350-701 Practice Test 33 — 15 Questions

Question 1

A Cisco FTD is deployed in inline mode and is configured with a file policy to detect malware. When a file is transferred, the FTD computes a SHA-256 hash and checks it against AMP cloud. The cloud returns 'unavailable' for the hash. What action will the FTD take by default?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow the file and log the event.. In Cisco Firepower/FTD file policies, when the AMP cloud is unreachable or returns 'unavailable' for a file hash, the default action for the Malware Cloud Lookup is to allow the file and log the event. This preserves availability and avoids blocking legitimate traffic based solely on a lookup failure. The administrator can change this behavior by configuring the file policy to block on lookup failure, but the out-of-box default is allow-and-log.

Answer

Perform a deep packet inspection on the file.

Answer

Detonate the file in a sandbox before deciding.

Answer

Block the file because it could not be verified.

Question 2

An engineer is configuring a Cisco ASA for site-to-site IKEv2 VPN with a VTI. Which two statements about VTI are true? (Choose two.)

Accepted Answer

VTI can be configured in IKEv2 mode with an IPsec profile.. Option A is correct because a Cisco ASA VTI (Virtual Tunnel Interface) is configured by applying an IPsec profile to a tunnel interface in IKEv2 mode, which binds the IPsec policy directly to the interface rather than to a crypto map. Option C is correct because the VTI is a routable tunnel interface that can participate in dynamic routing protocols such as OSPF or EIGRP, allowing the ASA to form routing adjacencies across the VPN. Option B is incorrect because VTI eliminates the need for a separate ACL to define interesting traffic; the IPsec profile applied to the tunnel interface determines what is encrypted. Option D is incorrect because VTI support is not limited to the ASA 5500-X series; it is available on other ASA platforms and versions that support IKEv2 VTIs. Option E is incorrect because VTI uses an IPsec profile on a tunnel interface, not a crypto map, which is the legacy policy-based method.

Answer

VTI requires a separate ACL to define interesting traffic.

Answer

VTI is only supported on the ASA 5500-X series.

Answer

VTI uses a crypto map to define the IPsec policy.

Question 3

In Cisco Firepower, an access control policy has multiple rules. Rule 1: Allow HTTP from any to any. Rule 2: Block HTTP from 10.0.0.0/8 to any. A packet from 10.0.0.1 to 192.168.1.1 with destination port 80 is inspected. What action is taken?

Accepted Answer

The packet is allowed because Rule 1 is matched first.. In Cisco Firepower access control policies, rules are evaluated top-down, and the first rule that matches the traffic determines the action. Since Rule 1 allows HTTP from any to any, the packet from 10.0.0.1 to 192.168.1.1 on port 80 matches Rule 1 and is allowed. Rule 2, which would block HTTP from 10.0.0.0/8, is never evaluated because the packet already matched Rule 1.

Answer

The packet is allowed only if no intrusion policy triggers.

Answer

The packet is blocked because Rule 2 is more specific.

Answer

The packet is blocked and an alert is generated.

Question 4

Which Cisco security product provides multi-factor authentication through push notifications, TOTP, and hardware tokens?

Accepted Answer

Cisco Duo. Cisco Duo is a multi-factor authentication solution that offers various methods including push notifications, time-based one-time passwords (TOTP), and hardware tokens.

Answer

Cisco AnyConnect

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 5

Which of the following is a characteristic of a stateful firewall like Cisco ASA?

Accepted Answer

It maintains a state table of active connections.. A stateful firewall such as Cisco ASA maintains a state table that tracks active connections, including source/destination IPs, ports, sequence numbers, and TCP flags. Return traffic for an established session is automatically permitted without an explicit inbound rule. This connection-awareness is the defining characteristic of stateful inspection.

Answer

It filters traffic based solely on packet headers.

Answer

It can only filter based on source IP address.

Answer

It requires a separate proxy for each application.

Question 6

Which security concept involves creating multiple layers of defense so that if one layer is breached, subsequent layers still provide protection?

Accepted Answer

Defense in depth. Defense in depth is a security architecture strategy that layers independent defensive mechanisms (e.g., firewalls, IDS/IPS, endpoint protection, encryption) so that if one layer is compromised, subsequent layers continue to protect the asset. This concept is fundamental to the 350-701 exam as it underpins Cisco's SecureX and integrated security fabric approach, where multiple controls (like ASA, Firepower, and Umbrella) work together to provide resilience against breaches.

Answer

Zero Trust

Answer

Separation of duties

Answer

Least privilege

Question 7

Which of the following is an example of a passive reconnaissance technique?

Accepted Answer

OSINT gathering from public websites. Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.

Answer

Port scanning

Answer

Social engineering

Answer

Vulnerability scanning

Question 8

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Accepted Answer

Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group, then Apply to interface. First enable AnyConnect image, then define IP pool, group policy, tunnel group, and apply to interface.

Answer

Apply to interface, then Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group

Answer

Enable AnyConnect image, then Group policy, then Define IP pool, then Tunnel group, then Apply to interface

Answer

Enable AnyConnect image, then Define IP pool, then Tunnel group, then Group policy, then Apply to interface

Question 9

An organization is adopting zero trust principles for cloud access. Which THREE measures are essential for implementing identity-centric security? (Choose three.)

Accepted Answer

Conditional access policies based on user, device, and location. Option B is correct because conditional access policies evaluate signals such as user identity, device compliance state, and location to enforce real-time, context-aware access decisions, which is the core of identity-centric zero trust. Option D is correct because Privileged Identity Management (PIM) with just-in-time access eliminates standing privileged credentials, granting elevated roles only when needed and after approval, thereby reducing the attack surface for identity-based threats. Option E is correct because multi-factor authentication for all users strengthens identity verification by requiring a second factor beyond a password, directly mitigating credential theft and replay attacks. Option A does not belong because a site-to-site VPN provides network-level tunnel connectivity rather than identity-centric access control. Option C does not belong because VLAN segmentation is a network-based isolation control, not an identity-driven enforcement mechanism.

Answer

Site-to-site VPN for connectivity

Answer

Network segmentation using VLANs

Question 10

An organization is deploying Cisco Duo for multi-factor authentication. Which TWO authentication methods can be used with Duo? (Choose two.)

Accepted Answer

Time-based one-time password (TOTP). Duo provides push notifications to a mobile app and time-based one-time passwords (TOTP) as authenticator methods. Biometrics is not a Duo method; SMS passcodes are available but legacy; hardware tokens are supported but the question asks for TWO, and push and TOTP are the most common. However, hardware token is also valid. The exam expects push and TOTP as primary.

Answer

Kerberos ticket

Answer

Smart card

Answer

Biometric authentication

Question 11

An organization has deployed Cisco WSA in explicit proxy mode. Users are required to authenticate using their Active Directory credentials. Which WSA feature enables transparent user identification without requiring users to manually log in?

Accepted Answer

Transparent user identification via Kerberos. In explicit proxy mode, users point their browsers at the WSA, but the WSA still needs to know who the user is to apply identity-based policies. Kerberos-based transparent user identification allows the WSA to authenticate the user against Active Directory silently using the existing Kerberos ticket from the domain logon, so no manual credential prompt appears. This is the standard Cisco WSA feature (configured under Network > Authentication) that provides seamless AD-based identification in explicit proxy deployments.

Answer

URL Filtering

Answer

WCCP redirection

Answer

SSL/TLS Decryption

Question 12

An organization wants to prevent sensitive data such as credit card numbers from being sent via email. Which TWO features of Cisco ESA can be used to achieve this?

Accepted Answer

Content filters. Content filters (C) are correct because they let you define rules that inspect message bodies, headers, and attachments for patterns such as credit card numbers and then take actions like drop, quarantine, or notify, which directly prevents sensitive data from leaving via email. DLP policies (E) are correct because Cisco ESA Data Loss Prevention uses predefined or custom classifiers (for example, credit card and PCI compliance templates) to detect and block sensitive content in outbound mail. Outbreak filters (A) only protect against virus outbreaks and phishing by quarantining suspicious messages based on threat rules, not by detecting data patterns like credit card numbers. Anti-spam filters (B) score and block unsolicited bulk email, and SenderBase reputation (D) evaluates sender IP and domain reputation; neither inspects message content for sensitive data, so they do not satisfy the requirement.

Answer

Outbreak filters

Answer

Anti-spam filters

Answer

SenderBase reputation

Question 13

A company wants to enforce consistent security policies for Office 365, Salesforce, and Box. Which Cisco product provides CASB functionality with policy enforcement for SaaS applications?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is Cisco's Cloud Access Security Broker (CASB) solution specifically designed to enforce consistent security policies across SaaS applications like Office 365, Salesforce, and Box. It provides visibility, data loss prevention (DLP), threat protection, and compliance monitoring by acting as a policy enforcement point between users and cloud services, using API-based integration to inspect and control data in transit and at rest.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Threat Defense

Answer

Cisco Umbrella

Question 14

A security administrator wants to enforce a policy that blocks upload of sensitive data to unauthorized cloud applications. Which technology should be used to gain visibility and control over sanctioned and unsanctioned SaaS applications?

Accepted Answer

CASB. A CASB (Cloud Access Security Broker) is purpose-built to sit between users and cloud services, providing visibility into sanctioned and unsanctioned SaaS usage and enforcing data-loss-prevention policies such as blocking uploads of sensitive data. It discovers shadow IT, classifies data, and applies granular controls (upload/download/block) across SaaS apps. This directly matches the requirement to gain visibility and control over SaaS applications.

Answer

Cisco Umbrella SIG

Answer

CWPP

Answer

CSPM

Question 15

A financial services company uses a multi-cloud strategy with workloads in AWS and Azure. They must comply with PCI DSS, which requires encryption of cardholder data at rest and in transit. The security team has implemented the following: 1) AWS S3 buckets use server-side encryption with AWS KMS (SSE-KMS). 2) Azure Blob Storage uses Azure Storage Service Encryption (SSE) with Azure Key Vault. 3) All traffic between VPCs and VNets uses IPsec VPN tunnels. During an audit, the assessor notes that data stored in AWS S3 is encrypted with a key that is also used for a development environment. Additionally, logs from Azure Blob Storage are accessible to a group of developers with read-only permissions. Which action should the security team take to address the compliance gaps?

Accepted Answer

Create separate KMS keys for production and development in AWS, and restrict Azure Blob Storage log access to only authorized security auditors.. PCI DSS requires strict separation of cryptographic keys between production and non-production environments, and logging access must be restricted to authorized personnel. Using the same KMS key for production S3 data and a development environment violates this requirement, and granting developers read-only access to Azure Blob Storage logs exposes sensitive audit data. Creating separate KMS keys for production and development in AWS ensures key isolation, while restricting Azure Blob Storage log access to only authorized security auditors enforces the principle of least privilege required by PCI DSS.

Answer

Change the encryption method to AWS S3 SSE-C and Azure client-side encryption to maintain separate keys.

Answer

Implement a cloud DLP solution to monitor access to encrypted data and alert on unauthorized use.

Answer

Use a third-party VPN appliance to ensure encryption in transit between all cloud environments.