350-701 Practice Test 26 — 15 Questions

Question 1

An attacker intercepts traffic between a client and server using ARP spoofing. Which type of attack is this?

Accepted Answer

Man-in-the-middle. ARP spoofing allows an attacker to intercept traffic, enabling man-in-the-middle (MITM) attacks.

Answer

Session hijacking

Answer

DNS poisoning

Answer

Denial of Service

Question 2

Which TWO actions are best practices when configuring a Cisco WSA to block malicious websites? (Choose two.)

Accepted Answer

Configure URL filtering categories to block known malicious categories. Option A is correct because configuring URL filtering categories to block known malicious categories (such as Malware, Phishing, and Botnets) directly prevents users from reaching sites Cisco Talos has classified as dangerous, which is a core WSA blocking practice. Option E is correct because enabling Web Reputation filtering uses Cisco's Web Reputation Scores (WRS) to dynamically block requests to URLs with poor reputation, catching malicious sites that may not yet be in a static category. Option B is not a best practice because setting the default action to 'Monitor' only logs traffic rather than blocking it, leaving malicious sites reachable. Option C is wrong because disabling user authentication removes per-user policy enforcement and accountability, weakening security rather than strengthening it. Option D is wrong because allowing all HTTPS traffic to improve performance bypasses inspection and blocking, directly undermining the goal of blocking malicious websites.

Answer

Set the default action to 'Monitor' for all categories

Answer

Disable user authentication to simplify policy

Answer

Allow all HTTPS traffic to improve performance

Question 3

A company is adopting a zero-trust security model for its cloud environment. Which THREE practices align with zero-trust principles? (Choose three.)

Accepted Answer

Use privileged identity management (PIM) for just-in-time access. Option A is correct because privileged identity management (PIM) enforces just-in-time elevation of privileges, so administrative rights are granted only when needed and expire automatically, which directly supports zero-trust's least-privilege and never-trust-implicitly principles. Option D is correct because requiring multi-factor authentication (MFA) for all cloud access verifies identity with more than a single factor and prevents access based solely on network location, a core zero-trust requirement. Option E is correct because conditional access policies evaluate signals such as user identity, device compliance, location, and risk to make dynamic, context-aware authorization decisions, which is exactly how zero-trust grants access per request. Option B is not correct because trusting all traffic from the corporate network is the implicit-trust perimeter model that zero-trust explicitly rejects. Option C is not correct because granting permanent administrative privileges violates least privilege and standing-access reduction, both central to zero-trust.

Answer

Trust all traffic from within the corporate network

Answer

Grant permanent administrative privileges for convenience

Question 4

An administrator wants to dynamically change the VLAN assignment for a user after a posture assessment determines that the endpoint is missing a critical patch. Which ISE feature accomplishes this?

Accepted Answer

CoA. Change of Authorization (CoA) is the correct answer because it is the ISE feature that allows dynamic, real-time changes to an authenticated session, such as reassigning a VLAN, after a posture assessment. When a posture assessment determines an endpoint is non-compliant (e.g., missing a critical patch), ISE can send a CoA request (RFC 5176) to the network access device (NAD) to modify the session attributes, including VLAN assignment, without requiring the user to reauthenticate.

Answer

TrustSec

Answer

Profiling

Answer

MAB

Question 5

In a Snort intrusion detection rule, which part specifies the action to take when the rule matches?

Accepted Answer

Action. In a Snort rule, the action is the first field of the rule header and specifies what happens when the rule matches (e.g., alert, log, pass, drop, reject). The question asks which part specifies the action, and that is literally the action field. The header format is action protocol src_ip src_port -> dst_ip dst_port.

Answer

Protocol

Answer

Options

Answer

Source IP

Question 6

An organization is using Cisco FMC with FTD devices. They want to detect and block malware in HTTP traffic. Which policy component must be configured to inspect files and submit SHA-256 hashes to AMP cloud for disposition?

Accepted Answer

File Policy. A File Policy in Cisco FMC is the policy component that inspects files in HTTP, SMTP, FTP, and other protocols, calculates SHA-256 hashes, and submits them to the AMP cloud for disposition. It defines which file types to inspect, what actions to take (block, malware cloud lookup, etc.), and is invoked from an Access Control Policy rule.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

Intrusion Policy

Question 7

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 8

A company using Cisco Web Security Appliance (WSA) in explicit proxy mode has enabled HTTPS decryption with a custom CA certificate. A user reports that a specific banking website displays a certificate error message. The administrator verifies that the WSA is generating a certificate for that site. What is the most likely cause of the error?

Accepted Answer

The banking website uses HTTP Public Key Pinning (HPKP) or Certificate Pinning.. The most likely cause is that the banking website uses HTTP Public Key Pinning (HPKP) or certificate pinning. When the WSA performs HTTPS decryption, it generates a new certificate for the site, which does not match the pinned public key or certificate hash that the browser expects. This mismatch triggers a certificate error, even though the WSA's CA is trusted.

Answer

The WSA's time is not synchronized with the NTP server, causing certificate validity issues.

Answer

The WSA is not configured to generate certificates for that domain.

Answer

The user's browser does not trust the WSA's CA certificate.

Question 9

In the shared responsibility model for cloud computing, which responsibility is managed by the customer in all service models (IaaS, PaaS, SaaS)?

Accepted Answer

Data and access management. In all cloud service models, the customer is always responsible for their own data and access management, including who has access to the data and how it is protected.

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Answer

Hypervisor patching

Question 10

An organization is adopting zero trust principles for cloud access. Which THREE components should be implemented to enforce identity as the new perimeter?

Accepted Answer

Multi-Factor Authentication (MFA) for all cloud access. Multi-Factor Authentication (MFA) for all cloud access (B) is correct because zero trust requires strong, verified identity for every access request, and MFA adds a possession or biometric factor beyond a password, preventing credential-only compromise. Privileged Identity Management (PIM) for just-in-time access (C) is correct because it enforces least privilege by granting elevated roles only when needed, for a limited time, with approval and audit trails, rather than standing admin rights. Conditional access policies based on user and device context (D) are correct because they evaluate signals such as user risk, sign-in risk, location, and device compliance before granting access, which is the core of identity-as-the-perimeter enforcement. Network segmentation via VLANs (A) is not correct here because it is a network-layer control that does not verify identity and is largely ineffective for cloud/SaaS access. Firewall rules based on source IP (E) are not correct because IP addresses are not reliable identity signals in cloud environments and can be spoofed or changed, contradicting zero trust principles.

Answer

Network segmentation via VLANs

Answer

Firewall rules based on source IP

Question 11

A Cisco TrustSec deployment is being implemented to enforce micro-segmentation. The security team needs to ensure that Security Group Tags (SGTs) are propagated across the network. Which THREE methods can be used to distribute SGT information in a TrustSec environment? (Choose three.)

Accepted Answer

SGT over SXP (SGT Exchange Protocol). Option A (SGT over SXP) is correct because the SGT Exchange Protocol is a dedicated TCP-based protocol (default port 64999) used to propagate IP-to-SGT bindings between TrustSec-capable devices and non-TrustSec devices or across network boundaries where inline tagging is not supported. Option C (SGT over VXLAN) is correct because in VXLAN-based fabrics, the Group Policy Option (GPO) flag allows the SGT to be carried in the VXLAN header (Group Policy ID field), enabling tag propagation across the overlay. Option D (SGT inline tagging in the Ethernet header) is correct because native TrustSec inline tagging inserts the 16-bit SGT into the Cisco Metadata (CMD) field of the Layer 2 Ethernet frame, allowing hop-by-hop propagation between TrustSec-capable hardware. Option B is incorrect because CDP is a Layer 2 discovery protocol used for neighbor information and does not carry SGT values. Option E is incorrect because MPLS does not natively transport SGTs; TrustSec tagging relies on Ethernet inline tagging, SXP, or VXLAN GPO rather than MPLS label fields.

Answer

SGT over Cisco Discovery Protocol (CDP)

Answer

SGT over MPLS

Question 12

An administrator is configuring DLP on the Cisco ESA to block social security numbers (SSNs) in outgoing email. The policy is set to 'Drop' for SSN matches, but some emails containing SSNs are still being delivered. What step should the administrator take to troubleshoot?

Accepted Answer

Verify that the DLP policy is enabled and assigned to the outgoing mail policy.. The most likely reason SSNs are still being delivered is that the DLP policy is not actually applied to the outgoing mail policy. Even if the DLP policy is configured to 'Drop' for SSN matches, it will have no effect unless it is enabled and explicitly assigned to the mail policy that governs outbound messages. Without this assignment, the ESA will not inspect messages against the DLP dictionary, allowing SSNs to pass through.

Answer

Increase the message size limit in the mail flow policy.

Answer

Ensure that TLS is enabled for outgoing mail.

Answer

Add additional SSN patterns to the DLP dictionary.

Question 13

Refer to the exhibit. What happened to the file 'crack.exe'?

Accepted Answer

The file was blocked from executing.. The exhibit shows that Cisco AMP for Endpoints detected 'crack.exe' as malicious and applied the 'BLOCK' action, which prevents the file from executing on the endpoint. This is indicated by the 'BLOCK' disposition in the event details, meaning the file was blocked before it could run. Option B is correct because the file was blocked from executing based on the detection and policy configured in AMP.

Answer

The file was allowed because it was detected as malicious.

Answer

The file was detected but no action was taken.

Answer

The file was quarantined to a secure folder.

Question 14

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Accepted Answer

DNS query flood. DNS query flood (A) is an application-layer attack because it overwhelms a DNS server with a high volume of valid-looking recursive queries, exhausting its ability to resolve names at Layer 7. Slowloris (B) is an application-layer attack that opens many partial HTTP connections and sends incomplete headers to keep sockets open, exhausting the web server's connection pool without high bandwidth. HTTP flood (E) is an application-layer attack that sends massive numbers of seemingly legitimate HTTP GET or POST requests to consume web server and application resources. DNS amplification (C) is a volumetric reflection/amplification attack typically classified at the network/infrastructure layer, not an application-layer attack. SYN flood (D) is a transport-layer (Layer 4) attack that exploits the TCP three-way handshake by sending many SYN packets without completing the connection.

Answer

DNS amplification

Answer

SYN flood

Question 15

During an incident response, a forensic analyst finds that an attacker used a script to modify ARP tables, enabling them to intercept and modify traffic between two hosts. Which attack technique was used?

Accepted Answer

Man-in-the-middle. Man-in-the-middle (MITM) attacks, such as ARP spoofing, allow interception and modification of traffic between two parties.

Answer

Pass-the-hash

Answer

Replay attack

Answer

DNS tunneling