350-701 Practice Test 44 — 15 Questions

Question 1

A security team is designing an endpoint protection strategy for a mix of Windows and macOS endpoints. They want to use Cisco AMP for Endpoints with centralized management. Which deployment approach minimizes administrative overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the AMP cloud console to manage a single policy that applies to both platforms with os-specific exclusions.. Cisco AMP for Endpoints offers a cloud-based console that provides centralized management for both Windows and macOS endpoints from a single pane of glass. This eliminates the need for on-premises infrastructure or separate management tools, and a single policy can be applied across platforms with OS-specific exclusions to handle differences in file paths and processes, thereby minimizing administrative overhead.

Answer

Deploy an on-premises AMP Console for each operating system.

Answer

Install a Windows Server as a management point and deploy connectors via SCCM.

Answer

Use group policies to define different policies for Windows and macOS.

Question 2

A cloud security architect is designing a zero-trust architecture for an enterprise using AWS and Azure. They need to enforce micro-segmentation between application tiers. Which Cisco solution is most appropriate?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct solution because it provides agent-based and agentless workload visibility, policy recommendation, and enforcement of micro-segmentation at the application tier level. It uses a combination of NetFlow, IPFIX, and host-based sensors to map inter-tier traffic flows and generate whitelist-based policies that are enforced via host firewall rules or network ACLs, directly addressing the zero-trust requirement to restrict lateral movement between application tiers in multi-cloud environments like AWS and Azure.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Firewall

Answer

Cisco Secure Cloud Analytics

Question 3

An organization wants to connect its on-premises data center to an AWS VPC privately, avoiding the public internet. Which AWS service provides a dedicated, private connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private connection from an on-premises data center to AWS, bypassing the public internet. Site-to-Site VPN uses the internet, PrivateLink is for accessing services privately across VPCs and on-premises, and NAT Gateway is for outbound internet access.

Answer

AWS Site-to-Site VPN

Answer

AWS PrivateLink

Answer

AWS NAT Gateway

Question 4

An organization is deploying containerized applications in a Kubernetes cluster on AWS EKS. They need to ensure that container images are scanned for vulnerabilities before deployment. Which approach aligns with DevSecOps best practices?

Accepted Answer

Integrate image scanning into the CI/CD pipeline before pushing to registry. Integrating image scanning into the CI/CD pipeline (e.g., using tools like Trivy or Amazon ECR scanning) ensures vulnerabilities are caught before deployment. Scanning after deployment or manually is less effective, and only scanning base images ignores application layer vulnerabilities.

Answer

Scan container images after deployment using a runtime scanner

Answer

Manually review images before deployment

Answer

Only scan base images, not application layers

Question 5

A security team wants to gain visibility into Shadow IT usage of SaaS applications and enforce data loss prevention policies. Which cloud security solution should they deploy?

Accepted Answer

CASB. CASB provides visibility, DLP, and threat detection for sanctioned and unsanctioned SaaS apps.

Answer

CSPM

Answer

Cisco Umbrella

Answer

CWPP

Question 6

An organization wants to deploy 802.1X for network access control. Which component is responsible for forwarding authentication requests from the endpoint to the authentication server?

Accepted Answer

Authenticator. In 802.1X, the authenticator (switch or wireless LAN controller) acts as the middleman, relaying EAP messages between the supplicant and the authentication server.

Answer

Authentication server

Answer

Supplicant

Answer

RADIUS proxy

Question 7

A company uses Cisco ISE for network access control. They want to allow employee-owned devices to access the guest network after a simple registration, while corporate devices get full access. Which ISE configuration best achieves this?

Accepted Answer

Use MAB for unknown devices, then perform posture assessment; redirect to registration portal if needed.. Using MAB for unknown devices captures their MAC addresses. Then, posture assessment checks compliance; if the device is non-corporate (employee-owned), it can be redirected to a guest registration portal for simple registration before granting guest network access. Corporate devices that are known can be authenticated via 802.1X and granted full access. Option A (802.1X with PEAP and machine certificates) is suitable for corporate devices but not for guest devices that may not support 802.1X. Option C (MAB only for corporate devices, deny others) would block employee-owned guest devices entirely. Option D (single PSK for guest SSID) is less secure as it does not provide individual authentication or posture assessment.

Answer

Use 802.1X with PEAP and machine certificates for all devices.

Answer

Use MAB only for corporate devices and deny all others.

Answer

Configure a single PSK for the guest SSID.

Question 8

A company is adopting a zero-trust security model for its cloud environment. Which THREE practices align with zero-trust principles? (Choose three.)

Accepted Answer

Use privileged identity management (PIM) for just-in-time access. Zero trust assumes no implicit trust; verify every request. MFA, conditional access, and privileged identity management are key components.

Answer

Trust all traffic from within the corporate network

Answer

Grant permanent administrative privileges for convenience

Question 9

An organization uses Cisco Umbrella to protect remote users. The security team notices that some malicious domains are not blocked because users are bypassing the DNS layer by using direct IP connections or non-DNS protocols. Which Cisco Umbrella feature should be enabled to inspect all traffic, including non-web traffic, and enforce policies regardless of DNS resolution?

Accepted Answer

Secure Internet Gateway (SIG). The Cisco Umbrella Secure Internet Gateway (SIG) provides a cloud-delivered firewall that can inspect all traffic (including non-web) and enforce policies without relying solely on DNS blocking.

Answer

Intelligent Proxy

Answer

Umbrella Roaming Client

Answer

DNS-layer Security

Question 10

Which TWO actions are best practices when configuring a Cisco WSA to block malicious websites? (Choose two.)

Accepted Answer

Configure URL filtering categories to block known malicious categories. Cisco WSA URL filtering categories allow administrators to block entire groups of known malicious sites, such as malware, phishing, or spyware categories, which are pre-classified by Cisco Talos. This provides a broad, proactive defense against threats without needing to maintain individual URL block lists. Option E is correct because Web Reputation filtering uses a scoring system (1–10, with lower scores being more malicious) to dynamically block or warn users about websites with poor reputation, even if they are not in a specific malicious category, adding a layer of behavioral analysis.

Answer

Set the default action to 'Monitor' for all categories

Answer

Disable user authentication to simplify policy

Answer

Allow all HTTPS traffic to improve performance

Question 11

Refer to the exhibit. The file invoice.pdf was determined to be malicious by the AMP cloud, yet the endpoint allowed it to execute. What is the most likely reason?

Accepted Answer

The AMP policy was configured to allow files with a certain confidence level or based on a custom rule.. The AMP for Endpoints connector sends a SHA-256 hash of the file to the AMP cloud for analysis. If the cloud determines the file is malicious but the endpoint still allows execution, the most likely reason is that the AMP policy has been configured with a custom rule or a confidence threshold that permits files at that specific malicious confidence level. This overrides the default block action for known malware.

Answer

The endpoint was not up to date with the latest AMP connector patches.

Answer

The file was not analyzed locally because local analysis was disabled.

Answer

The AMP connector lost connectivity after sending the file and fell back to a local allow policy.

Question 12

Refer to the exhibit. Based on the exhibit, what is the current state of the client and what action should the network administrator take to allow full network access?

Accepted Answer

The client is in a quarantine state due to posture assessment failure; the administrator should check the ISE posture policy and ensure the client meets compliance.. The exhibit shows 'Authz Success' but the presence of a URL redirect to a guest portal and a dACL named 'PERMIT_QUARANTINE' along with SGT value 2 (commonly quarantine) indicates the client is in a quarantine state due to posture assessment failure. The administrator should check the ISE posture policy and ensure the client meets compliance to allow full network access. Option B is incorrect because the authentication is complete; the issue is posture non-compliance, not incomplete authorization. Option C is incorrect because the redirect is a result of the quarantine policy, not an independent problem to be disabled. Option D is incorrect because the client does not have full access; the quarantine dACL restricts it.

Answer

The client's authentication succeeded but authorization is incomplete; the administrator should configure a new dACL on the switch.

Answer

The client is being redirected to a guest portal; the administrator should disable the URL redirect and assign a new VLAN.

Answer

The client is fully authenticated and authorized; no action is needed.

Question 13

A company using Cisco Web Security Appliance (WSA) in explicit proxy mode has enabled HTTPS decryption with a custom CA certificate. A user reports that a specific banking website displays a certificate error message. The administrator verifies that the WSA is generating a certificate for that site. What is the most likely cause of the error?

Accepted Answer

The banking website uses HTTP Public Key Pinning (HPKP) or Certificate Pinning.. The most likely cause is that the banking website uses HTTP Public Key Pinning (HPKP) or certificate pinning. When the WSA performs HTTPS decryption, it generates a new certificate for the site, which does not match the pinned public key or certificate hash that the browser expects. This mismatch triggers a certificate error, even though the WSA's CA is trusted.

Answer

The WSA's time is not synchronized with the NTP server, causing certificate validity issues.

Answer

The WSA is not configured to generate certificates for that domain.

Answer

The user's browser does not trust the WSA's CA certificate.

Question 14

An engineer configures a Cisco FTD in a high-availability pair with active/standby failover. The primary unit fails, and the standby takes over. After the primary recovers, what must be done to ensure it resumes as active?

Accepted Answer

Execute 'failover active' on the primary unit.. In active/standby failover, the active unit can be forced to become standby and the standby active. To make the recovered primary active, the command 'failover active' on the primary or 'failover reset' can be used. However, by default, the primary will not automatically become active unless configured with preempt.

Answer

No action is needed; the primary automatically resumes active role.

Answer

Reboot the secondary unit.

Answer

Disable and re-enable failover.

Question 15

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. File quarantine, process isolation, and remote shell investigation are EDR actions. Application whitelisting is a hardening technique, and MFA is authentication.

Answer

Multi-factor authentication

Answer

Application whitelisting