350-701 Practice Test 29 — 15 Questions

Question 1

Which component of Cisco AMP for Endpoints is responsible for preventing the execution of known malware by checking files against a continuously updated cloud database before they run?

Accepted Answer

File Reputation. File Reputation is the correct answer because it is the Cisco AMP for Endpoints component that queries a continuously updated cloud database (the AMP Threat Grid) to check the reputation of a file before it executes. If the file is known malware, execution is blocked immediately, preventing the threat from running. This pre-execution check relies on the file's SHA-256 hash and cloud-based reputation scoring.

Answer

Exploit Prevention

Answer

Application Control

Answer

Orbital

Question 2

A Cisco WSA receives intermittent complaints that legitimate websites are being blocked. The access policy uses reputation scoring and URL filtering. The administrator checks the logs and finds that the blocked requests have a web reputation score of -2.0. What action should be taken to allow these legitimate sites while still blocking malicious ones?

Accepted Answer

Create a custom URL category for the legitimate sites and apply an allow action above the reputation policy.. Creating a custom URL category for the legitimate sites and placing an allow action above the reputation policy ensures that traffic matching that category bypasses the reputation scoring check. This allows the legitimate sites while the reputation policy continues to block malicious sites with scores below the threshold. In Cisco WSA, access policies are evaluated in order, so a higher-priority allow rule for trusted URLs overrides the lower-priority reputation-based block.

Answer

Lower the reputation threshold to -1.0.

Answer

Set the reputation action to 'Monitor' for suspicious scores.

Answer

Disable web reputation filtering for that policy.

Question 3

An organization using Cisco Firepower NGFW wants to block all social media traffic while allowing other web traffic. Which feature should be configured?

Accepted Answer

URL filtering. URL filtering on Cisco Firepower NGFW uses category-based reputation and URL lists to allow or block web destinations. Social media sites are grouped into a predefined category (e.g., 'Social Networking'), so a URL filtering policy that blocks that category while allowing all others achieves the requirement without touching other traffic.

Answer

Intrusion prevention

Answer

TLS server identity discovery

Answer

Application control

Question 4

An organization uses AWS with a VPC and wants to inspect all traffic between instances in the same subnet using Cisco Firepower. What must be implemented?

Accepted Answer

AWS Traffic Mirroring to send traffic to a Firepower appliance. AWS Traffic Mirroring captures and forwards network traffic from Elastic Network Interfaces (ENIs) to a security appliance, such as a Cisco Firepower instance, for inspection. This allows the organization to monitor all traffic between instances within the same subnet without requiring changes to the routing table or placing the Firepower inline, which is not possible in a VPC without a gateway appliance. Option B is correct because Traffic Mirroring is the native AWS feature designed for out-of-band traffic inspection.

Answer

Configure VPC Endpoints to route traffic through Firepower

Answer

Use AWS Security Groups and log to Firepower

Answer

Deploy Firepower as a transparent bridge in the subnet

Question 5

In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?

Accepted Answer

Intermediate CA. In a PKI hierarchy, the intermediate CA (also called a subordinate CA) is the component that issues and revokes end-entity certificates and is directly subordinate to the root CA. This design keeps the root CA offline and protects its private key, while the intermediate CA handles day-to-day issuance. The root CA only signs the intermediate's certificate, forming a chain of trust.

Answer

Registration Authority (RA)

Answer

Root CA

Answer

Certificate Revocation List (CRL)

Question 6

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. In Cisco ISE, a posture policy defines the compliance conditions an endpoint must satisfy (e.g., antivirus running, OS patches applied) before being granted full access. It is evaluated after authentication and profiling, and its result feeds into the authorization policy that assigns the appropriate authorization profile (full access vs. restricted/quarantine).

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 7

A security engineer is configuring a Cisco Firepower NGFW to detect a buffer overflow attack. Which attack vector is this?

Accepted Answer

Exploitation. Buffer overflow is an exploitation technique where an attacker writes beyond the allocated buffer to execute arbitrary code.

Answer

Malware delivery

Answer

Reconnaissance

Answer

Denial of Service

Question 8

Which TWO of the following are common security objectives of the Cisco TrustSec solution? (Choose two.)

Accepted Answer

Microsegmentation of network traffic. Cisco TrustSec uses Security Group Tags (SGTs) to enforce microsegmentation by classifying traffic based on user, device, or role rather than IP addresses. This allows granular policy enforcement at the access layer, reducing lateral movement within the network. Microsegmentation is a core security objective of TrustSec, enabling dynamic, identity-based access control.

Answer

VPN termination for remote users

Answer

End-to-end data encryption

Answer

Network topology discovery

Question 9

Which THREE are characteristics of Cisco Stealthwatch?

Accepted Answer

Can integrate with Cisco ISE for automated threat response. Option A is correct because Stealthwatch integrates with Cisco ISE (Identity Services Engine) via pxGrid to enable automated threat response, such as quarantining or blocking suspicious endpoints based on detected anomalies. Option B is correct because Stealthwatch's core capability is behavioral analysis — it baselines normal network behavior and uses machine learning/analytics to detect anomalies and threats like data exfiltration, lateral movement, or malware. Option D is correct because Stealthwatch collects and analyzes flow telemetry using NetFlow, IPFIX, and other flow protocols to provide network-wide traffic visibility without requiring full packet capture. Option C is incorrect because Stealthwatch is a network visibility and security analytics platform, not a next-generation firewall (that role belongs to Cisco Firepower NGFW). Option E is incorrect because Stealthwatch detects and alerts on threats but does not function as an inline intrusion prevention system (IPS) that blocks traffic; that is the role of Cisco Firepower IPS.

Answer

Acts as a next-generation firewall

Answer

Functions as an intrusion prevention system (IPS)

Question 10

A network administrator wants to deploy Cisco AMP for Endpoints to protect endpoints. Which feature allows the detection of a file that was initially deemed benign but later discovered to be malicious?

Accepted Answer

Retrospective Security. Retrospective security in Cisco AMP for Endpoints continuously monitors file behavior and can re-evaluate files that were previously allowed, updating their disposition if malicious activity is detected later.

Answer

File Reputation

Answer

IOC Scanning

Answer

Exploit Prevention

Question 11

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Accepted Answer

Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.. Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Answer

Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.

Answer

Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.

Answer

Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.

Question 12

A company wants to use Cisco Umbrella to block access to malicious domains. They have deployed the Umbrella roaming client on all endpoints. However, traffic from a specific application is still reaching a known malicious domain. What is the most likely reason?

Accepted Answer

The application uses a hardcoded IP address or non-DNS protocol.. Cisco Umbrella operates at the DNS layer, meaning it can only block domains that are resolved via DNS queries. If an application uses a hardcoded IP address or communicates using a non-DNS protocol (e.g., direct IP connections or protocols like HTTP/HTTPS without DNS resolution), the traffic bypasses Umbrella's DNS-based enforcement entirely. This is why the malicious domain is still reachable despite the roaming client being deployed.

Answer

The Umbrella policy is configured to allow that specific application.

Answer

The domain is not categorized as malicious in Umbrella's database.

Answer

The Umbrella roaming client is not installed on the server.

Question 13

Refer to the exhibit. An administrator sees that the file invoice_2024.exe was blocked by both Cisco AMP and ESA. However, a user claims the attachment was delivered. What is the most likely cause?

Accepted Answer

The ESA was configured to 'Deliver then alert' for malware detected by AMP.. When Cisco ESA is configured with 'Deliver then alert' for malware detected by AMP, the email is delivered to the user before the AMP file reputation analysis completes. The ESA sends the file to AMP for analysis, but if the policy is set to deliver first and alert later, the user receives the attachment even if AMP later determines it is malicious. This explains why the administrator sees the block in both AMP and ESA logs, yet the user claims delivery.

Answer

The ESA was not configured to use AMP for file reputation.

Answer

The AMP file reputation check was not performed due to an ACL misconfiguration.

Answer

The file was whitelisted in the AMP policy.

Question 14

A small business uses Cisco Duo for multi-factor authentication. They want to ensure that employees accessing cloud apps from personal devices are compliant with device security policies. Which Duo feature should they use?

Accepted Answer

Duo Device Health. Duo Device Health is the Duo feature that collects endpoint posture signals (OS version, patch level, disk encryption, firewall/AV status, screen lock, etc.) from managed and unmanaged devices and feeds them into Duo policies. It allows administrators to write policies that block or allow access to cloud apps based on whether the device meets defined security requirements. This directly addresses the requirement to enforce device security compliance for employees using personal devices.

Answer

Duo Mobile

Answer

Duo Network Gateway

Answer

Duo Access Gateway

Question 15

A company uses Cisco Firepower Management Center (FMC) to manage multiple FTD devices. They want to create an access control policy that allows traffic from a specific user group (Active Directory) to access a web server on the internet, but blocks all other traffic from that group to the internet. Which identity source should be configured in FMC?

Accepted Answer

Active Directory realm. FMC identity policies can enforce user-based access control by integrating with an Active Directory realm, which uses AD as the identity source and supports user/group-based rules. Configuring an AD realm lets FMC retrieve user-to-group mappings and apply access control policy rules that allow the specified user group to reach the web server while blocking other traffic. This is the native identity integration for AD-based user group enforcement in Firepower.

Answer

LDAP

Answer

Local user database

Answer

RADIUS