350-701 Practice Test 32 — 15 Questions

Question 1

A company uses Cisco Umbrella SIG to enforce security policies. An employee attempts to visit a website categorized as 'Phishing' but the request is allowed. What is the most likely cause?

Accepted Answer

The policy is set to 'Allow' for the Phishing category. If a website categorized as Phishing is allowed, the most direct explanation is that the policy explicitly permits that category. Umbrella SIG enforces policies based on category and identity; an 'Allow' rule for Phishing overrides the default block. This is a configuration error, not a technical limitation.

Answer

The employee is using a VPN that bypasses the proxy

Answer

DNS security is disabled

Answer

The website uses HTTPS and Umbrella cannot inspect it

Question 2

An administrator wants to prevent confidential data (e.g., credit card numbers) from being sent via email using Cisco ESA. Which feature should be enabled and configured with the appropriate dictionary?

Accepted Answer

Data Loss Prevention (DLP) with a predefined credit card dictionary. Cisco ESA's Data Loss Prevention (DLP) feature is specifically designed to inspect outbound messages for sensitive data patterns, such as credit card numbers, using predefined dictionaries. By enabling DLP and selecting the appropriate credit card dictionary, the administrator can enforce policies to block or quarantine emails containing confidential information, directly addressing the requirement.

Answer

Outbreak Filters with file reputation

Answer

Anti-Spam with URL reputation

Answer

Message Filters with regex pattern matching

Question 3

A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?

Accepted Answer

Connection table (conn). When a return packet arrives from the web server, the ASA first checks the connection table (conn) to match the packet against an existing flow. The connection table entry was created when the inside user initiated the session and contains the translation and session state. This fast-path lookup allows the ASA to forward the packet without re-evaluating ACLs or performing a new NAT translation.

Answer

ACL table

Answer

NAT table (xlate)

Answer

Routing table

Question 4

To protect against phishing attacks that use fraudulent emails to trick users into revealing credentials, which email authentication technology verifies the sending domain's DNS records for a digital signature?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature added to the email header, which is verified against a public key published in the sender's DNS records. This ensures the email was sent by an authorized server and has not been altered in transit, protecting against phishing and spoofing.

Answer

DMARC

Answer

SenderBase

Answer

SPF

Question 5

Which of the following is a characteristic of a zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every request must be verified regardless of source.

Answer

Implicit trust for internal users

Answer

Trust but verify

Answer

Trust based on network location

Question 6

Which three cryptographic algorithms are considered secure for use in modern systems? (Choose three.)

Accepted Answer

ECDSA. ECDSA (A) is correct because it is an elliptic-curve digital signature algorithm that provides strong security with smaller key sizes (e.g., a 256-bit ECDSA key offers roughly 128-bit security), making it a modern, secure choice for signing and authentication. RSA (C) is correct because, when used with sufficiently large keys (typically 2048 bits or more) and proper padding such as OAEP or PSS, it remains a secure public-key algorithm for encryption and digital signatures. AES (E) is correct because it is a modern symmetric block cipher standardized by NIST that, with 128-, 192-, or 256-bit keys, is considered secure and is the current standard for symmetric encryption. MD5 (B) is not acceptable because it is a broken hash function with practical collision attacks, and 3DES (D) is not acceptable because its 64-bit block size enables Sweet32-style attacks and its effective key strength is reduced, so both are deprecated for modern secure systems.

Answer

MD5

Answer

3DES

Question 7

A network engineer is implementing Cisco TrustSec. Which two components are required to enforce Security Group Access Control List (SGACL) policies? (Choose two)

Accepted Answer

Cisco Catalyst switch with CTS. Option B (Cisco Catalyst switch with CTS) is correct because SGACL enforcement happens on TrustSec-capable network devices that tag traffic with Security Group Tags (SGTs) and apply the SGACL policy to the tagged packets; a Catalyst switch supporting Cisco TrustSec (CTS) is exactly such an enforcement point. Option C (Cisco ISE Policy Service Node) is correct because ISE acts as the policy controller that defines and distributes the SGACL policies (and the SGT-to-SGACL matrix) to the enforcing devices, making it a required component for SGACL policy enforcement. Option A (Cisco Wireless LAN Controller) is not required for SGACL enforcement, as it is an access-layer device that may propagate SGTs but does not itself enforce SGACLs. Option D (Cisco ASA Firewall) is not a required SGACL enforcement component in this scenario, since SGACLs are enforced by TrustSec-capable switches and routers, not by the ASA. Option E (Cisco AnyConnect Secure Mobility Client) is not required for SGACL enforcement, as it is an endpoint VPN/security client and plays no role in enforcing SGACLs on network devices.

Answer

Cisco Wireless LAN Controller

Answer

Cisco ASA Firewall

Answer

Cisco AnyConnect Secure Mobility Client

Question 8

A security administrator is configuring a Cisco Firepower NGFW to detect and block application-layer DDoS attacks. Which type of DDoS attack is characterized by overwhelming a server with incomplete HTTP requests, causing resource exhaustion?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.

Answer

UDP Flood

Answer

ICMP Flood

Answer

SYN Flood

Question 9

Which TWO of the following are benefits of using Cisco Cloudlock for cloud security? (Choose two.)

Accepted Answer

Shadow IT discovery. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into cloud application usage. Option A is correct because Cloudlock's Shadow IT discovery feature identifies unauthorized cloud applications being used by employees, allowing administrators to assess risk and enforce policies. This is a core CASB function that discovers and categorizes cloud apps based on user traffic patterns.

Answer

DDoS protection

Answer

Network firewall capabilities

Answer

Identity and access management

Question 10

A security administrator receives an alert that an email with an attachment was blocked by the Cisco Email Security Appliance (ESA). The attachment was identified as malware using cloud lookup. Which technology was used to detect the threat?

Accepted Answer

AMP for Email with SHA-256 cloud lookup. AMP for Email performs cloud-based file reputation and malware analysis by computing a SHA-256 hash of the attachment and querying Cisco Talos' cloud intelligence. When the hash matches a known malicious file, the attachment is blocked. This is the specific technology that identifies malware via cloud lookup on the file hash.

Answer

IronPort SenderBase Reputation Score (SBRS)

Answer

Outbreak Filters

Answer

Data Loss Prevention (DLP) policies

Question 11

A company wants to enforce that all outbound emails containing credit card numbers are blocked. Which Cisco ESA feature should be configured to achieve this?

Accepted Answer

DLP policies. Cisco ESA's Data Loss Prevention (DLP) feature scans message content (body, attachments, headers) against predefined or custom DLP policies that detect sensitive data patterns such as credit card numbers (with regex and checksum validation for PCI). You configure a DLP policy with a 'Credit Card Number' classifier and an action of Drop/Quarantine for outbound mail, which blocks the message before it leaves the gateway. This is the only listed feature designed for content-based sensitive-data enforcement.

Answer

Anti-Spam (SenderBase)

Answer

Outbreak Filters

Answer

AMP for Email

Question 12

During a security incident, an analyst uses Cisco AMP for Endpoints to remotely investigate a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to continue the investigation. Which AMP action should be taken?

Accepted Answer

Isolate. The Isolate action in Cisco AMP for Endpoints (now Secure Endpoint) blocks all network communication from the endpoint except for the AMP cloud connection, allowing the analyst to continue remote investigation (running queries, collecting forensic data) while containing the threat. This is the standard containment step during incident response.

Answer

Process isolation

Answer

File quarantine

Answer

Remove connector

Question 13

A network administrator is configuring Cisco ISE for guest access. The company requires a solution where guests can create their own accounts and receive network access after a sponsor approves. Which two components must be configured? (Choose two.)

Accepted Answer

Self-registration portal. To allow guests to self-register and have a sponsor approve, ISE needs a self-registration portal and a sponsor portal.

Answer

Hotspot portal

Answer

Posture assessment

Answer

MAB

Question 14

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Accepted Answer

Never trust, always verify. Option C ('Never trust, always verify') is correct because Zero Trust's core tenet is that no user, device, or workload is trusted by default regardless of network location, so every access request must be explicitly authenticated and authorized using signals like identity, device health, and context. Option D ('Least privilege access') is correct because Zero Trust enforces just-enough-access (JEA) and just-in-time (JIT) permissions, granting users and workloads only the minimum rights needed for a specific task, which limits lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: single-factor authentication (A) contradicts Zero Trust's requirement for strong, often phishing-resistant multi-factor authentication; perimeter-based security (B) reflects the traditional castle-and-moat model that Zero Trust explicitly replaces; and implicit trust for internal networks (E) is the exact assumption Zero Trust eliminates by treating the internal network as hostile.

Answer

Single-factor authentication

Answer

Perimeter-based security

Answer

Implicit trust for internal networks

Question 15

A Cisco FMC administrator needs to create a file policy to detect malware in HTTP downloads. The policy should allow the file to be delivered if it is known clean, block if known malicious, and allow but capture for analysis if unknown. Which combination of actions is required?

Accepted Answer

Detect Files: Clean = Allow; Malicious = Block; Unknown = Allow and Capture. A Firepower file policy defines actions per verdict: Clean files can be allowed, Malicious files blocked, and Unknown files allowed but submitted for analysis (Allow and Capture, i.e., send to Cisco Secure Malware Analytics). This combination matches the stated requirements exactly. The file policy is applied via an access control rule and inspects files in allowed traffic.

Answer

Detect Files: Clean = Block; Malicious = Allow; Unknown = Block

Answer

Detect Files: Clean = Allow; Malicious = Allow; Unknown = Block

Answer

Intrusion Policy instead of File Policy