350-701 Practice Test 28 — 15 Questions

Question 1

What is the primary purpose of DMARC in email authentication?

Accepted Answer

To specify a policy for failed authentication. DMARC tells receiving servers how to handle emails that fail SPF or DKIM checks.

Answer

To add a digital signature

Answer

To encrypt email content

Answer

To verify the sending IP address

Question 2

An organization using Cisco Firepower NGFW wants to block all social media traffic while allowing other web traffic. Which feature should be configured?

Accepted Answer

URL filtering. Firepower URL filtering can block categories such as 'Social Networking' to prevent access to social media sites.

Answer

Intrusion prevention

Answer

TLS server identity discovery

Answer

Application control

Question 3

A security engineer is configuring Cisco WSA for HTTPS inspection but notices that some encrypted traffic is being bypassed. The WSA is configured with a decryption policy that excludes traffic to financial websites. What is the most likely reason for the bypass?

Accepted Answer

The decryption policy has an exception for financial services. If the decryption policy excludes certain categories (e.g., Financial), those sites will not be decrypted and will bypass inspection.

Answer

The WSA's certificate is not trusted by clients

Answer

The WSA is in explicit proxy mode

Answer

TLS version is incompatible

Question 4

A security engineer is deploying Cisco AMP for Endpoints in an organization. To ensure that any malicious file that was initially allowed but later determined to be malicious can be traced, which feature should be used?

Accepted Answer

Device Trajectory. Cisco AMP uses retrospective security to continuously analyze file behavior. If a file is later deemed malicious, the Device Trajectory shows its propagation path and actions, allowing for containment and remediation.

Answer

SHA-256 file disposition

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Question 5

A multinational corporation uses Cisco AMP for Endpoints with cloud-based file reputation. The security team notices that a file that was previously determined to be clean (disposition: clean) is now reported as malicious by a threat intelligence feed. However, AMP has not taken any action on endpoints that already executed the file. The administrator confirms that retrospective security is enabled. What should the administrator check first to ensure that the file is remediated on all affected endpoints?

Accepted Answer

Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions.. When a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.

Answer

Verify that the file is not excluded from scanning due to an anti-virus exclusion list.

Answer

Confirm that the endpoints have internet connectivity to the AMP cloud.

Answer

Ensure that the file is being analyzed by the local AMP engine for accurate detection.

Question 6

A network engineer is deploying a Cisco FTD in active/standby high availability. Which statement is true about the configuration synchronization?

Accepted Answer

Configuration changes on the active unit are automatically replicated to the standby unit.. In FTD HA, configuration is synchronized from active to standby via FMC. The standby unit does not accept configuration changes directly.

Answer

Standby unit must be configured separately with identical settings.

Answer

Both units can be managed independently via FMC.

Answer

Failover is configured on the FTD directly without FMC.

Question 7

A company deploys Cisco Duo for multi-factor authentication to protect VPN access. Employees use AnyConnect to connect to the corporate network. After entering their credentials, they receive a push notification on their mobile device. Which Duo authentication method is being used?

Accepted Answer

Duo Push. Duo Push sends a push notification to the user's enrolled mobile device, which they can approve or deny. This is the most common method for VPN MFA with AnyConnect.

Answer

Bypass code

Answer

TOTP (Time-based One-Time Password)

Answer

Hardware token

Question 8

Which type of firewall is best suited to inspect application-layer traffic and protect against exploits like SQL injection?

Accepted Answer

Next-generation firewall with IPS and application visibility. A next-generation firewall (NGFW) with IPS and application visibility is best suited to inspect application-layer traffic and protect against exploits like SQL injection because it combines deep packet inspection (DPI), signature-based IPS, and application-level awareness. Unlike simpler firewalls, an NGFW can decode HTTP/HTTPS payloads, match patterns against SQL injection signatures (e.g., ' OR 1=1 --), and block malicious traffic at Layer 7 while maintaining stateful inspection.

Answer

Stateful firewall

Answer

Application proxy firewall

Answer

Packet-filtering firewall

Question 9

An administrator is troubleshooting an issue where emails sent to a specific external domain are being delayed by up to 30 minutes. The Cisco ESA is configured with multiple mail exchangers (MX) for delivery. The logs show that the ESA is attempting delivery to the primary MX, which is unresponsive, and failing over to the secondary MX after 30 minutes. What change should be made to reduce the delivery delay?

Accepted Answer

Reduce the delivery queue retry interval in the ESA settings. The delay is caused by the ESA waiting too long before failing over to the secondary MX. Reducing the delivery queue retry interval will cause the ESA to attempt failover sooner, reducing the delay. Option A is incorrect because SMTP over TLS (ESMTP) does not affect timeout or failover behavior. Option C is incorrect because increasing the number of MX records does not change the timeout or retry interval. Option D is incorrect because removing the primary MX record is not a best practice and does not address the root cause; the issue is the timeout, not the existence of the primary MX.

Answer

Enable SMTP over TLS (ESMTP) for the delivery

Answer

Increase the number of MX records for that domain

Answer

Remove the primary MX record from DNS

Question 10

A company is using Cisco WSA with explicit proxy mode. The security team wants to enforce HTTPS inspection for all web traffic from the finance department to detect malicious content in encrypted connections. However, they want to exclude traffic to financial institutions' websites due to compliance reasons. Which configuration approach should be used to achieve this?

Accepted Answer

Configure a policy for the finance department with HTTPS inspection enabled and add a bypass rule for the Financial Services URL category.. In WSA, you can configure bypass rules for specific URL categories or destinations to exclude them from HTTPS inspection while still inspecting other traffic.

Answer

Disable HTTPS inspection globally and enable it only for the finance department using a custom policy.

Answer

Configure SSL/TLS decryption on the firewall instead of the WSA.

Answer

Use transparent proxy mode with WCCP redirect to bypass inspection for financial sites.

Question 11

Based on the exhibit, what is the root cause of the AMP connector's inability to connect to the cloud?

Accepted Answer

The proxy requires authentication, and the AMP connector has no credentials configured.. The AMP connector is configured to use a proxy server, but the proxy requires authentication. Without credentials configured in the connector, the proxy will reject the HTTP CONNECT request (RFC 7231), preventing the connector from establishing the TLS tunnel to the AMP cloud. This is a common scenario when an organization uses an authenticated forward proxy, and the connector's proxy settings lack the username/password fields.

Answer

The AMP cloud servers are blocking the connector's IP address.

Answer

The proxy server address is incorrect in the connector configuration.

Answer

The connector has no network connectivity to the internet.

Question 12

A large enterprise is migrating legacy applications to AWS. The security team requires that all data in transit between the applications and the on-premises data center be encrypted and inspected for threats. They have deployed a Cisco Firepower NGFW on-premises and are using Amazon VPC with a VPN connection. The team is concerned about east-west traffic within the VPC also being inspected. They consider deploying Cisco Secure Firewall in the cloud (cFMC). However, budget constraints limit the number of virtual firewalls. Which design best meets the requirements while optimizing cost?

Accepted Answer

Deploy a single Cisco Secure Firewall virtual instance in a transit VPC and route all inter-VPC traffic through it.. Deploying a single Cisco Secure Firewall virtual instance in a transit VPC allows centralized inspection of all inter-VPC (east-west) traffic while minimizing costs. By routing traffic through the transit VPC, you avoid the expense of deploying a firewall in every VPC, and the on-premises Firepower NGFW handles north-south traffic (VPN and internet-bound). This design meets the encryption and threat inspection requirements for both east-west and north-south traffic within the budget constraint.

Answer

Inspect all traffic at the on-premises Firepower by routing all cloud traffic through a VPN.

Answer

Deploy a Cisco Secure Firewall virtual instance in each VPC.

Answer

Use AWS Network Firewall for east-west inspection and keep Firepower on-premises for north-south.

Question 13

A large enterprise uses Cisco ISE with pxGrid to share context with Firepower for threat containment. When a Firepower detects an infected endpoint, it triggers a pxGrid quarantine action that changes the endpoint's authorization profile. The engineer observes that the quarantine is applied, but after the Firepower clears the threat, the endpoint does not regain its original access. What is the most likely reason?

Accepted Answer

The ISE session is not forced to reauthenticate after quarantine release. When Firepower clears a threat and sends a clearance message to ISE via pxGrid, ISE may update the endpoint's authorization policy but does not automatically force the existing session to reauthenticate. The endpoint remains in the quarantine state because the network access device (NAD) still has the old session attributes. To restore original access, a Change of Authorization (CoA) must be sent to the NAD to trigger reauthentication. Option B correctly identifies that the session is not forced to reauthenticate after quarantine release. Option A is incorrect because Firepower does send the clearance message. Option C is incorrect because the NAD accepted the quarantine CoA, indicating CoA support. Option D is incorrect because the authorization policy order is not the issue; the problem is the lack of reauthentication.

Answer

Firepower failed to send the clearance message to ISE

Answer

The network access device does not support CoA

Answer

ISE authorization policy is not ordered correctly

Question 14

A university is using Cisco WSA to filter web traffic for its students and staff. The WSA is configured with transparent proxy mode and uses Active Directory for authentication. Recently, the IT department received complaints that some users cannot access certain educational websites that are correctly categorized as 'Education'. The WSA policy has a default rule that blocks all categories except those explicitly allowed. The 'Education' category is set to 'Allow'. However, affected users are shown a block page with the reason 'Web Reputation: Low Reputation'. The Web Reputation threshold is set to -5.0. The IT team checked the reputation scores of the blocked sites and found they are around -4.5. What is the most likely reason for the block?

Accepted Answer

The Web Reputation action is set to 'Block' for scores below 0, overriding the URL filtering allow. The Web Reputation action configured in the WSA policy overrides the URL category-based allow rule. Even though the 'Education' category is set to 'Allow', the Web Reputation threshold is set to -5.0, and the blocked sites have a reputation score of -4.5 (which is below the threshold, meaning worse reputation). The WSA applies the most restrictive action: if Web Reputation is set to 'Block' for scores below 0, it will block traffic regardless of the category allow action, resulting in the block page showing 'Web Reputation: Low Reputation'.

Answer

The 'Education' category is not included in the allowed list for the specific identification profile

Answer

The users are not authenticated properly and are assigned a default policy that blocks education

Answer

The HTTPS decryption is failing for those sites, causing a block

Question 15

A security engineer is evaluating Cisco solutions to detect and respond to network anomalies, including potential insider threats, by analyzing NetFlow data and behavioral patterns. Which Cisco product is best suited?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow and behavioral analytics to detect network threats and anomalies.

Answer

Cisco ISE

Answer

Cisco Firepower

Answer

Cisco ASA