350-701 Practice Test 33 — 15 Questions

Question 1

A company wants to implement privileged access management (PAM) to secure administrative credentials. They need a solution that provides just-in-time access and session recording. Which product integrated with Cisco SecureX can fulfill these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CyberArk. CyberArk is a leading PAM solution that provides just-in-time access, session recording, and password vaulting. Cisco SecureX can integrate with CyberArk for unified visibility.

Answer

Cisco Duo

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 2

An organization is implementing privileged access management (PAM) using Cisco SecureX and CyberArk. Which PAM capability provides temporary elevated access that is automatically revoked after a set period?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access grants temporary privileges that expire after the task is completed, reducing standing privileges.

Answer

Role-based access control

Answer

Session recording

Answer

Password vaulting

Question 3

A company uses Cisco ISE for network access control. They want to authenticate users connecting via VPN using multi-factor authentication. Which solution integrates with ISE to provide MFA for AnyConnect VPN?

Accepted Answer

Cisco Duo. Cisco Duo integrates with ISE and AnyConnect to provide multi-factor authentication for VPN access.

Answer

Cisco AMP for Endpoints

Answer

Cisco SecureX

Answer

CyberArk

Question 4

A security engineer is deploying Cisco AMP for Endpoints and wants to ensure that the client can detect and block memory injection attacks. Which AMP feature should be enabled to provide this protection?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP focuses on detecting and blocking memory injection attacks, such as buffer overflows and code injection, by monitoring process behavior.

Answer

Device Trajectory

Answer

Endpoint IOC scanning

Answer

File quarantine

Question 5

An administrator needs to enforce 802.1X authentication for devices that do not support 802.1X supplicants. Which method should be configured on Cisco ISE to allow these devices to authenticate?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows non-supplicant devices to authenticate based on their MAC address.

Answer

802.1X with EAP-TLS

Answer

Guest portal

Answer

PEAP-MSCHAPv2

Question 6

Which 802.1X component is responsible for enforcing access control on the network and relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (typically a switch or WLC) enforces access control and acts as a proxy between the supplicant and the authentication server (ISE).

Answer

Authentication server

Answer

RADIUS server

Answer

Supplicant

Question 7

An organization wants to deploy endpoint hardening measures. Which three capabilities are provided by Cisco AMP for Endpoints as part of EDR (Endpoint Detection and Response)? (Choose three.)

Accepted Answer

Remote shell investigation. EDR capabilities include file quarantine, process isolation, and remote shell investigation for incident response.

Answer

TrustSec SGT assignment

Answer

Device Sensor profiling

Question 8

Cisco ISE posture assessment requires that endpoints meet certain security requirements before being granted network access. Which of the following is a typical posture requirement?

Accepted Answer

Antivirus definition file version. Posture assessment checks for compliance with security policies, such as having antivirus software installed and up-to-date, patch levels, and disk encryption enabled.

Answer

SGT assignment

Answer

Device type identification via profiling

Answer

MAC address registration

Question 9

Which protocol does Cisco ISE use to communicate with network devices for 802.1X authentication?

Accepted Answer

RADIUS. Cisco ISE uses RADIUS for authentication, authorization, and accounting. 802.1X leverages EAP over RADIUS.

Answer

LDAP

Answer

SNMP

Answer

TACACS+

Question 10

A security analyst needs to investigate a potential breach on an endpoint running Cisco AMP. The analyst wants to remotely execute commands to gather forensic data and potentially isolate the endpoint from the network. Which Cisco AMP EDR capability should the analyst use?

Accepted Answer

Remote shell investigation. Remote shell investigation allows security analysts to execute commands on an endpoint remotely for live forensics, and process isolation can be used to contain threats.

Answer

Process isolation

Answer

Device Trajectory

Answer

File quarantine

Question 11

A security analyst needs to enforce that all endpoints have antivirus software running and are up-to-date with patches before granting full network access. Which Cisco ISE feature should be used to enforce this policy?

Accepted Answer

Posture assessment. Posture assessment checks endpoints for compliance with security policies (e.g., antivirus status, patch level) before granting access.

Answer

Change of Authorization (CoA)

Answer

Profiling

Answer

TrustSec SGT assignment

Question 12

A network engineer is configuring 802.1X on a switch port that connects to a VoIP phone and a PC behind the phone. Which authentication method should be used to authenticate both devices separately?

Accepted Answer

Multi-domain authentication (MDA). Multi-domain authentication (MDA) allows a switch port to authenticate multiple devices (e.g., phone and PC) separately, each with its own VLAN.

Answer

Single-host authentication

Answer

MAC Authentication Bypass (MAB)

Answer

Guest VLAN

Question 13

An engineer is configuring Cisco ISE for 802.1X authentication. The network has many printers and IP phones that do not support 802.1X supplicant software. Which ISE feature should be used to allow these devices to authenticate?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

Answer

Posture assessment

Answer

Guest access with sponsor portal

Answer

Profiling via DHCP probe

Question 14

A network engineer is trying to establish a site-to-site IPsec VPN between two Cisco routers. The IKEv2 proposal uses AES-256 encryption and SHA-256 hash. On the remote router, the configuration shows only AES-128 and SHA-1. What will happen during IKEv2 negotiation?

Accepted Answer

The IKEv2 negotiation will fail because no common proposal exists.. IKEv2 negotiation requires that both peers have at least one matching proposal (encryption, hash, DH group, etc.) in their configured transform sets. Since the local router offers AES-256/SHA-256 and the remote router only offers AES-128/SHA-1, there is no common proposal. IKEv2 does not perform automatic fallback or mixing of parameters; it simply fails if no match is found.

Answer

The router with stronger proposal will override the other.

Answer

The routers will automatically fall back to IKEv1.

Answer

The routers will negotiate and use AES-128 with SHA-256.

Question 15

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

Accepted Answer

The Web Reputation threshold of -6.0 is blocking the site due to a low reputation score. The exhibit shows a Web Reputation threshold of -6.0, meaning any website with a reputation score lower than -6.0 will be blocked. The banking site 'examplebank.com' likely has a low reputation score (e.g., due to being newly registered or hosting malicious content), causing it to fall below the threshold and be blocked. This is the most direct cause because the WSA applies reputation-based filtering before other policies, and the user's inability to access the site aligns with a reputation block rather than a category or scanning issue.

Answer

The Malware Scanning action is set to 'Scan' but blocks the site

Answer

The user identification is not configured correctly

Answer

The Social Networking category is set to 'Monitor' and is blocking the site