350-701 Practice Test 45 — 15 Questions

Question 1

A company has deployed Cisco AnyConnect VPN for remote access. They want to enforce that only company-managed devices with compliant antivirus and disk encryption can connect. Which solution should be added to the ASA?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Identity Services Engine (ISE) with posture assessment. Cisco ISE with posture assessment is the correct solution because it integrates with the ASA to enforce endpoint compliance before granting VPN access. Posture assessment checks for specific conditions such as antivirus status, disk encryption, and OS patch levels, ensuring only company-managed devices that meet security policies can connect via AnyConnect.

Answer

Cisco Firepower Threat Defense (FTD) with intrusion policy

Answer

Cisco Umbrella with DNS filtering

Answer

Cisco Stealthwatch with NetFlow

Question 2

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) are the native Azure resource designed to filter network traffic to and from Azure resources in a virtual network. They contain security rules that allow or deny inbound and outbound traffic based on source/destination IP, port, and protocol, and can be associated with subnets or network interfaces. This makes them the correct choice for restricting traffic between subnets, as they operate at the subnet level and can enforce granular control.

Answer

Azure DDoS Protection

Answer

Azure Policy

Answer

Azure Firewall

Question 3

A cloud operations team reports that after enabling Cisco Secure Cloud Analytics (CSCA) for an AWS account, some legitimate traffic is being flagged as suspicious. The team has fine-tuned the ML models but false positives persist. Which additional step should they take?

Accepted Answer

Customize alert rules based on known good behavior. C is correct because Cisco Secure Cloud Analytics (CSCA) uses machine learning to establish a baseline of normal traffic behavior. When false positives persist despite fine-tuning ML models, the next logical step is to customize alert rules to explicitly whitelist known good behavior, such as trusted IP ranges or specific application flows. This reduces noise without disabling detection or lowering sensitivity, and it directly addresses the root cause: legitimate traffic that deviates from the baseline but is actually benign.

Answer

Disable ML-based detection

Answer

Increase the severity threshold

Answer

Deploy additional sensors in VPC subnets

Question 4

An organization uses Cisco Umbrella to secure remote users. The security team wants to ensure that all DNS queries from endpoints are forwarded to Umbrella even when users are off the corporate network. Which deployment method achieves this?

Accepted Answer

Deploy the Cisco Umbrella Roaming Client on endpoints. The Cisco Umbrella Roaming Client is specifically designed to enforce DNS security on endpoints regardless of their network location. It installs a local DNS forwarder that intercepts all DNS queries and sends them to Umbrella's cloud resolvers, ensuring protection even when users are off the corporate network. This method does not rely on network-level configurations that are ineffective for remote users.

Answer

Configure a network-based proxy

Answer

Use a PAC file to redirect traffic

Answer

Use BGP injection to advertise Umbrella IPs

Question 5

Which Cisco security solution provides DNS-layer security to block access to malicious domains before a connection is established?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered secure internet gateway whose DNS-layer security resolves and blocks requests to malicious or unwanted domains before any TCP connection is made. It uses global DNS resolvers and threat intelligence to enforce policy at the earliest point in the connection lifecycle.

Answer

Cisco ESA

Answer

Cisco WSA

Answer

Cisco Firepower NGFW

Question 6

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). Cisco TrustSec is a segmentation technology that relies on Security Group Tags (SGTs), so option B is correct: TrustSec assigns an SGT to a user or device's traffic (via 802.1X, SGT Exchange Protocol, or static mapping) and enforces policy based on that tag rather than IP addresses. Option A is also correct because the Security Group Tag Exchange Protocol (SXP) is a TrustSec feature that propagates SGT-to-IP mappings to devices that cannot natively tag traffic, such as older switches or non-TrustSec-capable platforms. The remaining options are not TrustSec-specific features: IPsec VPN (C) is a separate tunneling/encryption technology, Network Access Control (D) is a broader category of admission control that TrustSec can integrate with but does not define, and 802.1X authentication (E) is an IEEE port-based access control standard used to obtain identity/SGT information, not a feature unique to TrustSec.

Answer

IPsec VPN

Answer

Network Access Control (NAC)

Answer

802.1X authentication

Question 7

A security engineer needs to prevent secrets (e.g., API keys) from being stored in code repositories. Which DevSecOps practice should be implemented?

Accepted Answer

Implement secrets management using a tool like Vault. Secrets management tools like HashiCorp Vault securely store and manage secrets, avoiding hardcoding in code.

Answer

Use a SAST scanner to find secrets in code

Answer

Encrypt the code repository

Answer

Use a DAST tool to test for secrets

Question 8

Cisco ISE uses profiling to identify the type of device connecting to the network. Which probe helps ISE identify a device by analyzing the DHCP requests it sends?

Accepted Answer

DHCP probe. The DHCP probe captures DHCP request options to identify the device type.

Answer

HTTP probe

Answer

Device Sensor

Answer

SNMP probe

Question 9

A security analyst notices that a file initially deemed 'unknown' by Cisco AMP for Endpoints was later reclassified as 'malicious'. The analyst needs to investigate the propagation of this file across endpoints. Which Cisco AMP feature provides a timeline view of file activity and spread?

Accepted Answer

Device Trajectory. Device Trajectory is the correct feature because it provides a timeline view of a file's activity across endpoints, including its origin, propagation, and subsequent actions. When Cisco AMP for Endpoints reclassifies a file from 'unknown' to 'malicious', Device Trajectory allows the analyst to trace the file's spread and interactions on each affected endpoint, enabling a thorough investigation of the infection chain.

Answer

SHA-256 disposition

Answer

Exploit Prevention

Answer

IOC scanning

Question 10

An engineer wants to block traffic from a specific country on a Cisco FTD. Which feature should be used in the access control policy?

Accepted Answer

Geolocation filtering. Cisco FTD geolocation filtering allows administrators to create access control rules that match traffic based on the source or destination country, using a continuously updated GeoIP database. This is the correct feature for blocking traffic from a specific country.

Answer

Intrusion policy

Answer

Application visibility and control (AVC)

Answer

URL filtering

Question 11

Which VPN technology allows Cisco AnyConnect clients to use UDP for transport to avoid TCP overhead and improve performance?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is the UDP-based counterpart to TLS and is used by Cisco AnyConnect to carry VPN traffic over UDP, avoiding TCP-over-TCP meltdown and reducing latency. AnyConnect uses DTLS for the data channel while TLS handles the control channel.

Answer

IPsec

Answer

L2TP

Answer

IKEv2

Question 12

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 13

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

Accepted Answer

Active scanning. ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.

Answer

Passive OSINT

Answer

ARP spoofing

Answer

DNS cache poisoning

Question 14

Refer to the exhibit. This JSON policy is part of a Cisco Cloudlock DLP configuration. What will happen when a user attempts to upload a file containing the word 'secret' to a cloud storage service?

Accepted Answer

The file upload is blocked if the content contains the word 'secret'. The JSON policy shown in the exhibit is a Cisco Cloudlock DLP policy that uses a data pattern to match the word 'secret' in file content. The action specified is 'block', which means when a user attempts to upload a file containing 'secret' to a cloud storage service, the upload is blocked and an alert is generated. Option B correctly identifies that the file upload is blocked if the content contains the word 'secret', aligning with the policy's enforcement action.

Answer

An alert is generated but the file is not blocked

Answer

Only files with 'secret' in the title are blocked

Answer

All files are blocked regardless of content

Question 15

A company uses Cisco Web Security Appliance (WSA) to filter web traffic. The security team wants to block access to a specific category of websites (e.g., 'Social Networking') for all users except the HR department. Which WSA feature should be used to achieve this policy?

Accepted Answer

Identity-based policy. Identity-based policies in Cisco WSA allow you to apply different access rules based on the user or group identity, typically authenticated via Active Directory or LDAP. By creating an identity-based policy that exempts the HR department (e.g., via an AD group) and blocks the 'Social Networking' category for all other users, you achieve the required granular control without affecting the entire organization.

Answer

Routing policy

Answer

Decryption policy

Answer

Global access policy