350-701 Practice Test 39 — 15 Questions

Question 1

A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:

1. Allow from any to any (for testing, but currently enabled)
2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443)
3. Block from guest wireless to data center
4. Allow from any to internet (destination any)

Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?

Accepted Answer

Move rule 3 (block guest to data center) above rule 1 (allow all). Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.

Answer

Modify rule 2 to include a deny for the guest subnet

Answer

Change rule 4 to block all traffic from guest network

Answer

Add a new rule after rule 4 to block the specific traffic

Question 2

Which Cisco security product is primarily used for endpoint threat detection and retrospective security?

Accepted Answer

Cisco AMP for Endpoints. Cisco AMP (Advanced Malware Protection) provides endpoint protection with retrospective analysis and threat detection.

Answer

Cisco ESA

Answer

Cisco Firepower

Answer

Cisco WSA

Question 3

A security engineer is configuring Cisco Umbrella to block malicious domains. They need to ensure that internal DNS queries from remote users using Cisco AnyConnect are protected. Which deployment method should they use?

Accepted Answer

Install the Umbrella Roaming Client on all endpoints. The Umbrella Roaming Client (now part of Cisco Secure Client) is the correct deployment method because it provides DNS-layer security directly on endpoints, including remote users connecting via AnyConnect. It intercepts DNS queries on the local machine and forwards them to Umbrella's cloud-based DNS resolvers, ensuring protection even when the user is off-network or behind a VPN. This is the only option that covers remote users without relying on network-level appliances or firewalls.

Answer

Configure DNS Layer Security in the office firewall

Answer

Enable Cisco Cloudlock integration

Answer

Deploy the Umbrella virtual appliance at headquarters

Question 4

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Cisco CloudLock uses DLP rules to scan files for sensitive content like PII patterns. Creating a DLP rule with a PII pattern enables the policy to identify files containing PII, which is the first step in detecting and alerting on such sharing events.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 5

A company wants to deploy endpoint hardening measures to prevent unauthorized applications from executing. Which THREE techniques are commonly used for application control? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting allows only approved applications to run. Host-based IPS monitors/prevents malicious behavior. EDR capabilities like file quarantine and process isolation help control applications. Blacklisting is less effective; patch management is not application control.

Answer

Patch management

Answer

Application blacklisting

Question 6

Cisco ISE performs profiling to identify device type. Which probe collects information by querying the device's MAC address OUI and DHCP options?

Accepted Answer

DHCP probe. The DHCP probe analyzes DHCP packets to gather information such as vendor class identifier and hostname, helping to profile the device type.

Answer

Device Sensor probe

Answer

SNMP probe

Answer

HTTP probe

Question 7

Which TWO of the following are components of Cisco TrustSec?

Accepted Answer

Security Group Tag (SGT). Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on identity and enforce access control policies. SGTs are 16-bit values assigned to users or devices, and they are carried in the packet header (e.g., via Cisco Metadata or inline tagging) to allow policy enforcement at the network layer.

Answer

802.1X

Answer

MACsec

Answer

IPsec

Question 8

A network engineer is implementing TrustSec on a Cisco switch. The goal is to tag traffic from the engineering VLAN with Security Group Tag (SGT) 10 and enforce policies on upstream switches. Which configuration is required on the access switch to propagate the SGT?

Accepted Answer

cts manual policy static sgt 10. The 'cts manual policy static sgt 10' command assigns a static Security Group Tag (SGT) to the switch port, which is then propagated to upstream switches via Cisco TrustSec (CTS) using SGT Exchange Protocol (SXP) or inline tagging. This ensures that traffic from the engineering VLAN is tagged with SGT 10, enabling policy enforcement on upstream devices.

Answer

switchport voice vlan 10

Answer

authentication host-mode multi-domain

Answer

spanning-tree portfast

Question 9

A security engineer reviews the security group rules for an EC2 instance. Based on the exhibit, which security concern should be addressed immediately?

Accepted Answer

RDP is allowed from all sources (0.0.0.0/0). Allowing RDP (TCP port 3389) from 0.0.0.0/0 exposes the EC2 instance to brute-force attacks and unauthorized remote access from the entire internet. Security groups are stateful and only support allow rules, so this overly permissive ingress rule is a critical security risk that must be removed or restricted to trusted IP ranges.

Answer

SSH is allowed from the entire internet because it uses TCP port 22

Answer

There is no deny rule to block malicious traffic

Answer

SSH access is allowed from two separate IP ranges

Question 10

A security engineer is analyzing logs from a Cisco ASA. They notice that a specific internal host is generating a high volume of outbound TCP SYN packets to multiple external IP addresses on port 443, but no SYN-ACK responses are received. What is the most likely explanation?

Accepted Answer

The host is infected with malware that is performing a SYN flood denial-of-service attack. The host is sending a high volume of TCP SYN packets to multiple external IPs on port 443 without receiving SYN-ACK responses, which is characteristic of a SYN flood attack. In a SYN flood, the attacker (or infected host) sends many SYN packets to exhaust the target's connection table, but the lack of SYN-ACK responses indicates the targets are not completing the handshake, often because the source IP is spoofed or the targets are unresponsive. The Cisco ASA logs show outbound SYN packets with no corresponding SYN-ACKs, which aligns with the host being used as a source for a denial-of-service attack.

Answer

The ASA is configured to block outbound HTTPS traffic

Answer

The host is downloading a large malware file via HTTPS

Answer

The host is establishing legitimate HTTPS connections

Question 11

A security analyst is investigating an incident on an endpoint protected by Cisco AMP. The analyst needs to isolate the compromised process and prevent it from communicating with other processes or the network. Which EDR capability should be used to achieve this?

Accepted Answer

Process isolation. Process isolation is an EDR capability that terminates the process and blocks its network and inter-process communication, effectively containing the threat.

Answer

File quarantine

Answer

IOC scanning

Answer

Remote shell

Question 12

A guest device in VLAN 200 attempts to reach a server at 10.10.1.1. What happens to the traffic?

Accepted Answer

The traffic is dropped. The VACL 'BLOCK_MAP' is applied to VLAN 200. The access-list BLOCK_GUEST denies traffic from any source to the 10.10.0.0/16 network. Since the destination 10.10.1.1 falls within this range, the traffic is dropped. Therefore, option C is correct. Option A is incorrect because the ACL denies the traffic. Option B is incorrect because the VACL drops the traffic rather than forwarding without action. Option D is incorrect because logging is not configured in the VACL.

Answer

The traffic is permitted

Answer

The traffic is forwarded without any action

Answer

The traffic is logged and forwarded

Question 13

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints was later determined to be malicious after execution. Which feature allows the administrator to see the file's propagation and impact on endpoints?

Accepted Answer

Device Trajectory. Device Trajectory is the correct answer because it provides a chronological timeline of a file's activity across all endpoints, showing its origin, propagation, and actions taken after execution. This feature is specifically designed to visualize the impact and spread of malicious files that were initially unknown but later determined to be malicious by Cisco AMP for Endpoints.

Answer

Exploit Prevention

Answer

Endpoint IOC Scanning

Answer

SHA-256 Disposition

Question 14

In a Cisco TrustSec deployment, you want to dynamically assign SGTs based on user authentication. Which mechanism should you use?

Accepted Answer

CTS identity-based networking (IBNS) with RADIUS CoA. Identity-Based Networking Services (IBNS) with RADIUS Change of Authorization (CoA) allows dynamic assignment of SGTs during authentication. Option A (CTS SXP) propagates SGTs but doesn't assign dynamically. Option B (CTS RBACL) is for role-based access control, not SGT assignment. Option C (CTS device classification) is for static assignment.

Answer

CTS SXP

Answer

CTS RBACL

Answer

CTS device classification

Question 15

A cloud security team is investigating a possible data exfiltration incident involving an AWS S3 bucket configured with cross-region replication. Which Cisco Cloudlock feature can detect unusual replication patterns that may indicate data theft?

Accepted Answer

Cloudlock User and Entity Behavior Analytics (UEBA). Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.

Answer

Umbrella threat intelligence

Answer

Stealthwatch Cloud flow logs

Answer

Firepower IPS signatures