350-701 Practice Test 35 — 15 Questions

Question 1

A company with 5000 endpoints uses Cisco Secure Endpoint (AMP) and Cisco ISE. Users report that legitimate software installations are being quarantined, causing delays. The security team receives many alerts for file executions. The AMP policy is set to "High Security" with "Block Unknown" enabled. Network traffic is monitored by Cisco Stealthwatch. The team wants to reduce operational overhead while maintaining security. What should they do?

Accepted Answer

Create an AMP exclusion for software installation directories and enable "File Reputation" with "Cloud Lookups". Option C is correct. Creating an AMP exclusion for software installation directories reduces false positives by preventing scanning of known legitimate installations. Enabling File Reputation with Cloud Lookups maintains detection by checking unknown files against cloud intelligence, thus not sacrificing security. Option A is too broad; lowering the security level might miss threats. Option B removes endpoint protection, relying solely on network detection which is insufficient. Option D removes endpoint protection entirely, increasing risk.

Answer

Disable "Block Unknown" and rely solely on Stealthwatch for threat detection

Answer

Change AMP policy to "Medium Security" and enable "Application Blocking with Allow List"

Answer

Disable AMP and use only ISE for endpoint posture checks

Question 2

A financial institution uses Cisco Firepower Threat Defense (FTD) for intrusion prevention and SSL decryption. The security team recently enabled SSL decryption on the FTD to inspect encrypted traffic. After the change, some internal applications that use client certificates for authentication stopped working. The FMC shows that SSL decryption is configured to inspect traffic to specific destination IPs. The applications are using a custom port (TCP 8443) for HTTPS. The administrator has already added the custom port to the SSL decryption policy. What is the most likely reason the applications are failing?

Accepted Answer

The applications are using client certificates, and the FTD is unable to re-encrypt with the original client certificate.. When FTD performs SSL decryption, it acts as a man-in-the-middle: it terminates the client's SSL connection, inspects the plaintext, and then initiates a new SSL connection to the server. If the client application presents a client certificate for authentication, the FTD cannot re-encrypt the new connection with that same client certificate because it does not have access to the client's private key. The server then rejects the re-encrypted connection, causing the application to fail.

Answer

The applications are using IPsec, not SSL.

Answer

The internal CA certificate is not trusted by the FTD.

Answer

The FTD is not configured to inspect traffic on port 8443.

Question 3

A company's remote employees use Cisco AnyConnect to connect to the corporate network. The VPN is configured with split tunneling so that only traffic to the corporate subnet (10.0.0.0/8) goes through the tunnel, and all other traffic goes directly to the internet. Recently, several employees reported that they cannot access the corporate file server (IP 10.2.3.4) even though they can connect to the VPN. The network team checks the ASA configuration and confirms that the split tunnel ACL includes the corporate subnet. The AnyConnect client shows that it is connected. What is the most likely cause of the issue?

Accepted Answer

The DNS resolution for the file server is failing due to VPN DNS settings.. When split tunneling is configured, DNS queries for corporate resources are often sent to the corporate DNS server through the tunnel. If the VPN adapter's DNS settings are not properly configured or the corporate DNS server is unreachable, the client cannot resolve the file server's hostname to its IP address (10.2.3.4), even though the IP itself is reachable via the tunnel. This is a common misconfiguration where the client uses its local DNS server, which does not have records for the internal corporate domain.

Answer

The ASA is performing NAT on the VPN traffic.

Answer

The file server's firewall is blocking VPN traffic.

Answer

The split tunnel ACL is not being applied correctly, and traffic is going direct to internet.

Question 4

A university is deploying 802.1X authentication for wired access using Cisco ISE. The network consists of Cisco Catalyst switches. The authentication is working for most users, but some users in a specific building are experiencing frequent authentication failures, especially during peak hours. The switches in that building are configured with RADIUS settings pointing to ISE. ISE logs show that authentication requests are being sent but sometimes time out. The network team suspects that the issue is related to RADIUS server load balancing, as the ISE deployment includes two nodes in a distributed model. What is the most likely cause of the timeouts?

Accepted Answer

The ISE nodes are not configured for load balancing, causing one node to be overwhelmed.. Option D is correct because the symptoms—intermittent timeouts during peak hours in a specific building—point to a load-balancing issue. In a distributed ISE deployment, if the switches are not configured with multiple RADIUS server entries or if ISE nodes are not properly load-balanced (e.g., using a single primary server or missing secondary server configuration), one node can become overwhelmed with authentication requests, leading to timeouts. The fact that authentication works for most users but fails during peak hours in one building strongly suggests that the switches in that building are sending all requests to a single ISE node that cannot handle the load.

Answer

The RADIUS shared secret is misconfigured on some switches.

Answer

The switches are not configured with the correct VLAN assignments.

Answer

The switches are using the wrong RADIUS accounting port.

Question 5

A network administrator is configuring Cisco Firepower Threat Defense (FTD) in routed mode to provide intrusion prevention (IPS) for internal traffic. They create an access control rule that allows traffic from the internal network (10.0.0.0/8) to the internet, and they attach an intrusion policy to this rule. After deploying the configuration, they generate known malicious traffic from a test host and observe that no alerts are triggered in the Firepower Management Center (FMC). The administrator checks the FTD and confirms that the Snort process is running, and the rule is at the top of the access control policy with action 'Allow'. What is the most likely cause of this issue?

Accepted Answer

The access control rule action is set to 'Allow' rather than 'Allow with Intrusion Prevention'.. In Cisco Firepower Threat Defense (FTD), an access control rule with action 'Allow' permits traffic without sending it to the Snort intrusion inspection engine. To enable IPS, the rule action must be 'Allow with Intrusion Prevention', which explicitly invokes the intrusion policy. Since the rule was set to 'Allow', the malicious traffic bypassed Snort inspection entirely, so no alerts were generated.

Answer

The FTD is configured in transparent mode.

Answer

The traffic is being fast-pathed and bypassing the Snort engine.

Answer

The intrusion policy is not associated with the correct preprocessor.

Question 6

An enterprise migrated its e-commerce application to AWS. They use Cisco Secure Workload (Tetration) for microsegmentation. After enabling enforcement, legitimate traffic between the web tier and database tier is being blocked. The security team verified that the policy allows the traffic based on labels. The Tetration console shows the enforcement mode as 'active blocking'. The database server is in a different VPC, and the web server is in a public subnet. The agents are running on both workloads and report correctly. Which configuration step is most likely missing?

Accepted Answer

The cloud connector (e.g., AWS cloud connector) is not configured. Cisco Secure Workload (Tetration) relies on cloud connectors to synchronize cloud infrastructure metadata (e.g., VPCs, subnets, instances) and enforce microsegmentation policies across VPC boundaries. Without a configured AWS cloud connector, Tetration cannot discover or enforce policies on resources in a different VPC, even if agents are running and labels are correctly assigned. The 'active blocking' enforcement mode indicates the policy is being applied, but the missing connector prevents the policy from being properly mapped to the database server in the separate VPC, causing legitimate traffic to be blocked.

Answer

The enforcement scope does not include the VPC peering connection

Answer

The application dependency mapping needs to be refreshed

Answer

The agents on the database server are not running

Question 7

A company has 500 users who work remotely and connect to cloud-based SaaS applications. The security team is concerned about malware downloads from these applications. They have deployed Cisco Umbrella with the SIG feature. However, after deployment, a test shows that downloading a file from Dropbox is not being inspected by the cloud security stack. The Umbrella dashboard indicates that the policy is active and the SIG feature is enabled. The network team confirms that the users are using the Umbrella roaming client and that the traffic is correctly forwarding to Umbrella. What is the most likely issue?

Accepted Answer

The traffic is bypassed because of an explicit bypass rule for Dropbox. Option D is correct because Cisco Umbrella's SIG (Security Internet Gateway) feature can be configured with explicit bypass rules for specific applications or domains. Even when the SIG is enabled and traffic is forwarding correctly, an administrator may have inadvertently created a bypass rule for Dropbox, causing its traffic to skip cloud security inspection. This explains why the policy is active but downloads from Dropbox are not inspected.

Answer

The SIG inspection only applies to HTTP traffic, not HTTPS

Answer

The Dropbox application uses non-standard ports

Answer

The users' devices are not configured with the Umbrella roaming client

Question 8

A small business uses Cisco Umbrella for DNS-layer security. They recently enabled multi-factor authentication (MFA) for all administration accounts. The IT manager is unable to log into the Umbrella dashboard; the login page accepts his password but then asks for an MFA code. However, he never set up MFA. He checks his email and finds no registration email. He is the only administrator. How should he regain access to the Umbrella dashboard?

Accepted Answer

Contact Cisco TAC and prove ownership of the account to have MFA reset.. When an administrator is locked out of Cisco Umbrella due to MFA that was never configured, and there is no other administrator to assist, the only recovery path is to contact Cisco TAC. TAC can verify account ownership through a proof-of-ownership process and then reset the MFA enrollment, allowing the administrator to set it up fresh. This is the standard escalation procedure for Umbrella when self-service recovery options are unavailable.

Answer

Create a new Umbrella account and transfer the organization.

Answer

Use the Umbrella API to programmatically disable MFA.

Answer

Have another administrator in the organization disable MFA for his account.

Question 9

A company has a hybrid cloud environment with workloads in AWS and Azure, and an on-premises data center. They use Cisco Tetration for micro-segmentation and Cisco CloudCenter for orchestration. Recently, they deployed a new multi-tier application in AWS: a web tier, an application tier, and a database tier, all across multiple Availability Zones. After deployment, the application is unreachable. The security team reviews Tetration policies and finds that a policy is in place to allow traffic between tiers, but the web tier cannot communicate with the application tier. The Tetration agent status shows all agents are healthy. The administrator checks the AWS security groups and notices that the web tier's security group allows inbound HTTP from 0.0.0.0/0, but the application tier's security group does not allow inbound traffic from the web tier's subnet. The application tier's security group only allows inbound traffic from the on-premises CIDR block in error. The network team requests a fix that does not impact other ongoing audits. What should the administrator do?

Accepted Answer

Update the AWS security group for the application tier to allow inbound traffic from the web tier's subnet.. Option C is correct because the root cause is that the AWS security group for the application tier is misconfigured to only allow inbound traffic from the on-premises CIDR block, rather than from the web tier's subnet. Cisco Tetration enforces micro-segmentation policies at the host level via agents, but it does not override or bypass native cloud security groups; both layers must permit the traffic. Updating the security group to allow inbound traffic from the web tier's subnet resolves the connectivity issue without affecting other audits, as it is a targeted, non-disruptive change.

Answer

Redeploy the application using Cisco CloudCenter to ensure proper security group association.

Answer

Configure Tetration to use 'full enforcement' mode for all policies, which overrides AWS security groups.

Answer

Remove the Tetration policy for the application tier to allow all traffic.

Question 10

A large enterprise is migrating legacy applications to AWS. The security team requires that all data in transit between the applications and the on-premises data center be encrypted and inspected for threats. They have deployed a Cisco Firepower NGFW on-premises and are using Amazon VPC with a VPN connection. The team is concerned about east-west traffic within the VPC also being inspected. They consider deploying Cisco Secure Firewall in the cloud (cFMC). However, budget constraints limit the number of virtual firewalls. Which design best meets the requirements while optimizing cost?

Accepted Answer

Deploy a single Cisco Secure Firewall virtual instance in a transit VPC and route all inter-VPC traffic through it.. Option D is correct because deploying a single Cisco Secure Firewall virtual instance in a transit VPC allows centralized inspection of all inter-VPC (east-west) traffic while minimizing costs. By routing traffic through the transit VPC, you avoid the expense of deploying a firewall in every VPC, and the on-premises Firepower NGFW handles north-south traffic (VPN and internet-bound). This design meets the encryption and threat inspection requirements for both east-west and north-south traffic within the budget constraint.

Answer

Inspect all traffic at the on-premises Firepower by routing all cloud traffic through a VPN.

Answer

Deploy a Cisco Secure Firewall virtual instance in each VPC.

Answer

Use AWS Network Firewall for east-west inspection and keep Firepower on-premises for north-south.

Question 11

A multinational company has recently deployed Cisco WSA with explicit proxy for 10,000 users across two data centers. The WSA is configured with multiple identities based on IP subnets and authentication via LDAP. Users in the R&D department (subnet 192.168.10.0/24) are configured with an access policy that blocks all social media, but they can access web-based email like Gmail. The administrator receives complaints that R&D users cannot access a critical partner's HTTPS website (https://portal.partner.com) that is not categorized. The access policy for R&D has a default action of 'Monitor' for uncategorized URLs, but the site is blocked. The web reputation score for the site is +1.5 (low risk). The global web reputation threshold is set to -1.0. The administrator checks the access logs and sees that the request is denied with the reason 'URL is blocked by policy'. The R&D policy has an explicit 'Deny' action for the URL category 'Uncategorized URLs' set to 'Block', but the default action for the policy is 'Monitor'. The identity matching is correct. What is the most likely cause and solution?

Accepted Answer

Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.. Option C is correct because the R&D access policy has an explicit 'Deny' action for the 'Uncategorized URLs' category, which overrides the default 'Monitor' action. Since portal.partner.com is uncategorized, it is blocked by this explicit deny. Creating a custom URL category for the partner site and configuring an explicit 'Allow' action in the R&D policy will bypass the uncategorized URL block while preserving the rest of the policy.

Answer

Change the R&D policy's Uncategorized URLs action from Block to Monitor.

Answer

Lower the global web reputation threshold to -2.0 to allow more sites.

Answer

Disable authentication for the R&D identity to bypass policy.

Question 12

A multinational corporation uses Cisco AMP for Endpoints with cloud-based file reputation. The security team notices that a file that was previously determined to be clean (disposition: clean) is now reported as malicious by a threat intelligence feed. However, AMP has not taken any action on endpoints that already executed the file. The administrator confirms that retrospective security is enabled. What should the administrator check first to ensure that the file is remediated on all affected endpoints?

Accepted Answer

Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions.. Option C is correct because when a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.

Answer

Verify that the file is not excluded from scanning due to an anti-virus exclusion list.

Answer

Confirm that the endpoints have internet connectivity to the AMP cloud.

Answer

Ensure that the file is being analyzed by the local AMP engine for accurate detection.

Question 13

An enterprise is migrating a critical application to AWS. The architecture includes an Application Load Balancer (ALB) in front of EC2 instances across multiple Availability Zones. The application must be protected against common web exploits such as SQL injection and cross-site scripting. The security team decides to use AWS WAF. They also need to ensure that only traffic from the company's corporate IP range (203.0.113.0/24) is allowed to reach the application, except for a partner integration that requires access from a specific IP (198.51.100.5). Additionally, all traffic must be inspected by a third-party NGFW for advanced threat detection. The NGFW is deployed in a separate VPC connected via VPC Peering. The current configuration: ALB is internet-facing, WAF is associated with the ALB, and the NGFW is not in the traffic path. After deployment, traffic from corporate users is not being inspected by the NGFW, and partner traffic is being blocked. What is the most efficient solution to meet all requirements?

Accepted Answer

Change the ALB scheme to internal, update DNS to point to the NGFW's public IP, and configure the NGFW to forward traffic to the ALB after inspection. Create WAF rules to block non-corporate traffic except partner IP.. Option B is correct because it restructures the traffic flow so that all traffic first hits the NGFW (via its public IP) for advanced threat inspection, then the NGFW forwards clean traffic to the internal ALB. By changing the ALB to internal, it no longer accepts direct internet traffic, ensuring the NGFW is in the path. WAF rules on the ALB then enforce the IP allowlist (corporate range plus partner IP) and protect against SQL injection and XSS, meeting all requirements efficiently.

Answer

Configure AWS WAF rate-based rules to block non-corporate IPs and enable managed rules for SQL injection.

Answer

Deploy an additional ALB as a reverse proxy in front of the NGFW, and configure the WAF on the front ALB.

Answer

Set up a site-to-site VPN between the corporate network and the VPC, and route partner traffic through the VPN.

Question 14

A company with 500 endpoints uses Cisco AMP for Endpoints with a private cloud and a single Threat Grid appliance for file analysis. The security team notices that some endpoints are not receiving updates to the local malware signatures for over 24 hours. The AMP console shows these endpoints as 'Out of Date'. The network team confirms that the endpoints can reach the private cloud server on TCP port 443. The endpoints are running Windows 10 with the latest AMP connector version. The private cloud server has sufficient disk space and is running normally. The AMP console shows that the 'Update Policy' is enabled and set to download signatures every 4 hours. Which action should the administrator take to resolve the issue?

Accepted Answer

Clear the update cache on the affected endpoints by running 'c:\Program Files\Cisco\AMP\xxxxx\amp_update.exe --clear-cache' from an elevated command prompt.. The correct action is to clear the update cache on the affected endpoints. When endpoints show as 'Out of Date' despite being able to reach the private cloud on TCP 443 and having the correct update policy, the local signature cache is often corrupted or stale. Running `amp_update.exe --clear-cache` forces the connector to discard its cached signature data and download a fresh copy from the private cloud, resolving the update failure without requiring a service restart or policy change.

Answer

Restart the Cisco AMP for Endpoints connector service on the affected endpoints.

Answer

Change the update policy interval from 4 hours to 1 hour to force more frequent checks.

Answer

Check if the firewall is blocking the signature update port 443 for those specific endpoints.

Question 15

A large enterprise has deployed Cisco ISE for network access control. The network consists of multiple access switches and wireless LAN controllers. The security team wants to enforce that only domain-joined Windows computers with up-to-date antivirus can access the corporate network. Non-compliant devices should be placed in a quarantine VLAN with limited access to remediation servers. The ISE policies are configured with posture assessment. However, during a test, a non-compliant Windows computer is granted full network access instead of being quarantined. The ISE logs show that the posture assessment passed, but the computer's antivirus is outdated. What is the most likely reason for this behavior?

Accepted Answer

The posture policy is configured with 'continue' action for non-compliant status, allowing the user to proceed to authorization.. Option B is correct because in Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

Answer

The authorization policy is matching before the posture policy is evaluated.

Answer

The posture agent is not installed on the endpoint, so the assessment is skipped.

Answer

The posture requirement is set to 'mandatory' but the agent is set to 'any', allowing non-compliant devices.