350-701 Practice Test 37 — 15 Questions

Question 1

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA. In explicit proxy mode, the WSA only intercepts traffic that is explicitly configured to use it as a proxy. Users can bypass the proxy by configuring their browser or application to use a direct HTTPS connection (e.g., using CONNECT tunnels over port 443). To prevent this, a firewall rule must block all outbound HTTP/HTTPS traffic except traffic originating from the WSA's IP address, forcing all web traffic through the proxy.

Answer

Enable SSL decryption on the WSA

Answer

Configure identity-based authentication for all users

Answer

Create a custom URL category for tunneling websites and block them

Question 2

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

Accepted Answer

Verify that the endpoint can resolve the AMP cloud hostname using DNS.. The AMP connector must resolve the AMP cloud hostname (e.g., `amp.cisco.com`) via DNS to establish the HTTPS connection. Even if outbound HTTPS is allowed, a DNS resolution failure would prevent the endpoint from reaching the cloud, causing the 'Out-of-Date' status. Verifying DNS ensures the endpoint can translate the hostname to an IP address, which is a prerequisite for policy updates.

Answer

Configure the AMP connector to use a static IP address for the cloud.

Answer

Reboot the endpoint to force a policy download.

Answer

Verify that SNMP is enabled on the endpoint.

Question 3

A security engineer is configuring Duo for VPN authentication with AnyConnect. Which authentication factor does Duo provide in addition to the user's primary credentials?

Accepted Answer

Second-factor authentication (push, TOTP, etc.). Duo integrates with Cisco AnyConnect via RADIUS to add a second authentication factor on top of the user's primary credentials (username/password). After the primary credentials are validated, Duo pushes a prompt, TOTP code, or phone call to the user's enrolled device, and only upon approval does the VPN session establish. This is the core value proposition of Duo as a multi-factor authentication (MFA) service for VPN access.

Answer

RADIUS accounting

Answer

SAML assertion

Answer

Machine certificate validation

Question 4

An organization uses Cisco Umbrella to block malicious domains. Which layer does Umbrella primarily operate at to prevent connections before they are established?

Accepted Answer

DNS layer. Cisco Umbrella's core security enforcement point is the DNS layer — it intercepts DNS queries from endpoints and forwards them to Umbrella's global resolvers, which block requests to malicious or unwanted domains before any TCP connection to the destination is established. Because DNS resolution is a prerequisite for nearly all outbound connections, blocking at this layer prevents the connection from ever being initiated. This is why Umbrella is described as a first line of defense that operates before IP or application-layer controls come into play.

Answer

Network layer (IP filtering)

Answer

Application layer

Answer

Transport layer

Question 5

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security solution that blocks malicious domains and provides secure internet gateway.

Answer

Cisco AMP

Answer

Cisco ESA

Answer

Cisco WSA

Question 6

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

Accepted Answer

The switch is not configured to include the calling-station-id in RADIUS requests.. The RADIUS Access-Request must include the Calling-Station-ID attribute (attribute 31) so ISE can identify the endpoint's MAC address for MAB or policy evaluation. If the switch does not send it, ISE logs the missing-attribute error and authentication fails. The fix is to configure the switch to include calling-station-id in RADIUS requests.

Answer

The switch is configured with 'authentication mac-move deny'.

Answer

The switch port is configured as a trunk port.

Answer

The client's MAC address is not registered in ISE.

Question 7

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?

Accepted Answer

PAT (overload). PAT (Port Address Translation), also called NAT overload, allows many internal hosts to share a single public IP address by translating both the source IP and source port. The ASA tracks each flow using unique source ports, enabling multiplexing of thousands of sessions over one public address. This is the standard NAT type for internet-bound traffic from internal networks.

Answer

Identity NAT

Answer

Static NAT

Answer

Dynamic NAT

Question 8

An organization wants to protect against Business Email Compromise (BEC) attacks where attackers spoof the CEO's email address to request wire transfers. Which email authentication method is specifically designed to help prevent domain spoofing by allowing senders to specify how email that fails authentication should be handled?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is specifically designed to allow domain owners to specify how email that fails SPF and/or DKIM authentication should be handled, such as quarantine or reject. It also provides reporting. This directly addresses domain spoofing by giving senders control over unauthenticated email.

Answer

SPF

Answer

DKIM

Answer

SenderBase

Question 9

Refer to the exhibit. An administrator has configured the router with zone-based firewall rules. Traffic from the DMZ zone to the OUTSIDE zone is being dropped, although traffic from the INSIDE zone to the OUTSIDE zone flows normally. The DMZ zone is configured with security-level 50 and the INSIDE zone with 100. What is the most likely cause of the dropped traffic?

Accepted Answer

No zone-pair is defined for traffic from DMZ to OUTSIDE. In Cisco IOS Zone-Based Firewall (ZBFW), traffic is only permitted between zones if a zone-pair is explicitly defined and a policy is applied to that zone-pair. The security-level concept from the legacy CBAC/firewall feature is not used in ZBFW; zones are logical and have no inherent trust level. Since traffic from INSIDE to OUTSIDE works, a zone-pair likely exists for that direction, but no zone-pair is configured for DMZ to OUTSIDE, causing the default drop. Therefore, the most likely cause is the absence of a zone-pair for DMZ-to-OUTSIDE traffic.

Answer

The inspect action is not applied to the DMZ traffic class

Answer

The class-default action in the policy-map drops all traffic from DMZ

Answer

The DMZ has a lower security-level than the INSIDE zone, causing traffic to be implicitly denied

Question 10

A security team suspects that malware is exfiltrating data by encoding it in DNS queries. Which Cisco security solution is specifically designed to analyze DNS traffic for malicious activity?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. It can detect and block DNS-based data exfiltration techniques, such as DNS tunneling, by inspecting DNS request patterns and comparing them against threat intelligence feeds. This makes it the correct choice for analyzing DNS traffic for malicious activity.

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Answer

Cisco Email Security Appliance

Question 11

A cloud security engineer is evaluating CSPM (Cloud Security Posture Management) solutions. Which TWO capabilities are essential for a CSPM tool? (Select two.)

Accepted Answer

Continuous compliance monitoring with industry standards. Option C is correct because a core function of CSPM is continuous compliance monitoring, mapping cloud resource configurations against frameworks such as CIS Benchmarks, PCI DSS, HIPAA, and SOC 2 to detect drift and generate audit evidence. Option E is correct because CSPM's primary purpose is identifying misconfigurations in cloud services (e.g., public S3 buckets, overly permissive IAM policies, unencrypted storage) by comparing actual posture against provider and industry best practices. Option A is not essential to CSPM; container image vulnerability scanning belongs to container security or vulnerability management tools (e.g., Trivy, Clair, Amazon ECR scanning), though some platforms bundle it. Option B is not essential to CSPM; incident response automation with playbooks is the domain of SOAR or SIEM platforms, not posture management. Option D is not essential to CSPM; real-time network traffic analysis is performed by IDS/IPS, NDR, or firewall tools, whereas CSPM focuses on configuration and compliance state rather than packet inspection.

Answer

Vulnerability scanning of container images

Answer

Incident response automation with playbooks

Answer

Real-time network traffic analysis

Question 12

Which of the following is the primary function of a Cloud Security Posture Management (CSPM) tool?

Accepted Answer

Monitor and remediate cloud misconfigurations against benchmarks. CSPM tools continuously scan cloud environments (AWS, Azure, GCP) against security benchmarks such as CIS, NIST, and PCI DSS to detect misconfigurations like public S3 buckets, overly permissive IAM roles, and disabled logging. Their primary function is to identify, alert on, and often auto-remediate these posture issues. This is distinct from runtime workload protection or network-layer filtering.

Answer

Block malicious domains at the DNS layer

Answer

Protect workloads from malware

Answer

Provide DLP for SaaS applications

Question 13

What is the primary purpose of DMARC in email authentication?

Accepted Answer

To specify a policy for failed authentication. DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM by allowing domain owners to publish a policy that instructs receiving mail servers on how to handle messages that fail authentication checks. The policy can specify none (monitor), quarantine (spam folder), or reject (block). This gives domain owners control over unauthenticated email claiming to be from their domain.

Answer

To add a digital signature

Answer

To encrypt email content

Answer

To verify the sending IP address

Question 14

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA), defined in RFC 5176, allows Cisco ISE to send a RADIUS Disconnect or CoA-Request packet to the NAD (switch/WLC) to modify an active session's authorization attributes — including VLAN — without forcing the endpoint to re-authenticate. This is exactly the mechanism used after posture assessment flips an endpoint from non-compliant to compliant (or vice versa). MAB, Profiling, and TrustSec do not perform mid-session authorization changes.

Answer

MAB

Answer

Profiling

Answer

TrustSec

Question 15

A company is implementing a cloud security posture management (CSPM) solution. Which TWO of the following are primary functions of CSPM?

Accepted Answer

Detection and remediation of cloud resource misconfigurations (e.g., open S3 buckets).. Option D is correct because CSPM's core purpose is to continuously detect and remediate misconfigurations in cloud resources, such as publicly exposed S3 buckets, unencrypted storage, or overly permissive security groups, which are the leading causes of cloud breaches. Option E is correct because CSPM platforms continuously monitor cloud infrastructure against compliance and security benchmarks like CIS Foundations, PCI DSS, HIPAA, and SOC 2, providing posture scoring and drift detection. Option A is incorrect because real-time network traffic inspection for malicious patterns is the function of network security tools such as IDS/IPS or cloud-native traffic inspection, not CSPM. Option B is incorrect because VM OS vulnerability scanning is typically performed by vulnerability management or workload protection tools, not CSPM. Option C is incorrect because managing user identities and access permissions is the domain of identity and access management (IAM) or CIEM, not CSPM.

Answer

Real-time inspection of network traffic for malicious patterns.

Answer

Vulnerability scanning of virtual machine operating systems.

Answer

Managing user identities and access permissions.