350-701 Practice Test 37 — 15 Questions

Question 1

A company deploys Cisco ASA with clientless SSL VPN to provide remote access to internal web-based applications. Users connect via a web browser and authenticate using RADIUS. The security policy requires that users re-authenticate after 15 minutes of inactivity. The administrator configures the group-policy with 'vpn-idle-timeout 15' and 'vpn-session-timeout 60'. After testing, the administrator finds that users can still access the internal web applications even after the VPN session has timed out. The administrator checks the ASA logs and confirms that the VPN session is indeed terminated. The web applications are standard HTTP-based and do not have their own session timeout mechanisms. What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web applications use persistent cookies that do not require re-authentication.. Clientless SSL VPN uses a web portal that relies on cookies to maintain the user's authenticated state. When the VPN session times out, the ASA terminates the VPN tunnel, but the web browser still holds the authentication cookie for the internal web application. Since the web application itself has no session timeout, the cookie remains valid, allowing the user to continue accessing the application without re-authentication. The ASA's vpn-idle-timeout and vpn-session-timeout only control the VPN tunnel, not the application-layer cookies.

Answer

The clientless SSL VPN portal uses 'application-specific' timeout settings.

Answer

The RADIUS server is sending the 'Session-Timeout' attribute that overrides the ASA configuration.

Answer

The ASA is configured with 'webvpn' and 'cache' enabled, which caches the application pages.

Question 2

A large enterprise recently migrated to Cisco Email Security Appliance (ESA) for inbound email filtering. The security team notices an increasing number of phishing emails that bypass the spam filter. Analysis shows that these emails originate from a legitimate but compromised domain (example-bank.com), use valid DKIM signatures, and have low spam scores due to carefully crafted benign text and embedded images. The team already has SenderBase enabled and uses the default spam threshold. The CEO received a convincing phishing email that led to a credential leak. Which course of action should the security team take to best mitigate this threat without causing significant false positives?

Accepted Answer

Create a content filter that detects the domain 'example-bank.com' in the envelope sender and sets the action to 'drop'.. Creating a content filter to detect the specific malicious domain in the envelope sender (MAIL FROM) and applying a 'drop' action directly blocks emails from that compromised domain. This targeted approach minimizes false positives on other domains. Option A is incorrect because increasing the spam threshold may still not catch these low-scoring emails and could increase false positives. Option B is incorrect because graymail filtering targets bulk or newsletter emails, not targeted phishing from a compromised legitimate domain. Option D is incorrect because DMARC with quarantine would only help if the domain were being spoofed; however, these emails are coming from the actual legitimate domain which is compromised, so DMARC would not apply.

Answer

Increase the spam threshold to catch lower-scoring emails.

Answer

Enable graymail filtering to categorize these emails as bulk suspicious.

Answer

Implement DMARC with a quarantine policy for the domain.

Question 3

In AWS, which resource acts as a stateful firewall at the instance level to control inbound and outbound traffic?

Accepted Answer

Security Group. Security groups in AWS are stateful firewalls that operate at the instance level, while NACLs are stateless at the subnet level.

Answer

Network ACL

Answer

Internet Gateway

Answer

VPC Flow Logs

Question 4

An organization is adopting a zero-trust model for cloud access. Which component enforces conditional access policies based on user, device, location, and risk level in Azure AD?

Accepted Answer

Azure AD Conditional Access. Azure AD Conditional Access evaluates signals (user, device, location, risk) and enforces policies like requiring MFA or blocking access.

Answer

Azure AD Identity Protection

Answer

Azure Security Center

Answer

Privileged Identity Management (PIM)

Question 5

In the shared responsibility model, which is the customer's responsibility in a SaaS model?

Accepted Answer

Data classification and access control. In SaaS, the provider manages the application, runtime, OS, and infrastructure. The customer is responsible for data and access management.

Answer

Network security

Answer

Physical data center security

Answer

Application security patches

Question 6

A company is using Cisco Umbrella for cloud security. Which two features are part of the Secure Internet Gateway (SIG) functionality? (Choose two.)

Accepted Answer

Cloud-delivered firewall. Secure Internet Gateway (SIG) functionality in Cisco Umbrella includes cloud-delivered firewall and web proxy. DNS-layer security is a separate core Umbrella feature, not part of SIG.

Answer

CASB functionality

Answer

CSPM capabilities

Answer

DNS-layer security

Question 7

A security administrator is configuring Cisco ISE for guest access. Which TWO components are required to allow guests to self-register and obtain network access? (Choose two.)

Accepted Answer

Guest VLAN. Guest self-registration requires a sponsor portal (or self-registration portal) and a guest VLAN or restricted ACL to provide limited access initially. The self-registration portal is typically part of the sponsor portal.

Answer

Device sensor

Answer

Posture assessment policy

Answer

Active Directory integration

Question 8

Which two controls are considered part of a zero-trust architecture for cloud access? (Choose two.)

Accepted Answer

Multi-factor authentication for all cloud access. Zero trust relies on identity verification (MFA) and granular access policies (conditional access) rather than network location.

Answer

Static firewall rules based on IP addresses

Answer

Permanent privileged role assignments

Answer

Network-based VPN for all users

Question 9

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 10

A company deploys a Cisco ASAv in AWS for VPN termination. They need to enforce multi-factor authentication (MFA) for remote access VPN users. Which Cisco solution integrates with ASAv to provide MFA?

Accepted Answer

Cisco Duo. Cisco Duo is the correct solution because it is a cloud-based MFA platform that integrates directly with the Cisco ASAv via the AnyConnect VPN client or the ASA's authentication proxy. Duo acts as a RADIUS or LDAP proxy, intercepting authentication requests and prompting users for a second factor (e.g., push notification, OTP) after primary credentials are validated. This provides the required multi-factor authentication for remote access VPN users without requiring additional on-premises infrastructure.

Answer

Cisco Umbrella

Answer

Cisco ISE

Answer

Cisco Cloudlock

Question 11

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Accepted Answer

Fileless attack techniques (e.g., PowerShell injection). Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

Answer

Malicious DNS queries

Answer

Phishing email headers

Answer

Anomalous network traffic patterns

Question 12

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan infrastructure-as-code templates for misconfigurations and container images for vulnerabilities. Which two tools are appropriate? (Select two.)

Accepted Answer

Trivy. IaC scanning can use Checkov or similar, and container scanning tools like Trivy or Clair are common.

Answer

SAST

Answer

HashiCorp Vault

Answer

DAST

Question 13

A hospital uses Cisco ESA for email security. The compliance team requires that all emails containing protected health information (PHI) be encrypted before leaving the organization. The administrator has configured a content filter that matches emails containing patterns like 'Patient ID: [0-9]{9}' and sends them to the encryption service. However, some encrypted emails are being rejected by the recipient's mail server because the encryption is applied after the email has already been processed. What is the most likely reason for this issue?

Accepted Answer

The encryption action is configured as 'deliver then encrypt' instead of 'encrypt then deliver'.. Cisco ESA processes emails through a series of mail policies and content filters before delivery. If the encryption action is configured as 'deliver then encrypt', the email is first sent to the recipient's mail server, and then encryption is attempted as a separate, asynchronous action. This means the email leaves the organization unencrypted, and the recipient's server may reject it if it expects encryption from the start. The correct configuration should be 'encrypt then deliver', which ensures the email is encrypted before it is queued for delivery, preventing rejection due to unencrypted content.

Answer

The content filter is only applied to incoming emails, not outgoing.

Answer

The recipient's mail server does not support the encryption protocol used.

Answer

The email exceeds the maximum size limit for encryption.

Question 14

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. The AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 15

Which TWO of the following are valid approaches to mitigate ARP spoofing attacks on a switched network?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) on VLANs. Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in a network. It relies on a DHCP snooping binding database to map IP addresses to MAC addresses, and it drops ARP packets that have invalid IP-to-MAC bindings, thereby preventing ARP spoofing attacks on a switched network.

Answer

Enable BPDU Guard on all switchports

Answer

Enable Port Security on all access ports

Answer

Enable DHCP Snooping globally