350-701 Practice Test 28 — 15 Questions

Question 1

A multinational corporation is implementing ISE for wired network access using 802.1X with EAP-TLS certificate authentication. Their Windows 10 laptops have certificates issued by an internal PKI. During testing, some users report that they are repeatedly prompted to select a certificate after connecting, and eventually authentication fails. ISE logs show 'Authentication failed - No matching certificate found'. The engineer checks the client machine and sees multiple certificates, including the correct one, in the personal store. The ISE endpoint identity store is populated with the user's AD credentials. What is the most likely cause of this failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The client certificates lack the 'Client Authentication' extended key usage (EKU). The most likely cause is that the client certificates lack the 'Client Authentication' extended key usage (EKU). For EAP-TLS, the client certificate must have the Client Authentication EKU to be used for authentication. If it's missing, the Windows supplicant will not select the certificate, and ISE will reject it with 'No matching certificate found'. Even if the certificate is in the personal store, it won't be used without the correct EKU.

Answer

The client's certificate is expired

Answer

The Windows supplicant requires a registry modification to enable auto-selection

Answer

ISE trusted CA certificate list does not include the issuing CA

Question 2

A security team wants to gain visibility into shadow IT usage of cloud applications and enforce data loss prevention policies. Which cloud security control should they deploy?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is designed to provide visibility into cloud application usage (shadow IT) and enforce data loss prevention (DLP) policies for SaaS applications. It sits between users and cloud services to monitor and control activity.

Answer

Cloud WAF

Answer

CWPP

Answer

CSPM

Question 3

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 4

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

Accepted Answer

Device Trajectory to review the event timeline.. Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.

Answer

Group Policy to check applied policies.

Answer

Dashboard to view overall threat scores.

Answer

File Search to find files with unknown verdict.

Question 5

A company wants to prevent users from downloading executable files (.exe) from the internet via the WSA. Which policy type should be configured?

Accepted Answer

Access policy with file type filtering. C is correct because an Access policy in WSA allows granular control over web traffic, including the ability to block specific file types such as .exe via the 'File Type Filtering' action. This directly prevents users from downloading executable files from the internet, as the WSA inspects the MIME type or file extension in the HTTP response and applies the configured block action.

Answer

URL filtering policy with category blocking

Answer

Data Security policy

Answer

Web Reputation Security policy

Question 6

A cloud security architect is designing zero trust for a multi-cloud environment. Which principle is most critical?

Accepted Answer

Identity as the new perimeter. Zero trust assumes no implicit trust; identity becomes the primary perimeter for access control.

Answer

Use of VPNs for all remote access

Answer

Encryption of all data in transit

Answer

Network segmentation using firewalls

Question 7

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Accepted Answer

Static assignment on the network access device (switch) using the 'cts role-based sgt' command. The 'cts role-based sgt' command on a network access device (switch) statically assigns an SGT to an endpoint based on its IP address or MAC address. Option E is correct because ISE can dynamically assign an SGT to an endpoint as part of an authorization policy during authentication, using RADIUS attributes like cisco-av-pair=CTS:SGT=value.

Answer

DNS resolution of the endpoint hostname

Answer

The IP address of the endpoint

Answer

DHCP Option 141

Question 8

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

Accepted Answer

Security Group. Security Groups in AWS are stateful virtual firewalls that operate at the instance (ENI) level. They control inbound and outbound traffic using allow rules only, and because they are stateful, return traffic for an allowed inbound connection is automatically permitted outbound, and vice versa. This stateful behavior means you don't need to explicitly allow ephemeral ports for return traffic, unlike stateless firewalls.

Answer

Network ACL

Answer

Internet Gateway

Answer

VPC Flow Logs

Question 9

Match each VPN type to its characteristic.

Accepted Answer

Site-to-Site VPN: Connects entire networks between different locations using IPsec.. The correct matches are: Site-to-Site VPN (connects networks), Remote Access VPN (connects individual users), MPLS VPN (uses MPLS in provider network), and DMVPN (dynamic tunnels). Common confusions involve swapping site-to-site and remote access characteristics.

Answer

Site-to-Site VPN: Allows individual users to connect to a corporate network from remote locations.

Answer

Remote Access VPN: Connects entire networks between different locations using IPsec.

Question 10

Match each Cisco security product to its category.

Accepted Answer

Cisco Firepower: Next-Generation Firewall. Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

Answer

Cisco Firepower: Network Access Control

Answer

Cisco Stealthwatch: Next-Generation Firewall

Question 11

A security engineer is investigating a suspicious process on an endpoint. Using Cisco Secure Endpoint, which EDR capability allows the engineer to isolate the process and prevent it from executing further?

Accepted Answer

Process isolation. Cisco Secure Endpoint provides EDR capabilities including process isolation, which terminates and prevents the process from running again.

Answer

File quarantine

Answer

IOC scanning

Answer

Remote shell

Question 12

An organization wants to deploy 802.1X for network access control. Which component is responsible for forwarding authentication requests from the endpoint to the authentication server?

Accepted Answer

Authenticator. In 802.1X, the authenticator is the network device (typically a switch or wireless controller) that sits between the supplicant (endpoint) and the authentication server (RADIUS). It forwards EAP authentication messages between the supplicant and the RADIUS server, acting as a relay. The authenticator controls port access based on the authentication result.

Answer

Authentication server

Answer

Supplicant

Answer

RADIUS proxy

Question 13

An engineer is deploying Cisco ISE for posture assessment. Which THREE conditions can ISE check during posture assessment before granting full network access? (Choose three.)

Accepted Answer

Patch level. Option A (Patch level) is correct because ISE posture policies can use conditions that verify the OS patch level (e.g., Windows Update/hotfix state) through the AnyConnect/ISE posture agent before granting full access. Option C (Disk encryption status) is correct because posture checks can verify disk encryption such as BitLocker or FileVault is enabled and compliant. Option D (Antivirus status) is correct because ISE posture commonly checks that an antivirus/antimalware product is installed, running, and up to date via vendor-specific condition checks. Option B (SSID) is not a posture condition; SSID is a wireless network identifier used in authorization/network conditions, not an endpoint posture check. Option E (Device MAC address) is not a posture condition; MAC addresses are used for identity/MAB or profiling, not for assessing endpoint compliance state.

Answer

SSID

Answer

Device MAC address

Question 14

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

Accepted Answer

Cisco AnyConnect ISE Posture Module. The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Answer

ISE Policy Service

Answer

Cisco ISE pxGrid

Answer

Network Access Device (switch)

Question 15

A network administrator is configuring Cisco WSA to intercept web traffic transparently. Which protocol should be used to redirect traffic from the router to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) is a Cisco-developed protocol that allows a router or Layer 3 switch to transparently redirect web traffic to a Cisco WSA (Web Security Appliance) without requiring client-side proxy configuration. The router and WSA form a WCCP service group, and the router intercepts HTTP/HTTPS flows and forwards them to the appliance. This is the standard method for transparent interception in Cisco WSA deployments.

Answer

SSL/TLS Decryption

Answer

HTTP Proxy with PAC files

Answer

Active Directory integration