350-701 Practice Test 35 — 15 Questions

Question 1

A Cisco WSA administrator wants to prioritize bandwidth for video conferencing applications while limiting recreational streaming. Which feature should be configured?

Accepted Answer

Bandwidth Controls. Cisco WSA's Bandwidth Controls feature lets administrators define bandwidth limits and priorities for specific applications, URL categories, or user groups. By assigning a high priority or guaranteed bandwidth to video conferencing categories and a low limit to streaming media categories, the administrator can prioritize conferencing while throttling recreational streaming. This is exactly the use case Bandwidth Controls is designed for.

Answer

SSL/TLS Decryption

Answer

Application Visibility and Control (AVC)

Answer

URL Filtering

Question 2

An organization uses Cisco Umbrella to block malicious domains. The security team notices that some malware traffic bypasses DNS-layer blocking because the malware uses hardcoded IP addresses. Which Umbrella feature should be enabled to additionally inspect traffic at the IP layer?

Accepted Answer

Secure Internet Gateway (SIG). Cisco Umbrella Secure Internet Gateway (SIG) extends protection beyond DNS by inspecting traffic at the IP and URL layers, including IP-layer enforcement that blocks connections to hardcoded malicious IPs. Since the malware bypasses DNS resolution entirely, only a solution that inspects the IP layer will catch it. SIG provides this IP-layer blocking as part of its cloud-delivered security stack.

Answer

Intelligent Proxy

Answer

DNS-layer security

Answer

Umbrella Roaming Client

Question 3

In a DevSecOps pipeline, which tool would be used to scan Infrastructure as Code (IaC) templates for security misconfigurations?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool specifically designed to scan Infrastructure as Code (IaC) templates (Terraform, CloudFormation, Kubernetes, ARM) for security misconfigurations and compliance violations. It fits directly into DevSecOps pipelines to catch issues before deployment.

Answer

SAST tool

Answer

Container image scanner

Answer

DAST tool

Question 4

An organization uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which cloud security solution should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) is deployed to enforce security policies, including DLP, for cloud applications and services. It acts as an intermediary between users and SaaS applications, providing visibility and control to prevent sensitive data from being shared externally.

Answer

Web Application Firewall (WAF)

Answer

Cloud Security Posture Management (CSPM)

Answer

Cloud Workload Protection Platform (CWPP)

Question 5

A Cisco ASA firewall is configured with multiple contexts. The administrator needs to allow traffic from a context to pass through the management context for management purposes. Which type of interface should be used for this inter-context communication?

Accepted Answer

Use a shared interface that is allowed in multiple contexts.. In multiple-context mode on a Cisco ASA, inter-context communication (such as allowing a user context to send management traffic to the management context) is achieved by using a shared interface. A shared interface is assigned to multiple security contexts, enabling them to communicate directly without requiring a physical or virtual crossover cable. This design allows the management context to receive traffic from other contexts for monitoring or administrative purposes while maintaining separation of forwarding tables.

Answer

Configure a virtual interface in each context and bridge them.

Answer

Use a dedicated physical interface for each context and route through the backplane.

Answer

Configure a subinterface on the management interface for each context.

Question 6

A security team wants to inspect SSL-encrypted traffic from users accessing SaaS applications through Cisco Umbrella. Which feature should they enable?

Accepted Answer

Intelligent Proxy. Cisco Umbrella's Intelligent Proxy performs selective SSL inspection of risky or uncategorized domains, including SaaS traffic, without decrypting everything. It is the feature that lets Umbrella inspect encrypted traffic to SaaS apps for threats and policy enforcement.

Answer

Roaming client

Answer

DNS-layer blocking

Answer

SIG cloud firewall

Question 7

Which Cisco Firepower management option is used for on-box management of a single FTD device, without a separate management center?

Accepted Answer

FDM (Firepower Device Manager). FDM (Firepower Device Manager) is the on-box, web-based management interface built directly into a single FTD appliance, allowing configuration and monitoring without any external manager. It is designed specifically for small-scale or standalone deployments where a full FMC would be overkill. Because it runs locally on the device, it satisfies the 'single FTD, no separate management center' requirement.

Answer

Cisco Defense Orchestrator

Answer

FMC (Firepower Management Center)

Answer

ASA CLI

Question 8

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. The AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 9

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Accepted Answer

Step 1: Configure IKE policy (Phase 1), Step 2: Set pre-shared key, Step 3: Define interesting traffic via ACL, Step 4: Configure crypto map (binding Phase 2), Step 5: Apply crypto map to interface. IKE policy defines Phase 1 parameters, then pre-shared key is set, interesting traffic is defined via ACL, crypto map binds Phase 2 parameters, and it is applied to the interface.

Answer

Step 1: Define interesting traffic via ACL, Step 2: Configure IKE policy, Step 3: Set pre-shared key, Step 4: Configure crypto map, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Configure crypto map, Step 4: Define interesting traffic ACL, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Define interesting traffic ACL, Step 4: Apply crypto map to interface, Step 5: Configure crypto map

Question 10

A company is planning to use Cisco Umbrella to secure internet access for branch offices. They already have Cisco Meraki MX appliances at each branch. What is the best way to send DNS traffic from the branches to Umbrella?

Accepted Answer

Enable the Umbrella integration in Meraki dashboard. Cisco Meraki MX appliances have a native, built-in integration with Cisco Umbrella that can be enabled directly from the Meraki dashboard. This integration automatically redirects all DNS traffic from the branch to Umbrella's DNS resolvers (208.67.222.222 and 208.67.220.220) without requiring additional hardware, software, or complex tunnel configurations. It is the simplest and most efficient method for securing DNS traffic when Meraki MX devices are already deployed.

Answer

Deploy the Umbrella virtual appliance at each branch

Answer

Install the Umbrella Roaming Client on each user device

Answer

Configure IPSec tunnels between branches and Umbrella data centers

Question 11

A Cisco ASA is configured with a site-to-site VPN using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec tunnel?

Accepted Answer

Transform set. In a Cisco ASA site-to-site VPN using IKEv2, the transform set defines the encryption and authentication algorithms (e.g., ESP-AES-256-SHA) that protect the IPsec tunnel data. IKEv2 proposals handle the IKE phase negotiation, not the IPsec SA parameters. Therefore, the transform set is the correct component.

Answer

ISAKMP policy

Answer

IKEv2 proposal

Answer

Crypto map

Question 12

A network administrator is configuring Cisco ISE for device profiling. The goal is to identify the type of device (e.g., Windows PC, iPhone, printer) connecting to the network. Which probe should be used to gather the DHCP option 60 (vendor class identifier) and option 12 (hostname) information?

Accepted Answer

DHCP probe. The DHCP probe in ISE collects information from DHCP packets, including option 60 (vendor class identifier) and option 12 (hostname), which are used for device profiling.

Answer

Cisco Device Sensor

Answer

SNMP probe

Answer

HTTP probe

Question 13

In Cisco Firepower Management Center (FMC), which action in an access control rule will send a TCP RST to the source and destination and log the event?

Accepted Answer

Block with reset. In Cisco FMC access control rules, the 'Block with reset' action explicitly sends a TCP RST packet to both the source and destination to immediately terminate the connection, and it logs the event. This is distinct from 'Block' which silently drops the packet without notifying either endpoint. The reset action is used when you want to actively reject the connection rather than just drop it.

Answer

Trust

Answer

Allow

Answer

Interactive Block

Question 14

An engineer needs to allow inbound HTTP traffic from the internet to a web server in the DMZ on a Cisco ASA. The DMZ interface security level is 50, and the outside interface is 0. Which interface direction should the access control entry be applied?

Accepted Answer

Inbound on the outside interface. On a Cisco ASA, ACLs are always applied in the inbound direction relative to the interface where traffic enters the device. Traffic from the internet arrives on the outside interface, so the ACE permitting TCP/80 must be applied inbound on the outside interface. The ASA then evaluates the ACL before any translation or routing decision, and the DMZ security level (50) only governs implicit return traffic, not the initial inbound flow.

Answer

Outbound on the DMZ interface

Answer

Outbound on the outside interface

Answer

Inbound on the DMZ interface

Question 15

A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)

Accepted Answer

Cisco ESA (Email Security Appliance). Cisco ESA (Email Security Appliance), option C, is a dedicated on-premises email security gateway that inspects SMTP traffic for spam, malware, phishing, and data loss prevention, making it specifically designed for email security. Cisco Secure Email (Cloud), option D, is the cloud-hosted equivalent (formerly Cisco Cloud Email Security) that provides the same email threat protection, spam filtering, and encryption without on-premises hardware. The other options do not belong: Cisco Stealthwatch (A) is a network traffic analysis and flow-based anomaly detection tool, Cisco ISE (B) is a NAC/identity and access control platform using 802.1X and RADIUS, and Cisco WSA (E) is a secure web gateway that proxies HTTP/HTTPS traffic rather than email.

Answer

Cisco Stealthwatch

Answer

Cisco ISE (Identity Services Engine)

Answer

Cisco WSA (Web Security Appliance)