350-701 Practice Test 4 — 10 Questions

Question 1

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The command dot1x system-auth-control is a global configuration command that enables 802.1X authentication on the switch. Without it, the per-interface dot1x pae authenticator and authentication port-control auto commands have no effect because the 802.1X process is not globally enabled. This is why the client sends EAPoL-Start but the switch never responds with EAP-Request/Identity.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 2

Cisco ISE is configured with posture assessment to ensure endpoints meet security requirements before gaining network access. After a posture check, ISE needs to dynamically change the VLAN assignment for a non-compliant endpoint. Which ISE feature enables this real-time change?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically update authentication and authorization attributes such as VLAN assignment.

Answer

TrustSec

Answer

Guest portal

Answer

Profiling

Question 3

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Option C is correct because Cisco CloudLock DLP policies rely on content-matching rules that identify sensitive data such as PII using predefined or custom regex/pattern definitions, which is the detection mechanism required before any alerting can occur. Option D is correct because the scenario specifically requires detecting and alerting on external sharing of PII files, so a policy must be configured with the external-sharing trigger and an alert action tied to the PII DLP rule. Option A is incorrect because the requirement is to detect and alert, not to automatically block, and blocking all external PII sharing exceeds the stated scope. Option B is incorrect because disabling external sharing application-wide is a blunt control that prevents legitimate collaboration and does not provide the required detection and alerting. Option E is incorrect because a transparent proxy inspects network traffic and is not the mechanism used to enforce CloudLock SaaS API-based DLP policies on files shared within a cloud application.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 4

An attacker intercepts ARP packets on a local network and associates their MAC address with the IP address of a legitimate host. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) allows an attacker to intercept traffic by associating their MAC with the victim's IP.

Answer

Typosquatting

Answer

SSL stripping

Answer

DNS cache poisoning

Question 5

An engineer is configuring Cisco ISE for 802.1X authentication. The network has many printers and IP phones that do not support 802.1X supplicant software. Which ISE feature should be used to allow these devices to authenticate?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) allows non-802.1X-capable devices to authenticate based on their MAC address.

Answer

Posture assessment

Answer

Guest access with sponsor portal

Answer

Profiling via DHCP probe

Question 6

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation (A) is correct because it enforces granular, identity- and workload-based policies between internal segments, so stolen credentials alone cannot freely reach other servers and lateral movement paths are blocked or alerted. Network behavioral analytics such as Stealthwatch (D) is correct because it baselines normal east-west traffic and uses flow telemetry to detect anomalous internal connections, beaconing, and unusual data transfers indicative of lateral movement and exfiltration. Endpoint detection and response (EDR) (E) is correct because it monitors process, credential, and command activity on hosts, detecting techniques like pass-the-hash, remote service creation, and suspicious lateral tooling, and can isolate the endpoint. A stateful firewall at the perimeter (B) only inspects traffic crossing the network edge and does not see or stop internal east-west lateral movement. SSL inspection (C) decrypts TLS traffic for content inspection but by itself neither segments the internal network nor correlates host/network behavior to detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 7

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 8

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

Accepted Answer

Remote shell investigation. Cisco AMP for Endpoints includes endpoint detection and response (EDR) capabilities such as remote shell, which allows analysts to execute commands on the endpoint for investigation.

Answer

Process isolation

Answer

File quarantine

Answer

IOC scanning

Question 9

Which cloud security control is specifically designed to protect workloads such as VMs and containers from threats?

Accepted Answer

CWPP. CWPP (Cloud Workload Protection Platform) provides security for workloads across clouds.

Answer

CSPM

Answer

CASB

Answer

SIG

Question 10

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Option A is correct because creating custom whitelist exclusions for trusted applications prevents legitimate business software from being quarantined or blocked, directly reducing false positives while still allowing AMP for Endpoints to enforce its policies on unknown or untrusted files. Option B is correct because group-based policies let the engineer tailor detection and blocking rules to specific endpoint populations (for example, developers versus standard users), so aggressive settings are not applied where they would generate unnecessary false positives. Option D is correct because setting file reputation to block only files with a 'Malicious' disposition avoids blocking files with 'Unknown' or 'Clean' verdicts, which are common sources of false positives, while still stopping confirmed threats. Option C is not correct because enabling all exploit prevention rules regardless of environment ignores the need to tune protections to the actual software and workloads in use, which increases false positives. Option E is not correct because disabling file reputation removes a core AMP for Endpoints protection layer and its cloud lookups, weakening detection rather than minimizing false positives while maintaining strong protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries