350-701 Practice Test 44 — 15 Questions

Question 1

A security team is investigating an email threat that bypassed the Cisco ESA. The email appears to be from the CFO asking for a wire transfer. Which THREE of the following are characteristics of this attack? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It is a type of phishing known as Business Email Compromise (BEC).. Option A is correct because this is a classic Business Email Compromise (BEC) attack, a form of phishing in which attackers impersonate or compromise a trusted business contact to trick victims into transferring funds. Option C is correct because the scenario describes impersonation of a senior executive (the CFO) to request a wire transfer, which is the defining pretext of BEC fraud. Option D is correct because BEC succeeds through social engineering—manipulating human trust and urgency—rather than exploiting software vulnerabilities or delivering malicious code. Option B is incorrect because BEC messages typically contain no malicious links or attachments and often originate from legitimate or lookalike accounts, so anti-spam filters frequently fail to block them, as the scenario itself demonstrates. Option E is incorrect because this attack does not rely on malware attachments; it is a text-based deception aimed at inducing a voluntary financial transaction.

Answer

It is easily blocked by anti-spam filters.

Answer

It uses malware attachments to compromise the system.

Question 2

An engineer is deploying a Cisco FTD in inline mode and wants to inspect SSL/TLS traffic using the 'decrypt-resign' action. What must be configured on the client devices to avoid certificate errors?

Accepted Answer

Install the organization's CA certificate in the client's trusted root store.. When using 'decrypt-resign', the FTD generates a new certificate signed by a CA that the organization controls. Clients must trust the organization's CA certificate (root CA) that is used to sign the re-encrypted certificates. Without that, clients will see certificate errors.

Answer

Disable certificate validation on all client browsers.

Answer

Install the FTD's self-signed certificate on each client.

Answer

Use 'decrypt-known-key' instead, which does not require client configuration.

Question 3

A company is deploying Cisco Cloud Web Security (CWS) using an on-premises connector. They want to authenticate users via Active Directory and apply granular policies based on user identity. Which authentication method should be configured on the connector?

Accepted Answer

LDAP authentication with transparent user identification. Cisco Cloud Web Security (CWS) with an on-premises connector can integrate with Active Directory via LDAP to perform transparent user identification. This allows the connector to map IP addresses to authenticated user identities without requiring explicit proxy authentication, enabling granular policy enforcement based on AD user or group membership.

Answer

Local user database on the connector

Answer

Transparent proxy with explicit authentication via PAC file

Answer

SAML-based authentication

Question 4

Which protocol does Cisco ISE use to communicate with network devices for 802.1X authentication?

Accepted Answer

RADIUS. Cisco ISE uses RADIUS for authentication, authorization, and accounting. 802.1X leverages EAP over RADIUS.

Answer

LDAP

Answer

SNMP

Answer

TACACS+

Question 5

A small business uses Cisco Umbrella for DNS-layer security. They recently enabled multi-factor authentication (MFA) for all administration accounts. The IT manager is unable to log into the Umbrella dashboard; the login page accepts his password but then asks for an MFA code. However, he never set up MFA. He checks his email and finds no registration email. He is the only administrator. How should he regain access to the Umbrella dashboard?

Accepted Answer

Contact Cisco TAC and prove ownership of the account to have MFA reset.. When an administrator is locked out of Cisco Umbrella due to MFA that was never configured, and there is no other administrator to assist, the only recovery path is to contact Cisco TAC. TAC can verify account ownership through a proof-of-ownership process and then reset the MFA enrollment, allowing the administrator to set it up fresh. This is the standard escalation procedure for Umbrella when self-service recovery options are unavailable.

Answer

Create a new Umbrella account and transfer the organization.

Answer

Use the Umbrella API to programmatically disable MFA.

Answer

Have another administrator in the organization disable MFA for his account.

Question 6

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Accepted Answer

Check the Cisco Umbrella dashboard for the domain, identify the internal IP, and block the domain via policy.. Cisco Umbrella is a DNS-layer security solution that can log and block DNS queries to malicious domains. The administrator should first check the Umbrella dashboard to identify the internal IP generating the excessive queries, then create a policy to block the domain, which will prevent all subsequent DNS resolutions to that domain without affecting other traffic.

Answer

Create a firewall ACL to block the IP address of the DNS server from the internal user.

Answer

Disable the user's network access temporarily and inform the IT department.

Answer

Enable full packet capture on the internal network and wait for the next occurrence.

Question 7

A network engineer is troubleshooting 802.1X authentication failures. Which two components are required for a successful 802.1X authentication? (Choose two.)

Accepted Answer

Authentication server (ISE). In 802.1X authentication, the supplicant (client software) initiates the authentication process by sending an EAPOL-Start message, and the authentication server (ISE) validates the client's credentials via RADIUS. Without both, the authentication cannot complete. The supplicant provides identity, while the authentication server makes the final permit/deny decision.

Answer

DHCP server

Answer

DNS server

Answer

RADIUS proxy

Question 8

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Option A (Assume breach) is correct because zero trust operates on the principle of minimizing blast radius and segmenting access, assuming that any network, device, or identity could already be compromised, so no implicit trust is granted based on location. Option E (Verify explicitly) is correct because zero trust requires authenticating and authorizing every request based on all available data points, including user identity, device health, location, and service, before granting access. Together, these principles align with the NIST SP 800-207 zero trust tenets: never trust, always verify, and assume breach. Option B (Implicit trust for internal traffic) is incorrect because zero trust explicitly rejects implicit trust for traffic inside the corporate perimeter. Option C (Use static passwords) is incorrect because zero trust favors strong, phishing-resistant authentication such as MFA and passwordless methods, not static passwords. Option D (Use perimeter firewalls only) is incorrect because zero trust moves beyond perimeter-based defense to identity- and policy-based controls at every access point.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 9

Which encryption algorithm is classified as symmetric?

Accepted Answer

AES. AES is a symmetric encryption algorithm, using the same key for encryption and decryption.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECDSA

Question 10

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

Accepted Answer

Enable Removable Media Scan in the policy.. Cisco Secure Endpoint (AMP) includes a dedicated 'Removable Media Scan' policy feature that automatically scans files executed from USB drives and other removable media. When enabled, this feature triggers a scan of any file launched from a removable device, and if the file is determined to be malicious based on local or cloud reputation, it can be blocked or quarantined before execution completes.

Answer

Enable File Reputation to check files against the cloud.

Answer

Enable Exploit Prevention to block malicious code execution.

Answer

Configure Quarantine actions for all file events.

Question 11

A company uses Cisco Umbrella to protect remote users. They want to ensure that SSL-encrypted traffic to malicious websites is inspected, but without breaking compliance with privacy regulations. Which Umbrella feature should they enable?

Accepted Answer

Intelligent Proxy. Intelligent Proxy allows selective SSL inspection based on policy, balancing security and privacy.

Answer

Secure Internet Gateway (SIG)

Answer

Roaming Client

Answer

DNS-layer security

Question 12

An engineer is tuning an IPS on a Cisco FTD to reduce false positives. Which three techniques are effective? (Choose three.)

Accepted Answer

Add source and destination IP filters to signatures. Option A is correct because adding source and destination IP filters to signatures narrows the traffic a signature evaluates, so it only fires on relevant hosts and avoids false positives from unrelated traffic. Option B is correct because disabling specific signatures that trigger incorrectly removes the exact noisy rules causing false positives while leaving the rest of the policy intact. Option C is incorrect because increasing the global sensitivity slider to maximum makes signatures more aggressive and typically increases, not reduces, false positives. Option D is incorrect because enabling all built-in rules maximizes coverage but also maximizes the chance of false positives, which is the opposite of the goal. Option E is correct because using monitor mode for new or modified rules lets the engineer observe how those rules behave on live traffic and tune or suppress them before enforcing, preventing false positives from reaching production.

Answer

Increase the global sensitivity slider to maximum

Answer

Enable all built-in rules to maximize coverage

Question 13

During a phishing simulation, an employee receives an email that appears to be from the CEO requesting an urgent wire transfer. This type of attack is known as:

Accepted Answer

Business Email Compromise (BEC). Business Email Compromise (BEC) is a sophisticated scam that targets organizations by impersonating a high-level executive (like the CEO) to trick employees into performing unauthorized actions, such as wire transfers. In this scenario, the email appears to be from the CEO requesting an urgent wire transfer, which is a classic BEC attack. BEC often does not involve malicious links or attachments, relying instead on social engineering to exploit trust and urgency.

Answer

Whaling

Answer

Spear phishing

Answer

Malspam

Question 14

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

Accepted Answer

SQL Injection. SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Buffer Overflow

Answer

Cross-Site Scripting (XSS)

Question 15

A cloud engineer is deploying a web application on AWS and needs to control inbound and outbound traffic at both the instance and subnet levels. Which two AWS security controls should they configure? (Select two.)

Accepted Answer

Security Groups. Security Groups (B) are the correct control for instance-level traffic filtering, acting as stateful virtual firewalls attached to ENIs that allow or deny inbound and outbound rules by protocol, port, and source/destination. Network ACLs (E) are the correct control for subnet-level traffic filtering, acting as stateless, ordered allow/deny rules applied to all resources in a subnet for both ingress and egress. Together, B and E satisfy the requirement to control traffic at both the instance and subnet levels. AWS PrivateLink (A) only provides private connectivity to services via VPC endpoints and does not filter instance or subnet traffic. AWS WAF (C) filters HTTP/HTTPS application-layer requests at CloudFront, ALB, or API Gateway, not at the instance or subnet layer. AWS Shield (D) provides DDoS protection, not granular inbound/outbound traffic control at the instance or subnet level.

Answer

AWS PrivateLink

Answer

AWS WAF

Answer

AWS Shield