350-701 Practice Test 42 — 15 Questions

Question 1

Which Cisco security product provides network visibility and traffic analytics using NetFlow and IPFIX?

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch uses NetFlow/IPFIX for network visibility and threat detection. Option A (FMC) is for firewall management. Option D (ISE) is for identity services. Option C (Umbrella) is for cloud security.

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella

Answer

Cisco ISE

Question 2

A large enterprise uses Cisco Firepower Threat Defense (FTD) as its next-generation firewall. The network team recently deployed a new application that uses HTTPS for all communications. Users report that the application is slow and sometimes fails to load pages. The security team suspects that SSL inspection might be causing the issue. The FTD is configured with an SSL policy that decrypts all HTTPS traffic using a self-signed certificate. The internal CA is not trusted by the application servers. Which action should the engineer take to resolve the performance and connectivity issues while maintaining security visibility?

Accepted Answer

Create an SSL decryption bypass rule for the specific application servers' IP addresses.. The application servers do not trust the FTD's self-signed certificate, causing SSL/TLS handshake failures or performance degradation due to certificate validation errors and renegotiation. By creating an SSL decryption bypass rule for the specific application servers' IP addresses, the engineer exempts that traffic from inspection, resolving connectivity and performance issues while still inspecting other HTTPS traffic for security visibility.

Answer

Increase the SSL decryption resources by adding more FTD modules.

Answer

Install the internal CA certificate on all application servers.

Answer

Disable SSL inspection globally on the FTD.

Question 3

Refer to the exhibit. A user is unable to access Dropbox, which is a high-risk application. The administrator wants to allow Dropbox but still block other high-risk apps. What is the most efficient way to achieve this?

Accepted Answer

Create a new Cloudlock policy that allows Dropbox for all users, placed with higher priority. Cisco Cloudlock uses a policy-based approach where policies are evaluated in order of priority. By creating a new policy with higher priority that explicitly allows Dropbox, the administrator can override the existing block policy for that specific application while maintaining the block on all other high-risk apps. This is the most efficient method as it avoids modifying or deleting the original policy.

Answer

Add the user to a group that is exempt from the policy

Answer

Delete the existing policy and create separate policies for each high-risk app

Answer

Modify the existing policy to change risk level to 'Medium'

Question 4

A network administrator notices that an endpoint running the AMP connector is not sending events to the cloud. The connector status shows 'Connected' in the AMP console. What is the most likely cause?

Accepted Answer

The endpoint is behind a proxy that does not allow HTTPS traffic to the AMP cloud.. The AMP connector status shows 'Connected' in the AMP console, which indicates that the endpoint has successfully established a TCP connection and authenticated with the AMP cloud. However, if the endpoint is behind a proxy that does not allow HTTPS (TCP/443) traffic to the AMP cloud, the connector may appear connected (due to a persistent keep-alive or cached status) but cannot send event data because the proxy is blocking the actual data-plane traffic. This is a common misconfiguration where the proxy allows the initial handshake but filters subsequent HTTPS requests.

Answer

The AMP license has expired.

Answer

Inbound firewall rules block incoming connections to the AMP connector.

Answer

The AMP connector service is stopped on the endpoint.

Question 5

A company uses Cisco Umbrella for cloud-delivered security. Users report that some websites are incorrectly blocked. The security team wants to allow a specific website temporarily while investigating. Which action should the administrator take?

Accepted Answer

Create a custom policy rule to allow the specific domain.. The correct action is to create a custom policy rule to allow the specific domain. Cisco Umbrella uses policy-based rules to control DNS and web traffic; a custom allow rule overrides the default block for that domain without affecting other security settings. This provides a temporary, targeted exception while the investigation continues.

Answer

Disable the Umbrella policy entirely.

Answer

Configure a Proxy Auto-Config (PAC) file to exclude the domain.

Answer

Change the internal DNS servers to use a public resolver like 8.8.8.8.

Question 6

A security administrator is implementing Cisco AMP for Endpoints and wants to identify files that were initially allowed but later determined to be malicious. Which feature allows the administrator to see the propagation of such a file across the environment?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP for Endpoints provides a timeline of file activity, showing where a file originated and how it spread, which is critical for retrospective security analysis.

Answer

Exploit Prevention

Answer

IOC Scanning

Answer

SHA-256 Disposition

Question 7

A company is deploying Cisco ISE to enforce access policies based on endpoint posture. Endpoints must be compliant before being granted full network access. Which policy type is used to define the compliance requirements?

Accepted Answer

Posture policy. Posture policy defines the compliance requirements (e.g., antivirus, patch level) and the remediation actions. Option A is incorrect because Authentication policy determines the method of authentication. Option B is incorrect because Profiling policy identifies device type. Option D is incorrect because Authorization policy determines the resulting access after authentication and posture.

Answer

Authentication policy

Answer

Profiling policy

Answer

Authorization policy

Question 8

A company uses Cisco Web Security Appliance (WSA) with transparent proxy mode. Recently, they enabled NTLM authentication. Some users are intermittently prompted for credentials while browsing. What is the most likely cause of this behavior?

Accepted Answer

The WSA is not configured to handle NTLM persistent connections, causing the browser to re-authenticate on each request.. In transparent proxy mode with NTLM authentication, the WSA must maintain persistent connections to avoid re-authentication on every HTTP request. If the WSA is not configured to handle NTLM persistent connections (e.g., by enabling connection reuse or adjusting keepalive settings), the browser will be prompted repeatedly for credentials because each new TCP connection triggers a new NTLM challenge-response cycle. This intermittent behavior occurs because some connections may be reused while others are not, depending on browser and proxy settings.

Answer

The WSA is configured to prompt for authentication only for specific categories.

Answer

The user's browser has cached an incorrect credential.

Answer

The WSA is set to use Kerberos instead of NTLM.

Question 9

During a security incident, a SOC analyst notices that a malicious file was executed on an endpoint. Using Cisco AMP for Endpoints, which feature should the analyst use to visualize the file's propagation and activities across the network over time?

Accepted Answer

Device Trajectory. Device Trajectory provides a timeline view of file and process activities on an endpoint, showing how a file propagated and what actions it performed, which is crucial for incident investigation.

Answer

Orbital Advanced Search

Answer

IOC Scan

Answer

File Reputation Lookup

Question 10

Refer to the exhibit. A file with SHA256 hash 'a1b2c3d4e5f6...' is detected on an endpoint. The threat grid returns a score of 90 for this file. What action is taken by AMP?

Accepted Answer

Block (because the custom detection rule has action 'block').. The exhibit shows a custom detection rule configured with an action of 'block'. In Cisco AMP, custom detection rules take precedence over reputation scores or threat grid analysis. When a file matches a custom SHA256 hash rule, AMP applies the configured action (block) regardless of the threat score, which in this case is 90.

Answer

Allow (because threat score 90 is not specifically matched in reputation).

Answer

Quarantine (because score 90 falls between 80 and 100).

Answer

No action (because the file is in the whitelist).

Question 11

Which TWO factors should be considered when designing a Cisco ISE deployment for network access control (NAC) in a multi-site environment? (Choose two.)

Accepted Answer

ISE node roles and placement (primary, secondary, monitoring). Multi-site NAC design with Cisco ISE requires careful consideration of node roles and WAN connectivity. Option A is correct because ISE node roles (Administration, Policy Service, Monitoring) and placement across sites determine authentication flow, failover, and load balancing. Option E is correct because WAN link latency and reliability between sites directly impact authentication timeouts and replication. Option B (Endpoint profiling) is a general ISE feature but not specific to multi-site design. Option C (Number of endpoints per policy evaluator) is a capacity planning detail, not a primary design factor for multi-site. Option D (Type of network access device) is more about compatibility than multi-site topology.

Answer

Endpoint profiling needs

Answer

Number of endpoints per policy evaluator

Answer

Type of network access device (switch, WLC, VPN)

Question 12

A network engineer is troubleshooting a site-to-site IPsec VPN that fails to establish. The IKE phase 1 completes successfully, but phase 2 fails. The debug output shows 'IPSEC(validate_proposal): transform set proposal mismatch'. Both peers have the same transform set configured. What is the most likely cause?

Accepted Answer

Mismatched encryption/authentication algorithms in the transform set. The error 'IPSEC(validate_proposal): transform set proposal mismatch' indicates that the IPsec transform sets proposed by the two peers do not match during IKE phase 2 negotiation. Even if the transform sets appear identical in configuration, a mismatch in the encryption algorithm (e.g., AES-256 vs AES-128) or authentication algorithm (e.g., SHA-1 vs SHA-256) will cause this failure. Since IKE phase 1 completed successfully, the pre-shared key and routing are not the issue, and lifetime mismatches typically generate a different error.

Answer

Mismatched IPsec lifetime values

Answer

Missing route for the remote subnet

Answer

Incorrect pre-shared key

Question 13

An engineer configures a Cisco ASA firewall with three interfaces: inside (security level 100), outside (security level 0), and DMZ (security level 50). Traffic from the inside network to the DMZ network is sourced from 10.1.1.0/24 and destined to 192.168.1.0/24. The inside interface is configured with IP 10.1.1.1, DMZ interface with IP 192.168.1.1. An ACL on the inside interface permits IP traffic from 10.1.1.0/24 to 192.168.1.0/24. What happens when a packet from 10.1.1.10 to 192.168.1.10 arrives at the inside interface?

Accepted Answer

The packet is forwarded because the security levels allow traffic from higher to lower, and an ACL permits it.. The ASA allows traffic from higher to lower security levels by default, but only if an ACL permits it. Since the inside level (100) is higher than DMZ (50), and the ACL permits the traffic, the packet is forwarded.

Answer

The packet is dropped because no ACL is applied to the DMZ interface.

Answer

The packet is dropped because traffic from higher to lower security levels is implicitly denied.

Answer

The packet is forwarded only if a NAT rule exists for the source address.

Question 14

A company uses Cisco Umbrella to enforce web security. After deploying a new policy that blocks all social media sites, users report that they cannot access a corporate Salesforce instance that uses a social login feature. Which Umbrella setting should be adjusted to resolve the issue without weakening the policy?

Accepted Answer

Add Salesforce to the Application Settings allowed list. The social login feature for Salesforce is being blocked by the Social Networking content category in Cisco Umbrella. By adding Salesforce to the Application Settings allowed list, you permit the specific application traffic while keeping the broader social media policy intact. This granular control ensures that only the required Salesforce instance bypasses the block, without weakening the overall security posture.

Answer

Create a bypass code for users to access Salesforce

Answer

Disable the Social Networking category under Content Categories

Answer

Configure Intelligent Proxy to inspect Salesforce traffic

Question 15

Refer to the exhibit. An administrator has configured the router with zone-based firewall rules. Traffic from the DMZ zone to the OUTSIDE zone is being dropped, although traffic from the INSIDE zone to the OUTSIDE zone flows normally. The DMZ zone is configured with security-level 50 and the INSIDE zone with 100. What is the most likely cause of the dropped traffic?

Accepted Answer

No zone-pair is defined for traffic from DMZ to OUTSIDE. The most likely cause is that no zone-pair is defined for traffic from DMZ to OUTSIDE. In zone-based firewall, traffic between zones is implicitly denied unless a zone-pair with a service policy is configured. Since only INSIDE to OUTSIDE has a zone-pair, DMZ to OUTSIDE traffic is dropped by default. Option B is correct. Option A is incorrect because the inspect action, while missing, would not help if no policy is applied. Option C is incorrect because the class-default applies only within the applied policy. Option D is incorrect because security-levels are not used in ZBFW.

Answer

The inspect action is not applied to the DMZ traffic class

Answer

The class-default action in the policy-map drops all traffic from DMZ

Answer

The DMZ has a lower security-level than the INSIDE zone, causing traffic to be implicitly denied