350-701 Practice Test 28 — 15 Questions

Question 1

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

Accepted Answer

Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.. Option D is correct because Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.

Answer

Install a next-generation firewall at the internet edge and enable IPS.

Answer

Upgrade all access switches to support Private VLANs (PVLANs).

Answer

Deploy 802.1X with dynamic VLAN assignment across all wired ports.

Question 2

A DevOps team is deploying containerized applications on Kubernetes and needs to ensure that only authorized images are run. Which solution should they integrate with Kubernetes to enforce image trust and scanning?

Accepted Answer

Cisco Cloud Workload Protection (CWP). Cisco Cloud Workload Protection (CWP) is the correct solution because it provides integrated image scanning, vulnerability assessment, and trust enforcement for containerized workloads in Kubernetes. CWP uses a policy-based admission controller to block deployments of unauthorized or vulnerable images before they run, directly addressing the requirement to ensure only authorized images are executed.

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Firepower Next-Generation Firewall

Answer

Cisco Umbrella

Question 3

Which TWO Cisco solutions provide virtual firewall capabilities in public cloud environments? (Choose two.)

Accepted Answer

Cisco ASAv. Cisco ASAv (Adaptive Security Virtual Appliance) is a virtualized version of the Cisco ASA firewall that can be deployed in public cloud environments such as AWS, Azure, and GCP. It provides stateful firewall, VPN, and threat defense capabilities natively within the cloud infrastructure. Option A is correct because ASAv is explicitly designed for virtual firewall functions in public clouds.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 4

A company deploys a web application firewall (WAF) from Cisco on AWS Marketplace. They want to integrate with AWS CloudTrail for logging. What is the primary benefit?

Accepted Answer

Centralized logging of WAF events in CloudTrail. Integrating a Cisco WAF deployed via AWS Marketplace with AWS CloudTrail provides centralized logging of all WAF events, including allowed and blocked requests, directly into CloudTrail. This enables a single, auditable log stream for security monitoring and compliance, as CloudTrail captures API calls and WAF events for analysis in AWS services like CloudWatch Logs or Amazon S3.

Answer

Simplified compliance reporting

Answer

Elimination of false positives

Answer

Automatic WAF rule updates

Question 5

A company wants to implement Zero Trust principles in their cloud environment. Which THREE of the following are key Zero Trust tenets?

Accepted Answer

Assume breach (minimize blast radius). Option A is correct because 'Assume breach' is a core Zero Trust tenet that minimizes the blast radius by segmenting access and continuously monitoring for threats, even within the cloud environment. This principle assumes that an attacker may already be present, so it enforces micro-segmentation and real-time analytics to limit lateral movement, aligning with NIST SP 800-207 Zero Trust Architecture guidelines.

Answer

Implement multifactor authentication (MFA) everywhere

Answer

Assume that the perimeter is secure

Question 6

A DevOps team is deploying microservices in Azure Kubernetes Service (AKS). They need to enforce inter-container communication policies based on labels. Which Cisco solution provides micro-segmentation for containers in AKS?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct solution because it provides micro-segmentation for containers in Azure Kubernetes Service (AKS) by enforcing inter-container communication policies based on labels. It uses a Kubernetes-native approach, integrating with the Kubernetes API to discover pods and services, and applies label-based policies via eBPF or sidecar proxies to control traffic between containers without modifying the application.

Answer

Cisco Firepower

Answer

Cisco ACI

Answer

Cisco ISE

Question 7

Refer to the exhibit. Enter the command output from a Cisco Umbrella deployment. An administrator observes that 25 DNS queries were blocked. What does this indicate?

Accepted Answer

Policy enforcement blocking malicious or unwanted domains. The command output from a Cisco Umbrella deployment shows that 25 DNS queries were blocked. In Umbrella, DNS queries are blocked due to policy enforcement, typically when the domain being queried matches a security category (e.g., malware, phishing, command-and-control) or a custom block list. This indicates that Umbrella's cloud-delivered security policy actively prevented resolution of those 25 domains, protecting the network from malicious or unwanted content.

Answer

Successful DNS resolution for those queries

Answer

Internal DNS resolution failures

Answer

Network congestion causing queries to timeout

Question 8

A cloud architect is designing a hybrid network between on-premises and AWS. They need to ensure traffic to the internet from the VPC uses the on-premises security stack for inspection. The VPC has an Internet Gateway (IGW). What must be configured to force outbound traffic to the on-premises firewall?

Accepted Answer

Update the VPC route table to point 0.0.0.0/0 to the virtual private gateway or transit gateway attachment. Option C is correct because to force all outbound internet traffic from the VPC through the on-premises firewall, the VPC route table must have a default route (0.0.0.0/0) pointing to the virtual private gateway (VPG) or transit gateway (TGW) attachment. This directs traffic over the VPN or Direct Connect to the on-premises network, where the security stack inspects it before reaching the internet. The Internet Gateway (IGW) remains present but is not used for this traffic because the route table entry overrides it.

Answer

Use VPC Endpoints for all services

Answer

Deploy a NAT Gateway and assign it to the route table

Answer

Configure security groups to block direct internet access

Question 9

A cloud security engineer is evaluating CSPM (Cloud Security Posture Management) solutions. Which TWO capabilities are essential for a CSPM tool? (Select two.)

Accepted Answer

Continuous compliance monitoring with industry standards. Option C is correct because CSPM tools are fundamentally designed to continuously monitor cloud environments against industry standards such as CIS, NIST, and PCI DSS. This ensures that the cloud infrastructure remains compliant with regulatory and security frameworks, which is a core requirement for cloud security posture management.

Answer

Vulnerability scanning of container images

Answer

Incident response automation with playbooks

Answer

Real-time network traffic analysis

Question 10

A security engineer is configuring Cisco Umbrella to block malicious domains. They need to ensure that internal DNS queries from remote users using Cisco AnyConnect are protected. Which deployment method should they use?

Accepted Answer

Install the Umbrella Roaming Client on all endpoints. The Umbrella Roaming Client (now part of Cisco Secure Client) is the correct deployment method because it provides DNS-layer security directly on endpoints, including remote users connecting via AnyConnect. It intercepts DNS queries on the local machine and forwards them to Umbrella's cloud-based DNS resolvers, ensuring protection even when the user is off-network or behind a VPN. This is the only option that covers remote users without relying on network-level appliances or firewalls.

Answer

Configure DNS Layer Security in the office firewall

Answer

Enable Cisco Cloudlock integration

Answer

Deploy the Umbrella virtual appliance at headquarters

Question 11

A cloud security team is investigating a possible data exfiltration incident involving an AWS S3 bucket configured with cross-region replication. Which Cisco Cloudlock feature can detect unusual replication patterns that may indicate data theft?

Accepted Answer

Cloudlock User and Entity Behavior Analytics (UEBA). Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.

Answer

Umbrella threat intelligence

Answer

Stealthwatch Cloud flow logs

Answer

Firepower IPS signatures

Question 12

An organization uses AWS and Azure. They deploy Cisco Secure Workload to enforce microsegmentation. They discover that after deploying agents on EC2 instances, some traffic is misclassified due to overlapping IPs across multiple VPCs. Which configuration change best resolves this?

Accepted Answer

Use Cloud Connector to map instance metadata. C is correct because Cloud Connector in Cisco Secure Workload (formerly Tetration) integrates with AWS and Azure APIs to retrieve instance metadata, such as VPC ID, subnet, and instance ID. This metadata allows Secure Workload to uniquely identify workloads even when they have overlapping IP addresses across different VPCs, enabling accurate traffic classification and policy enforcement.

Answer

Reassign unique labels for each workload

Answer

Enable VRF-like segmentation within Secure Workload

Answer

Configure separate enforcement scopes for each VPC

Question 13

A company uses AWS Organizations with multiple accounts. They need to enforce that all S3 buckets have encryption enabled. Which AWS service can centrally audit and automatically remediate non-compliant buckets?

Accepted Answer

AWS Config conformance packs. AWS Config conformance packs allow you to deploy a collection of AWS Config rules and remediation actions as a single entity. By using a conformance pack that includes the 's3-bucket-server-side-encryption-enabled' managed rule, you can continuously audit all S3 buckets across your AWS Organization for encryption compliance and automatically trigger remediation (e.g., via AWS Systems Manager Automation) to enable encryption on non-compliant buckets.

Answer

Amazon GuardDuty

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 14

An organization is deploying Cisco Cloud Workload Protection (CWP) in AWS. Which THREE of the following components are part of a standard CWP architecture?

Accepted Answer

Workload sensor (agent or agentless). The workload sensor (agent or agentless) is a core component of Cisco Cloud Workload Protection (CWP) because it provides visibility into workload activity, including process execution, network connections, and file integrity. This sensor collects telemetry data from workloads running in AWS and forwards it to the centralized analysis engine for threat detection and policy enforcement.

Answer

Cloud Security Posture Management (CSPM) scanner

Answer

Cisco Umbrella DNS connector

Question 15

An organization is using Microsoft 365 and wants to prevent sensitive data from being shared externally via email and OneDrive. Which Cisco cloud security product should they deploy?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct choice because it is a cloud-native CASB (Cloud Access Security Broker) that integrates with Microsoft 365 to enforce data loss prevention (DLP) policies. It can inspect email attachments and OneDrive files for sensitive data patterns (e.g., credit card numbers, PII) and block external sharing based on policy. Cloudlock uses APIs to scan content at rest and in transit, providing granular control over data residency and sharing permissions.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Answer

Cisco Duo