350-701 Practice Test 40 — 15 Questions

Question 1

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 2

A network engineer is troubleshooting an 802.1X deployment where some Windows 10 endpoints fail to authenticate. Logs show that the client sends an EAPoL-Start but never receives an EAP-Request/Identity. The switch port configuration is:
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator
Which additional command is most likely needed?

Accepted Answer

dot1x system-auth-control. The switch interface is configured for 802.1X with 'authentication port-control auto', but this alone is insufficient. The global command 'dot1x system-auth-control' must be enabled to activate the 802.1X feature on the switch. Without it, the switch ignores EAPoL-Start messages and does not send EAP-Request/Identity. Option B is correct.

Answer

dot1x reauthentication

Answer

spanning-tree portfast

Answer

dot1x timeout tx-period 3

Question 3

Refer to the exhibit. A network administrator is troubleshooting a wired client that has successfully authenticated using MAB. However, the client is unable to access resources beyond the local subnet. What is the most likely cause?

Accepted Answer

The authorization policy is missing a downloadable ACL (dACL) to allow traffic.. The authorization policy 'Permit_Access' likely does not include a downloadable ACL (dACL), which is required on the switch to allow traffic beyond the local subnet. Without a dACL, the switch defaults to denying inter-subnet traffic. Option A is incorrect because the DHCP scope may include a default gateway, but the issue is about traffic filtering, not IP assignment. Option B is incorrect because VLAN 10 assignment is correct; the problem is the lack of a dACL to permit routing. Option C is incorrect because inter-VLAN routing is configured on the router or Layer 3 switch, but the switchport itself needs a dACL to allow traffic from the client.

Answer

The client's IP address is from a DHCP scope that does not include a default gateway.

Answer

The VLAN policy is incorrect; the client should be in VLAN 20.

Answer

The switch is not configured for inter-VLAN routing.

Question 4

Which TWO actions are recommended best practices for securing web traffic using Cisco Umbrella?

Accepted Answer

Enable IP-layer enforcement for all destinations.. Enabling IP-layer enforcement in Cisco Umbrella ensures that all traffic to destinations that match a blocked category is dropped at the IP layer, even if DNS-based blocking is bypassed (e.g., via direct IP connections). This provides a second layer of protection by inspecting and blocking traffic based on the destination IP address, preventing users from circumventing DNS filtering by using IP addresses directly. Option E is also correct because using Selective Proxy with PAC files allows granular control over web traffic routing based on destination category, enabling organizations to apply different security policies (e.g., proxy inspection for high-risk categories) while allowing direct access to trusted categories. This combination of IP-layer enforcement and selective proxying provides comprehensive web security.

Answer

Configure SSL decryption to always bypass traffic to trusted domains.

Answer

Configure the network to use the root DNS forwarder for all DNS queries.

Answer

Configure local security stack bypass for all internal IP ranges.

Question 5

An administrator is configuring a Cisco ASA 5500-X to perform SSL inspection for outbound traffic. The users must be able to access HTTPS websites without certificate errors. Which configuration step is essential for the ASA to perform decryption?

Accepted Answer

Generate a trusted root CA certificate on the ASA and distribute it to all client machines.. For the ASA to perform SSL inspection (a man-in-the-middle proxy), it must generate a trusted root CA certificate that is installed as a trusted root on all client machines. This allows the ASA to dynamically sign the web server's certificate during the SSL handshake, so clients trust the re-encrypted traffic without certificate errors.

Answer

Configure the ASA to use a self-signed certificate without distribution.

Answer

Import the web server's private key onto the ASA.

Answer

Configure AAA authentication for SSL inspection.

Question 6

Which THREE of the following are recommended best practices for configuring Cisco AMP for Endpoints to minimize false positives while maintaining strong detection?

Accepted Answer

Enable file reputation scanning with cloud lookups. Options B, C, and E are correct. Option B (File reputation scanning with cloud lookups) validates files against cloud intelligence, allowing known good files to reduce false positives. Option C (Application blocking with a whitelist of approved software) ensures only trusted applications run, minimizing false alerts. Option E (Exclusions for directories where trusted software is installed) prevents scanning of benign files, lowering false positives while maintaining detection for unknowns. Option A is incorrect because setting scan level to maximum for all file types increases false positives without significant detection gain. Option D is incorrect because disabling exploit prevention weakens security and is not recommended.

Answer

Set scan level to maximum for all file types

Answer

Disable exploit prevention to reduce false positives

Question 7

A security engineer is configuring Cisco Web Security Appliance (WSA) to block downloads of potentially malicious file types such as .exe and .scr. The engineer wants to ensure that these files are blocked even if they are hosted on trusted websites. Which TWO actions should the engineer take?

Accepted Answer

Create an access policy that enables file reputation filtering.. Options A and C are correct because file reputation filtering (A) uses Talos threat intelligence to block files based on their reputation, regardless of the source URL, and file type control (C) allows blocking specific file extensions such as .exe and .scr. Both features are configured within an access policy and apply to all traffic, including trusted websites. Option B (custom URL category) is for categorizing websites, not file types. Option D (HTTPS proxy decryption) is necessary for inspecting encrypted traffic but does not itself block file types. Option E (DLP) is designed for data loss prevention, not file type blocking.

Answer

Create a custom URL category for the file types.

Answer

Configure HTTPS proxy to decrypt traffic for file inspection.

Answer

Enable Data Loss Prevention (DLP) on the access policy.

Question 8

A Cisco WSA receives intermittent complaints that legitimate websites are being blocked. The access policy uses reputation scoring and URL filtering. The administrator checks the logs and finds that the blocked requests have a web reputation score of -2.0. What action should be taken to allow these legitimate sites while still blocking malicious ones?

Accepted Answer

Create a custom URL category for the legitimate sites and apply an allow action above the reputation policy.. Creating a custom URL category for the legitimate sites and placing an allow action above the reputation policy ensures that traffic matching that category bypasses the reputation scoring check. This allows the legitimate sites while the reputation policy continues to block malicious sites with scores below the threshold. In Cisco WSA, access policies are evaluated in order, so a higher-priority allow rule for trusted URLs overrides the lower-priority reputation-based block.

Answer

Lower the reputation threshold to -1.0.

Answer

Set the reputation action to 'Monitor' for suspicious scores.

Answer

Disable web reputation filtering for that policy.

Question 9

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

Accepted Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will only authenticate the PC, and any additional device will be denied.. Gi1/0/1 is configured with the `authentication port-control auto` and `authentication host-mode multi-auth` commands, which allow both the VoIP phone and the PC to authenticate independently. Gi1/0/2 is configured with `authentication host-mode single-host` (the default), which only permits a single authenticated device; any additional device, such as a second PC connected via a hub, will be denied access.

Answer

Both ports will authenticate all connected devices because 802.1X supports multiple hosts by default.

Answer

Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because multi-auth is not supported on access ports.

Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because the tx-period is too long.

Question 10

An FTD device is deployed in passive mode. Which statement about its traffic processing is true?

Accepted Answer

It receives traffic from a network tap or SPAN port and cannot block traffic.. In passive mode, the FTD receives a copy of traffic from a span port; it cannot block traffic in real-time. It can only generate alerts.

Answer

It can block malicious traffic by sending TCP resets.

Answer

It operates as a transparent firewall with inline inspection.

Answer

It can use the 'Block' action in access control rules.

Question 11

A company uses Cisco ISE for posture assessment. They require that all endpoints meet a certain set of compliance rules before being granted network access. Which service is responsible for performing the posture assessment on the endpoint?

Accepted Answer

Cisco AnyConnect ISE Posture Module. The Cisco AnyConnect ISE Posture Module is the client-side software agent installed on the endpoint that performs the actual posture assessment. It collects compliance information such as OS patch level, antivirus status, and running processes, then reports this data to the ISE Policy Service for evaluation. Without this module running on the endpoint, ISE cannot perform a posture check.

Answer

ISE Policy Service

Answer

Cisco ISE pxGrid

Answer

Network Access Device (switch)

Question 12

A global enterprise with over 20,000 endpoints has been using Cisco AMP for Endpoints for two years. They recently migrated to a new SIEM and want to forward AMP events in near real-time. The security operations team notices that the SIEM is receiving duplicate events for the same file execution, causing alert fatigue. The AMP console shows that the 'Send to Syslog' action is enabled on two different policies, and both policies are applied to the same groups of endpoints. The team also uses the AMP APIs to pull data. The network engineer wants to eliminate duplicate events without losing any critical alerts. Which course of action should the engineer take?

Accepted Answer

Review the group hierarchy and ensure each endpoint is assigned to a single policy that includes the syslog action.. Duplicate events occur because the same set of endpoints is covered by two different policies both with the 'Send to Syslog' action enabled. By reviewing the group hierarchy and ensuring each endpoint is assigned to a single policy that includes the syslog action, you eliminate duplicates while still forwarding all events. Option A (disable API) does not affect syslog duplicates; the API is a separate data source. Option B (increase detection interval) would not deduplicate events; it only changes the rate of detection. Option C (remove syslog action from one policy) might still cause duplicates if the other policy still applies to the same endpoints, and it could also affect other security settings in that policy. The proper approach is to maintain a clean policy assignment hierarchy.

Answer

Disable the AMP API to stop duplicates from multiple data sources.

Answer

Increase the event detection interval to reduce the number of events generated.

Answer

Remove the 'Send to Syslog' action from one of the two policies.

Question 13

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

Accepted Answer

The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN. The ISE posture policy requires a corporate certificate, and since the user skipped that step, the endpoint is marked as 'NonCompliant'. ISE then sends a Change of Authorization (CoA) to the switch, which dynamically moves the port from the authorized VLAN (10) to a remediation VLAN. This remediation VLAN typically has restricted access, such as no internet connectivity, while still allowing DHCP to assign an IP address from that VLAN's scope.

Answer

The user is not logged into the domain

Answer

The switchport is still in the default VLAN

Answer

The DHCP server does not have a scope for VLAN 10

Question 14

A security team implements a policy where users must provide a password and a one-time code from a mobile app. Which authentication factors are being used?

Accepted Answer

Knowledge and possession. Something you know (password) and something you have (mobile app one-time code).

Answer

Inherence only

Answer

Possession and inherence

Answer

Knowledge and inherence

Question 15

A company uses Amazon Web Services (AWS) and wants to integrate with Cisco Defense Orchestrator (CDO) for centralized security management. Which THREE capabilities does CDO provide when managing AWS security services? (Choose three.)

Accepted Answer

Monitor AWS CloudTrail logs for security events.. A is correct because Cisco Defense Orchestrator (CDO) can ingest and monitor AWS CloudTrail logs to detect security events, such as unauthorized API calls or policy violations. This integration allows CDO to correlate cloud-native audit logs with firewall events for centralized visibility and alerting, which is a key capability for cloud security management.

Answer

Manage AWS Identity and Access Management (IAM) roles.

Answer

Provision and configure AWS VPC subnets.