350-701 Practice Test 31 — 15 Questions

Question 1

A DevOps team is deploying microservices in Azure Kubernetes Service (AKS). They need to enforce inter-container communication policies based on labels. Which Cisco solution provides micro-segmentation for containers in AKS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct solution because it provides micro-segmentation for containers in Azure Kubernetes Service (AKS) by enforcing inter-container communication policies based on labels. It uses a Kubernetes-native approach, integrating with the Kubernetes API to discover pods and services, and applies label-based policies via eBPF or sidecar proxies to control traffic between containers without modifying the application.

Answer

Cisco Firepower

Answer

Cisco ACI

Answer

Cisco ISE

Question 2

An engineer is configuring Cisco Firepower Threat Defense (FTD) in inline NGFW mode. The access control policy must block all traffic from geolocation 'North Korea' and allow all other traffic. Which type of rule should be used and in what order should it be placed?

Accepted Answer

Block rule with source geolocation North Korea, placed at the top of the policy.. In an FTD access control policy, rules are evaluated top-down and the first match wins. To block North Korea while allowing everything else, the block rule must be placed at the top so it is evaluated before any permit rule. Using source geolocation as the match criterion is correct because the traffic originates from North Korea. This ensures the block takes effect and the subsequent allow-all rule handles the rest.

Answer

Intrusion policy with geolocation filter, placed before access control rules.

Answer

Block rule with source geolocation North Korea, placed at the bottom of the policy.

Answer

Permit rule with destination geolocation North Korea, placed at the top.

Question 3

An organization uses Cisco ESA to enforce DLP policies. Which of the following is an example of a DLP policy that can be configured on the ESA?

Accepted Answer

Scanning for credit card numbers in outbound email. DLP (Data Loss Prevention) on Cisco ESA is specifically designed to detect and prevent sensitive data from leaving the organization. Scanning for credit card numbers in outbound email is a classic DLP use case, as it identifies personally identifiable information (PII) or payment card data (PCI) and can take action such as quarantining or encrypting the message. The ESA uses DLP policies that leverage pattern matching and content filters to identify such data. This is a core function of the ESA's DLP feature, which integrates with Cisco's DLP engine or third-party DLP providers.

Answer

Blocking email attachments over 10 MB

Answer

Quarantining messages with malware

Answer

Filtering spam based on SenderBase reputation

Question 4

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan Terraform configuration files for misconfigurations before deployment. Which tool is specifically designed for that purpose?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically built to scan Infrastructure as Code (IaC) files, including Terraform, CloudFormation, Kubernetes manifests, and others, for security and compliance misconfigurations. It parses Terraform HCL and plan files to detect issues like open security groups, unencrypted storage, or overly permissive IAM policies before deployment. Unlike generic SAST or DAST tools, Checkov understands the declarative syntax and resource relationships unique to IaC, making it the right fit for pre-deployment Terraform scanning.

Answer

DAST scanner

Answer

SAST scanner

Answer

Container image scanner

Question 5

A large enterprise uses Cisco WSA with integrated Cisco Advanced Malware Protection (AMP) to inspect web traffic. The security policy dictates that all downloaded files should be scanned by AMP. Recently, a user downloaded a PDF file from a trusted vendor site, but the download was blocked by the WSA. The administrator checks the WSA logs and sees that the file was blocked due to AMP's 'File Reputation' score of 10 (high risk). However, the vendor confirms the file is legitimate. The administrator notes that the file is digitally signed by the vendor. What is the most appropriate next step to allow the file while maintaining security?

Accepted Answer

Add the file's SHA-256 hash to the AMP custom allow list to override the reputation.. Cisco AMP allows administrators to create custom allow lists using file hashes (SHA-256) to override the file reputation score. Since the file is digitally signed and confirmed legitimate, adding its SHA-256 hash to the AMP custom allow list will permit the download while still scanning other files from that domain, preserving security. This approach directly addresses the false positive without broadly reducing security controls.

Answer

Add the vendor's domain to the WSA's global URL whitelist.

Answer

Lower the AMP file reputation threshold from 10 to 7 to allow files with lower risk scores.

Answer

Disable AMP scanning for the vendor's domain in the WSA policy.

Question 6

An organization wants to prevent outbound email containing credit card numbers from leaving the network. Which Cisco ESA feature should be configured?

Accepted Answer

DLP Policies. Cisco ESA's Data Loss Prevention (DLP) policies are designed to inspect outbound email content and attachments for sensitive data patterns such as credit card numbers, Social Security numbers, and other PII, and then block, quarantine, or encrypt messages that match. DLP uses predefined or custom classifiers to detect credit card numbers via regex and checksum validation (Luhn algorithm).

Answer

AMP for Email

Answer

Anti-spam (SenderBase)

Answer

Outbreak Filters

Question 7

An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle (MITM). ARP spoofing — sending forged ARP replies to associate the attacker's MAC address with a legitimate IP (such as the server's) — positions the attacker between the client and server, allowing interception and possibly modification of traffic. This is the classic definition of a man-in-the-middle (MITM) attack, where the attacker transparently relays and captures communications between two parties.

Answer

Reconnaissance

Answer

DNS cache poisoning

Answer

DDoS attack

Question 8

An attacker uses a tool to scan a target network for open ports and running services. Which type of reconnaissance does this represent?

Accepted Answer

Active scanning. Active scanning involves directly interacting with the target network to discover open ports and running services, such as using tools like Nmap. This type of reconnaissance sends packets to the target and analyzes responses, which is exactly what the attacker is doing. It is considered active because it generates traffic that could be detected.

Answer

DNS cache poisoning

Answer

Social engineering

Answer

Passive OSINT

Question 9

Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?

Accepted Answer

Cisco Advanced Malware Protection (AMP). Cisco Advanced Malware Protection (AMP) is Cisco's endpoint and network malware protection product that provides file reputation, file analysis (via AMP Threat Grid), and retrospective security — the ability to look back at file behavior and retroactively alert on files that were previously deemed benign. This matches the question's requirements exactly.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Web Security Appliance (WSA)

Answer

Cisco Email Security Appliance (ESA)

Question 10

Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer security by intercepting DNS queries and blocking requests to malicious or unwanted domains before a connection is established. It is the primary Cisco product for this function.

Answer

AMP for Endpoints

Answer

Firepower NGFW

Answer

Stealthwatch

Question 11

In the shared responsibility model for PaaS, which of the following is the customer responsible for?

Accepted Answer

Applications and data. In the shared responsibility model for PaaS, the customer is responsible for securing their applications and data, while the cloud provider manages the underlying infrastructure, including the operating system, runtime, and physical infrastructure. This is because PaaS provides a platform where the customer deploys their own code and manages data, but the provider handles the platform layers.

Answer

Operating system patching

Answer

Runtime environment

Answer

Physical infrastructure

Question 12

A company is experiencing an increase in spear-phishing attacks targeting executives. Which TWO Cisco ESA features should be configured to mitigate this threat?

Accepted Answer

BEC impersonation protection. IMPERSONATION PROTECTION (BEC) and DMARC verification help detect spoofed executive emails. Outbreak filters and anti-spam may not catch targeted attacks.

Answer

Anti-spam (SenderBase)

Answer

DLP policies

Answer

Outbreak Filters

Question 13

An organization wants to enforce multi-factor authentication for remote VPN access. Cisco AnyConnect is used as the VPN client. Which Cisco product integrates with AnyConnect to provide MFA capabilities such as push notifications and one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo is the correct answer because it is the Cisco product specifically designed to integrate with AnyConnect for multi-factor authentication (MFA). Duo provides push notifications, one-time passwords (OTP), and other MFA methods by acting as an authentication proxy that validates secondary factors via RADIUS or SAML before allowing VPN access.

Answer

Cisco ISE

Answer

Cisco SecureX

Answer

Cisco AMP for Endpoints

Question 14

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

Accepted Answer

Add the NAS, then define identity source, then authentication policy, then authorization policy, then test. First add the NAS, then define identity source, authentication policy, authorization policy, and finally test.

Answer

Define identity source, then add the NAS, then authentication policy, then authorization policy, then test

Answer

Add the NAS, then define identity source, then authorization policy, then authentication policy, then test

Answer

Add the NAS, then authentication policy, then define identity source, then authorization policy, then test

Question 15

A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?

Accepted Answer

Install a Certificate Authority (CA) certificate on the WSA and distribute it to clients. The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.

Answer

Create a bypass list for internal sites

Answer

Configure an Access Control List (ACL) to allow decryption

Answer

Configure user authentication