350-701 Practice Test 35 — 15 Questions

Question 1

An organization wants to implement multi-factor authentication (MFA) for administrative access to network devices. Which two methods can be used with Cisco Duo to provide MFA for admin access? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Push notification. Push notification is correct because Cisco Duo can send a push notification to the Duo Mobile app on the administrator's smartphone. The admin approves or denies the login attempt directly from the app, providing a seamless and secure second factor for authentication to network devices.

Answer

SMS passcode

Answer

Biometric fingerprint

Answer

Bypass code

Question 2

A company uses Cisco Web Security Appliance (WSA) to filter web traffic. The security team wants to block access to a specific category of websites (e.g., 'Social Networking') for all users except the HR department. Which WSA feature should be used to achieve this policy?

Accepted Answer

Identity-based policy. Identity-based policies in Cisco WSA allow you to apply different access rules based on the user or group identity, typically authenticated via Active Directory or LDAP. By creating an identity-based policy that exempts the HR department (e.g., via an AD group) and blocks the 'Social Networking' category for all other users, you achieve the required granular control without affecting the entire organization.

Answer

Routing policy

Answer

Decryption policy

Answer

Global access policy

Question 3

Which THREE of the following are true regarding HTTPS decryption on Cisco Web Security Appliance (WSA)? (Choose three.)

Accepted Answer

Decryption can be selectively applied based on URL category.. Cisco WSA allows administrators to define decryption policies that selectively decrypt HTTPS traffic based on URL categories (e.g., Social Networking, Finance, Health). This granular control enables organizations to balance security inspection with privacy compliance, decrypting only high-risk categories while bypassing sensitive ones like banking or healthcare.

Answer

Decryption is transparent to the user and does not require any client configuration.

Answer

HTTPS decryption is enabled by default for all traffic.

Question 4

An organization discovers that a man-in-the-middle attack was successfully performed using a forged certificate issued by a trusted CA. The legitimate CA’s private key was compromised. Which PKI component was breached?

Accepted Answer

Certification Authority (CA) private key. The man-in-the-middle attack succeeded due to a forged certificate issued by a trusted CA, which directly implies that the CA's private key was compromised. The CA's private key is the root of trust in a PKI; if it is stolen, an attacker can sign fraudulent certificates that will be trusted by all clients that trust the CA. Without the private key, the attacker could not have created a valid forged certificate.

Answer

Online Certificate Status Protocol (OCSP) responder

Answer

Registration Authority (RA)

Answer

Certificate Revocation List (CRL)

Question 5

Which security concept involves creating multiple layers of defense so that if one layer is breached, subsequent layers still provide protection?

Accepted Answer

Defense in depth. Defense in depth is a security architecture strategy that layers independent defensive mechanisms (e.g., firewalls, IDS/IPS, endpoint protection, encryption) so that if one layer is compromised, subsequent layers continue to protect the asset. This concept is fundamental to the 350-701 exam as it underpins Cisco's SecureX and integrated security fabric approach, where multiple controls (like ASA, Firepower, and Umbrella) work together to provide resilience against breaches.

Answer

Zero Trust

Answer

Separation of duties

Answer

Least privilege

Question 6

Which THREE features are available in Cisco Umbrella to protect against DNS-based threats? (Choose three.)

Accepted Answer

IP-layer enforcement. Cisco Umbrella provides DNS-layer security (option C) as its core function, intercepting DNS queries to block requests to malicious domains before a connection is established. IP-layer enforcement (option A) extends protection by applying policies based on the destination IP address, blocking traffic to known malicious IPs even if DNS resolution is bypassed. Application control (option B) allows administrators to permit or block specific cloud applications (e.g., Dropbox, Facebook) at the DNS level, preventing data exfiltration or unauthorized usage through DNS-based application identification.

Answer

Data Loss Prevention (DLP)

Answer

Anti-virus scanning

Question 7

An organization is deploying Cisco Cloud Workload Protection (CWP) in AWS. Which THREE of the following components are part of a standard CWP architecture?

Accepted Answer

Workload sensor (agent or agentless). The workload sensor (agent or agentless) is a core component of Cisco Cloud Workload Protection (CWP) because it provides visibility into workload activity, including process execution, network connections, and file integrity. This sensor collects telemetry data from workloads running in AWS and forwards it to the centralized analysis engine for threat detection and policy enforcement.

Answer

Cloud Security Posture Management (CSPM) scanner

Answer

Cisco Umbrella DNS connector

Question 8

A company is deploying cloud workload protection for their Azure VMs. They want to ensure that security policies are automatically adjusted based on workload changes. Which technology should they implement?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct choice because it provides workload protection for Azure VMs with automatic policy adjustment based on workload changes. It uses agent-based and agentless sensors to collect telemetry, builds a dependency map, and enforces micro-segmentation policies that dynamically adapt as workloads scale, migrate, or change, meeting the requirement for automated security policy adjustment.

Answer

Cisco Firepower NGFW

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch

Question 9

A company wants to allow employees to access webmail services but block any upload of attachments that contain malware. Which feature of Cisco WSA should be configured?

Accepted Answer

Malware scanning with DVS engine. The Dynamic Vectoring and Scoring (DVS) engine in Cisco WSA provides advanced malware detection by analyzing file attachments in real time, including webmail uploads. It uses multiple scanning techniques, such as reputation analysis and file-type identification, to block malware before it reaches the user. This directly addresses the requirement to prevent malware-laden attachments in webmail traffic.

Answer

Data Loss Prevention (DLP) policy

Answer

Application Visibility and Control (AVC)

Answer

URL filtering policy

Question 10

Refer to the exhibit. The crypto map is applied to an interface. Which additional configuration is necessary for IPsec to function correctly?

Accepted Answer

Configure an ISAKMP policy (IKE phase 1) with pre-shared key or certificate. IPsec requires both IKE Phase 1 (ISAKMP) and Phase 2 to be configured. The crypto map references a transform-set and an access list, but without an ISAKMP policy defining authentication (pre-shared key or certificate) and encryption/hash parameters, IKE cannot establish a secure control channel. Option D is correct because the ISAKMP policy is mandatory for IKE Phase 1 negotiation before IPsec SAs can be created.

Answer

Define an extended access list for interesting traffic

Answer

Create a tunnel interface and apply the crypto map to it

Answer

Create a transform-set with the same parameters as the proposal

Question 11

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

Accepted Answer

An ACL to match the traffic to be translated. For NAT to translate traffic, the firewall must know which traffic to translate. An ACL is used to match the source IP addresses (or networks) that should be translated. Without an ACL applied to the NAT rule, the firewall has no criteria to identify traffic from VLAN 10 for translation, so packets are forwarded without NAT, causing internet access to fail while internal routing works.

Answer

A NAT pool with available public IP addresses

Answer

Port Address Translation (PAT) configuration

Answer

A route map to apply NAT based on destination

Question 12

Which TWO of the following are true about MACsec?

Accepted Answer

It uses IEEE 802.1AE standard. MACsec is defined by the IEEE 802.1AE standard, which specifies a security protocol for providing data confidentiality, integrity, and origin authenticity at Layer 2. It operates directly on Ethernet frames, encrypting the payload while preserving the frame header for transparent forwarding. This makes option B correct because the standard is the foundational reference for MACsec.

Answer

It requires a PKI

Answer

It provides data confidentiality only

Answer

It is used for WLAN security

Question 13

Which THREE are key components of Cisco's Cloud Security architecture? (Choose three.)

Accepted Answer

Cisco Duo. Cisco Duo is a key component of Cisco's Cloud Security architecture because it provides multi-factor authentication (MFA) as a cloud-delivered service, enforcing zero-trust access policies for users connecting to cloud applications and resources. It integrates with various identity providers and applications via SAML, RADIUS, and OAuth, ensuring that only authenticated and authorized users gain access, which is fundamental to securing cloud environments.

Answer

Cisco Catalyst switches

Answer

Cisco Meraki access points

Question 14

A company deploys Cisco ISE for network access control. They need to allow guests to access the internet via a self-registration portal. Which two components must be configured? (Choose two.)

Accepted Answer

Self-registration portal. Guest access in ISE requires a sponsor portal (for approval) or self-registration portal, and integration with the network devices (switches/WLCs) for guest VLAN assignment.

Answer

EAP-TLS authentication

Answer

Posture assessment for guests

Answer

MAB for guest devices

Question 15

A small business uses Cisco Umbrella to protect its 50 employees. One employee reports that they cannot access a specific website (www.example.com) that is required for their work. The administrator checks the Umbrella dashboard and sees that the domain is categorized as 'Social Networking' and is blocked by the company's policy. However, the employee argues that the website is actually a business tool. The administrator verifies that the website is indeed legitimate. What is the best course of action to restore access while maintaining security?

Accepted Answer

Create a policy override to allow the specific domain while keeping the category blocked.. Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

Answer

Contact Cisco Umbrella support to re-categorize the domain.

Answer

Disable the 'Social Networking' category blocking policy.

Answer

Remove the user from the Umbrella policy entirely.