350-701 Practice Test 34 — 15 Questions

Question 1

An organization uses Cisco ESA to filter inbound email. The security team notices that some phishing emails are reaching users despite having an anti-spam policy. Further analysis reveals that the emails are sent from a domain that is gray-listed but not blocked. What should the administrator do to prevent these emails without impacting legitimate emails?

Accepted Answer

Create a content filter to quarantine the emails based on malicious URLs or attachment type.. Option B is correct because creating a content filter to quarantine emails based on malicious URLs or attachment type directly addresses the phishing threat without affecting legitimate emails. Since the domain is gray-listed (not blocked), the anti-spam policy considers the sender as suspicious but not malicious; a content filter can inspect the email content for specific indicators of compromise (e.g., known malicious URLs or dangerous attachment types like .exe or .js) and quarantine those emails, bypassing the gray-mail classification.

Answer

Disable the Gray Mail feature in the anti-spam policy.

Answer

Enable Retrospective Scanning to detect the phishing emails after delivery.

Answer

Add the sender IP address to the SenderBase block list.

Question 2

Which THREE of the following are best practices for deploying Cisco Web Security Appliance (WSA) in a large enterprise environment? (Select exactly three.)

Accepted Answer

Use explicit proxy mode with PAC files for user-specific policy enforcement. Option A is correct because explicit proxy mode with PAC files allows the WSA to enforce granular, user-specific policies based on authentication (e.g., via NTLM or LDAP) and destination URL. PAC files enable automatic proxy configuration for clients, ensuring traffic is routed through the WSA without manual browser settings, while still supporting user identity for policy decisions.

Answer

Configure transparent proxy to avoid client configuration

Answer

Disable anti-malware scanning to improve performance

Question 3

A user in the marketing group reports that they cannot access twitter.com. The access policy summary is shown in the exhibit. What is the most likely reason?

Accepted Answer

The Social Networking category is set to Block in the Marketing-Policy.. Option D is correct because the exhibit shows that the Marketing-Policy has the Social Networking category set to Block. Since twitter.com is classified under Social Networking, this action explicitly denies access for users assigned to that policy, overriding any other settings.

Answer

The default policy is blocking the site because Marketing-Policy is set to Monitor only.

Answer

The access policy has a time-based restriction that blocks social media during work hours.

Answer

The marketing group is not assigned to the Marketing-Policy.

Question 4

An administrator reviewed the log entry from the Cisco ESA exhibit. The DLP policy is set to 'Continue (with disclaimer)' for credit card matches. How should the policy be changed to prevent this data leakage?

Accepted Answer

Change the DLP policy action from 'Continue' to 'Drop'.. Option B is correct because the current DLP policy action 'Continue (with disclaimer)' allows the email to be delivered after appending a disclaimer, which does not prevent data leakage. Changing the action to 'Drop' will block the email entirely, preventing the credit card data from leaving the organization. This directly addresses the requirement to stop the data leakage.

Answer

Remove the DLP policy assignment for the Finance mail flow.

Answer

Lower the DLP sensitivity threshold.

Answer

Enable TLS encryption on the policy.

Question 5

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Accepted Answer

Deploy the AMP connector to all endpoints, including servers and desktops.. Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Answer

Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.

Answer

Set the default policy action to 'Block' for all file types to maximize security from day one.

Question 6

Which TWO of the following are common causes of email delivery delays in Cisco Email Security Appliance (ESA)? (Select exactly two.)

Accepted Answer

High volume of email in the delivery queue. Option B is correct because a high volume of email in the delivery queue indicates that the ESA is experiencing a backlog of messages awaiting delivery. This can occur due to rate limiting, transient delivery failures, or a large number of messages being processed simultaneously, which directly causes delays in email delivery as the queue must be drained sequentially.

Answer

Too many recipients in a single message

Answer

Incorrect MX record for the destination domain

Answer

Improper SPF record on the sender's domain

Question 7

A company's Cisco WSA is configured with explicit proxy mode. Users report that they can browse the internet but cannot access internal websites hosted on the company's intranet. What is the most likely cause?

Accepted Answer

The internal websites are not in the proxy bypass list.. In explicit proxy mode, the WSA requires clients to be configured to send traffic to it. If internal websites are not added to the proxy bypass list (or the WSA's PAC file does not direct internal traffic directly), the WSA will attempt to proxy requests for internal sites, which may fail because the WSA cannot route to internal IPs or the internal DNS resolution fails. This is the most likely cause because users can browse the internet (proxied traffic works) but cannot reach internal sites (which should bypass the proxy).

Answer

The WSA is in transparent proxy mode.

Answer

Users are not authenticated to the WSA.

Answer

SSL decryption is blocking the internal sites.

Question 8

A university is using Cisco ESA to manage email for 20,000 students and staff. They have implemented anti-spam and anti-virus policies. Recently, the IT helpdesk has been receiving complaints that legitimate emails from external senders (such as admissions notifications) are being marked as spam and quarantined. The administrators check the ESA and find that these emails are being flagged with a spam score above the threshold, but the content appears to be legitimate. The sending domains are not on any blacklist. The ESA is using default anti-spam settings. What should the administrator do to reduce false positives without compromising security?

Accepted Answer

Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).. Option C is correct because adding the legitimate sender domains or IPs to the ESA's SenderBase whitelist explicitly bypasses anti-spam scanning for those trusted sources, reducing false positives while maintaining security for all other inbound email. This approach leverages the ESA's reputation-based filtering to allow known good senders without lowering the global spam threshold or disabling protection entirely.

Answer

Create a content filter to allow any email with 'admissions' in the subject.

Answer

Disable anti-spam scanning for all inbound email.

Answer

Lower the spam threshold to decrease sensitivity.

Question 9

A hospital uses Cisco ESA for email security. The compliance team requires that all emails containing protected health information (PHI) be encrypted before leaving the organization. The administrator has configured a content filter that matches emails containing patterns like 'Patient ID: [0-9]{9}' and sends them to the encryption service. However, some encrypted emails are being rejected by the recipient's mail server because the encryption is applied after the email has already been processed. What is the most likely reason for this issue?

Accepted Answer

The encryption action is configured as 'deliver then encrypt' instead of 'encrypt then deliver'.. Option A is correct because Cisco ESA processes emails through a series of mail policies and content filters before delivery. If the encryption action is configured as 'deliver then encrypt', the email is first sent to the recipient's mail server, and then encryption is attempted as a separate, asynchronous action. This means the email leaves the organization unencrypted, and the recipient's server may reject it if it expects encryption from the start. The correct configuration should be 'encrypt then deliver', which ensures the email is encrypted before it is queued for delivery, preventing rejection due to unencrypted content.

Answer

The content filter is only applied to incoming emails, not outgoing.

Answer

The recipient's mail server does not support the encryption protocol used.

Answer

The email exceeds the maximum size limit for encryption.

Question 10

A security engineer notices that several endpoints in the HR department have been infected with ransomware despite having Cisco AMP for Endpoints deployed. The AMP policy is set to 'Detect' for all file types. What is the most likely reason the ransomware was not blocked?

Accepted Answer

The AMP policy was set to 'Detect' and not 'Block' or 'Quarantine'.. Cisco AMP for Endpoints policies have three primary actions: 'Detect', 'Block', and 'Quarantine'. When a policy is set to 'Detect', the endpoint will alert on malicious files but will not prevent execution. Since the ransomware was allowed to run, the most likely cause is that the policy was configured to 'Detect' only, rather than a more restrictive action like 'Block' or 'Quarantine'.

Answer

The endpoints had process exclusions that allowed the ransomware process.

Answer

The AMP cloud was unreachable during the infection attempt.

Answer

The file was too large for cloud analysis and AMP timed out.

Question 11

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

Accepted Answer

The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.. The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Answer

The AMP license has expired.

Answer

Inbound firewall rules block incoming connections to the AMP connector.

Answer

The AMP connector service is stopped on the endpoint.

Question 12

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Accepted Answer

The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.. Option C is correct because Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Answer

The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.

Answer

The AMP policy has file reputation disabled, so all files are allowed.

Answer

The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.

Question 13

A security team is designing an endpoint protection strategy for a mix of Windows and macOS endpoints. They want to use Cisco AMP for Endpoints with centralized management. Which deployment approach minimizes administrative overhead?

Accepted Answer

Use the AMP cloud console to manage a single policy that applies to both platforms with os-specific exclusions.. Option D is correct because Cisco AMP for Endpoints offers a cloud-based console that provides centralized management for both Windows and macOS endpoints from a single pane of glass. This eliminates the need for on-premises infrastructure or separate management tools, and a single policy can be applied across platforms with OS-specific exclusions to handle differences in file paths and processes, thereby minimizing administrative overhead.

Answer

Deploy an on-premises AMP Console for each operating system.

Answer

Install a Windows Server as a management point and deploy connectors via SCCM.

Answer

Use group policies to define different policies for Windows and macOS.

Question 14

During a ransomware attack, an endpoint protected by AMP for Endpoints successfully blocked the ransomware file. Which AMP policy action was likely applied?

Accepted Answer

Block. When AMP for Endpoints successfully blocks a ransomware file, the 'Block' policy action is applied. This action prevents the file from executing on the endpoint by terminating the process and quarantining the file in the local quarantine, ensuring the threat is neutralized immediately. The 'Block' action is the most restrictive and is designed to stop known malware, including ransomware, from causing harm.

Answer

Allow

Answer

Quarantine

Answer

Detect

Question 15

A large enterprise recently migrated to Cisco Email Security Appliance (ESA) for inbound email filtering. The security team notices an increasing number of phishing emails that bypass the spam filter. Analysis shows that these emails originate from a legitimate but compromised domain (example-bank.com), use valid DKIM signatures, and have low spam scores due to carefully crafted benign text and embedded images. The team already has SenderBase enabled and uses the default spam threshold. The CEO received a convincing phishing email that led to a credential leak. Which course of action should the security team take to best mitigate this threat without causing significant false positives?

Accepted Answer

Create a content filter that detects the domain 'example-bank.com' in the envelope sender and sets the action to 'drop'.. Option B is correct because creating a content filter to detect the specific malicious domain in the envelope sender (MAIL FROM) and applying a 'drop' action directly blocks emails from that domain. This is a targeted approach that does not affect other domains. Option A is incorrect because graymail filtering is for newsletters and bulk mail, not for targeted phishing. Option C is incorrect because increasing the spam threshold may cause more false positives and may still not catch these low-scoring emails. Option D is incorrect because DMARC with quarantine would only help if the domain is being spoofed, but the emails are actually coming from the legitimate domain which is compromised.

Answer

Increase the spam threshold to catch lower-scoring emails.

Answer

Enable graymail filtering to categorize these emails as bulk suspicious.

Answer

Implement DMARC with a quarantine policy for the domain.