350-701 Practice Test 34 — 15 Questions

Question 1

A company wants to deploy a site-to-site VPN between two branch offices using Cisco IOS routers. The security policy requires that all traffic between the sites must be encrypted and authenticated using strong encryption. The engineer chooses IPsec with IKEv2. Which IPsec transform set configuration provides the strongest encryption and authentication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

transform-set ESP-AES256 ESP-SHA256-HMAC. It specifies AES-256 encryption, which is the strongest symmetric cipher available in IPsec transform sets, combined with ESP-SHA256-HMAC for integrity and authentication. IKEv2 supports these modern algorithms, and this configuration meets the requirement for strong encryption and authentication.

Answer

transform-set ESP-AES128 ESP-SHA-HMAC

Answer

transform-set ESP-DES ESP-MD5-HMAC

Answer

transform-set ESP-3DES ESP-SHA-HMAC

Question 2

A Cisco WSA appliance is configured with explicit proxy mode. Users report that they cannot access external HTTPS websites, but HTTP works fine. The proxy logs show 'SSL handshake failed' errors. What is the most likely reason?

Accepted Answer

The WSA's SSL certificate is not trusted by the clients.. In explicit proxy mode, the Cisco WSA must intercept HTTPS traffic by performing a man-in-the-middle (MITM) decryption. For this to work, the WSA presents its own SSL certificate to the client. If that certificate is not trusted by the client's browser or operating system (i.e., not installed in the trusted root certificate store), the client will reject the SSL handshake, resulting in 'SSL handshake failed' errors. HTTP traffic is unaffected because it does not involve certificate validation.

Answer

The HTTPS proxy port is not configured on the WSA.

Answer

The WSA is configured to forward HTTPS traffic without decryption.

Answer

Client certificates are required for authentication.

Question 3

Which TWO of the following are valid methods for deploying Cisco Firepower Threat Defense (FTD) in high availability?

Accepted Answer

Clustering. Cisco FTD supports high availability through Active/Standby failover (option D) and clustering (option B). Active/Standby failover provides stateful redundancy with one unit handling traffic while the other monitors and takes over upon failure. Clustering groups multiple FTD devices into a single logical unit for both high availability and scalability, distributing traffic across members.

Answer

Active/Active failover

Answer

Load balancing with external load balancer

Answer

StackWise

Question 4

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC. They want to create a rule that blocks access to social media applications regardless of port or protocol. Which policy should be used?

Accepted Answer

Access Control Policy with Application and URL filtering. An Access Control Policy with Application and URL filtering is the correct choice because it allows the security engineer to create a rule that blocks social media applications based on application signatures, independent of the port or protocol used. This policy inspects traffic at Layer 7, using the Cisco Firepower application detector database to identify and block applications like Facebook or Twitter even if they use non-standard ports or encryption.

Answer

Intrusion Policy

Answer

Prefilter Policy

Answer

SSL Policy

Question 5

A company is implementing cloud security posture management (CSPM). Which Cisco product provides CSPM capabilities?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it is Cisco's cloud-native cloud security posture management (CSPM) solution. It continuously monitors cloud infrastructure (e.g., AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks, providing automated remediation and visibility into cloud security posture. This directly aligns with the CSPM use case described in the question.

Answer

Cisco Tetration

Answer

Cisco Firepower

Answer

Cisco ISE

Question 6

A network administrator is configuring Cisco Umbrella for web security. They want to ensure that all DNS requests from branch offices are sent to Umbrella for policy enforcement, but they have limited control over the branch routers. What is the most effective deployment method?

Accepted Answer

Deploy the Umbrella roaming client on endpoints. The Umbrella roaming client (Option A) is the most effective method because it can be deployed on endpoints to redirect all DNS queries to Umbrella's cloud resolvers, regardless of branch router configuration. This client works at the OS level, intercepting DNS traffic and enforcing policies even when the network path is uncontrolled, making it ideal for scenarios with limited router access.

Answer

Set up a transparent proxy on the branch routers

Answer

Configure Umbrella as DNS forwarder on the branch routers

Answer

Use PAC files on the clients to redirect web traffic

Question 7

A network administrator notices that users in the finance department are unable to access a legitimate business web application that uses custom port 8443. The WSA is configured with a decryption policy that decrypts all traffic on port 443. What is the most likely cause of the issue?

Accepted Answer

The decryption policy is not applied to port 8443, so the WSA treats it as non-decrypted traffic which may be blocked by default. The WSA's decryption policy is configured to decrypt traffic only on port 443 (HTTPS). Since the finance department's web application uses custom port 8443, the traffic is not subject to decryption. By default, the WSA may block non-decrypted traffic that matches certain security or access policies, or it may treat it as untrusted, leading to access failure. The most likely cause is that the decryption policy does not cover port 8443, so the WSA applies a default action (often block) to non-decrypted traffic.

Answer

The WSA is configured with a time-based access rule that only allows access during business hours

Answer

The WSA cannot decrypt traffic on port 8443, causing a certificate mismatch

Answer

The web application is blocked by an identity-based access policy

Question 8

A company is designing a remote access VPN solution using Cisco ASA with load balancing. Which three features are essential for high availability and redundancy? (Choose three.)

Accepted Answer

Failover. Failover is essential for high availability in Cisco ASA remote access VPN solutions. It allows a standby ASA to take over seamlessly if the primary unit fails, maintaining VPN sessions and ensuring uninterrupted remote access. This is achieved through stateful or stateless failover, where configuration and connection state are synchronized between the paired units.

Answer

Split tunneling

Answer

AnyConnect profiles

Question 9

A cloud security team is deploying Cisco Tetration (Secure Workload) in a hybrid cloud environment. Which three are prerequisites for workload discovery and policy enforcement? (Choose three.)

Accepted Answer

Deployment of sensors on all workloads. B is correct because Cisco Tetration (Secure Workload) relies on sensors installed on each workload to collect granular telemetry, including process, network, and flow data. Without sensors, the platform cannot discover workload dependencies or enforce micro-segmentation policies, as sensors are the primary data source for the agent-based architecture.

Answer

Configuration of flow export from network devices

Answer

Registration with Cisco Smart Licensing

Question 10

An organization wants to implement privileged access management (PAM) for critical servers. They require just-in-time access and session recording. Which solution integrates with Cisco SecureX to provide these capabilities?

Accepted Answer

CyberArk. CyberArk is a leading PAM solution that integrates with Cisco SecureX to provide just-in-time access, session recording, and password vaulting.

Answer

Cisco Duo

Answer

Cisco AMP for Endpoints

Answer

Cisco ISE

Question 11

Cisco ISE uses profiling to identify the type of device connecting to the network. Which probe helps ISE identify a device by analyzing the DHCP requests it sends?

Accepted Answer

DHCP probe. The DHCP probe captures DHCP request options to identify the device type.

Answer

HTTP probe

Answer

Device Sensor

Answer

SNMP probe

Question 12

A company is deploying Cisco Umbrella for web security. They want to enforce that all DNS requests from remote users using VPN are filtered. Which deployment method should be used?

Accepted Answer

Install the Cisco Umbrella Roaming Security client on remote endpoints.. The Cisco Umbrella Roaming Security client is the correct deployment method for filtering DNS requests from remote VPN users because it installs a local DNS forwarder on the endpoint that intercepts all DNS traffic and sends it directly to Umbrella's cloud resolvers, even when the user is off the corporate network. This ensures that DNS queries are filtered regardless of the VPN tunnel state, as the client operates independently of the VPN connection.

Answer

Use a PAC file to redirect web traffic to Umbrella.

Answer

Configure the corporate DNS servers to forward to Umbrella.

Answer

Deploy a virtual appliance as a DNS forwarder at the branch office.

Question 13

An organization is migrating to AWS and wants to ensure that all internet-bound traffic from VPCs is inspected by a central security appliance. Which AWS service should be used to redirect this traffic?

Accepted Answer

Transit Gateway. Transit Gateway is correct because it acts as a central hub that can route traffic between VPCs and on-premises networks, and it supports route tables that can direct all internet-bound traffic to a central security appliance (such as a firewall or IDS/IPS) via a VPC attachment or a Network Virtual Appliance. This enables traffic inspection and policy enforcement without requiring individual VPCs to manage their own internet gateways or NAT devices.

Answer

AWS Direct Connect

Answer

VPC Peering

Answer

Internet Gateway

Question 14

An administrator configures Cisco Email Security Appliance (ESA) to add a disclaimer to all outgoing emails using a content filter. The filter is enabled and matches all outgoing mail. However, some users report that the disclaimer is missing from their sent emails. Which action should the administrator take to troubleshoot?

Accepted Answer

Review the message filters in the 'Incoming' or 'Outgoing' mail policies that might be taking precedence.. Content filters on Cisco ESA are evaluated after message filters. If a message filter (e.g., one that strips headers or drops attachments) is applied in the same or a higher-priority mail policy, it can prevent the content filter from processing the message, causing the disclaimer to be missing. The administrator should review the message filters in the 'Incoming' or 'Outgoing' mail policies to identify any that might be taking precedence and interfering with the content filter's action.

Answer

Increase the memory allocated to the content filter engine.

Answer

Verify that the mail flow policy for outgoing mail is set to 'Accept'.

Answer

Check if the content filter is disabled or has an invalid condition.

Question 15

Which TWO are best practices for securing Cisco ASA remote access VPN? (Choose two.)

Accepted Answer

Enforce multi-factor authentication (MFA) for VPN users.. Enforcing multi-factor authentication (MFA) for VPN users adds an additional layer of security beyond just a password, significantly reducing the risk of credential theft and unauthorized access. Cisco ASA supports MFA integration with RADIUS servers (e.g., Cisco ISE, Duo Security) that can require a one-time password (OTP) or push notification, aligning with the principle of defense-in-depth for remote access VPNs.

Answer

Disable clientless SSL VPN to force full-tunnel client.

Answer

Use pre-shared keys for user authentication to simplify deployments.

Answer

Use L2TP/IPsec for legacy compatibility.