350-701 Practice Test 2 — 30 Questions

Question 1

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 2

An organization wants to enforce multi-factor authentication (MFA) for VPN access using Cisco AnyConnect. Which Cisco product integrates with AnyConnect to provide MFA via push notifications or one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Answer

Cisco SecureX

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 3

Refer to the exhibit. What is the effect of this NAT rule on the Cisco FTD device deployed in the cloud?

Accepted Answer

Performs identity NAT between the two networks without port translation. The NAT rule shown in the exhibit is a static identity NAT (also known as NAT exempt or no-translation NAT) that translates the source IP address of traffic from the 192.168.1.0/24 network to the same IP address when going to the 10.0.0.0/24 network. This is achieved by specifying the source address as both the original and translated address, effectively bypassing any address translation while still being processed by the NAT engine. Since no port translation is configured, it performs identity NAT without PAT, which is why option A is correct.

Answer

Translates source IP when traffic goes from outside to inside

Answer

Enables Port Address Translation (PAT)

Answer

Translates destination IP from 192.168.1.0 to a public IP

Question 4

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Accepted Answer

Allow. In Firepower access control policy, the actions are Trust (skip further inspection), Allow (permit and inspect), Block (block traffic), and Interactive Block (present a block page). These are standard actions.

Answer

Log

Answer

Reset

Answer

Redirect

Question 5

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Cisco ISE's profiler service uses the MAC OUI (Organizationally Unique Identifier) to identify the hardware vendor, and DHCP fingerprints (specific option ordering in DHCP requests) to determine the exact operating system or device type. This passive profiling technique allows ISE to classify endpoints without requiring any agent installation.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 6

An engineer is configuring Cisco Secure Endpoint (AMP) connectors. Which deployment is supported for the macOS platform?

Accepted Answer

macOS. Cisco Secure Endpoint connectors are available for Windows, Mac, Linux, Android, and iOS. macOS is supported.

Answer

Android

Answer

Linux

Answer

iOS

Question 7

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Accepted Answer

NetFlow Probe. Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Answer

Syslog

Answer

RADIUS Accounting

Answer

SNMP Polling

Question 8

An endpoint with MAC 0011.2233.4455 and user 'guest' authenticates but fails. However, the device is not assigned to quarantine. Which policy condition is most likely responsible for the unexpected behavior?

Accepted Answer

The device is compliant and the device type is in the allowed list. The condition requires either 'EndPointCompliant EQUALS No' OR device type not in the list. If the device is compliant (posture passed) and the device type is in the list, the condition is false, so the quarantine rule is not applied, and a default permit rule might apply instead. Option A is incorrect because authentication failure would show 'Failed' and not reach authorization. Option B is incorrect because MAB is not in use here. Option D is incorrect because if the device were in quarantine, it would have been assigned.

Answer

The authentication failure overrides authorization

Answer

The quarantine VLAN is not configured on the switch

Answer

The device is authenticated via MAB, bypassing posture

Question 9

Match each security technology to its primary function.

Accepted Answer

Firewall: Filters traffic based on stateful inspection and access control lists.. Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Answer

Firewall: Monitors network traffic for malicious activity and can block or alert.

Answer

VPN: Enforces endpoint compliance and access policies.

Question 10

An administrator is configuring Cisco ISE to profile endpoints. The administrator wants to ensure that endpoints are correctly identified based on MAC address and hostname. Which of the following is a prerequisite for successful profiling?

Accepted Answer

The network devices must have profiling enabled and be configured with SNMP.. C is correct because Cisco ISE uses SNMP to query network devices (switches, wireless LAN controllers) for endpoint attributes such as MAC addresses and hostnames. Profiling must be enabled on the network devices, and SNMP (typically v2c or v3) must be configured so that ISE can collect the necessary data via MIBs like BRIDGE-MIB or ENTITY-MIB to correlate MAC-to-port mappings and hostname information.

Answer

The DHCP server must be configured with option 82.

Answer

The endpoints must have the ISE agent installed.

Answer

The switch must be configured with SNMP v3.

Question 11

An organization wants to deploy AMP for Endpoints in an offline environment where endpoints cannot connect to the internet. Which deployment option is appropriate?

Accepted Answer

Install a Cisco AMP Private Cloud appliance within the local network and point connectors to it.. Cisco AMP for Endpoints offers a Private Cloud appliance that can be deployed on-premises in an offline environment. This appliance replicates all cloud-based threat intelligence and analysis locally, allowing endpoints to communicate with it via the AMP connector without requiring internet access. The Private Cloud appliance handles all file disposition, retrospective alerts, and policy updates within the local network.

Answer

Deploy the AMP connectors with a local proxy caching all AMP communications.

Answer

Configure the AMP connectors in 'Standalone' mode to operate without cloud communication.

Answer

Use Cisco ESA as an intermediary to proxy AMP requests from endpoints.

Question 12

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to send updates to the network device to change VLAN, ACL, or other attributes without requiring the endpoint to re-authenticate.

Answer

MAB

Answer

Profiling

Answer

TrustSec

Question 13

A Cisco FTD device is deployed in inline mode and configured with an SSL policy to decrypt traffic. The policy uses 'Decrypt - Known Key' for traffic to an internal server. What is required for this decryption to work?

Accepted Answer

The FTD must have the server's private key imported.. 'Decrypt - Known Key' requires the server's private key to be imported into the FTD so it can decrypt the traffic by impersonating the server.

Answer

The FTD must generate a new certificate for each session.

Answer

The server's certificate must be signed by a public CA.

Answer

The client must trust the FTD's CA certificate.

Question 14

An organization wants to deploy endpoint hardening by allowing only approved applications to run. Which technology should be implemented to achieve this?

Accepted Answer

Application whitelisting. Application whitelisting is the correct technology because it enforces endpoint hardening by explicitly allowing only approved applications to execute, blocking all others by default. This is a fundamental principle of least privilege and is often implemented using tools like Windows AppLocker or Cisco AMP's application control, which maintain a hash-based or path-based allow list.

Answer

EDR

Answer

Host-based IPS

Answer

Antivirus software

Question 15

Drag and drop the steps to troubleshoot an IPsec VPN failure where Phase 1 is not completing into the correct order.

Accepted Answer

1. Check IP reachability between peers. 2. Verify UDP port 500 is open. 3. Compare IKE proposals. 4. Verify pre-shared keys. 5. Use debug commands.. Start with reachability, then check UDP 500, compare IKE proposals, verify pre-shared keys, and finally use debug for detailed errors.

Answer

1. Verify pre-shared keys. 2. Check IP reachability. 3. Compare IKE proposals. 4. Verify UDP port 500 is open. 5. Use debug commands.

Answer

1. Use debug commands immediately. 2. Verify UDP port 500 is open. 3. Check IP reachability. 4. Compare IKE proposals. 5. Verify pre-shared keys.

Answer

1. Check IP reachability. 2. Compare IKE proposals. 3. Verify UDP port 500 is open. 4. Use debug commands. 5. Verify pre-shared keys.

Question 16

Match each Cisco security solution to its primary use case.

Accepted Answer

Cisco ASA: Provides stateful firewall and VPN capabilities.. Cisco ASA is a firewall/VPN solution, Firepower is NGFW/IPS, and ISE handles network access control. Common confusions involve mixing ASA with ISE or Firepower with Umbrella.

Answer

Cisco ASA: Enforces network access control and policy.

Answer

Cisco Firepower: Provides DNS-layer security for internet traffic.

Question 17

An organization wants to deploy endpoint hardening measures. Which three of the following are considered endpoint hardening techniques? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting, host-based IPS, and EDR capabilities are all endpoint hardening techniques that protect endpoints by controlling what runs, detecting threats, and enabling response.

Answer

RADIUS authentication

Answer

SNMP polling

Question 18

An enterprise wants to prevent data exfiltration from its SaaS applications to unauthorized personal cloud storage. Which Cisco solution should be deployed?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct solution because it is a cloud-native CASB (Cloud Access Security Broker) specifically designed to protect SaaS applications like Office 365 and Salesforce. It provides data loss prevention (DLP) policies that can detect and block the exfiltration of sensitive data to unauthorized personal cloud storage services by inspecting API traffic and user activities in real time.

Answer

Cisco Umbrella

Answer

Cisco Duo

Answer

Cisco Firepower NGFW

Question 19

A network administrator needs to provide network access to a legacy printer that does not support 802.1X. Which Cisco ISE feature should be used to authenticate this device?

Accepted Answer

MAC Authentication Bypass. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicant software to authenticate based on their MAC address. ISE can be configured to accept the MAC address as the credential.

Answer

Posture assessment

Answer

Guest access with self-registration

Answer

Profiling using DHCP probe

Question 20

A company uses Cisco Umbrella to provide DNS-layer security. An employee tries to visit a website that is hosting malware, but the domain is not yet categorized. How does Umbrella handle this request?

Accepted Answer

The request is blocked if the domain is identified as malicious by Umbrella's threat intelligence. Umbrella's DNS-layer security can block domains based on intelligence feeds, including newly observed malicious domains. It does not need categorization; it uses real-time threat intelligence. The intelligent proxy is separate.

Answer

The request is redirected to a captive portal for user awareness

Answer

The request is allowed because the domain is not categorized

Answer

The request is proxied through the intelligent proxy for inspection