350-701 Practice Test 43 — 15 Questions

Question 1

An organization deploys Cisco FTD in a high-availability pair using active/standby. If the active unit fails, what happens to existing connections?

Accepted Answer

Existing connections are preserved if stateful failover is configured.. In active/standby, state information is synchronized. When the standby becomes active, existing connections are preserved if the failover is stateful.

Answer

All connections are dropped and must be re-established.

Answer

The standby unit cannot take over because it has no configuration.

Answer

Only TCP connections are preserved; UDP connections are dropped.

Question 2

A company is deploying a cloud-native application using microservices on AWS. They need to ensure that inter-service communication is encrypted and authenticated. The security team wants to use mutual TLS (mTLS) without managing individual certificates. Which solution should they implement?

Accepted Answer

Use AWS Certificate Manager Private CA with a service mesh (e.g., Istio) to issue and rotate certificates for each service.. AWS Certificate Manager Private CA can integrate with a service mesh like Istio to automatically issue, distribute, and rotate mTLS certificates for each microservice. This eliminates the need for manual certificate management while ensuring encrypted and authenticated inter-service communication via mutual TLS.

Answer

Use AWS IAM roles for each microservice to authenticate via AWS Signature Version 4.

Answer

Store certificates in AWS Secrets Manager and configure sidecar proxies to retrieve them.

Answer

Deploy AWS CloudHSM to generate keys and certificates for each microservice.

Question 3

Which TWO of the following are valid action types that can be assigned to a file in an AMP policy rule?

Accepted Answer

Quarantine. In an AMP policy rule, the valid action types that can be assigned to a file are 'Quarantine' and 'Block'. Quarantine isolates the file to prevent execution or spread, while Block denies access to the file entirely. Both are core enforcement actions in Cisco AMP for Endpoints, used to stop threats based on file reputation or analysis.

Answer

Scan

Answer

Monitor

Answer

Delete

Question 4

Which THREE of the following are valid considerations when deploying Cisco Advanced Malware Protection (AMP) for Networks on a Firepower system? (Choose three.)

Accepted Answer

An AMP subscription must be active on the Firepower Management Center.. An active AMP subscription on the Firepower Management Center (FMC) is required to enable the AMP for Networks feature. Without a valid subscription license tied to the FMC, the system cannot authenticate with the AMP cloud or enforce file-based threat policies.

Answer

AMP for Networks should be deployed in inline mode behind the firewall.

Answer

A dedicated bridge group must be created on the Firepower device.

Question 5

A SOC analyst notices that after deploying Cisco AMP for Endpoints, some legitimate business software is being blocked by the Exploit Prevention engine. What is the recommended action to allow this software while maintaining maximum security?

Accepted Answer

Create an application exception in Exploit Prevention policy. Cisco AMP for Endpoints' Exploit Prevention engine uses behavioral analysis to block suspicious activities, and legitimate software may trigger these heuristics. Creating an application exception in the Exploit Prevention policy allows the specific software to run without disabling the entire engine, preserving protection against other exploits. This targeted exception maintains maximum security by only exempting the known legitimate application from exploit detection rules.

Answer

Disable Exploit Prevention entirely on affected endpoints

Answer

Add the software's executable hash to the file exclusion list

Answer

Set Exploit Prevention to 'Audit' mode

Question 6

Which Cisco TrustSec feature uses a classification packet to carry security group information across network devices?

Accepted Answer

Security Group Tag (SGT). The Security Group Tag (SGT) is the Cisco TrustSec mechanism that embeds security group information directly into a packet's Ethernet frame (typically as a Cisco Meta Data or inline tag). This allows the packet to carry its source group identity across network devices, enabling consistent policy enforcement without requiring per-hop reclassification.

Answer

Security Group Access Control List (SGACL)

Answer

MACsec

Answer

Cisco TrustSec (CTS)

Question 7

A security analyst discovers that an endpoint was infected by a file that initially received a 'clean' disposition from Cisco AMP. The analyst needs to identify all other endpoints that executed the same file and examine their trajectory. Which approach should be used to find these endpoints in the AMP console?

Accepted Answer

Search for the file's SHA-256 hash in the AMP console to see all endpoints with that file. Cisco AMP maintains a global file disposition database that maps SHA-256 hashes to all endpoints that have ever executed or stored that file. By searching for the file's SHA-256 hash in the AMP console, the analyst can instantly retrieve a list of all endpoints with that file, including those that received a 'clean' disposition before the file was later classified as malicious. This leverages AMP's cloud-based telemetry and file reputation system, enabling rapid identification of all affected systems without requiring additional scans or manual correlation.

Answer

Check the Device Trajectory of the infected endpoint and manually correlate with other endpoints

Answer

Use the IOC scanning feature to scan all endpoints for the file's signature

Answer

Run a retrospective security scan on all endpoints using the file's SHA-256 hash

Question 8

A network engineer is implementing Cisco TrustSec in an enterprise network. Which two components are required for TrustSec to function correctly? (Choose two.)

Accepted Answer

ISE. Cisco TrustSec uses the Identity Services Engine (ISE) as the centralized policy server to define and enforce security group tags (SGTs) and access policies. ISE is the mandatory policy decision point that assigns SGTs to endpoints and distributes them to network devices via SXP or inline tagging. Without ISE, there is no mechanism to create, manage, or propagate the SGT-based policies that TrustSec relies on.

Answer

AAA server

Answer

Firepower

Answer

SGACL

Question 9

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses exploit-specific signatures and behavioral monitoring to block common exploitation techniques (e.g., heap spray, ROP, SEH overwrite) without relying on known malware signatures, making it effective against zero-day exploits. Malware Analytics (C) is correct because it detonates suspicious files in a sandboxed environment to analyze behavior and detect previously unknown threats, providing protection against zero-day malware before signatures are available.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 10

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Answer

SHA-256 file disposition

Question 11

Refer to the exhibit. An engineer configures this interface for 802.1X. Users report that after successful authentication, they are forced to reauthenticate every hour even though the authentication session is still active. What configuration change should be made to prevent reauthentication unless triggered by a change?

Accepted Answer

Remove 'authentication periodic'.. The 'authentication periodic' command enables periodic reauthentication. Removing it with 'no authentication periodic' stops automatic reauthentication, preventing the hourly reauthentication. Option A is incorrect because increasing 'dot1x timeout tx-period' only affects the timeout for initial EAP over LAN (EAPoL) transmissions, not reauthentication intervals. Option B is incorrect because setting 'authentication timer reauthenticate' to 0 would disable periodic reauthentication, but the proper fix is to remove the 'authentication periodic' command to allow reauthentication only on change. Option D is incorrect because 'authentication event server dead action authorize' configures behavior when the RADIUS server is unavailable, which is unrelated to periodic reauthentication.

Answer

Increase 'dot1x timeout tx-period' to 60.

Answer

Change 'authentication timer reauthenticate' to 0.

Answer

Add 'authentication event server dead action authorize'.

Question 12

A security team is investigating an email threat that bypassed the Cisco ESA. The email appears to be from the CFO asking for a wire transfer. Which THREE of the following are characteristics of this attack? (Choose THREE.)

Accepted Answer

It is a type of phishing known as Business Email Compromise (BEC).. This is a Business Email Compromise (BEC) attack, which often involves spoofing, impersonation of executives, and social engineering to request financial transfers.

Answer

It is easily blocked by anti-spam filters.

Answer

It uses malware attachments to compromise the system.

Question 13

A company receives a spear-phishing email that appears to come from the CEO requesting an urgent wire transfer. What type of email attack is this?

Accepted Answer

Whaling. Whaling targets senior executives with personalized attacks.

Answer

Phishing

Answer

Spear Phishing

Answer

Malspam

Question 14

An organization is implementing Privileged Access Management (PAM) using CyberArk integrated with Cisco SecureX. Which THREE capabilities are typically provided by such a PAM solution?

Accepted Answer

Session recording of administrative activities. Session recording of administrative activities (Option B) is a core capability of CyberArk PAM, as it captures and logs all keystrokes, commands, and screen activity during privileged sessions. This recording is stored securely and can be replayed for audit and compliance purposes, integrating with Cisco SecureX for centralized visibility and threat detection.

Answer

Firewall rule management

Answer

Antivirus scanning of administrative workstations

Question 15

Which THREE of the following are valid components of Cisco ISE's visibility and enforcement architecture?

Accepted Answer

TrustSec with SGTs. Cisco ISE's visibility and enforcement architecture relies on TrustSec with Security Group Tags (SGTs) to enforce access policies based on logical groupings rather than IP addresses. SGTs are propagated via SXP or inline tagging, enabling dynamic policy enforcement across the network.

Answer

NetFlow for flow analysis

Answer

SNMP traps for alerting