350-701 Practice Test 38 — 15 Questions

Question 1

Which TWO of the following are valid methods for deploying Cisco WSA? (Choose TWO.)

Accepted Answer

Explicit proxy (browser configuration). Cisco WSA can be deployed as an explicit proxy (browsers configured to use it) or as a transparent proxy using WCCP or other redirection methods.

Answer

As a mail relay

Answer

As a DNS server

Answer

Inline with firewall port mirroring

Question 2

To protect against phishing attacks that use fraudulent emails to trick users into revealing credentials, which email authentication technology verifies the sending domain's DNS records for a digital signature?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature to verify that an email originated from the claimed domain. SPF (Sender Policy Framework) verifies the sending IP address against authorized IP lists but does not use a digital signature. DMARC builds on both SPF and DKIM. Therefore, the correct answer is D.

Answer

DMARC

Answer

SenderBase

Answer

SPF

Question 3

A Cisco TrustSec deployment is being implemented to enforce micro-segmentation. The security team needs to ensure that Security Group Tags (SGTs) are propagated across the network. Which THREE methods can be used to distribute SGT information in a TrustSec environment? (Choose three.)

Accepted Answer

SGT over SXP (SGT Exchange Protocol). The correct methods are SGT over SXP (SGT Exchange Protocol), SGT over VXLAN, and SGT inline tagging in the Ethernet header. SGT over MPLS is not a standard TrustSec propagation method. SGT over CDP is not supported; CDP is used for device discovery, not SGT propagation.

Answer

SGT over Cisco Discovery Protocol (CDP)

Answer

SGT over MPLS

Question 4

Which TWO of the following are core components of the Cisco Identity Services Engine (ISE) for policy enforcement?

Accepted Answer

Active Directory Integration. The Policy Service Node (PSN) is responsible for policy decision and enforcement, and Active Directory integration is a key component for identity mapping. NAD (Network Access Device) is an external device that ISE controls, not a component of ISE itself. EAP-TLS is an authentication protocol, and Firepower is a separate security product.

Answer

EAP-TLS

Answer

Firepower Threat Defense

Answer

Network Access Device (NAD)

Question 5

A company is moving its data to AWS and wants to use Cisco Cloudlock for cloud access security broker (CASB) capabilities. Which deployment mode is required for Cloudlock to inspect traffic for shadow IT discovery?

Accepted Answer

API-based. For shadow IT discovery, Cloudlock uses an API-based deployment mode to connect directly to cloud service providers (e.g., AWS, Office 365) via their APIs. This allows Cloudlock to pull metadata, user activity logs, and application usage data without requiring traffic redirection, enabling identification of unsanctioned cloud applications. Proxy-based modes are not used for shadow IT discovery because they require traffic to be routed through the proxy, which is not feasible for cloud-to-cloud traffic.

Answer

Proxy-based (forward proxy)

Answer

Log collection

Answer

Reverse proxy

Question 6

A security administrator notices that several endpoints in the finance department are exhibiting unusual network behavior, including connections to known malicious IP addresses. The administrator has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) with TETRA and has enabled the built-in firewall. What is the best course of action to quickly identify the root cause and contain the threat?

Accepted Answer

Use the Cisco Secure Endpoint console to review the TETRA engine's real-time traffic analysis and isolate the affected endpoints.. Cisco Secure Endpoint with TETRA provides real-time traffic analysis and endpoint isolation capabilities directly from the console. The TETRA engine inspects network flows using behavioral analysis and machine learning, and the administrator can immediately isolate affected endpoints to prevent lateral movement while reviewing the root cause.

Answer

Disable the built-in firewall on the endpoints to allow full traffic inspection by the TETRA engine.

Answer

Wait for the weekly threat report from Cisco Talos to identify the malware family and then apply a signature update.

Answer

Uninstall the Cisco Secure Endpoint connector and reinstall it with a fresh policy.

Question 7

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 8

In Cisco ISE, which protocol is used for EAP-TLS authentication, and what is the primary requirement for the client to successfully authenticate?

Accepted Answer

EAP-TLS, requiring a client certificate. EAP-TLS uses certificates for mutual authentication. The client must have a valid certificate (typically issued by a CA trusted by ISE) to authenticate successfully.

Answer

EAP-FAST, requiring a PAC file

Answer

LEAP, requiring a shared secret

Answer

PEAP-MSCHAPv2, requiring username and password

Question 9

A network administrator is deploying Cisco ISE for network access control. The administrator needs to profile devices that connect to the network. Which TWO probes can be used to gather information for device profiling? (Choose two.)

Accepted Answer

DHCP probe. DHCP probe collects hostname and other DHCP options, which are used for device profiling. HTTP probe captures User-Agent strings from web traffic, providing device type information. Together, these two probes are commonly used to profile devices. The other options listed are not the correct choices for this question.

Answer

SNMP probe

Answer

DNS probe

Answer

Device Sensor

Question 10

On a Cisco ASA, which command applies a policy-map globally to all interfaces?

Accepted Answer

service-policy. The service-policy command applies the policy-map globally.

Answer

class-map

Answer

policy-map

Answer

access-group

Question 11

A company with 5,000 endpoints is using Cisco Secure Endpoint. The security team receives an alert that a specific file (SHA256: 8f4a...b2c) has been detected as malware on 10 endpoints. The file has been quarantined on those endpoints. The team wants to ensure that no other endpoints in the organization have this file. Which feature should be used to locate the file across all endpoints?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is the correct feature because it provides a powerful, query-based search capability across all endpoints managed by Cisco Secure Endpoint. It allows the security team to search for specific file hashes (like SHA256: 8f4a...b2c) across the entire endpoint fleet, identifying any endpoint that has the file present, regardless of whether it has been quarantined or not. This is the only option that enables proactive, organization-wide file discovery beyond simple alert-based or policy-driven actions.

Answer

The Policy editor with file blacklist

Answer

TETRA traffic analysis

Answer

The AMP Dashboard with event filters

Question 12

Refer to the exhibit. A user has successfully authenticated via 802.1X. However, the SGT (Security Group Tag) assigned is 0, which is the default untagged value. Which configuration change would most likely allow ISE to assign a non-zero SGT for this user?

Accepted Answer

In ISE authorization profile, add Cisco AV pair 'cts:security-group-tag=15'. The SGT (Security Group Tag) is assigned by ISE via a RADIUS AV (Attribute-Value) pair during the 802.1X authorization phase. The Cisco AV pair 'cts:security-group-tag=15' explicitly instructs ISE to send SGT value 15 in the RADIUS Access-Accept message. Without this AV pair in the authorization profile, ISE defaults to SGT 0 (untrusted/unassigned), even if the user successfully authenticates.

Answer

Enable 'cts manual' globally on the switch

Answer

Ensure that the switch has a RADIUS server defined with 'radius-server host 10.1.1.1 auth-port 1645'

Answer

Configure 'aaa authorization network default group radius' on the switch

Answer

Enable 'sgt caching' on the switch port

Question 13

An organization wants to deploy Cisco ISE to authenticate devices that do not support 802.1X supplicant software, such as printers and IoT sensors. Which authentication method should be configured on the switch port to allow these devices network access?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicants to authenticate based on their MAC address. The switch sends the MAC address as the username and password to ISE.

Answer

EAP-TLS

Answer

EAP-FAST

Answer

PEAP-MSCHAPv2

Question 14

Which THREE are recommended best practices for deploying Cisco AMP for Endpoints in a large enterprise?

Accepted Answer

Deploy the AMP connector to all endpoints, including servers and desktops.. Deploying the AMP connector to all endpoints, including servers and desktops, ensures comprehensive visibility and protection across the entire enterprise attack surface. Cisco AMP for Endpoints relies on a connector installed on each device to perform file analysis, retrospective detection, and telemetry collection; leaving any endpoint unmonitored creates a blind spot that attackers can exploit. This is a foundational best practice for large-scale deployments to achieve consistent security coverage.

Answer

Configure the policy to block all files with disposition 'Unknown' to prevent zero-day attacks.

Answer

Set the default policy action to 'Block' for all file types to maximize security from day one.

Question 15

A security engineer is configuring Cisco Firepower NGFW to block social media applications. Which feature should be used to achieve this?

Accepted Answer

Application control. Firepower uses application control to identify and block specific applications like social media.

Answer

URL filtering

Answer

Intrusion prevention

Answer

TLS server identity discovery