350-701 Practice Test 30 — 15 Questions

Question 1

Drag and drop the steps to recover a lost password on a Cisco IOS router in the correct order.

Accepted Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Restore config register to 0x2102, Step 8: Reload the router. Enter ROMmon, change register to skip startup-config, boot, copy config, change password, save, and restore register.

Answer

Step 1: Enter ROMmon, Step 2: Boot the router, Step 3: Change config register to 0x2142, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Restore config register to 0x2102, Step 8: Reload the router

Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Restore config register to 0x2102, Step 7: Reload the router

Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Reload the router

Question 2

A company uses Cisco Umbrella for cloud-delivered security. Users report that some websites are incorrectly blocked. The security team wants to allow a specific website temporarily while investigating. Which action should the administrator take?

Accepted Answer

Create a custom policy rule to allow the specific domain.. The correct action is to create a custom policy rule to allow the specific domain. Cisco Umbrella uses policy-based rules to control DNS and web traffic; a custom allow rule overrides the default block for that domain without affecting other security settings. This provides a temporary, targeted exception while the investigation continues.

Answer

Disable the Umbrella policy entirely.

Answer

Configure a Proxy Auto-Config (PAC) file to exclude the domain.

Answer

Change the internal DNS servers to use a public resolver like 8.8.8.8.

Question 3

Which deployment mode allows a Cisco Firepower NGFW to inspect traffic without being in the direct forwarding path?

Accepted Answer

Passive. Passive deployment mode (also called monitor-only or TAP mode) allows a Cisco Firepower NGFW to receive a copy of traffic from a SPAN port or network TAP and analyze it without sitting inline in the forwarding path. Because the sensor is not inline, it cannot drop or block traffic — it can only detect, log, and alert. This is why passive mode is used for intrusion detection (IDS) rather than intrusion prevention (IPS).

Answer

Transparent

Answer

Routed

Answer

Inline

Question 4

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

Accepted Answer

Integrate image scanning into the CI/CD pipeline before pushing to registry. Integrating image scanning into the CI/CD pipeline before pushing to the registry is a DevSecOps best practice: vulnerabilities are caught early, before deployment, and the pipeline can fail the build if critical issues are found. This shifts security left and prevents vulnerable images from reaching production.

Answer

Scan container images after deployment using a runtime scanner

Answer

Manually review images before deployment

Answer

Only scan base images, not application layers

Question 5

A company is deploying Cisco ESA and wants to protect against malware delivered via email attachments. Which TWO features can be used together to provide both signature-based detection and behavioral analysis?

Accepted Answer

SHA-256 cloud lookup. AMP for Email uses SHA-256 cloud lookup for known malware and file sandboxing for unknown files to detect malicious behavior.

Answer

Outbreak filters

Answer

DLP policies

Answer

Anti-spam with SenderBase

Question 6

A network administrator wants to deploy Cisco WSA as a transparent proxy to inspect web traffic without changing browser settings. Which protocol should be used to redirect traffic to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) is a Cisco protocol that enables transparent redirection of web traffic to a WSA without changing browser settings. The router or switch configured with WCCP intercepts traffic and redirects it to the WSA for inspection.

Answer

PAC files

Answer

WPAD

Answer

GRE tunneling

Question 7

An engineer configures a Cisco FTD in a high-availability pair with active/standby failover. The primary unit fails, and the standby takes over. After the primary recovers, what must be done to ensure it resumes as active?

Accepted Answer

Execute 'failover active' on the primary unit.. In Cisco FTD active/standby failover, when the primary unit recovers it rejoins as standby by default; it does not automatically preempt. To make it active again, an administrator must manually run 'failover active' on the primary (or 'failover standby' on the current active). This is by design to avoid unnecessary failover flapping.

Answer

No action is needed; the primary automatically resumes active role.

Answer

Reboot the secondary unit.

Answer

Disable and re-enable failover.

Question 8

A security administrator is investigating an alert from an IPS that detected a SQL injection attempt. The alert was triggered by a signature that looks for specific patterns in the traffic. What type of detection method is this?

Accepted Answer

Signature-based detection. The alert was triggered by a signature that looks for specific patterns in traffic, which is the definition of signature-based detection. SQL injection signatures match known attack strings or regex patterns (e.g., 'UNION SELECT', 'OR 1=1'). This is a static pattern match against known indicators, not behavioral or statistical analysis.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 9

Refer to the exhibit. Enter the command output from a Cisco Umbrella deployment. An administrator observes that 25 DNS queries were blocked. What does this indicate?

Accepted Answer

Policy enforcement blocking malicious or unwanted domains. The command output from a Cisco Umbrella deployment shows that 25 DNS queries were blocked. In Umbrella, DNS queries are blocked due to policy enforcement, typically when the domain being queried matches a security category (e.g., malware, phishing, command-and-control) or a custom block list. This indicates that Umbrella's cloud-delivered security policy actively prevented resolution of those 25 domains, protecting the network from malicious or unwanted content.

Answer

Successful DNS resolution for those queries

Answer

Internal DNS resolution failures

Answer

Network congestion causing queries to timeout

Question 10

A network administrator is configuring site-to-site VPN between two Cisco ASA firewalls using IKEv2. The administrator wants to ensure that the VPN tunnel uses the most secure encryption algorithm available. Which encryption algorithm should be selected in the IKEv2 proposal?

Accepted Answer

AES-256. AES-256 is the most secure encryption algorithm among the options because it uses a 256-bit key, providing a significantly larger key space than AES-128 (128-bit), DES (56-bit), and 3DES (effectively 112-bit). In IKEv2 proposals, the encryption algorithm (e.g., AES-CBC-256) is specified to protect the IKEv2 control plane and IPsec data plane. While AES-128 is still considered secure, AES-256 offers a higher security margin against brute-force attacks, aligning with the administrator's goal of using the most secure algorithm available.

Answer

AES-128

Answer

DES

Answer

3DES

Question 11

A network engineer is configuring a site-to-site VPN between two Cisco ASAs using IKEv2. Which component defines the encryption and hash algorithms for Phase 2?

Accepted Answer

Transform set. In IKEv2 on Cisco ASA, the transform set defines the Phase 2 (IPsec SA) encryption and hash algorithms, along with the encapsulation mode (tunnel/transport) and optional PFS settings. The IKEv2 proposal handles Phase 1 (IKE SA) parameters such as encryption, integrity, PRF, and DH group. The transform set is referenced by the crypto map or IPsec profile that binds the VPN policy together.

Answer

IKEv2 proposal

Answer

Crypto map

Answer

ISAKMP policy

Question 12

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Accepted Answer

RADIUS. Options C and D are correct because RADIUS and LDAP are both standard authentication methods supported by Cisco AnyConnect and its associated AAA infrastructure: RADIUS (C) is a widely used AAA protocol for authenticating VPN users via servers like Cisco ISE or ACS, and LDAP (D) is commonly used to authenticate AnyConnect users against directory services such as Microsoft Active Directory. TACACS+ (A) is primarily used for device administration (router/switch command authorization), not for authenticating VPN end users in an AnyConnect deployment. OSPF (B) is a routing protocol and has no role in user authentication, and SNMP (E) is a network management protocol used for monitoring and configuration, not authentication.

Answer

TACACS+

Answer

OSPF

Answer

SNMP

Question 13

An engineer is configuring a Cisco ASA to support a DMZ segment. Which three of the following are best practices for DMZ design? (Choose three.)

Accepted Answer

Place public-facing servers in the DMZ.. Option A is correct because public-facing servers such as web, mail, and DNS hosts should be placed in the DMZ so that if they are compromised, the attacker is not already inside the protected internal network. Option B is correct because traffic initiated from the DMZ toward the inside network must be restricted or denied, since the DMZ is a lower-trust zone and should not be able to reach internal resources unless explicitly required. Option D is correct because strict ACLs between the outside and DMZ limit which external traffic can reach DMZ hosts, reducing the attack surface and enforcing least-privilege access. Option C is not a best practice because a DMZ interface is typically assigned a security level between the outside (0) and inside (100), commonly 50, so that it is distinct from the untrusted outside zone. Option E is incorrect because the DMZ must use a separate subnet from the inside network to maintain segmentation and prevent direct Layer 2/Layer 3 access between zones.

Answer

Assign the DMZ interface a security level of 0.

Answer

Use the same subnet for DMZ and inside networks.

Question 14

In the shared responsibility model for PaaS, which of the following is typically the customer's responsibility?

Accepted Answer

Securing the application code and data. In the PaaS shared responsibility model, the customer is responsible for securing their application code and data, while the provider manages the underlying infrastructure, OS, and hypervisor. This division means the customer must handle application-level security, including code vulnerabilities, data encryption, and access controls.

Answer

Securing the hypervisor

Answer

Patching the underlying operating system

Answer

Managing network firewall rules

Question 15

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Answer

show crypto engine statistics

Answer

debug crypto isakmp

Answer

show crypto isakmp sa