350-701 Practice Test 40 — 15 Questions

Question 1

During 802.1X authentication, which component acts as the intermediary that forwards authentication requests between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X architecture, the authenticator (typically a switch or wireless LAN controller) is the network device that relays EAP messages between the supplicant and the authentication server (e.g., ISE).

Answer

Authentication server

Answer

RADIUS proxy

Answer

Supplicant

Question 2

A network administrator is troubleshooting why users in the marketing department cannot access a specific cloud storage site through the Cisco WSA. The access policy for marketing is set to 'Monitor' for the File Sharing category, but the site is blocked. What is the most likely reason?

Accepted Answer

A more specific identity or policy is applying a block action.. Cisco WSA applies policies in a hierarchical order, and a more specific identity or policy (e.g., one based on user group, subnet, or time range) can override a broader policy set to 'Monitor'. Even though the marketing department's access policy is configured to monitor the File Sharing category, a more granular rule may explicitly block the cloud storage site, causing the unexpected block.

Answer

Web reputation threshold is set to block the site.

Answer

The site is mis-categorized as an unknown URL.

Answer

URL filtering is disabled for that policy.

Question 3

Which of the following is a characteristic of a 'false negative' in intrusion detection?

Accepted Answer

Malicious traffic is not detected.. A false negative occurs when the IDS/IPS fails to detect an actual attack. It misses the malicious activity.

Answer

The signature database is updated.

Answer

The system crashes due to high resource usage.

Answer

An alert is generated for benign traffic.

Question 4

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

MD5 hash of a malicious file. Cisco AMP for Endpoints detects indicators of compromise (IOCs) such as file hashes, and the MD5 hash of a malicious file (option C) is a classic file-based IOC that AMP uses for detection and threat intelligence matching. Option D, the IP address of a command-and-control server, is a network-based IOC that AMP for Endpoints can detect through its network activity monitoring and threat intelligence feeds, identifying communication with known malicious infrastructure. These two are true IOCs because they represent artifacts of compromise that security tools can observe and block. In contrast, option A (last login time), option B (OS version), and option E (logged-in username) are system or user context details, not indicators of malicious activity, and are not classified as IOCs.

Answer

The endpoint's last login time

Answer

The version of the operating system

Answer

The username of the logged-in user

Question 5

A DevOps team is deploying containers in Kubernetes and needs to enforce network security policies between pods. Which Cisco solution is designed for this?

Accepted Answer

Cisco Secure Workload (Tetration). Cisco Secure Workload (formerly Tetration) is the correct answer because it provides micro-segmentation and network policy enforcement for containerized environments like Kubernetes. It uses agent-based and agentless sensors to map all inter-pod traffic flows and enforce whitelist-based policies at the kernel level via eBPF or iptables, ensuring zero-trust between pods without requiring changes to the underlying network fabric.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Question 6

During a cloud migration, an organization notices increased latency in AWS workloads when using Cisco Firepower for traffic inspection. What is the most likely cause?

Accepted Answer

The Firepower instance is undersized for the traffic volume. When using Cisco Firepower for traffic inspection in AWS, the Firepower instance must process all traffic traversing the virtual appliance. If the instance type (e.g., m5.large) is undersized relative to the throughput demands (e.g., exceeding 1 Gbps), packet processing will queue, causing increased latency. This is a common scaling issue in cloud migrations where on-premises traffic patterns are replicated without adjusting instance sizing.

Answer

The VPC routing table is misconfigured, causing traffic to hairpin

Answer

AWS WAF is conflicting with Firepower rules

Answer

Firepower is inspecting encrypted traffic without SSL decryption

Question 7

An administrator notices that some users receive spam messages even though the ESA policy is set to 'Quarantine' for suspected spam. The messages are not found in the user's spam quarantine. What is the most likely cause?

Accepted Answer

Incoming mail is received on a listener that does not apply the anti-spam engine.. If incoming mail is received on a mail policy (listener) that does not have the anti-spam engine enabled, the ESA will not apply any spam filtering to those messages. Even though the global or default policy may be set to 'Quarantine', the listener configuration determines which security services are invoked. Without the anti-spam engine on that listener, messages bypass spam detection entirely and are delivered directly to the user's inbox, never appearing in the spam quarantine.

Answer

The sender's IP is in the allow list.

Answer

The spam threshold is set too low.

Answer

The anti-spam engine signatures are outdated.

Question 8

Which component in an 802.1X deployment is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator (switch/WLC). The authenticator (typically a switch or wireless LAN controller) acts as an intermediary, forwarding EAP messages between the supplicant and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Question 9

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. The recommended action to prevent a known false positive from being flagged again is to add the file's SHA-256 hash to the custom detection list with an 'Allow' or 'Uncategorized' disposition. This overrides the local or cloud-based verdict for that specific file, ensuring AMP for Endpoints treats it as clean without affecting global detection policies.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.

Question 10

An organization discovers that a man-in-the-middle attack was successfully performed using a forged certificate issued by a trusted CA. The legitimate CA’s private key was compromised. Which PKI component was breached?

Accepted Answer

Certification Authority (CA) private key. The man-in-the-middle attack succeeded due to a forged certificate issued by a trusted CA, which directly implies that the CA's private key was compromised. The CA's private key is the root of trust in a PKI; if it is stolen, an attacker can sign fraudulent certificates that will be trusted by all clients that trust the CA. Without the private key, the attacker could not have created a valid forged certificate.

Answer

Online Certificate Status Protocol (OCSP) responder

Answer

Registration Authority (RA)

Answer

Certificate Revocation List (CRL)

Question 11

An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?

Accepted Answer

Redirection of traffic to malicious servers. DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.

Answer

Encryption of DNS queries

Answer

Exposure of DNS server credentials

Answer

Denial of service to the DNS server

Question 12

A security engineer is deploying Cisco AMP for Endpoints to protect against malware. The company wants to block all executables from running in the Downloads folder except those signed by a specific trusted publisher. Which policy configuration should the engineer use?

Accepted Answer

Create an Application Control rule to block all executables in the Downloads folder and add an exception for the trusted publisher.. Cisco AMP for Endpoints uses Application Control rules to allow or block executables based on file path and publisher certificate. By creating a rule that blocks all executables in the Downloads folder and adding an exception for executables signed by the trusted publisher, the engineer achieves the exact requirement—only trusted signed executables can run from that folder.

Answer

Use the default malware protection policy, which automatically blocks untrusted executables in Downloads.

Answer

Configure an Exclusion for the Downloads folder and then use a Custom Detection for untrusted executables.

Answer

Enable Simple Custom Detections with the SHA-256 hashes of all known executables.

Question 13

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Option A is correct because the ISE profiler collects endpoint identity attributes such as MAC OUI (the first 24 bits of the MAC address identifying the hardware vendor) and DHCP fingerprint data (DHCP parameter request list, hostname, and vendor class identifier) to infer the endpoint's operating system. Option B is correct because profiling relies on a mix of active probes (for example, SNMP queries, NetFlow, NMAP scans, and RADIUS probes) and passive probes (for example, DHCP, RADIUS, and HTTP snooping) to gather endpoint attributes. Option C is correct because the attributes discovered by the profiler (such as device type, OS, and manufacturer) are exposed as dictionary attributes that can be referenced in authorization policy conditions and rules. Option D is not correct because posture compliance checking is a separate ISE service that requires the AnyConnect posture module or the ISE posture agent, not the profiler. Option E is not correct because profiling is agentless and works through network-based probes, so no ISE agent must be installed on endpoints.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 14

Which TWO of the following are capabilities of Cisco Orbital?

Accepted Answer

Running live queries across all endpoints. Cisco Orbital is a cloud-native endpoint investigation and threat-hunting platform, and option B (running live queries across all endpoints) is correct because Orbital's core capability is executing SQL-like queries against telemetry from all connected endpoints in real time to hunt for threats and anomalies. Option C (scheduled forensic data collection tasks) is also correct because Orbital allows administrators to create scheduled queries and collection tasks that periodically gather forensic artifacts (such as running processes, network connections, and file hashes) from endpoints for later analysis. Option A is incorrect because real-time file reputation checking is a function of Cisco Secure Endpoint's cloud reputation engine (or Cisco Talos), not Orbital. Option D is incorrect because pre-execution sandboxing of unknown files is performed by Cisco Secure Malware Analytics (Threat Grid) or the Secure Endpoint file analysis feature, not Orbital. Option E is incorrect because automated endpoint isolation is an enforcement action performed by Cisco Secure Endpoint (often orchestrated with Cisco ISE/pxGrid), whereas Orbital is an investigation and visibility tool, not an isolation mechanism.

Answer

Real-time file reputation checking

Answer

Pre-execution sandboxing of unknown files

Answer

Automated endpoint isolation via ISE

Question 15

Which Cisco technology provides visibility into the performance of SaaS applications such as Microsoft 365?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Umbrella SIG