350-701 Practice Test 4 — 10 Questions

Question 1

During a security audit, a penetration tester discovers that a Cisco ASA firewall is configured with a rule that permits traffic from the inside interface with a source IP address in the RFC 1918 range to the outside interface. The rule uses the 'inspect' command for HTTP and FTP. Which potential vulnerability does this configuration introduce?

Accepted Answer

The firewall may allow IP spoofing if antispoofing is not enabled. Option D is correct because the configuration permits traffic from RFC 1918 private IP addresses on the inside interface to the outside interface without any explicit antispoofing or Unicast Reverse Path Forwarding (uRPF) check. This allows an attacker on the inside network to spoof source IP addresses that appear to come from the inside subnet, bypassing the firewall's intended security boundary. Without antispoofing, the ASA will not verify that the source IP actually belongs to the inside network, enabling IP spoofing attacks.

Answer

FTP inspection permits anonymous login commands

Answer

The configuration allows traffic without network address translation (NAT)

Answer

The HTTP inspection may allow SQL injection attacks to bypass the firewall

Question 2

A security administrator is tasked with implementing a solution that provides single sign-on (SSO) for users accessing multiple enterprise applications. The solution must support SAML 2.0 and integrate with the existing Microsoft Active Directory. Which component is essential for this architecture?

Accepted Answer

Identity Provider (IdP). Option C is correct because an Identity Provider (IdP) is the essential component that authenticates users against Microsoft Active Directory and issues SAML 2.0 assertions to enable single sign-on (SSO) across multiple enterprise applications. The IdP acts as the trusted source of identity, validating credentials and generating signed SAML tokens that Service Providers (SPs) accept without requiring separate logins.

Answer

Certificate Authority (CA)

Answer

RADIUS server

Answer

Service Provider (SP)

Question 3

Refer to the exhibit. A user attempts to SSH to the router. The RADIUS server is unreachable. What will happen?

Accepted Answer

The user will be authenticated using the local database. When RADIUS is unreachable and the router is configured for AAA authentication, the default behavior is to fall back to the local database if the 'local' keyword is included in the authentication method list. In this scenario, the user will be authenticated using the local database because the RADIUS server is unreachable, and the router has a local user account configured. This is a standard AAA fallback mechanism to ensure administrative access is not completely lost.

Answer

The user will be denied access because RADIUS is unreachable

Answer

The router will try TACACS+ as a fallback

Answer

The user will be authenticated using RADIUS after a timeout

Question 4

Which security concept involves creating multiple layers of defense so that if one layer is breached, subsequent layers still provide protection?

Accepted Answer

Defense in depth. Defense in depth is a security architecture strategy that layers independent defensive mechanisms (e.g., firewalls, IDS/IPS, endpoint protection, encryption) so that if one layer is compromised, subsequent layers continue to protect the asset. This concept is fundamental to the 350-701 exam as it underpins Cisco's SecureX and integrated security fabric approach, where multiple controls (like ASA, Firepower, and Umbrella) work together to provide resilience against breaches.

Answer

Zero Trust

Answer

Separation of duties

Answer

Least privilege

Question 5

An organization wants to restrict administrative access to Cisco network devices based on the time of day and source IP address. Which technology should be used?

Accepted Answer

TACACS+ with per-command authorization. TACACS+ is the correct choice because it supports per-command authorization, which allows an administrator to define granular access policies based on attributes such as time of day and source IP address. This is achieved through the TACACS+ authorization process, where the AAA server evaluates the user's request against configured authorization rules before granting access to specific commands or sessions.

Answer

SNMPv3 with ACLs

Answer

802.1X with EAP-TLS

Answer

IPsec VPN with extended authentication

Question 6

Which TWO of the following are true about MACsec?

Accepted Answer

It uses IEEE 802.1AE standard. MACsec is defined by the IEEE 802.1AE standard, which specifies a security protocol for providing data confidentiality, integrity, and origin authenticity at Layer 2. It operates directly on Ethernet frames, encrypting the payload while preserving the frame header for transparent forwarding. This makes option B correct because the standard is the foundational reference for MACsec.

Answer

It requires a PKI

Answer

It provides data confidentiality only

Answer

It is used for WLAN security

Question 7

Which Cisco TrustSec feature uses a classification packet to carry security group information across network devices?

Accepted Answer

Security Group Tag (SGT). The Security Group Tag (SGT) is the Cisco TrustSec mechanism that embeds security group information directly into a packet's Ethernet frame (typically as a Cisco Meta Data or inline tag). This allows the packet to carry its source group identity across network devices, enabling consistent policy enforcement without requiring per-hop reclassification.

Answer

Security Group Access Control List (SGACL)

Answer

MACsec

Answer

Cisco TrustSec (CTS)

Question 8

A network administrator is configuring management access on a Cisco router. The requirement is to provide encrypted remote access with AAA authentication and fallback to local credentials if the AAA server is unavailable. Which configuration best meets these requirements?

Accepted Answer

Enable SSHv2 with AAA authentication and 'aaa authentication login default group radius local' configured.. Option B is correct because SSHv2 provides encrypted remote access, and the command 'aaa authentication login default group radius local' configures AAA authentication with RADIUS as the primary method and local credentials as a fallback if the RADIUS server is unreachable. This meets the requirement for both encrypted access and AAA fallback to local authentication.

Answer

Enable Telnet with a local username and password.

Answer

Enable HTTP with AAA authentication.

Answer

Use SNMPv3 with read-write community strings.

Question 9

Refer to the exhibit. An administrator notices that DNS responses larger than 512 bytes are being dropped. Which configuration change should be made to allow larger DNS responses?

Accepted Answer

Increase the message-length maximum under the DNS map. The correct answer is D because DNS inspection on Cisco ASA/Firepower devices uses a DNS map to enforce a default maximum message length of 512 bytes, which aligns with the original DNS specification (RFC 1035). To allow larger DNS responses (e.g., those using EDNS0, which can exceed 512 bytes), you must increase the message-length maximum under the DNS map. This change permits the firewall to reassemble and forward DNS packets that exceed the default limit without dropping them.

Answer

Remove the DNS inspection policy

Answer

Add an access-list to permit the traffic

Answer

Disable the set connection advanced-options command

Question 10

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. The correct answer is A because an Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy