350-701 Practice Test 36 — 15 Questions

Question 1

A company deploys Cisco Firepower Threat Defense (FTD) in transparent mode. They create an access control rule to allow HTTP traffic from the inside network (10.10.10.0/24) to a web server at 192.168.1.100. The rule is configured with action 'Allow', a source zone 'inside', a destination zone 'outside', and an intrusion policy attached. After deployment, users report they cannot access the web server. The administrator verifies that the web server is reachable from other networks and that the FTD management interface is accessible. The FTD's packet capture shows no traffic matching the rule. The rule is listed first in the access control policy. What is the most likely cause of the problem?

Accepted Answer

The FTD is in transparent mode, so it does not use zones; the rule should be assigned to an interface pair.. In transparent mode, Cisco Firepower Threat Defense (FTD) operates as a Layer 2 bridge and does not use security zones. Instead, traffic is controlled by interface pairs. The rule configured with source and destination zones will never match traffic because transparent mode bypasses zone-based policy enforcement. The correct approach is to assign the rule to an interface pair (e.g., inside to outside) rather than zones.

Answer

The intrusion policy is blocking the traffic.

Answer

The web server's IP address is not correctly defined in the network object.

Answer

The rule's action is set to 'Monitor' instead of 'Allow'.

Question 2

A large enterprise uses Cisco TrustSec to enforce segmentation between departments. The network consists of Cisco Catalyst switches running IOS XE with IP ACLs and Security Group Tags (SGTs). The security policy requires that traffic from the Engineering group (SGT=10) to the Finance group (SGT=20) be allowed only to TCP port 443. The administrator configures a Security Group Access Control List (SGACL) on Cisco ISE with a permit statement for TCP 443 and a deny for all other traffic, and pushes it to the switches. After deployment, they notice that Engineering users can access Finance servers not only on TCP 443 but also on other ports. The administrator verifies that the SGACL is correctly configured on ISE and that the switches are receiving the SGTs. Additionally, the switches have IP ACLs on the interfaces. What is the most likely cause of this issue?

Accepted Answer

The IP ACLs on the switches are overriding the SGACL.. The most likely cause is that IP ACLs on the switch interfaces are overriding the SGACL. In Cisco TrustSec, SGACLs are applied after SGT classification and are evaluated in the forwarding path, but if a traditional IP ACL is configured on the same interface, it is processed first and can permit or deny traffic independently of the SGACL. Since the IP ACLs are present and not configured to match the required policy, they allow traffic on ports other than TCP 443, bypassing the SGACL enforcement.

Answer

The SGT classification is not occurring on the access switches.

Answer

The SGACL is applied only on the inbound direction of the interface.

Answer

The switches are not running Cisco TrustSec-compatible software.

Question 3

A security analyst is investigating a malware incident on an endpoint protected by Cisco AMP for Endpoints. The Device Trajectory shows that a file named 'invoice.exe' was detonated from a USB drive. The file's cloud verdict was 'Unknown' at the time of execution. The analyst sees that the file spawned multiple child processes that made outbound connections to a malicious IP. The AMP policy has 'Exploit Prevention' enabled but 'File Reputation' is set to 'Monitor' only. The analyst wants to prevent similar incidents in the future without blocking legitimate applications. Which action should the analyst recommend?

Accepted Answer

Change the File Reputation setting to 'Block' for files with 'Unknown' disposition.. Option B is correct because setting File Reputation to 'Block' would have prevented execution of 'Unknown' files like invoice.exe. However, this might block legitimate unknown files. Option A (blocking USB execution) is too restrictive. Option C (enabling more exploit prevention rules) would not have stopped this file because it was malware, not an exploit. Option D (adding file hash to blacklist) is reactive and not proactive.

Answer

Block all execution of applications from removable media via Group Policy.

Answer

Enable all Exploit Prevention rules, including those for script-based attacks.

Answer

Add the SHA256 hash of 'invoice.exe' to the global blacklist.

Question 4

A company uses Microsoft Azure and has deployed Cisco CloudCenter for workload lifecycle management. They also use Cisco Firepower NGFW in Azure. A security analyst notices that the Firepower logs show outbound connections from a workload to an IP address in a known threat feed. The workload is a Linux server that runs a custom application. The analyst checks Azure Network Security Groups (NSGs) and finds that outbound traffic is not restricted. The company's policy requires that all outbound traffic be inspected and logged. The analyst wants to block the specific IP while allowing other outbound traffic. Which action should be taken?

Accepted Answer

Create a Firepower Access Control policy rule to block traffic to the threat IP and log it.. Option B is correct because Cisco Firepower NGFW is the inline security enforcement point in this Azure deployment, and it can inspect and log all outbound traffic. Creating a Firepower Access Control policy rule to block the specific threat IP and log it directly enforces the security policy at the firewall layer, which is the only device capable of deep packet inspection and logging as required by company policy. NSGs operate at Layer 3/4 and cannot inspect application-layer traffic or integrate with threat feeds for granular IP blocking without affecting other traffic.

Answer

Configure the NSG to deny all outbound traffic and then add allow rules for known good destinations.

Answer

Add a network security group rule to block the specific IP address.

Answer

Modify the route table to send all outbound traffic through a firewall, bypassing the NSG.

Question 5

A company has deployed Cisco Umbrella with a virtual appliance (VA) for content filtering. Users report that some websites are not loading properly, and the helpdesk suspects that the VA is blocking legitimate traffic. The network administrator checks the VA dashboard and sees that the VA is passing traffic normally. However, the administrator notices that the VA's upstream DNS server is set to a public resolver (208.67.222.222) instead of the company's internal DNS servers. This causes internal hostnames to resolve incorrectly. The company uses Active Directory with domain-joined computers. What should the administrator do to resolve the issue?

Accepted Answer

Change the upstream DNS server in the VA configuration to point to the internal DNS servers.. The virtual appliance (VA) acts as a forwarding proxy; it receives DNS queries from clients, forwards them to its configured upstream DNS server, and applies content filtering policies. When the upstream DNS is set to a public resolver like 208.67.222.222 (OpenDNS), the VA cannot resolve internal Active Directory domain names (e.g., .local or internal FQDNs) because the public resolver has no knowledge of the private DNS zone. Changing the upstream DNS server to the company's internal DNS servers allows the VA to resolve both internal and external names correctly, while still applying Umbrella's content filtering policies to external traffic.

Answer

Add a conditional forwarder in the internal DNS for all .local domains.

Answer

Configure the clients to use Umbrella's DNS directly instead of the VA.

Answer

Disable Umbrella content filtering for internal domain names.

Question 6

A large enterprise uses Cisco WSA with integrated Cisco Advanced Malware Protection (AMP) to inspect web traffic. The security policy dictates that all downloaded files should be scanned by AMP. Recently, a user downloaded a PDF file from a trusted vendor site, but the download was blocked by the WSA. The administrator checks the WSA logs and sees that the file was blocked due to AMP's 'File Reputation' score of 10 (high risk). However, the vendor confirms the file is legitimate. The administrator notes that the file is digitally signed by the vendor. What is the most appropriate next step to allow the file while maintaining security?

Accepted Answer

Add the file's SHA-256 hash to the AMP custom allow list to override the reputation.. Option C is correct because Cisco AMP allows administrators to create custom allow lists using file hashes (SHA-256) to override the file reputation score. Since the file is digitally signed and confirmed legitimate, adding its SHA-256 hash to the AMP custom allow list will permit the download while still scanning other files from that domain, preserving security. This approach directly addresses the false positive without broadly reducing security controls.

Answer

Add the vendor's domain to the WSA's global URL whitelist.

Answer

Lower the AMP file reputation threshold from 10 to 7 to allow files with lower risk scores.

Answer

Disable AMP scanning for the vendor's domain in the WSA policy.

Question 7

A university IT team manages 1,000 macOS laptops for students using Cisco AMP for Endpoints. They receive reports that some students' laptops are running slowly and fans are spinning constantly. The team checks the AMP console and sees that these endpoints are performing constant file scans on user directories. The team suspects that the AMP scanning is causing high CPU usage. They want to optimize performance without compromising security. The laptops use the default AMP policy with real-time scanning enabled. What should the team do?

Accepted Answer

Add exclusions for common user data directories in the AMP policy.. Option D is correct because adding exclusions for known safe folders (like default user document directories) reduces unnecessary scanning. Option A (disable real-time scanning) would leave endpoints vulnerable. Option B (increase scanning interval) is not applicable to real-time scanning. Option C (reduce notification alerts) does not affect CPU usage.

Answer

Reduce the number of alert notifications to limit AMP's background activity.

Answer

Increase the file scanning interval to every 30 seconds instead of real-time.

Answer

Disable real-time scanning and rely on scheduled scans.

Question 8

A small business uses Cisco AMP for Endpoints with a cloud-based console. The owner receives an email from Cisco that the AMP connector on a specific endpoint has gone offline. The endpoint is a Windows 10 laptop used for remote work. The owner checks the AMP console and sees the endpoint's last check-in was three days ago. The owner contacts the remote user, who says the laptop is running normally and they can access the internet. What should the owner do to resolve the issue?

Accepted Answer

Instruct the user to restart the AMP connector service (Cisco AMP for Endpoints Connector).. Option C is correct because the most likely issue is that the AMP connector service has stopped or crashed. Restarting the service will re-establish communication. Option A (reinstall connector) is unnecessary. Option B (check firewall) is less likely since internet access works. Option D (update Windows) is not directly related.

Answer

Instruct the user to disable Windows Firewall temporarily.

Answer

Ask the user to install the latest Windows updates.

Answer

Ask the user to uninstall and reinstall the AMP connector.

Question 9

A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?

Accepted Answer

Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.. Option C is correct because duplicate events are caused by multiple policies with the same syslog action. Consolidating policy assignments ensures that each endpoint receives only one policy with syslog forwarding. Option A (disable API) would stop API pulls but not duplicates from syslog. Option B (disable one policy) might remove the syslog action from one policy but could leave gaps if that policy has other important settings. Option D (increase detection interval) does not affect duplicates.

Answer

Disable the AMP API to stop duplicates from multiple data sources.

Answer

Increase the event detection interval to reduce the number of events generated.

Answer

Remove the 'Send to Syslog' action from one of the two policies.

Question 10

An organization is deploying Cisco Secure Endpoint (AMP) in a high-security environment where endpoints are air-gapped from the internet. The security team needs to maintain up-to-date threat intelligence without direct cloud access. They have a dedicated local server that can download feeds from the AMP cloud once and distribute to endpoints. The server runs the AMP Private Cloud software. However, after installation, endpoints are not receiving updates. The team verifies that the Private Cloud server can reach the AMP cloud via a managed proxy. The endpoints can communicate with the Private Cloud server on TCP 443. What is the most likely cause of the update failure?

Accepted Answer

The Private Cloud appliance has not been registered and licensed in the AMP console.. Option B is correct because the Private Cloud must be registered and licensed with Cisco to receive updates. Without registration, it cannot download threat intelligence. Option A (proxy misconfiguration) is possible but the team verified the proxy works. Option C (endpoint certificate issue) is less likely; endpoints authenticate via policy. Option D (Private Cloud out of disk space) would log errors, but not the primary cause if the server is newly set up.

Answer

The proxy is not properly configured to allow HTTPS from the Private Cloud to the AMP cloud.

Answer

The endpoints are using an incorrect certificate to authenticate to the Private Cloud.

Answer

The Private Cloud server's disk is full, preventing new update downloads.

Question 11

A financial company uses Cisco AMP for Endpoints to protect 500 Windows workstations. The security administrator notices that several endpoints in the accounting department are showing 'Out-of-Date' status for over a week. The administrator checks the AMP console and sees that the group policy for accounting has been modified to disable certain scanning features. The endpoints have Internet connectivity but are not updating their policy or receiving new definitions. The administrator suspects a misconfiguration. What should the administrator do first to resolve this issue?

Accepted Answer

Verify that the endpoints can communicate with the AMP cloud by checking the connector's connectivity status.. Option A is correct because the most common cause of 'Out-of-Date' endpoints is a communication issue. Checking the AMP connector's connection status (e.g., via the connector GUI) can reveal if the endpoint can reach the cloud. Option B (restart services) might temporarily fix but not identify root cause. Option C (reinstall connector) is drastic and should be last resort. Option D (increase polling interval) does not help if there is a connectivity obstacle.

Answer

Restart the AMP services on a few affected endpoints to force a policy update.

Answer

Increase the policy polling interval from 60 minutes to 30 minutes.

Answer

Reinstall the AMP connector on all affected endpoints.

Question 12

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Accepted Answer

Upgrade the switch IOS to a version that supports the new ISE posture attributes.. Option B is correct because older IOS versions may not properly interpret the new RADIUS attributes sent by ISE during posture assessment, causing session termination. Upgrading to a supported IOS version resolves the compatibility issue. Option A is incorrect because ignoring the Session-Timeout attribute is not a recommended practice and may cause security issues. Option C is incorrect because disabling posture for these ports is a workaround, not a solution. Option D is incorrect because increasing the timeout does not address the root cause, which is the switch's inability to handle the attribute.

Answer

Disable posture assessment for the affected switch ports using a different authorization policy.

Answer

Configure the switches to ignore the Session-Timeout attribute sent by ISE.

Answer

Increase the session-timeout value in the ISE authorization profile to a larger value.

Question 13

A government agency is deploying Cisco ISE with a posture agent to ensure endpoints comply with security policies before accessing the network. The posture policy requires that all Windows computers have antivirus (AV) software running. The engineer configures a condition 'AV installed and running' and binds it to an authorization profile that grants full access if compliant, or quarantine if not. During testing, a computer that has AV installed and running (verified manually) is placed in quarantine. ISE logs show 'Posture - AV condition not satisfied'. The engineer checks the ISE posture configuration: the AV condition uses a default Cisco AV dictionary. What is the most likely cause?

Accepted Answer

The AV vendor is not supported by the ISE default posture dictionary. The posture condition uses a dictionary that maps known AV products. If the specific AV brand is not in the Cisco default dictionary, the condition will fail even if AV is running. Option B is correct. Option A would affect many. Option C would cause other issues. Option D is possible but less likely.

Answer

The posture policy is configured to require the AV version as well

Answer

The client's ISE posture agent is not installed

Answer

The client's firewall is blocking communication with ISE

Question 14

A hospital is deploying Cisco ISE for network access control. They have a mix of employee laptops, medical devices (e.g., infusion pumps), and guest smartphones. The network uses Cisco Catalyst 9300 switches and Aironet 3700 series access points. For medical devices, the policy must use Machine Authentication (MAB) since they are 802.1X incapable. The ISE policy authenticates via MAB and then assigns the device to a specific VLAN for medical devices. During a pilot, the network team notices that some infusion pumps (MAC: 00:1A:2B:3C:4D:5E) are failing MAB authentication. The switch logs show 'Authentication failed for MAC 001a.2b3c.4d5e on interface GigabitEthernet1/0/10'. ISE logs show 'Authentication failed - RADIUS server rejected - Reason: Invalid Endpoint ID'. The engineer has verified the MAC address is in the ISE endpoint repository with correct identity group. What should the engineer check next to resolve this issue?

Accepted Answer

Check the MAC address format in the ISE endpoint identity store (such as using lowercase with a hyphen separator). The error 'Invalid Endpoint ID' typically indicates that the username/password used for MAB is not matching. For MAB, the switch sends the MAC address as both username and password. If the ISE repository has the MAC but the authentication profile expects a different format (e.g., lowercase, colon-separated), it can fail. Option B is correct because the switch might be sending the MAC in different case (upper vs lower) or without dashes. Option A would cause different error. Option C would prevent any auth. Option D would cause other services to fail, not specific to MAB.

Answer

Verify that the switch port is configured with 'authentication port-control auto'

Answer

Confirm that the ISE policy for MAB allows the device to authenticate

Answer

Ensure the RADIUS shared secret is correct on the switch and ISE

Question 15

A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?

Accepted Answer

The proxy target rules in ISE do not match the WLC's NAS-IP-Address. The error 'unable to find a suitable proxy target' indicates that the ISE node cannot determine which proxy to use for the authentication request, often due to proxy target rules not matching the incoming request attributes like NAS-IP-Address. Option D is correct because if the proxy target rules are missing or incorrect, ISE cannot forward the request. Option A would cause different errors. Option B might cause performance but not internal error. Option C would cause connection errors, not proxy target errors.

Answer

The WLC is not configured to use the ISE proxy nodes as RADIUS servers

Answer

The RADIUS shared secret is mismatched between WLC and ISE

Answer

ISE node CPU is overloaded due to high authentication load