350-701 Practice Test 31 — 15 Questions

Question 1

Drag and drop the steps to configure 802.1X port-based authentication on a Cisco switch in the correct order.

Accepted Answer

Configure AAA and RADIUS, then configure authentication list, then enable 802.1X globally, then enable 802.1X on the interface.. AAA and RADIUS must be configured first, then the authentication list, global 802.1X enable, and finally interface-level enable.

Answer

Configure AAA and RADIUS, then enable 802.1X globally, then configure authentication list, then enable 802.1X on the interface.

Answer

Configure authentication list, then configure AAA and RADIUS, then enable 802.1X globally, then enable 802.1X on the interface.

Answer

Configure AAA and RADIUS, then enable 802.1X globally, then enable 802.1X on the interface, then configure authentication list.

Question 2

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Configuring custom whitelist exclusions for trusted applications prevents Cisco AMP for Endpoints from flagging legitimate software as malicious, which directly reduces false positives. This is done by adding file hashes, paths, or certificate signers to the exclusion list, ensuring that known safe executables are not subjected to further analysis or blocked.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 3

A Cisco ASA has three interfaces: inside (100), outside (0), and DMZ (50). A static NAT rule is configured to map the DMZ server 10.1.1.10 to outside address 200.1.1.10. An ACL on the outside interface permits traffic to 200.1.1.10. A host on the internet sends a packet to 200.1.1.10. What happens when the packet hits the outside interface?

Accepted Answer

The packet is forwarded to the DMZ server after NAT translation.. The ASA translates the destination address to the DMZ IP using the static NAT rule, then routes the packet to the DMZ interface. Security levels do not block because NAT is performed before routing.

Answer

The packet is dropped because no ACL exists for the DMZ interface.

Answer

The packet is forwarded only if an ACL on the DMZ interface permits it.

Answer

The packet is dropped because the outside security level is lower than DMZ.

Question 4

Which TWO Cisco solutions provide virtual firewall capabilities in public cloud environments? (Choose two.)

Accepted Answer

Cisco ASAv. Cisco ASAv (Adaptive Security Virtual Appliance) is a virtualized version of the Cisco ASA firewall that can be deployed in public cloud environments such as AWS, Azure, and GCP. It provides stateful firewall, VPN, and threat defense capabilities natively within the cloud infrastructure. Option A is correct because ASAv is explicitly designed for virtual firewall functions in public clouds.

Answer

Cisco DNA Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 5

To enforce zero trust principles in a cloud environment, an administrator requires all access to cloud resources to be authenticated and authorized based on user identity and device health. Which Cisco Duo feature enables policies that consider conditions such as location, device compliance, and risk level?

Accepted Answer

Duo Access Policies. Cisco Duo Access Policies allow administrators to create policies that enforce access controls based on conditions like user location, device compliance, and sign-in risk.

Answer

Duo Multi-Factor Authentication (MFA)

Answer

Duo Device Health

Answer

Duo Privileged Access Management

Question 6

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

Accepted Answer

Exclude addresses, then Create the DHCP pool, then Specify the network and subnet mask, then Set the default-router and dns-server options.. First create pool, define network, then set options like default-router and dns-server, and exclude addresses before or after.

Answer

Create the DHCP pool, then Exclude addresses, then Set the default-router and dns-server options, then Specify the network and subnet mask.

Answer

Specify the network and subnet mask, then Create the DHCP pool, then Exclude addresses, then Set the default-router and dns-server options.

Answer

Set the default-router and dns-server options, then Specify the network and subnet mask, then Create the DHCP pool, then Exclude addresses.

Question 7

Which TWO of the following are capabilities of Cisco Orbital?

Accepted Answer

Running live queries across all endpoints. Cisco Orbital is a cloud-based endpoint query and response tool that uses the osquery framework to allow security teams to run live SQL-like queries across all endpoints in real time. It also supports scheduled forensic data collection tasks, enabling continuous monitoring and historical analysis of endpoint state without requiring persistent agents or heavy infrastructure.

Answer

Real-time file reputation checking

Answer

Pre-execution sandboxing of unknown files

Answer

Automated endpoint isolation via ISE

Question 8

A multinational corporation is migrating its on-premises data center to a public cloud provider. The security policy requires that all traffic between cloud VPCs and the on-premises network must be inspected by a next-generation firewall (NGFW) deployed in the cloud. The on-premises network uses BGP for dynamic routing. Which design meets the requirement while minimizing latency and administrative overhead?

Accepted Answer

Deploy a transit VPC with an NGFW instance and configure BGP dynamic routing between the transit VPC, other VPCs, and the on-premises network.. A transit VPC with an NGFW instance allows centralized traffic inspection while using BGP dynamic routing to exchange routes between the transit VPC, other VPCs, and the on-premises network. This design minimizes administrative overhead by avoiding static route management and reduces latency by keeping inspection within the cloud, rather than hair-pinning traffic on-premises. BGP enables automatic failover and route propagation, meeting the dynamic routing requirement.

Answer

Use AWS Transit Gateway with static routes pointing to the NGFW instance for inspection.

Answer

Create a site-to-site VPN between each VPC and the on-premises network, and configure the NGFW on-premises.

Answer

Use AWS Direct Connect to connect all VPCs to the on-premises network and place the NGFW on-premises.

Question 9

An engineer is configuring an ASA to allow inbound HTTP traffic from the outside to a server on the DMZ. The outside interface has security level 0 and the DMZ interface has security level 50. Which set of commands correctly implements the required access and NAT?

Accepted Answer

nat (dmz,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside. The ASA requires a static NAT for inbound traffic and an ACL on the outside interface to permit the traffic.

Answer

nat (outside,dmz) static 10.1.1.10; access-list dmz_access_in permit tcp any host 10.1.1.10 eq 80; access-group dmz_access_in in interface dmz

Answer

nat (inside,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Answer

nat (dmz,outside) dynamic 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Question 10

A company is deploying Cisco TrustSec to enforce micro-segmentation between data center servers. Security team wants to use Security Group Tags (SGTs) assigned dynamically via ISE. Which method should the engineer use to propagate SGTs to the access switches that connect the servers, assuming the network uses Cisco Nexus 9000 switches and ISE as the policy server?

Accepted Answer

Deploy SXP (SGT Exchange Protocol) between ISE and the Nexus switches. For dynamic SGT propagation from ISE to network devices, SXP (SGT Exchange Protocol) is the standard method. It carries IP-to-SGT mappings from ISE to the Nexus switches, enabling the switches to enforce policies without requiring inline tagging on every link. Option B (CoA) is used for reauthentication and session changes, not for bulk SGT propagation. Option C (SGT inline tagging) is a hardware-based method for carrying SGTs on frame headers between switches, but it does not propagate the bindings from ISE; it requires all links to support tagging. Option D (dedicated VLAN per security group) is a traditional segmentation method, not related to Cisco TrustSec SGTs. Therefore, A is correct.

Answer

Configure ISE as a RADIUS server to send CoA with SGT

Answer

Enable SGT inline tagging on all interswitch links

Answer

Use a dedicated VLAN per security group

Question 11

A Cisco FTD administrator is configuring SSL/TLS inspection. They want to inspect encrypted traffic to an external website that uses a certificate signed by a public CA. Which SSL/TLS inspection action should be used to decrypt this traffic?

Accepted Answer

Decrypt-resign. For traffic to external sites with public certificates, the FTD can use 'decrypt-resign' where it re-encrypts the traffic with a custom CA certificate installed on the client. 'Decrypt-known-key' is for traffic where the private key is known (e.g., internal servers).

Answer

Do not decrypt

Answer

Decrypt-known-key

Answer

Block

Question 12

You are a security engineer for a multinational corporation with 5,000 employees. The company uses Cisco Umbrella for DNS-layer security, Cisco Web Security Appliance (WSA) for proxy services in the data center, and Cisco Email Security Appliance (ESA) for email security. Recently, the security team has received multiple reports of users receiving phishing emails that bypass the ESA. The emails contain links to malicious websites that are also not blocked by Umbrella or WSA. Upon investigation, you find that the phishing emails use newly registered domains (less than 24 hours old) and the malicious websites are hosted on cloud infrastructure with frequently changing IP addresses. The company's current security policies rely on signature-based detection and static blocklists. Which action should you take to most effectively mitigate these threats?

Accepted Answer

Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.. Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.

Answer

Configure the WSA to block all domains registered within the last 30 days.

Answer

Enable Data Loss Prevention (DLP) on the ESA to scan email content for sensitive data.

Answer

Increase the frequency of signature updates on the ESA and WSA to every hour.

Question 13

An organization uses Cisco ISE for guest access. They want to allow guests to create their own accounts through a web portal while requiring approval from a sponsor before network access is granted. Which guest access method should be configured?

Accepted Answer

Self-registration with sponsor approval. Self-registration with sponsor approval allows guests to create accounts, but access is only granted after a sponsor approves the request. This is a common guest access scenario in ISE.

Answer

Hotspot guest access

Answer

Self-registration without approval

Answer

Sponsor portal

Question 14

Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?

Accepted Answer

802.1X authentication. 802.1X authentication is a valid NAC method because it enforces port-based access control by requiring end devices to authenticate via EAP (Extensible Authentication Protocol) before gaining network access. It integrates with a RADIUS server (e.g., Cisco ISE) to validate credentials and dynamically assign VLANs or ACLs based on policy, making it a core NAC technology.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP source guard

Answer

DHCP snooping

Question 15

A network administrator is configuring Cisco ISE to enforce access control based on user authentication. The company requires that only users who authenticate via Active Directory are allowed access to the corporate wireless network. Which policy should be configured in ISE to accomplish this?

Accepted Answer

Authorization policy. Authorization policies in Cisco ISE define the access permissions granted to authenticated users, such as allowing or denying network access. In this scenario, after a user authenticates via Active Directory (handled by the authentication policy), the authorization policy evaluates conditions (e.g., AD group membership) to enforce the required access control for the corporate wireless network.

Answer

Profiling policy

Answer

Authentication policy

Answer

Policy set