350-701 Practice Test 5 — 25 Questions

Question 1

An email administrator receives reports of a targeted phishing campaign where attackers impersonate the CEO to request wire transfers. Which Cisco ESA feature provides the best defense against this Business Email Compromise (BEC) attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DMARC verification. DMARC can detect and block spoofed emails from the CEO's domain by verifying SPF and DKIM alignment.

Answer

Outbreak Filters

Answer

Anti-spam with SenderBase reputation

Answer

DLP policies

Question 2

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature to verify that an email was not tampered with and is from the claimed domain.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 3

A company wants to prevent users from downloading executable files (.exe) from the internet via the WSA. Which policy type should be configured?

Accepted Answer

Access policy with file type filtering. C is correct because an Access policy in WSA allows granular control over web traffic, including the ability to block specific file types such as .exe via the 'File Type Filtering' action. This directly prevents users from downloading executable files from the internet, as the WSA inspects the MIME type or file extension in the HTTP response and applies the configured block action.

Answer

URL filtering policy with category blocking

Answer

Data Security policy

Answer

Web Reputation Security policy

Question 4

An organization wants to block access to malicious websites using Cisco Umbrella. Which two protection layers are available with the Umbrella SIG? (Choose two.)

Accepted Answer

Cloud proxy. Umbrella SIG includes DNS security and cloud proxy for web traffic filtering.

Answer

IPS/IDS

Answer

VPN termination

Answer

Email sandboxing

Question 5

A Cisco ESA administrator is investigating an increase in false positive detections from the outbreak filter. The filter is configured to use TALOS intelligence and has a threshold of 'Medium'. Which action would most effectively reduce false positives while maintaining protection against new outbreaks?

Accepted Answer

Change the threshold to 'High'. The outbreak filter uses TALOS threat intelligence to quarantine suspicious messages. Increasing the threshold to 'High' reduces sensitivity, meaning only messages with strong indicators of maliciousness will be flagged, reducing false positives.

Answer

Change the threshold to 'Low'

Answer

Disable the outbreak filter

Answer

Exempt all internal senders from the filter

Question 6

An organization wants to prevent outbound email containing credit card numbers from leaving the network. Which Cisco ESA feature should be configured?

Accepted Answer

DLP Policies. The Cisco ESA DLP feature scans outbound email for sensitive data like credit card numbers and can block or quarantine such messages.

Answer

AMP for Email

Answer

Anti-spam (SenderBase)

Answer

Outbreak Filters

Question 7

A company uses Cisco Umbrella to block malicious domains. An endpoint user reports that they cannot access a legitimate business website. The website resolves to a domain that is not on any block list. What is the most likely cause?

Accepted Answer

The domain is part of a content category that is blocked in the Umbrella policy.. Cisco Umbrella enforces security policies based on content categories, not just individual domains. Even if a domain is not explicitly blocked, it may belong to a content category (e.g., 'Newly Seen Domains', 'Pornography', 'Hacking') that has been set to 'Block' in the Umbrella policy. This is a common cause of legitimate sites being blocked, as Umbrella evaluates the domain against all applicable categories before allowing access.

Answer

The domain is listed in a custom Destination List with 'Block' action.

Answer

The Umbrella policy has Application Settings enabled for 'Web Browsing' with block action.

Answer

The Umbrella roaming client is using an invalid API token.

Question 8

A company uses Cisco ISE for network access control. They have deployed TrustSec and want to enforce segmentation using Security Group Tags (SGTs). The network team reports that SGTs are not being propagated correctly. Which protocol is responsible for SGT propagation between switches?

Accepted Answer

SXP. SXP (SGT Exchange Protocol) is the protocol used for propagating Security Group Tags (SGTs) between switches that do not support inline tagging. Option A is incorrect because NETCONF is a network configuration protocol and not used for SGT propagation. Option B is incorrect because while RADIUS can carry SGTs in AV pairs from ISE to the network device, it is not used for switch-to-switch propagation. Option C is incorrect because CDP (Cisco Discovery Protocol) is used for device discovery and not for SGT propagation.

Answer

NETCONF

Answer

RADIUS

Answer

CDP

Question 9

During a cloud migration, an organization notices increased latency in AWS workloads when using Cisco Firepower for traffic inspection. What is the most likely cause?

Accepted Answer

The Firepower instance is undersized for the traffic volume. When using Cisco Firepower for traffic inspection in AWS, the Firepower instance must process all traffic traversing the virtual appliance. If the instance type (e.g., m5.large) is undersized relative to the throughput demands (e.g., exceeding 1 Gbps), packet processing will queue, causing increased latency. This is a common scaling issue in cloud migrations where on-premises traffic patterns are replicated without adjusting instance sizing.

Answer

The VPC routing table is misconfigured, causing traffic to hairpin

Answer

AWS WAF is conflicting with Firepower rules

Answer

Firepower is inspecting encrypted traffic without SSL decryption

Question 10

An organization has deployed Cisco WSA in explicit proxy mode. Users are required to authenticate using their Active Directory credentials. Which WSA feature enables transparent user identification without requiring users to manually log in?

Accepted Answer

Transparent user identification via Kerberos. Transparent user identification on Cisco WSA can be achieved using Kerberos authentication or NTLM, allowing automatic authentication with AD credentials without manual login.

Answer

URL Filtering

Answer

WCCP redirection

Answer

SSL/TLS Decryption

Question 11

A security engineer is troubleshooting an issue where users can bypass the Cisco WSA by using HTTPS. What must be enabled on the WSA to inspect encrypted traffic?

Accepted Answer

HTTPS Inspection. SSL/TLS decryption (HTTPS inspection) is required to decrypt and inspect encrypted web traffic.

Answer

AVC

Answer

URL Filtering

Answer

Bandwidth Controls

Question 12

A security analyst notices that a user is receiving a high volume of emails from unknown senders with links to malicious sites. The ESA is configured with Cisco TALOS threat intelligence. Which ESA feature should the analyst configure to block these emails based on the reputation of the sender before they reach the user's inbox?

Accepted Answer

IronPort SenderBase reputation. The IronPort SenderBase reputation system uses SBRS scores to filter email based on sender reputation, blocking messages from low-reputation senders before delivery.

Answer

Anti-malware with AMP for Email

Answer

Outbreak filters

Answer

DLP policies

Question 13

During a phishing simulation, an employee receives an email that appears to be from the CEO requesting an urgent wire transfer. This type of attack is known as:

Accepted Answer

Business Email Compromise (BEC). Business Email Compromise (BEC) is a targeted attack where the attacker impersonates a senior executive to request fraudulent transfers.

Answer

Whaling

Answer

Spear phishing

Answer

Malspam

Question 14

An organization uses Cisco ESA to enforce DLP policies. Which of the following is an example of a DLP policy that can be configured on the ESA?

Accepted Answer

Scanning for credit card numbers in outbound email. DLP policies on ESA scan for patterns like credit card numbers, SSNs, etc., in outbound email to prevent data leaks.

Answer

Blocking email attachments over 10 MB

Answer

Quarantining messages with malware

Answer

Filtering spam based on SenderBase reputation

Question 15

Which Cisco security solution provides DNS-layer security to block access to malicious domains before a connection is established?

Accepted Answer

Cisco Umbrella. Cisco Umbrella operates at the DNS layer to block requests to malicious domains.

Answer

Cisco ESA

Answer

Cisco WSA

Answer

Cisco Firepower NGFW

Question 16

An engineer is troubleshooting a Cisco WSA that is failing to block malware downloads from a specific cloud storage website. The URL filtering policy is set to block the 'Cloud Storage' category, and the Web Reputation score is set to block scores below -5.0. Users can still download files. What is the most likely cause?

Accepted Answer

The file type is not configured for malware inspection. The Cisco WSA can block malware downloads only if it inspects the file content. If the file type is not configured for malware inspection, the WSA will allow the download even if the URL category and reputation score are set to block. This is because malware inspection requires explicit configuration of file types (e.g., .exe, .zip) to scan for threats, and without it, the WSA bypasses deep content analysis.

Answer

HTTPS proxy decryption is not configured

Answer

The L4 Traffic Monitor is not enabled

Answer

The users are not authenticated

Question 17

Which Cisco technology uses SHA-256 file hashes to determine if a file is malicious by querying a cloud database?

Accepted Answer

AMP for Email. AMP for Email uses SHA-256 cloud lookup to compare file hashes against known threats.

Answer

DLP Policies

Answer

Outbreak Filters

Answer

SenderBase Reputation

Question 18

An organization uses Cisco Firepower NGFW to enforce content security policies. The security team wants to block all social media traffic during business hours but allow access during lunch breaks. Additionally, they want to detect and alert on any SSL connections to unknown destinations that might indicate data exfiltration. Which THREE capabilities of the NGFW should be combined to achieve these objectives?

Accepted Answer

URL filtering based on time schedules. URL filtering blocks categories by time, application control enforces policies per app, and TLS server identity discovery detects unknown destinations in encrypted traffic.

Answer

Intrusion prevention system (IPS)

Answer

AMP file scanning

Question 19

Which Cisco technology uses SenderBase reputation scores (SBRS) to evaluate incoming email?

Accepted Answer

Cisco ESA anti-spam. Cisco ESA uses IronPort SenderBase reputation to assign a score (-10 to +10) to senders to determine spam likelihood.

Answer

Cisco Firepower intrusion prevention

Answer

Cisco WSA URL filtering

Answer

Cisco Umbrella DNS security

Question 20

A company is deploying Cisco Umbrella SIG to protect against malware and phishing. The security team wants to ensure that even if a user clicks on a malicious link in an email, the traffic is inspected and blocked if needed. Which TWO features of Umbrella can be used to provide this protection?

Accepted Answer

Cloud proxy with URL filtering. DNS security blocks malicious domains at the DNS lookup stage, and cloud proxy can inspect HTTP/HTTPS traffic to block malicious content even if DNS is bypassed.

Answer

SSL/TLS decryption on the proxy

Answer

ThousandEyes agents

Answer

AMP for mobile devices