350-701 Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. The crypto map is applied to an interface. Which additional configuration is necessary for IPsec to function correctly?

Accepted Answer

Configure an ISAKMP policy (IKE phase 1) with pre-shared key or certificate. IPsec requires both IKE Phase 1 (ISAKMP) and Phase 2 to be configured. The crypto map references a transform-set and an access list, but without an ISAKMP policy defining authentication (pre-shared key or certificate) and encryption/hash parameters, IKE cannot establish a secure control channel. Option D is correct because the ISAKMP policy is mandatory for IKE Phase 1 negotiation before IPsec SAs can be created.

Answer

Define an extended access list for interesting traffic

Answer

Create a tunnel interface and apply the crypto map to it

Answer

Create a transform-set with the same parameters as the proposal

Question 2

Which TWO of the following are components of Cisco TrustSec?

Accepted Answer

Security Group Tag (SGT). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on identity and enforce access control policies. SGTs are 16-bit values assigned to users or devices, and they are carried in the packet header (e.g., via Cisco Metadata or inline tagging) to allow policy enforcement at the network layer.

Answer

802.1X

Answer

MACsec

Answer

IPsec

Question 3

Which TWO of the following are common security objectives of the Cisco TrustSec solution? (Choose two.)

Accepted Answer

Microsegmentation of network traffic. Cisco TrustSec uses Security Group Tags (SGTs) to enforce microsegmentation by classifying traffic based on user, device, or role rather than IP addresses. This allows granular policy enforcement at the access layer, reducing lateral movement within the network. Microsegmentation is a core security objective of TrustSec, enabling dynamic, identity-based access control.

Answer

VPN termination for remote users

Answer

End-to-end data encryption

Answer

Network topology discovery

Question 4

A company is implementing a Zero Trust architecture. The security team needs to ensure that all traffic between workloads in a private cloud is encrypted and mutually authenticated. Which solution best meets these requirements?

Accepted Answer

Mutual TLS (mTLS) between workloads. Mutual TLS (mTLS) provides both encryption and mutual authentication by requiring each workload to present a valid X.509 certificate during the TLS handshake. This ensures that only verified workloads can communicate, and all traffic is encrypted at the application layer, making it the ideal choice for a Zero Trust architecture where every connection is authenticated and authorized regardless of network location.

Answer

MACsec on the network interfaces

Answer

IPsec VPN between each pair of workloads

Answer

SSH tunnels between workloads

Question 5

Which Cisco ISE node is responsible for authenticating endpoints and enforcing access policies?

Accepted Answer

Policy Service Node (PSN). The Policy Service Node (PSN) is the Cisco ISE component that performs endpoint authentication, authorization, and accounting (AAA) and enforces access policies by processing RADIUS requests from network access devices (NADs). It handles posture assessment, guest services, and client provisioning, making it the direct enforcement point for network access control.

Answer

Administration Node

Answer

pxGrid

Answer

Monitoring Node

Question 6

A network engineer is troubleshooting an issue where users on a specific VLAN cannot access the internet through a Cisco ASA firewall. The ASA has a default route pointing to the ISP router. The security policy includes an ACL that permits all traffic from the inside interface to the outside interface. What is the most likely cause of the problem?

Accepted Answer

NAT (Network Address Translation) is not configured. The most likely cause is that NAT is not configured. Even though the ACL permits all traffic from inside to outside, the Cisco ASA requires NAT (or a NAT exemption rule) to translate private IP addresses to a routable public IP address when traffic traverses from a higher-security interface (inside) to a lower-security interface (outside). Without NAT, the ASA will drop the packets because it cannot determine how to route the private source addresses on the public internet, and the return traffic would have no way to reach the internal hosts.

Answer

The default route is misconfigured

Answer

DNS is not resolving domain names

Answer

The ACL is blocking the traffic

Question 7

A company is deploying a new remote access solution for teleworkers. They need to ensure that only company-owned devices can connect, and that the devices meet security posture requirements. Which combination of technologies should be used?

Accepted Answer

Cisco AnyConnect VPN with posture assessment. Cisco AnyConnect VPN with posture assessment is correct because it provides both device authentication (ensuring only company-owned devices connect) and security posture checks (e.g., OS patch level, antivirus status, firewall enabled) via the Cisco Secure Client (formerly AnyConnect) and ISE (Identity Services Engine). This combination enforces compliance before granting network access, meeting the requirement for teleworker remote access.

Answer

IPsec VPN with pre-shared keys

Answer

DMVPN

Answer

SSL VPN without client

Question 8

An organization wants to enforce micro-segmentation in a data center to isolate application tiers. Which Cisco technology allows defining security policies based on endpoint groups rather than IP addresses?

Accepted Answer

Cisco TrustSec with Security Group Tags (SGTs). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on endpoint groups (e.g., application tiers) rather than IP addresses. This allows micro-segmentation by enforcing policies that follow the traffic regardless of IP changes, using SGTs carried in the packet via Cisco Metadata (CMD) or inline tagging.

Answer

Cisco ASA with access-lists

Answer

Cisco ISE with guest services

Answer

Cisco Firepower NGFW with URL filtering

Question 9

A company deploys Cisco ISE for network access control. They want to enforce that only employees with a valid certificate and a compliant posture can access the corporate Wi-Fi. Which policy combination should be used?

Accepted Answer

Authentication using EAP-TLS and a Posture Enforcement Policy (PEP). Option C is correct because EAP-TLS provides certificate-based mutual authentication, ensuring only employees with a valid certificate can authenticate. The Posture Enforcement Policy (PEP) then checks the endpoint's compliance (e.g., antivirus, patch level) before granting network access. This combination meets the requirement for both certificate validation and posture compliance enforcement on corporate Wi-Fi.

Answer

Authorization profile with dACL and a Posture Enforcement Policy (PEP)

Answer

Authentication using PEAP-MSCHAPv2 and a Posture Enforcement Policy (PEP)

Answer

Guest portal with self-registration and a Posture Enforcement Policy (PEP)

Question 10

Which THREE of the following are valid characteristics of a next-generation firewall (NGFW) compared to a traditional stateful firewall? (Choose three.)

Accepted Answer

Decryption and inspection of SSL/TLS traffic. A is correct because NGFWs can perform SSL/TLS decryption and inspection, allowing them to examine encrypted traffic for threats. Traditional stateful firewalls only inspect packet headers and state information, leaving encrypted payloads unexamined. This capability is critical for detecting malware or data exfiltration hidden in HTTPS sessions.

Answer

Support for network address translation (NAT)

Answer

Support for site-to-site VPNs

Question 11

A network team is configuring Cisco FTD for a new branch office. They want to allow outbound web traffic but block all inbound traffic except for a specific public server. Which policy type should be used to allow the return traffic for outbound connections?

Accepted Answer

A stateful access rule. Cisco FTD uses a stateful firewall engine that tracks the state of outbound connections. When a stateful access rule permits outbound web traffic, the firewall automatically creates a dynamic pinhole for the return traffic, eliminating the need for explicit inbound rules. This is the correct policy type because it maintains session state and allows only related return packets, aligning with the requirement to block all other inbound traffic.

Answer

A stateless ACL

Answer

A NAT rule

Answer

SSL decryption

Question 12

A security engineer is analyzing logs from a Cisco ASA. They notice that a specific internal host is generating a high volume of outbound TCP SYN packets to multiple external IP addresses on port 443, but no SYN-ACK responses are received. What is the most likely explanation?

Accepted Answer

The host is infected with malware that is performing a SYN flood denial-of-service attack. Option C is correct because the host is sending a high volume of TCP SYN packets to multiple external IPs on port 443 without receiving SYN-ACK responses, which is characteristic of a SYN flood attack. In a SYN flood, the attacker (or infected host) sends many SYN packets to exhaust the target's connection table, but the lack of SYN-ACK responses indicates the targets are not completing the handshake, often because the source IP is spoofed or the targets are unresponsive. The Cisco ASA logs show outbound SYN packets with no corresponding SYN-ACKs, which aligns with the host being used as a source for a denial-of-service attack.

Answer

The ASA is configured to block outbound HTTPS traffic

Answer

The host is downloading a large malware file via HTTPS

Answer

The host is establishing legitimate HTTPS connections

Question 13

Which TWO of the following are best practices for securing Cisco routers against unauthorized access? (Choose two.)

Accepted Answer

Disable unused services like HTTP server and CDP. C is correct because disabling unused services like HTTP server and CDP reduces the attack surface of the router. The HTTP server can be exploited for web-based attacks, and CDP can leak sensitive network topology information. Cisco best practices recommend disabling all unnecessary services to minimize exposure.

Answer

Enable SNMP read-write community string for monitoring

Answer

Use the 'service password-enforcement' command to encrypt passwords with type 7

Answer

Configure authentication using HTTP with local username/password

Question 14

Refer to the exhibit. What is the most likely reason for the high number of 'No route to host' drops on a Cisco ASA?

Accepted Answer

Missing static route on the ASA. The 'No route to host' drop on a Cisco ASA indicates that the firewall has no valid route in its routing table to reach the destination IP address of the packet. Option C is correct because a missing static route (or dynamic route) for the destination network prevents the ASA from performing a route lookup, causing it to drop the packet with this specific syslog message. This is a Layer 3 forwarding issue, not a policy or NAT problem.

Answer

Firewall is in transparent mode

Answer

Interface is down

Answer

Incorrect NAT rule

Question 15

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Accepted Answer

Enable TCP Intercept with a low threshold. TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.

Answer

Increase the connection timeout

Answer

Implement an access-list to allow only known source IPs

Answer

Configure a static route to null0 for the server's IP

350-701 Practice Test 26 — 15 Questions

Exhibit

350-701 Practice Test 26 — 15 Questions

Exhibit