator reviews the AMP event log shown in the exhibit. The same file hash appears in all events. What is the most likely explanation for the third event showing a 'TETRA Event' with 'Action: Quarantine' and 'Disposition: Unknown'?

Accepted Answer

The file was executed and, because its disposition was unknown, AMP quarantined it and submitted it for cloud analysis.. The third event shows a TETRA (Trajectory) event with 'Action: Quarantine' and 'Disposition: Unknown' because AMP uses TETRA to correlate related events into a single trajectory. When a file with an unknown disposition is executed, AMP quarantines it locally and submits it to the cloud for analysis. The 'Unknown' disposition indicates the cloud had not yet classified the file at the time of the event, and the quarantine action is a precautionary measure while analysis is pending.

Answer

The AMP connector failed to communicate with the cloud and generated a TETRA event as an error.

Answer

The file was previously blocked, but the user executed it from a different location, triggering a TETRA event.

Answer

The file was determined to be malicious by the cloud after the first detection.

Question 13

A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?

Accepted Answer

Install the Umbrella roaming client on all endpoints.. The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.

Answer

Deploy the Umbrella virtual appliance in the data center.

Answer

Use BGP to redirect traffic to Umbrella.

Answer

Configure Active Directory integration.

Question 14

A network administrator configures the above policy on a Cisco Firepower Threat Defense (FTD) device. Users report that they cannot access the login page at https://www.example.com/login. What is the most likely cause?

Accepted Answer

The 'inspect' action in INSIDE_INSPECT does not permit the traffic; it only inspects.. Option C is correct because in Cisco Firepower Threat Defense (FTD), the 'inspect' action only monitors traffic for threats without explicitly permitting it. For traffic to be allowed through the device, a separate 'allow' or 'permit' action is required in the access control policy. Since INSIDE_INSPECT uses only 'inspect', the HTTPS traffic to the login page is blocked by default, as FTD implicitly denies traffic that is not explicitly permitted.

Answer

The 'match request uri regex ".*evil.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The 'match request body regex ".*malware.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The class-map HTTP_CLASS is incorrectly matching the host header for example.com.

Question 15

A company wants to implement network access control for IoT devices that do not support 802.1X. Which Cisco ISE feature can be used to grant these devices network access based on their MAC address?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.

Answer

Guest access

Answer

Profiling

Answer

Posture assessment

Question 16

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Accepted Answer

The interface Gi0/1/1 is not configured as a trusted interface for RA guard.. RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Answer

The device is not in the same VLAN as the RA guard policy.

Answer

The device tracking entry for aaaa.bbbb.cccc is invalid.

Answer

The device tracking table has reached its limit.

Question 17

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control

Question 18

Cisco ISE is configured to assign Security Group Tags (SGTs) to endpoints based on their identity. This is part of which Cisco security architecture?

Accepted Answer

Cisco TrustSec. Cisco TrustSec is the security architecture that uses Security Group Tags (SGTs) to enforce access control based on identity rather than IP addresses. Cisco ISE acts as the policy decision point, dynamically assigning SGTs to endpoints and distributing them via protocols like SXP or inline tagging, enabling consistent policy enforcement across the network.

Answer

Cisco Duo

Answer

Cisco SecureX

Answer

Cisco AMP

Question 19

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. Option D is correct because Posture policy defines the compliance requirements (e.g., antivirus, patch level) and the remediation actions. Option A is incorrect because Authentication policy determines the method of authentication. Option B is incorrect because Authorization policy determines the resulting access after authentication and posture. Option C is incorrect because Profiling policy identifies device type.

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 20

A company is deploying Cisco ISE for network access control. Which three policies must be configured to enforce access based on device posture? (Choose three)

Accepted Answer

Authorization policy. Authorization policy (A) is correct because it defines the final access permissions (e.g., permit, deny, VLAN assignment, ACL) based on the posture assessment results. After the endpoint's posture is evaluated, the authorization policy uses conditions like 'PostureStatus: Compliant' or 'PostureStatus: NonCompliant' to enforce network access control. Without an authorization policy, the posture check result would have no effect on actual network access.

Answer

Guest access policy

Answer

Profiling policy