350-701 Practice Test 36 — 15 Questions

Question 1

A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?

Accepted Answer

Ransomware. Ransomware is a type of malware that encrypts files on a victim's system and demands payment (usually cryptocurrency) for the decryption key. The scenario describes exactly this behavior: malware encrypts files and demands payment for decryption, which is the defining characteristic of ransomware.

Answer

Remote Access Trojan (RAT)

Answer

Botnet C2

Answer

Keylogger

Question 2

In the shared responsibility model for cloud services, which layer is the customer responsible for managing in an IaaS environment?

Accepted Answer

Operating system, applications, and data. In the IaaS shared responsibility model, the cloud provider secures the physical infrastructure (servers, networking, hypervisor), while the customer is responsible for everything from the guest OS upward — including the operating system, middleware, applications, and data. This is the defining characteristic of IaaS: the customer manages the OS and above.

Answer

Virtual machines and storage only

Answer

Only data and access policies

Answer

Physical servers and networking

Question 3

A cloud architect is designing a hybrid network between on-premises and AWS. They need to ensure traffic to the internet from the VPC uses the on-premises security stack for inspection. The VPC has an Internet Gateway (IGW). What must be configured to force outbound traffic to the on-premises firewall?

Accepted Answer

Update the VPC route table to point 0.0.0.0/0 to the virtual private gateway or transit gateway attachment. To force all outbound internet traffic from the VPC through the on-premises firewall, the VPC route table must have a default route (0.0.0.0/0) pointing to the virtual private gateway (VPG) or transit gateway (TGW) attachment. This directs traffic over the VPN or Direct Connect to the on-premises network, where the security stack inspects it before reaching the internet. The Internet Gateway (IGW) remains present but is not used for this traffic because the route table entry overrides it.

Answer

Use VPC Endpoints for all services

Answer

Deploy a NAT Gateway and assign it to the route table

Answer

Configure security groups to block direct internet access

Question 4

Which authentication factor does a fingerprint scanner represent?

Accepted Answer

Inherence factor (something you are). Inherence factors are based on biological traits like fingerprints.

Answer

Knowledge factor (something you know)

Answer

Possession factor (something you have)

Answer

Location factor (somewhere you are)

Question 5

An administrator needs to enforce 802.1X authentication for devices that do not support 802.1X supplicants. Which method should be configured on Cisco ISE to allow these devices to authenticate?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows non-supplicant devices to authenticate based on their MAC address.

Answer

802.1X with EAP-TLS

Answer

Guest portal

Answer

PEAP-MSCHAPv2

Question 6

An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol, RFC 6960) allows a client to query a responder for the revocation status of a specific certificate in real time, returning 'good', 'revoked', or 'unknown' without downloading the entire CRL. This satisfies the requirement for real-time revocation checking with minimal bandwidth. OCSP is the standard replacement for CRL-based checking in latency-sensitive environments.

Answer

SCEP

Answer

EST

Answer

CRL

Question 7

A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)

Accepted Answer

Never trust, always verify. Option B (Never trust, always verify) is a core Zero Trust principle because it requires every access request to be explicitly authenticated and authorized based on identity, device health, and context, regardless of network location. Option C (Least privilege access) is correct because Zero Trust enforces just-in-time and just-enough-access (JIT/JEA) so users and workloads receive only the minimum permissions needed, limiting lateral movement. Option D (Microsegmentation) is correct because Zero Trust relies on granular network segmentation, often at the workload or application level, to prevent unrestricted east-west traffic and contain breaches. Option A (Trust but verify) reflects a traditional perimeter-based model, not Zero Trust, since Zero Trust assumes no implicit trust. Option E (Defense in depth) is a broader layered-security strategy that can complement Zero Trust but is not one of its defining core principles.

Answer

Trust but verify

Answer

Defense in depth

Question 8

A SOC analyst is investigating a BEC attack. Which three indicators should be examined in the email headers to detect the spoofing? (Choose three.)

Accepted Answer

DKIM result. The DKIM result (A) is a correct indicator because it shows whether the message's cryptographic signature validated against the sending domain's published public key, and a 'fail' or 'none' result signals possible spoofing or tampering. The SPF result (B) is correct because it records whether the sending server's IP was authorized by the envelope-from domain's SPF record, so a 'fail' or 'softfail' indicates the message may have been sent from an unauthorized host. The DMARC result (D) is correct because it combines SPF and DKIM alignment with the From: header domain and reports pass/fail, directly revealing whether the visible sender domain was spoofed. The Subject line (C) and Message body content (E) are not header authentication indicators; they are message content that may contain social-engineering clues but do not provide technical proof of spoofing.

Answer

Subject line

Answer

Message body content

Question 9

A network administrator is configuring Cisco ISE profiling to identify devices on the network. Which probe allows ISE to identify device type by analyzing the HTTP User-Agent string?

Accepted Answer

HTTP probe. The HTTP probe inspects HTTP packets, including the User-Agent field, to determine the operating system and browser type, aiding in device profiling.

Answer

DHCP probe

Answer

Device Sensor

Answer

SNMP probe

Question 10

An organization is experiencing repeated SQL injection attacks. A security analyst is tasked with recommending mitigations. Which THREE actions are most effective in preventing SQL injection? (Choose three.)

Accepted Answer

Use prepared statements with parameterized queries. Option A is correct because prepared statements with parameterized queries separate SQL code from user-supplied data, so input is treated strictly as data and cannot alter query structure, which is the most fundamental defense against SQL injection. Option C is correct because a WAF can inspect HTTP requests and block known SQL injection patterns (e.g., tautologies like ' OR 1=1--, UNION SELECT, or stacked queries), providing a valuable compensating/detection layer especially for legacy code that cannot be immediately fixed. Option D is correct because strict input validation (allowlisting expected formats, types, lengths, and character sets) rejects malformed or malicious input before it reaches the database, reducing the attack surface for injection payloads. Option B is not among the chosen answers because suppressing detailed database error messages is only a defense-in-depth measure that prevents information disclosure; it does not stop SQL injection itself. Option E is also not chosen because strong password policies for database accounts mitigate credential brute-force and unauthorized access, but they do nothing to prevent injection through application input paths.

Answer

Disable detailed database error messages in production

Answer

Enforce strong password policies for database accounts

Question 11

A company uses Cisco Umbrella SIG to secure internet access for remote users. The security team wants to block access to social media websites but allow access to business-related websites that may share the same IP addresses. Which Umbrella feature should be used to enforce this granular control?

Accepted Answer

Cloud proxy with URL filtering. Cisco Umbrella's cloud proxy with URL filtering operates at the application layer (HTTP/HTTPS), inspecting full URLs rather than just domain names. This allows the security team to block social media websites while permitting business-related websites that may resolve to the same IP addresses, as the proxy can differentiate based on the URL path and content category.

Answer

DNS security layer

Answer

ThousandEyes agents

Answer

AMP file scanning

Question 12

Which Cisco security product provides DNS-layer security to block malicious domains and cloud-based threats?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security service that provides DNS-layer filtering to block malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco ISE

Answer

Cisco AMP

Question 13

A Cisco FTD administrator is configuring SSL/TLS inspection. They want to inspect encrypted traffic to an external website that uses a certificate signed by a public CA. Which SSL/TLS inspection action should be used to decrypt this traffic?

Accepted Answer

Decrypt-resign. For traffic to external sites with public certificates, the FTD can use 'decrypt-resign' where it re-encrypts the traffic with a custom CA certificate installed on the client. 'Decrypt-known-key' is for traffic where the private key is known (e.g., internal servers).

Answer

Do not decrypt

Answer

Decrypt-known-key

Answer

Block

Question 14

A security team is implementing Privileged Access Management (PAM) using CyberArk integrated with Cisco SecureX. They need to provide just-in-time access to a critical server for a specific task, with automatic password rotation after use. Which PAM capability addresses this requirement?

Accepted Answer

Password vaulting. Password vaulting is the PAM capability that stores privileged credentials in an encrypted vault, checks them out on demand for just-in-time access, and automatically rotates them after the session ends. This directly satisfies the requirement for temporary, task-scoped access with post-use rotation. CyberArk's core offering is built around this vaulting and rotation model.

Answer

Remote shell investigation

Answer

Session recording

Answer

EDR file quarantine

Question 15

A network engineer is troubleshooting 802.1X authentication on a Cisco switch. Users report that they cannot authenticate. The engineer verifies that the switch (authenticator) is configured correctly and the RADIUS server (ISE) is reachable. Which component is most likely misconfigured on the client side?

Accepted Answer

Supplicant. In 802.1X, the supplicant is the client-side software (e.g., Cisco Secure Client/AnyConnect, Windows native supplicant) that responds to the authenticator's EAP requests and presents credentials. If the switch (authenticator) and ISE (authentication server) are verified working, the remaining likely failure point is the supplicant configuration — wrong EAP method, missing certificate, or incorrect profile. The supplicant is the only client-side component in the 802.1X triad.

Answer

Authentication server

Answer

RADIUS shared secret

Answer

Authenticator