350-701 Practice Test 27 — 15 Questions

Question 1

A network engineer is troubleshooting a site-to-site IPsec VPN that fails to establish. The IKE phase 1 completes successfully, but phase 2 fails. The debug output shows 'IPSEC(validate_proposal): transform set proposal mismatch'. Both peers have the same transform set configured. What is the most likely cause?

Accepted Answer

Mismatched encryption/authentication algorithms in the transform set. The error 'IPSEC(validate_proposal): transform set proposal mismatch' indicates that the IPsec transform sets proposed by the two peers do not match during IKE phase 2 negotiation. Even if the transform sets appear identical in configuration, a mismatch in the encryption algorithm (e.g., AES-256 vs AES-128) or authentication algorithm (e.g., SHA-1 vs SHA-256) will cause this failure. Since IKE phase 1 completed successfully, the pre-shared key and routing are not the issue, and lifetime mismatches typically generate a different error.

Answer

Mismatched IPsec lifetime values

Answer

Missing route for the remote subnet

Answer

Incorrect pre-shared key

Question 2

An engineer is troubleshooting an IPsec VPN between two Cisco routers. The tunnel is up, but traffic is not passing. The encryption domain on both sides is correctly configured. What is the most likely cause?

Accepted Answer

ACL on the WAN interface blocking ESP traffic. When the IPsec tunnel is up but no traffic passes, the most common cause is that the WAN interface ACL is blocking ESP (protocol 50) or UDP/4500 (NAT-T) traffic. Even though IKE and IPsec SAs are established, if the ACL drops the encrypted packets, the tunnel appears operational but cannot forward data. This is distinct from transform set or IKE mismatches, which would prevent the tunnel from coming up at all.

Answer

Mismatched IPSec transform sets

Answer

Routing loop

Answer

Mismatched IKE phase 1 parameters

Question 3

Refer to the exhibit. A network administrator applies the ACL to the interface. What is the effect on traffic inbound to the interface?

Accepted Answer

Only TCP traffic destined to 192.168.1.100 on port 80 is permitted; all other IP traffic is denied. The ACL is applied inbound on the interface and contains a single entry that permits TCP traffic from any source to destination 192.168.1.100 on port 80. Because there is an implicit deny all at the end of every standard and extended ACL, only traffic matching this specific permit statement is allowed; all other IP traffic is denied.

Answer

All TCP traffic is permitted; other IP traffic is denied

Answer

All IP traffic is permitted

Answer

The ACL is applied outbound, so it has no effect on inbound traffic

Question 4

A network engineer needs to implement a security solution that provides encryption, integrity, and authentication at Layer 2 between two switches. Which technology should be used?

Accepted Answer

MACsec. MACsec (IEEE 802.1AE) provides hop-by-hop encryption, integrity, and authentication at Layer 2 (the data link layer) directly on Ethernet frames. It uses GCM-AES-128 or GCM-AES-256 to encrypt the entire payload and authenticate the frame, ensuring confidentiality and integrity between directly connected switches without requiring IP-layer processing.

Answer

SSL/TLS

Answer

IPsec

Answer

802.1X

Question 5

Which security principle ensures that a user or system is granted only the minimum permissions necessary to perform a specific function?

Accepted Answer

Least privilege. The principle of least privilege dictates that a user, process, or system should be granted only the minimum permissions necessary to perform a specific function. In Cisco security contexts, this is enforced through features like Role-Based Access Control (RBAC) on Cisco IOS devices, where privilege levels (0-15) are assigned to restrict command access, or via TrustSec Security Group Tags (SGTs) that limit traffic flows to only required resources.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 6

Which THREE of the following are benefits of using Cisco ISE for network access control?

Accepted Answer

Firewall integration. Cisco ISE provides centralized policy management (option C) by allowing administrators to define and enforce access policies from a single console, which simplifies network access control across the entire organization. Guest access provisioning (option B) is a native feature of ISE that enables secure, self-service or sponsored guest onboarding with customizable captive portals and role-based access. Firewall integration (option A) is a benefit because ISE can dynamically communicate with Cisco firewalls (e.g., ASA, Firepower) via pxGrid to enforce context-aware policies, such as quarantining an infected endpoint or granting micro-segmentation based on user identity and device posture.

Answer

Storage encryption

Answer

URL filtering

Question 7

Which TWO benefits does centralized RADIUS authentication provide over local authentication on network devices? (Choose two.)

Accepted Answer

Centralized accounting and logging of all authentication attempts. Centralized RADIUS authentication aggregates all authentication, authorization, and accounting (AAA) data on a single server. This provides a unified audit trail for all login attempts across network devices, enabling comprehensive logging and accounting that local authentication cannot offer. Local authentication logs are device-specific and lack centralized aggregation, making forensic analysis and compliance reporting more difficult.

Answer

Faster authentication because of local caching

Answer

Support for multiple authentication protocols like PAP, CHAP, EAP

Answer

No need for a backup authentication method

Question 8

A security administrator discovers that users are evading the corporate firewall by using SSH to tunnel HTTP traffic to external servers. Which action can be taken on a Cisco ASA firewall to detect and prevent this?

Accepted Answer

Enable SSH inspection using the 'inspect ssh' command in the global policy. Option B is correct because enabling SSH inspection with the 'inspect ssh' command on a Cisco ASA allows the firewall to monitor SSH control channel negotiations and detect when SSH is being used to tunnel other protocols (like HTTP). The ASA can then enforce policies to block such tunneling, preventing users from bypassing the corporate firewall.

Answer

Configure a dynamic PAT rule to limit the number of SSH sessions

Answer

Create an access-list to block port 22 entirely

Answer

Implement SSL decryption to inspect the encrypted SSH payload

Question 9

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the external interface. The most likely issue is that the crypto map is not applied to the external interface. In IPsec VPN configuration, the crypto map must be applied to the interface that sends and receives encrypted traffic (typically the outside/public-facing interface). Without this application, the router does not know which traffic to protect or how to negotiate the IPsec tunnel, even if the tunnel is established (e.g., IKE Phase 1 completes). The tunnel may show as up due to successful ISAKMP negotiation, but no traffic will be encrypted because the crypto map's policy (including the access-list and transform set) is never enforced on the interface.

Answer

The transform set uses wrong encryption

Answer

The access-list is too permissive

Answer

The peer address is wrong

Question 10

Which THREE elements are essential components of a secure network architecture according to Cisco's SAFE model? (Choose three.)

Accepted Answer

Encryption for data in transit. Encryption for data in transit is a core component of Cisco's SAFE model because it ensures confidentiality and integrity of traffic traversing the network. SAFE mandates encryption protocols such as IPsec, TLS, or MACsec to protect against eavesdropping and man-in-the-middle attacks. This aligns with the model's principle of maintaining trustworthiness across all communication paths.

Answer

A single firewall at the internet edge

Answer

Large broadcast domains to simplify management

Question 11

An organization discovers that a man-in-the-middle attack was successfully performed using a forged certificate issued by a trusted CA. The legitimate CA’s private key was compromised. Which PKI component was breached?

Accepted Answer

Certification Authority (CA) private key. The correct answer is A because the man-in-the-middle attack succeeded due to a forged certificate issued by a trusted CA, which directly implies that the CA's private key was compromised. The CA's private key is the root of trust in a PKI; if it is stolen, an attacker can sign fraudulent certificates that will be trusted by all clients that trust the CA. Without the private key, the attacker could not have created a valid forged certificate.

Answer

Online Certificate Status Protocol (OCSP) responder

Answer

Registration Authority (RA)

Answer

Certificate Revocation List (CRL)

Question 12

A company is designing a secure segmentation strategy for a three-tier web application. They want to isolate the web, application, and database tiers while allowing only necessary traffic. Which design best achieves defense-in-depth while minimizing complexity?

Accepted Answer

Use VRF-Lite with SGTs and enforce policies via Cisco ISE.. Option C is correct because VRF-Lite with Security Group Tags (SGTs) and Cisco ISE provides scalable, policy-based segmentation that follows the defense-in-depth principle. VRF-Lite creates separate routing tables for each tier, while SGTs enforce granular, identity-based access control at the network layer, reducing complexity compared to multiple firewalls or ACLs. This design allows necessary traffic between tiers without relying on IP addresses alone, aligning with zero-trust architecture.

Answer

Place each tier in a separate VLAN and rely on ACLs on the distribution switch.

Answer

Deploy a dedicated firewall for each tier and connect them in series.

Answer

Place a single stateful firewall between each tier with separate interfaces.

Question 13

A network administrator is configuring port security on a Cisco switch port connected to a single endpoint. The requirement is that only the first device that connects to the port is allowed, and any subsequent device that attempts to connect must trigger an error-disabled state. Which two features must be configured to meet this requirement?

Accepted Answer

switchport port-security mac-address sticky. Option B is correct because the 'switchport port-security mac-address sticky' command dynamically learns the MAC address of the first connected device and saves it as a sticky secure MAC address in the running configuration. Option E is correct because setting the maximum number of secure MAC addresses to 1 ensures that only the first device's MAC address is allowed; any additional device will trigger a security violation. Together, these two features enforce that only the first device can connect, and subsequent devices cause the port to enter an error-disabled state when combined with the shutdown violation mode.

Answer

switchport port-security aging type inactivity

Answer

switchport port-security mac-address 0000.1111.2222

Answer

switchport port-security violation shutdown

Question 14

An organization is migrating to AWS and wants to ensure that all internet-bound traffic from VPCs is inspected by a central security appliance. Which AWS service should be used to redirect this traffic?

Accepted Answer

Transit Gateway. Transit Gateway is correct because it acts as a central hub that can route traffic between VPCs and on-premises networks, and it supports route tables that can direct all internet-bound traffic to a central security appliance (such as a firewall or IDS/IPS) via a VPC attachment or a Network Virtual Appliance. This enables traffic inspection and policy enforcement without requiring individual VPCs to manage their own internet gateways or NAT devices.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 15

A security team is evaluating cloud security solutions. Which TWO of the following are core capabilities of a Cloud Access Security Broker (CASB)?

Accepted Answer

Shadow IT discovery and visibility. Option C is correct because Shadow IT discovery and visibility is a core CASB capability. CASBs discover unsanctioned cloud applications (Shadow IT) by analyzing network traffic logs, API integrations, or proxy data to identify cloud services used without IT approval, providing visibility into usage, risk posture, and user activity.

Answer

Provisioning and de-provisioning of cloud resources

Answer

Container image scanning

Answer

Intrusion prevention for virtual machines