350-701 Practice Test 5 — 25 Questions

Question 1

A network administrator is configuring a site-to-site VPN between two Cisco ASA firewalls using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec SA?

Accepted Answer

Transform set. In IKEv2 site-to-site VPN on Cisco ASA, the transform set defines the encryption and authentication algorithms (for example, ESP-AES-256 and ESP-SHA-HMAC) used to protect the IPsec SA. It is referenced by the crypto map or IKEv2 profile to negotiate the child SA.

Answer

Crypto map

Answer

Group policy

Answer

ISAKMP policy

Question 2

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC. They want to create a rule that blocks access to social media applications regardless of port or protocol. Which policy should be used?

Accepted Answer

Access Control Policy with Application and URL filtering. An Access Control Policy with Application and URL filtering is the correct choice because it allows the security engineer to create a rule that blocks social media applications based on application signatures, independent of the port or protocol used. This policy inspects traffic at Layer 7, using the Cisco Firepower application detector database to identify and block applications like Facebook or Twitter even if they use non-standard ports or encryption.

Answer

Intrusion Policy

Answer

Prefilter Policy

Answer

SSL Policy

Question 3

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Accepted Answer

Trust action bypasses all further inspection modules.. Option A is correct because the Trust action in a Cisco FTD access control policy terminates policy evaluation for that connection and bypasses all subsequent inspection, including SSL, IPS, and file/malware inspection, effectively allowing the traffic without further deep inspection. Option B is correct because the Interactive Block action permits the user to proceed after being presented with a customizable block page (a user-response page), unlike the Block action which silently drops the traffic. Option C is incorrect because the default action when no rule matches is Block (or Block with reset), not Allow. Option D is incorrect because the Block action drops the traffic and logs it, it does not allow it to pass. Option E is incorrect because the Allow action permits the traffic and subjects it to all configured inspection modules (IPS, URL filtering, malware, etc.), not URL filtering alone.

Answer

Allow action is the default action if no rule matches.

Answer

Block action logs the traffic and allows it to pass.

Answer

Allow action applies only URL filtering but not IPS.

Question 4

Which Cisco TrustSec feature uses a classification packet to carry security group information across network devices?

Accepted Answer

Security Group Tag (SGT). The Security Group Tag (SGT) is the Cisco TrustSec mechanism that embeds security group information directly into a packet's Ethernet frame (typically as a Cisco Meta Data or inline tag). This allows the packet to carry its source group identity across network devices, enabling consistent policy enforcement without requiring per-hop reclassification.

Answer

Security Group Access Control List (SGACL)

Answer

MACsec

Answer

Cisco TrustSec (CTS)

Question 5

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

Accepted Answer

Reauthentication timer set too short. The reauthentication timer on the switch port is set too short, causing the 802.1X session to expire and re-initiate authentication frequently. This results in users being dropped after a few minutes as the port cycles through reauthentication, even though MAB fallback may temporarily allow traffic. The default reauthentication timer is typically 3600 seconds, but if misconfigured to a very low value (e.g., 60 seconds), it will cause periodic disconnections.

Answer

Incorrect VLAN assignment

Answer

Incorrect RADIUS shared secret

Answer

MAB timeout set too low

Question 6

A network engineer is trying to establish a site-to-site IPsec VPN between two Cisco routers. The IKEv2 proposal uses AES-256 encryption and SHA-256 hash. On the remote router, the configuration shows only AES-128 and SHA-1. What will happen during IKEv2 negotiation?

Accepted Answer

The IKEv2 negotiation will fail because no common proposal exists.. IKEv2 negotiation requires that both peers have at least one matching proposal (encryption, hash, DH group, etc.) in their configured transform sets. Since the local router offers AES-256/SHA-256 and the remote router only offers AES-128/SHA-1, there is no common proposal. IKEv2 does not perform automatic fallback or mixing of parameters; it simply fails if no match is found.

Answer

The router with stronger proposal will override the other.

Answer

The routers will automatically fall back to IKEv1.

Answer

The routers will negotiate and use AES-128 with SHA-256.

Question 7

A security engineer needs to block access to social media websites for all users except those in the HR department. The solution must integrate with Active Directory. Which Cisco WSA feature should be used?

Accepted Answer

Identity-based policies with AD integration. Identity-based policies on Cisco WSA use an identity realm integrated with Active Directory (via LDAP, Kerberos, or NTLM) to apply different access rules per user or group. By creating a policy that blocks social media for everyone but allows the HR group, the engineer satisfies both the blocking requirement and the AD integration requirement. This is the native WSA mechanism for group-differentiated web policy.

Answer

SSL/TLS decryption

Answer

Explicit proxy with PAC file

Answer

Transparent proxy with WCCP

Question 8

An organization wants to deploy Cisco ISE to authenticate devices that do not support 802.1X supplicant software, such as printers and IoT sensors. Which authentication method should be configured on the switch port to allow these devices network access?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows devices without 802.1X supplicant software to authenticate using their MAC address. The switch sends the MAC address to Cisco ISE, which checks it against a database and grants access if authorized.

Answer

EAP-TLS

Answer

EAP-FAST

Answer

PEAP-MSCHAPv2

Question 9

To enforce zero trust principles in a cloud environment, an administrator requires all access to cloud resources to be authenticated and authorized based on user identity and device health. Which Cisco Duo feature enables policies that consider conditions such as location, device compliance, and risk level?

Accepted Answer

Duo Access Policies. Cisco Duo Access Policies allow administrators to create policies that enforce access controls based on conditions like user location, device compliance, and sign-in risk.

Answer

Duo Multi-Factor Authentication (MFA)

Answer

Duo Device Health

Answer

Duo Privileged Access Management

Question 10

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

Accepted Answer

CoA (Change of Authorization). Change of Authorization (CoA) allows ISE to send real-time authorization changes (e.g., VLAN change) to the NAD using RADIUS Disconnect or Change of Authorization messages, without requiring the client to reauthenticate.

Answer

TrustSec SGT assignment

Answer

RADIUS Accounting

Answer

MAB

Question 11

An organization uses Cisco ISE to enforce posture compliance. After a user's machine is patched, ISE sends a command to the switch to reclassify the endpoint from a restricted VLAN to a full-access VLAN. Which ISE feature accomplishes this?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change an authenticated session's attributes, such as VLAN assignment or ACL, without requiring reauthentication.

Answer

Posture Assessment

Answer

Profiling

Answer

Guest Access

Question 12

Which cryptographic algorithm is considered deprecated and should be avoided due to known vulnerabilities, especially when used in digital signatures and certificate signing?

Accepted Answer

MD5. MD5 is a hashing algorithm with known collision vulnerabilities, making it unsuitable for security-sensitive applications like digital signatures.

Answer

SHA-256

Answer

SHA-3

Answer

AES-256

Question 13

A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)

Accepted Answer

Certificate Authority (CA). Option A, Certificate Authority (CA), is essential because the CA is the trusted entity that issues, signs, and manages digital certificates, binding public keys to identities and forming the root of trust in any PKI. Option C, a Certificate revocation list (CRL) or OCSP responder, is also essential because PKI must provide a way to check and revoke certificates that are no longer valid, such as after key compromise or employee departure; CRLs are published lists and OCSP responders provide real-time status. Option B, the private key of the end user, is not a PKI component itself but a key held by the subscriber; PKI manages certificates and keys, but the end user's private key is not an infrastructure component. Option D, a hashing function, is used within certificate signatures and integrity checks but is a cryptographic primitive, not a defining PKI component. Option E, a symmetric encryption algorithm, is not required for PKI, which is based on asymmetric cryptography and digital certificates.

Answer

Private key of the end user

Answer

Hashing function

Answer

Symmetric encryption algorithm

Question 14

An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)

Accepted Answer

Never trust, always verify. Option B, 'Never trust, always verify,' is foundational to zero trust because it requires every access request to be authenticated and authorized based on identity, device posture, and context regardless of network location, eliminating implicit trust. Option E, 'Least privilege access,' is also foundational because zero trust enforces just-enough-access (JEA) and just-in-time (JIT) permissions, granting users and workloads only the minimum rights needed for a specific task to limit lateral movement. Option A is incorrect because single factor authentication relies on only one credential and does not provide the continuous, strong verification zero trust requires. Option C is incorrect because implicit trust for internal networks is the traditional perimeter model that zero trust explicitly rejects. Option D is incorrect because 'trust but verify' still starts from a position of trust, whereas zero trust starts from no trust and verifies every request.

Answer

Single factor authentication

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 15

An engineer wants to configure NAT on a Cisco ASA such that multiple internal hosts share a single public IP address when accessing the internet. Which NAT type should be used?

Accepted Answer

PAT (overload). PAT (Port Address Translation) or NAT overload allows multiple internal hosts to share a single public IP by using unique port numbers.

Answer

Static NAT

Answer

Dynamic NAT

Answer

Identity NAT

Question 16

Which THREE elements are essential components of a secure network architecture according to Cisco's SAFE model? (Choose three.)

Accepted Answer

Encryption for data in transit. Encryption for data in transit is a core component of Cisco's SAFE model because it ensures confidentiality and integrity of traffic traversing the network. SAFE mandates encryption protocols such as IPsec, TLS, or MACsec to protect against eavesdropping and man-in-the-middle attacks. This aligns with the model's principle of maintaining trustworthiness across all communication paths.

Answer

A single firewall at the internet edge

Answer

Large broadcast domains to simplify management

Question 17

A security engineer is configuring Cisco AMP for Endpoints to protect against memory injection attacks. Which feature should be enabled to block exploits that attempt to inject malicious code into legitimate processes?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques by monitoring process behavior.

Answer

IOC Scanning

Answer

Device Trajectory

Answer

File quarantine

Question 18

A network engineer is troubleshooting an issue where an endpoint is failing to authenticate via 802.1X on a Cisco switch. The switch port is in unauthorized state. Which step should the engineer take first to identify the root cause?

Accepted Answer

Check the ISE authentication logs for failure reasons.. The correct first step is to check the ISE authentication logs for failure reasons because the switch port is already in an unauthorized state, meaning the 802.1X authentication process has failed. ISE (the RADIUS server) logs provide the most granular failure reason, such as invalid credentials, unknown client, or EAP method mismatch, which directly pinpoints the root cause. Checking the switch's RADIUS reachability or endpoint configuration would be premature without first understanding why authentication was denied.

Answer

Check the switch's RADIUS server reachability.

Answer

Check the endpoint's supplicant configuration.

Answer

Check the CA server for certificate issues.

Question 19

A security analyst wants to detect misconfigurations in cloud storage buckets using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud). What must be configured first?

Accepted Answer

Connect to the cloud provider's API. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) relies on API integration with the cloud provider (AWS, Azure, GCP) to pull metadata about cloud resources, including storage bucket configurations. By connecting to the cloud provider's API, the platform can continuously monitor for misconfigurations such as public read/write access, unencrypted buckets, or improper logging settings. Without this API connection, the platform cannot access the cloud provider's resource inventory or configuration state, making bucket misconfiguration detection impossible.

Answer

Enable flow log export to the analytics platform

Answer

Install a sensor in the cloud VPC

Answer

Deploy a syslog collector

Question 20

A security architect is designing network access control for a campus network. The requirement is to authenticate users before granting network access and to enforce policies based on user identity and device posture. Which solution should be deployed?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the correct solution because it provides centralized policy-based network access control that authenticates users via 802.1X, MAB, or web authentication, and enforces dynamic VLAN assignment, ACLs, or SGTs based on user identity and device posture (e.g., compliance with antivirus, OS patches). Unlike a generic AAA server, ISE integrates with posture assessment (via AnyConnect or NAC Agent) and supports profiling, guest access, and BYOD onboarding, directly meeting the requirement for identity- and posture-based enforcement.

Answer

AAA server with TACACS+

Answer

VPN concentrator with client certificate authentication

Answer

Next-generation firewall with application control