350-701 Practice Test 41 — 15 Questions

Question 1

An organization is using Cisco Umbrella alongside Cisco AMP for Endpoints. A user reports that they cannot access a legitimate file-sharing website. However, the site is not categorized as malicious by Umbrella. What is the most likely reason for the block?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco AMP's Intelligent Proxy detected the file download as potentially malicious and blocked it. Cisco AMP for Endpoints includes an Intelligent Proxy feature that can inspect and block file downloads based on real-time threat intelligence, even if the website itself is not categorized as malicious by Cisco Umbrella. In this scenario, the user can access the site but the file download is blocked, which aligns with AMP's Intelligent Proxy intercepting the download and determining it to be potentially malicious.

Answer

The website's domain is in a custom block list

Answer

The endpoint's firewall is blocking the connection

Answer

The user is behind a proxy that is not configured with Umbrella

Question 2

A company uses Cisco Secure Workload to enforce microsegmentation across multiple AWS accounts. After enabling enforcement, they find that the policies are only applied to workloads in the primary account. What is the most likely reason?

Accepted Answer

The cloud connector is not configured for the secondary accounts. Cisco Secure Workload (formerly Tetration) uses cloud connectors to integrate with AWS accounts and discover workloads. When enforcement is enabled, the policies are applied only to workloads in the primary account because the cloud connector has not been configured for the secondary AWS accounts. Without the connector, the platform cannot manage or enforce policies on workloads outside the primary account.

Answer

The policy labels are not propagated

Answer

The agents in secondary accounts are not registered

Answer

The enforcement scope is limited to a single VPC

Question 3

A security analyst notices that a Cisco Firepower Threat Defense (FTD) device is not applying file policies to detect malware in HTTP traffic. The access control policy has an HTTPS decryption rule that decrypts traffic from external sources. The file policy is associated with the same rule. What is the missing configuration?

Accepted Answer

The HTTP inspection is not enabled in the access control policy's advanced settings.. File policies in Firepower require the appropriate inspection engine to be enabled for the traffic type. For HTTP traffic, the FTD must have HTTP inspection enabled in the access control policy's advanced settings. Without this, the file policy will not be applied to HTTP traffic even if decryption is configured. Option B is correct because enabling HTTP inspection allows the file policy to inspect decrypted HTTP traffic. Option A is incorrect because the file policy action (Detect vs. Block) does not prevent detection. Option C is incorrect because decryption is already in place for external sources. Option D is incorrect because file policies work independently of URL categories.

Answer

The file policy is set to 'Detect' but not 'Block' for malware.

Answer

SSL decryption is not configured for the internal network.

Answer

The URL category is not defined in the file policy.

Question 4

During a security incident, an investigator wants to identify all endpoints that communicated with a known malicious IP address within the last 24 hours. Which Cisco tool is best suited for this forensic analysis?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch). Cisco Secure Network Analytics (Stealthwatch) is the correct tool because it provides network-wide visibility and flow-based analytics using NetFlow/IPFIX data. It can retroactively query all historical flow records to identify every endpoint that communicated with a known malicious IP address within a specified time window, making it ideal for forensic analysis.

Answer

Cisco Firepower NGFW

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 5

A security engineer is designing cloud workload protection (CWPP) for a hybrid environment with VMs and containers. Which TWO capabilities should a CWPP solution provide? (Choose two.)

Accepted Answer

Intrusion prevention system (IPS) for workloads. CWPP solutions focus on workload protection including vulnerability scanning, intrusion detection, file integrity monitoring, and sometimes container security.

Answer

Cloud security posture management (CSPM) for configuration

Answer

DNS-layer security for user devices

Answer

Data loss prevention (DLP) for SaaS applications

Question 6

During a security incident, an analyst needs to isolate a compromised endpoint and perform remote forensic analysis using Cisco AMP for Endpoints. Which capability allows the analyst to execute commands on the endpoint remotely?

Accepted Answer

Remote shell investigation. Remote shell investigation is the correct answer because Cisco AMP for Endpoints includes a feature that allows an analyst to establish a secure, encrypted shell session directly with the compromised endpoint. This enables the execution of arbitrary commands for live remote forensic analysis without requiring additional tools or manual intervention on the endpoint.

Answer

Device Trajectory

Answer

File quarantine

Answer

Process isolation

Question 7

Drag and drop the steps to implement Cisco Umbrella (formerly OpenDNS) for DNS-layer security in the correct order.

Accepted Answer

Registration, Add network identity, Point DNS to Umbrella, Set policies, Verify. Start with registration, add network identity, point DNS to Umbrella, set policies, then verify.

Answer

Registration, Point DNS to Umbrella, Add network identity, Set policies, Verify

Answer

Add network identity, Registration, Point DNS to Umbrella, Set policies, Verify

Answer

Registration, Add network identity, Set policies, Point DNS to Umbrella, Verify

Question 8

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 9

A university is implementing 802.1X for student wireless networks using Cisco Wireless LAN Controllers (WLCs) and ISE. Students connect with their personal devices using PEAP-MSCHAPv2. During heavy usage, some students report authentication failures and sporadic disconnections. The network team examines the ISE live logs and sees many 'Authentication failed' entries with reason 'Internal error - unable to find a suitable proxy target'. The team has configured two ISE nodes as authentication proxies for the wireless subnets. What is the most likely cause of this issue?

Accepted Answer

The proxy target rules in ISE do not match the WLC's NAS-IP-Address. The error 'unable to find a suitable proxy target' indicates that the ISE node cannot determine which proxy to use for the authentication request, often due to proxy target rules not matching the incoming request attributes like NAS-IP-Address. Option D is correct because if the proxy target rules are missing or incorrect, ISE cannot forward the request. Option A would cause different errors. Option B might cause performance but not internal error. Option C would cause connection errors, not proxy target errors.

Answer

The WLC is not configured to use the ISE proxy nodes as RADIUS servers

Answer

The RADIUS shared secret is mismatched between WLC and ISE

Answer

ISE node CPU is overloaded due to high authentication load

Question 10

A multinational company has recently deployed Cisco WSA with explicit proxy for 10,000 users across two data centers. The WSA is configured with multiple identities based on IP subnets and authentication via LDAP. Users in the R&D department (subnet 192.168.10.0/24) are configured with an access policy that blocks all social media, but they can access web-based email like Gmail. The administrator receives complaints that R&D users cannot access a critical partner's HTTPS website (https://portal.partner.com) that is not categorized. The access policy for R&D has a default action of 'Monitor' for uncategorized URLs, but the site is blocked. The web reputation score for the site is +1.5 (low risk). The global web reputation threshold is set to -1.0. The administrator checks the access logs and sees that the request is denied with the reason 'URL is blocked by policy'. The R&D policy has an explicit 'Deny' action for the URL category 'Uncategorized URLs' set to 'Block', but the default action for the policy is 'Monitor'. The identity matching is correct. What is the most likely cause and solution?

Accepted Answer

Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.. The R&D access policy has an explicit 'Deny' action for the 'Uncategorized URLs' category, which overrides the default 'Monitor' action. Since portal.partner.com is uncategorized, it is blocked by this explicit deny. Creating a custom URL category for the partner site and configuring an explicit 'Allow' action in the R&D policy will bypass the uncategorized URL block while preserving the rest of the policy.

Answer

Change the R&D policy's Uncategorized URLs action from Block to Monitor.

Answer

Lower the global web reputation threshold to -2.0 to allow more sites.

Answer

Disable authentication for the R&D identity to bypass policy.

Question 11

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Accepted Answer

Self-registration guest portal. The self-registration guest portal is the correct choice because it allows guests to create their own credentials and, crucially, includes a configurable step where the user must accept an Acceptable Use Policy (AUP) before being granted network access. This portal type is specifically designed for scenarios where guests self-onboard and must acknowledge a policy, which is a core requirement for compliance in many guest access deployments.

Answer