350-701 Practice Test 3 — 30 Questions

Question 1

A company uses Amazon Web Services (AWS) and wants to integrate with Cisco Defense Orchestrator (CDO) for centralized security management. Which THREE capabilities does CDO provide when managing AWS security services? (Choose three.)

Accepted Answer

Monitor AWS CloudTrail logs for security events.. A is correct because Cisco Defense Orchestrator (CDO) can ingest and monitor AWS CloudTrail logs to detect security events, such as unauthorized API calls or policy violations. This integration allows CDO to correlate cloud-native audit logs with firewall events for centralized visibility and alerting, which is a key capability for cloud security management.

Answer

Manage AWS Identity and Access Management (IAM) roles.

Answer

Provision and configure AWS VPC subnets.

Question 2

During a cloud migration, the security team uses Cisco CloudLock for DLP. They notice that the DLP engine is not scanning certain files in Google Drive shared with external users. The CloudLock admin console shows the connector status as 'connected'. What is the most likely cause?

Accepted Answer

The connector lacks permission to scan external files. Cisco CloudLock requires explicit permissions to scan files shared with external users. Even though the connector status shows 'connected', the default OAuth scopes granted during initial setup may not include access to files shared outside the organization. The DLP engine can only inspect files it has read access to; without the 'drive.readonly' scope extended to externally shared items, those files are invisible to scanning.

Answer

The files are too large (over 100 MB)

Answer

The external sharing is disabled in CloudLock policy

Answer

The files are in Google Drive 'My Drive' not 'Shared Drive'

Question 3

A network engineer is designing a multi-cloud architecture with AWS and Azure. The company needs consistent security policies across both cloud providers and on-premises data centers. Which Cisco solution should the engineer recommend?

Accepted Answer

Cisco Tetration.. Option B is correct because Cisco Tetration provides workload protection and micro-segmentation across multicloud environments. Option A is wrong because Stealthwatch is for network traffic visibility, not policy orchestration. Option C is wrong because Firepower is more focused on on-premises. Option D is wrong because Umbrella is cloud-delivered security but not for workload segmentation.

Answer

Cisco Umbrella SIG.

Answer

Cisco Firepower NGFW.

Answer

Cisco Stealthwatch Enterprise.

Question 4

A company wants to prevent users from downloading executable files (.exe) from the internet via the WSA. Which policy type should be configured?

Accepted Answer

Access policy with file type filtering. C is correct because an Access policy in WSA allows granular control over web traffic, including the ability to block specific file types such as .exe via the 'File Type Filtering' action. This directly prevents users from downloading executable files from the internet, as the WSA inspects the MIME type or file extension in the HTTP response and applies the configured block action.

Answer

URL filtering policy with category blocking

Answer

Data Security policy

Answer

Web Reputation Security policy

Question 5

An organization is migrating from on-premises Cisco ESA to Cisco Cloud Email Security (CES). They need to ensure that email encryption policies remain consistent after migration. What is the best approach to migrate the encryption policies?

Accepted Answer

Export the configuration from on-premises ESA and import into CES. Exporting the configuration from on-premises ESA and importing into CES ensures consistency. Option A is wrong because manual re-creation is error-prone. Option C is wrong because using the API requires custom scripting and may not capture all policies. Option D is wrong because there is no direct synchronization feature between on-premises and cloud ESA.

Answer

Use the Cisco ESA API to migrate policies automatically

Answer

Recreate the policies manually in CES based on existing documentation

Answer

Synchronize the two appliances using Cisco Security Management Suite

Question 6

A network administrator notices that users in the finance department are unable to access a legitimate business web application that uses custom port 8443. The WSA is configured with a decryption policy that decrypts all traffic on port 443. What is the most likely cause of the issue?

Accepted Answer

The decryption policy is not applied to port 8443, so the WSA treats it as non-decrypted traffic which may be blocked by default. The WSA's decryption policy is configured to decrypt traffic only on port 443 (HTTPS). Since the finance department's web application uses custom port 8443, the traffic is not subject to decryption. By default, the WSA may block non-decrypted traffic that matches certain security or access policies, or it may treat it as untrusted, leading to access failure. The most likely cause is that the decryption policy does not cover port 8443, so the WSA applies a default action (often block) to non-decrypted traffic.

Answer

The WSA is configured with a time-based access rule that only allows access during business hours

Answer

The WSA cannot decrypt traffic on port 8443, causing a certificate mismatch

Answer

The web application is blocked by an identity-based access policy

Question 7

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

Accepted Answer

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA. When using explicit proxy, clients must be configured to use the proxy. To prevent bypass, configure the firewall to block outbound HTTP/HTTPS traffic from non-proxy sources, or use transparent proxy with WCCP. Option A is wrong because enabling SSL decryption alone does not force traffic through proxy. Option B is wrong because authenticating users does not prevent bypass. Option D is wrong because creating a deny URL category for tunnels is ineffective.

Answer

Enable SSL decryption on the WSA

Answer

Configure identity-based authentication for all users

Answer

Create a custom URL category for tunneling websites and block them

Question 8

An administrator is troubleshooting an issue where emails sent to a specific external domain are being delayed by up to 30 minutes. The Cisco ESA is configured with multiple mail exchangers (MX) for delivery. The logs show that the ESA is attempting delivery to the primary MX, which is unresponsive, and failing over to the secondary MX after 30 minutes. What change should be made to reduce the delivery delay?

Accepted Answer

Reduce the delivery queue retry interval in the ESA settings. Configuring a shorter timeout or retry interval on the delivery queue will cause the ESA to fail over faster. Option A is wrong because increasing the number of MX records doesn't change the timeout. Option B is wrong because disabling the primary MX is not a good practice. Option D is wrong because enabling ESMTP does not affect timeout.

Answer

Enable SMTP over TLS (ESMTP) for the delivery

Answer

Increase the number of MX records for that domain

Answer

Remove the primary MX record from DNS

Question 9

A company using Cisco Web Security Appliance (WSA) in explicit proxy mode has enabled HTTPS decryption with a custom CA certificate. A user reports that a specific banking website displays a certificate error message. The administrator verifies that the WSA is generating a certificate for that site. What is the most likely cause of the error?

Accepted Answer

The banking website uses HTTP Public Key Pinning (HPKP) or Certificate Pinning.. Banking websites often use dynamic certificates with extended validation (EV) and may implement certificate pinning. However, the WSA's generated certificate will not match the original certificate's public key or subject alternative names if the site uses pinning. Option B is correct because certificate pinning will cause a mismatch. Option A is incorrect because the CA certificate is already trusted. Option C is incorrect because the WSA's certificate is generated on the fly. Option D is possible but less specific to banking sites.

Answer

The WSA's time is not synchronized with the NTP server, causing certificate validity issues.

Answer

The WSA is not configured to generate certificates for that domain.

Answer

The user's browser does not trust the WSA's CA certificate.

Question 10

Which TWO of the following are best practices when configuring Cisco Email Security Appliance (ESA) anti-spam filters? (Choose two.)

Accepted Answer

Adjust threshold levels per sender group to reduce false positives.. Best practices for ESA anti-spam include enabling multiple anti-spam engines for layered detection and configuring threshold levels per group. Option A is correct because using both Cisco Anti-Spam and third-party engines improves detection. Option E is correct because tuning thresholds per sender group reduces false positives. Option B is incorrect because enabling all engines can cause performance issues. Option C is incorrect because blocking without quarantine may cause loss of legitimate mail. Option D is incorrect because reputation lists are the least accurate.

Answer

Rely solely on IP reputation lists for spam detection.

Answer

Set the anti-spam action to 'Delete' for high-scoring messages.

Answer

Enable all available anti-spam engines to ensure maximum detection.

Question 11

A global company uses Cisco Umbrella to enforce security policies across roaming users. Recently, a user reported that they could not access a legitimate business application while connected to a guest Wi-Fi at an airport. The application is categorized as 'Productivity' in Umbrella. Other users outside the office can access it. What is the most likely reason?

Accepted Answer

The user's Umbrella roaming client is unable to authenticate, so the request uses the default policy which blocks the category.. Option D is correct because Umbrella uses identity-based policies; if the roaming security client cannot detect the user identity (e.g., due to no VPN or client failure), the request falls back to the default policy, which might block the category. Option A is wrong because the category is not blocked globally. Option B is wrong because the issue is specific to one user, not location. Option C is wrong because the guest Wi-Fi has no public IP block.

Answer

The application's category is blocked globally in the Umbrella policy.

Answer

The user is in a different geographic location with a stricter policy.

Answer

The guest Wi-Fi's public IP address is on a block list.

Question 12

A company wants to prevent sensitive data such as credit card numbers from being sent via email. Which Cisco ESA feature should be enabled?

Accepted Answer

Data Loss Prevention (DLP). C is correct because Data Loss Prevention (DLP) is the Cisco ESA feature specifically designed to inspect email content and attachments for sensitive data patterns, such as credit card numbers, and enforce policies to prevent their unauthorized transmission. DLP uses predefined or custom dictionaries and message filters to detect and block or quarantine such data, directly addressing the requirement to prevent sensitive data from being sent via email.

Answer

Anti-Spam

Answer

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Answer

Anti-Malware

Question 13

A security analyst notices that a Cisco Firepower Threat Defense (FTD) device is not applying file policies to detect malware in HTTP traffic. The access control policy has an HTTPS decryption rule that decrypts traffic from external sources. The file policy is associated with the same rule. What is the missing configuration?

Accepted Answer

The HTTP inspection is not enabled in the access control policy's advanced settings.. File policies in Firepower are applied based on network analysis and file inspection. For HTTP traffic, the FTD must have the appropriate inspection engine enabled. Option C is correct because the HTTP inspection profile must be configured to inspect traffic and apply file policies. Option A is not directly related. Option B is incorrect because decryption is already in place. Option D is unnecessary as file policies work independently of URL filtering.

Answer

The file policy is set to 'Detect' but not 'Block' for malware.

Answer

SSL decryption is not configured for the internal network.

Answer

The URL category is not defined in the file policy.

Question 14

A Cisco WSA receives intermittent complaints that legitimate websites are being blocked. The access policy uses reputation scoring and URL filtering. The administrator checks the logs and finds that the blocked requests have a web reputation score of -2.0. What action should be taken to allow these legitimate sites while still blocking malicious ones?

Accepted Answer

Create a custom URL category for the legitimate sites and apply an allow action above the reputation policy.. Option A is correct because creating a custom URL category for the legitimate sites and placing an allow action above the reputation policy ensures that traffic matching that category bypasses the reputation scoring check. This allows the legitimate sites while the reputation policy continues to block malicious sites with scores below the threshold. In Cisco WSA, access policies are evaluated in order, so a higher-priority allow rule for trusted URLs overrides the lower-priority reputation-based block.

Answer

Lower the reputation threshold to -1.0.

Answer

Set the reputation action to 'Monitor' for suspicious scores.

Answer

Disable web reputation filtering for that policy.

Question 15

A network administrator is troubleshooting why users in the marketing department cannot access a specific cloud storage site through the Cisco WSA. The access policy for marketing is set to 'Monitor' for the File Sharing category, but the site is blocked. What is the most likely reason?

Accepted Answer

A more specific identity or policy is applying a block action.. The correct answer is C because Cisco WSA applies policies in a hierarchical order, and a more specific identity or policy (e.g., one based on user group, subnet, or time range) can override a broader policy set to 'Monitor'. Even though the marketing department's access policy is configured to monitor the File Sharing category, a more granular rule may explicitly block the cloud storage site, causing the unexpected block.

Answer

Web reputation threshold is set to block the site.

Answer

The site is mis-categorized as an unknown URL.

Answer

URL filtering is disabled for that policy.

Question 16

A small business uses Cisco Umbrella to protect its 50 employees. One employee reports that they cannot access a specific website (www.example.com) that is required for their work. The administrator checks the Umbrella dashboard and sees that the domain is categorized as 'Social Networking' and is blocked by the company's policy. However, the employee argues that the website is actually a business tool. The administrator verifies that the website is indeed legitimate. What is the best course of action to restore access while maintaining security?

Accepted Answer

Create a policy override to allow the specific domain while keeping the category blocked.. Option C is correct because Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

Answer

Contact Cisco Umbrella support to re-categorize the domain.

Answer

Disable the 'Social Networking' category blocking policy.

Answer

Remove the user from the Umbrella policy entirely.

Question 17

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Option D is correct because starting with 'Audit' mode allows observation without disruption. Option A is wrong because blocking all unknown files may cause false positives. Option B is wrong because disabling the firewall weakens security. Option C is wrong because disabling file analysis reduces detection capability.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 18

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. Option C is correct because the AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 19

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. Option D is correct because adding a file hash to the custom detection list as an exception prevents future alerts. Option A is wrong because disabling detection for that file type is too broad. Option B is wrong because changing policy to 'Audit' reduces protection. Option C is wrong because only the cloud can update dispositions, but custom exceptions are used for false positives.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.

Question 20

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

Accepted Answer

Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.. Option A is correct because the AMP connector must be registered with the AMP cloud, and the FMC must be configured to pull events via API. Option B is wrong because the firewall does not need to be the default gateway. Option C is wrong because Syslog is not the primary method; API integration is used. Option D is wrong because the AMP cloud account is already used; the issue is registration.

Answer

Configure the AMP connectors to send Syslog events to the FMC.

Answer

Deploy an on-premises AMP console to forward events to FMC.

Answer

Configure the Firepower NGFW to be the default gateway for the endpoints.