350-701 Practice Test 34 — 15 Questions

Question 1

You are troubleshooting a Cisco ISE deployment where some endpoints are stuck in the 'Not Compliant' posture after a posture scan. ISE logs show 'Conditional NAC Agent result: Not Compliant due to missing required application.' The application is installed on the endpoint. What should you check?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The posture policy requires a specific version that is not installed.. The error 'Not Compliant due to missing required application' despite the application being installed suggests that the posture policy is checking for a specific version of the application that is not present. ISE posture policies can require a minimum version or exact version, and if the installed version does not match, the endpoint is marked non-compliant.

Answer

The NAC Agent is running an outdated version.

Answer

The endpoint's firewall is blocking the ISE posture probe.

Answer

The antivirus definition file is outdated.

Question 2

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints has been later determined to be malicious. Which Cisco AMP feature allows the administrator to see the file's propagation and impacts across endpoints?

Accepted Answer

Device Trajectory. Device Trajectory provides a timeline view of file and process activity, showing the propagation of a threat after it is discovered to be malicious.

Answer

SHA-256 Disposition

Answer

IOC Scanning

Answer

Exploit Prevention

Question 3

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

Accepted Answer

Cisco ISE with pxGrid. Cisco ISE with pxGrid (Platform Exchange Grid) enables automated policy-based responses by allowing Cisco AMP for Endpoints to share threat intelligence with ISE. When AMP detects a high-severity malware, it triggers a pxGrid event that instructs ISE to dynamically quarantine the host by applying a security group access control list (SGACL) or a CoA (Change of Authorization) to block network access. This integration is specifically designed for context sharing and automated remediation across Cisco security products.

Answer

Cisco Stealthwatch with NetFlow

Answer

Cisco Web Security Appliance

Answer

Cisco Firepower Next-Gen Firewall

Question 4

Which TWO of the following are valid methods for deploying Cisco WSA? (Choose TWO.)

Accepted Answer

Explicit proxy (browser configuration). Option D (Explicit proxy via browser configuration) is correct because Cisco WSA can be deployed as an explicit proxy, where client browsers or PAC files are configured to send HTTP/HTTPS requests directly to the WSA's proxy listening ports (typically 80, 3128, or 8080). Option E (Transparent proxy via WCCP) is correct because WSA supports WCCP (Web Cache Communication Protocol) to redirect traffic transparently from a Cisco router or switch to the WSA without any client-side configuration. Option A is incorrect because a mail relay handles SMTP email traffic, which is not a WSA deployment role; WSA is a secure web gateway for HTTP/HTTPS. Option B is incorrect because WSA is not a DNS server; it may query DNS for reputation and categorization but does not serve DNS records. Option C is incorrect because firewall port mirroring (SPAN) only copies traffic for monitoring and cannot redirect traffic inline to the WSA for enforcement.

Answer

As a mail relay

Answer

As a DNS server

Answer

Inline with firewall port mirroring

Question 5

A company uses Microsoft Azure and has deployed Cisco CloudCenter for workload lifecycle management. They also use Cisco Firepower NGFW in Azure. A security analyst notices that the Firepower logs show outbound connections from a workload to an IP address in a known threat feed. The workload is a Linux server that runs a custom application. The analyst checks Azure Network Security Groups (NSGs) and finds that outbound traffic is not restricted. The company's policy requires that all outbound traffic be inspected and logged. The analyst wants to block the specific IP while allowing other outbound traffic. Which action should be taken?

Accepted Answer

Create a Firepower Access Control policy rule to block traffic to the threat IP and log it.. Cisco Firepower NGFW is the inline security enforcement point in this Azure deployment, and it can inspect and log all outbound traffic. Creating a Firepower Access Control policy rule to block the specific threat IP and log it directly enforces the security policy at the firewall layer, which is the only device capable of deep packet inspection and logging as required by company policy. NSGs operate at Layer 3/4 and cannot inspect application-layer traffic or integrate with threat feeds for granular IP blocking without affecting other traffic.

Answer

Configure the NSG to deny all outbound traffic and then add allow rules for known good destinations.

Answer

Add a network security group rule to block the specific IP address.

Answer

Modify the route table to send all outbound traffic through a firewall, bypassing the NSG.

Question 6

A company uses Cisco Umbrella for DNS-layer security. They want to block access to known malicious IPs that may be resolved by non-DNS traffic. Which feature should they enable?

Accepted Answer

IP Layer Enforcement. IP Layer Enforcement is the correct feature because it allows Cisco Umbrella to block traffic to known malicious IP addresses even when the traffic does not originate from a DNS query. This is essential for blocking threats that use hardcoded IPs or non-DNS protocols like direct IP connections, ensuring protection beyond DNS-layer filtering.

Answer

File Analysis

Answer

Application Discovery

Answer

HTTPS Inspection

Question 7

In a Cisco ISE 802.1X deployment, which component acts as the authenticator?

Accepted Answer

Authenticator (switch/WLC). In an 802.1X deployment, the authenticator is the device that controls access to the network, typically a switch or wireless LAN controller. It relays authentication messages between the supplicant and the authentication server. The authenticator does not make the authentication decision; it enforces the decision made by the authentication server.

Answer

RADIUS server

Answer

Authentication server (ISE)

Answer

Supplicant (client software)

Question 8

Which Cisco security product is primarily used for endpoint threat detection and retrospective security?

Accepted Answer

Cisco AMP for Endpoints. Cisco AMP (Advanced Malware Protection) provides endpoint protection with retrospective analysis and threat detection.

Answer

Cisco ESA

Answer

Cisco Firepower

Answer

Cisco WSA

Question 9

Which Cisco Umbrella feature provides off-network protection by intercepting DNS requests on a user's device?

Accepted Answer

Umbrella Roaming Client. The Umbrella Roaming Client is a lightweight agent installed on endpoints (Windows/macOS) that intercepts DNS requests locally and forwards them to Umbrella's global network, providing protection even when the device is off the corporate network. It enforces the same DNS-layer security policies regardless of where the user connects.

Answer

Secure Internet Gateway (SIG)

Answer

Cisco AnyConnect

Answer

Intelligent Proxy

Question 10

Which two controls are considered part of a zero-trust architecture for cloud access? (Choose two.)

Accepted Answer

Multi-factor authentication for all cloud access. Multi-factor authentication (A) is a core zero-trust control because it enforces strong identity verification for every cloud access request, aligning with the 'never trust, always verify' principle rather than relying on network location. Conditional access policies based on user and device (E) are also fundamental to zero trust, as they evaluate contextual signals such as user identity, device compliance, location, and risk before granting access to cloud resources. Together, these controls support continuous verification and least-privilege access in a zero-trust architecture. Static firewall rules based on IP addresses (B) are not zero-trust controls because they assume trust based on network location, which zero trust explicitly rejects. Permanent privileged role assignments (C) violate least-privilege and just-in-time access principles central to zero trust. A network-based VPN for all users (D) extends perimeter-based trust by placing users on the internal network, which is contrary to zero-trust access models.

Answer

Static firewall rules based on IP addresses

Answer

Permanent privileged role assignments

Answer

Network-based VPN for all users

Question 11

Which TWO benefits does centralized RADIUS authentication provide over local authentication on network devices? (Choose two.)

Accepted Answer

Centralized accounting and logging of all authentication attempts. Centralized RADIUS authentication aggregates all authentication, authorization, and accounting (AAA) data on a single server. This provides a unified audit trail for all login attempts across network devices, enabling comprehensive logging and accounting that local authentication cannot offer. Local authentication logs are device-specific and lack centralized aggregation, making forensic analysis and compliance reporting more difficult.

Answer

Faster authentication because of local caching

Answer

Support for multiple authentication protocols like PAP, CHAP, EAP

Answer

No need for a backup authentication method

Question 12

A network engineer is configuring Cisco ISE to assign Security Group Tags (SGTs) to endpoints based on their identity and role. Which two components are required for TrustSec SGT classification and enforcement? (Choose two.)

Accepted Answer

Network devices (switches/firewalls) that enforce SGACLs. Option B is correct because TrustSec enforcement requires network devices such as switches and firewalls that support Security Group ACLs (SGACLs) and can apply them to traffic based on the SGT values carried in the Cisco Metadata (CMD) or SGT Exchange Protocol (SXP). Option D is correct because Cisco ISE acts as the centralized policy server that authenticates endpoints, assigns SGTs through authorization policies, and distributes the SGT-to-IP mappings and SGACL policies to the enforcing devices. Options A, C, and E are not required components for TrustSec SGT classification and enforcement: AnyConnect is a VPN/endpoint client, AMP for Endpoints is an endpoint malware protection platform, and Duo is a multi-factor authentication service, none of which provide the core SGT tagging and SGACL enforcement functions.

Answer

Cisco AnyConnect client

Answer

Cisco AMP for Endpoints

Answer

Cisco Duo

Question 13

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

Accepted Answer

The SXP speaker and listener are both configured as listener.. In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'. Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.

Answer

The SXP source IP is not reachable.

Answer

The SXP hold-down timer expires too quickly.

Answer

The SXP password is incorrect.

Question 14

Which Cisco ESA feature uses SHA-256 cloud lookups to detect malware in email attachments?

Accepted Answer

AMP for Email. Cisco ESA's AMP for Email (Advanced Malware Protection) leverages SHA-256 cloud lookups to compare file hashes of email attachments against Talos threat intelligence. When an attachment is processed, its SHA-256 hash is computed and sent to the AMP cloud for real-time verdict (malicious, clean, or unknown). This is distinct from signature-based detection, as it relies on cloud-based file reputation analysis.

Answer

Outbreak Filters

Answer

DLP Policies

Answer

Anti-spam (SenderBase)

Question 15

A security engineer is troubleshooting an issue where users can bypass the Cisco WSA by using HTTPS. What must be enabled on the WSA to inspect encrypted traffic?

Accepted Answer

HTTPS Inspection. Cisco WSA's HTTPS Inspection feature performs SSL/TLS decryption (via a trusted internal CA certificate deployed to clients) so the appliance can see the full URL and content inside encrypted sessions. Without it, the WSA can only see the SNI/hostname and cannot apply URL categories or content policies to the encrypted payload, allowing users to bypass filtering by using HTTPS.

Answer

AVC

Answer

URL Filtering

Answer

Bandwidth Controls