350-701 Practice Test 45 — 15 Questions

Question 1

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They want to enable URL filtering based on user identity from an Active Directory (AD) source. Which configuration steps are required on the FMC?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an identity source (AD), create realm and user groups, then configure URL filtering rules with user conditions.. To enable URL filtering based on user identity from Active Directory, you must first configure an identity source (AD) on the FMC, then create a realm and import user groups. After that, you can configure URL filtering rules within an access control policy that includes user conditions to match traffic against specific AD users or groups. This sequence ensures the FTD can resolve user identity before applying URL category-based actions.

Answer

Create a URL category and associate it with a user group in the access control policy.

Answer

Create URL filtering rules first, then assign to users via dynamic object.

Answer

Configure identity source and NAT policy, then apply URL filtering.

Question 2

Which TWO of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

MD5 hash of a malicious file. Cisco AMP for Endpoints uses file reputation analysis based on cryptographic hashes, including MD5, to identify known malicious files. When an endpoint attempts to execute or download a file, AMP computes its MD5 hash and compares it against a cloud-based threat intelligence database; a match indicates a known malware sample and is a clear indicator of compromise.

Answer

The endpoint's last login time

Answer

The version of the operating system

Answer

The username of the logged-in user

Question 3

Which TWO of the following are features of Cisco Umbrella? (Choose two.)

Accepted Answer

Secure web gateway. Cisco Umbrella provides DNS-layer security as a core feature, which blocks requests to malicious domains before a connection is established, effectively preventing malware, phishing, and command-and-control callbacks. It also includes a Secure Web Gateway (SWG) that enforces URL filtering, application controls, and HTTPS inspection to protect users from web-based threats. These two capabilities are fundamental to Umbrella's cloud-delivered security architecture.

Answer

Cloud access security broker

Answer

Next-generation firewall

Answer

Data loss prevention

Question 4

A company is deploying Cisco Umbrella to enforce security policies for remote users. They want to ensure that DNS requests from roaming clients are routed through Umbrella's DNS resolvers. However, some users are bypassing Umbrella by using third-party DNS servers like Google (8.8.8.8). Which configuration should be applied to prevent this?

Accepted Answer

Enable DNS Policy in the Umbrella roaming client. The Umbrella roaming client's DNS Policy feature forces all DNS traffic from the endpoint to use Umbrella's DNS resolvers, even if the user manually configures a third-party DNS server like Google (8.8.8.8). This is achieved by intercepting DNS requests at the OS level and redirecting them to the Umbrella resolvers, effectively preventing bypass attempts without relying on network-level blocks.

Answer

Configure Content Filtering to block Google DNS

Answer

Add a firewall rule on each client to block port 53 to all but Umbrella

Answer

Enable IP Layer Enforcement in the Umbrella dashboard

Question 5

A laptop fails to authenticate via 802.1X on a Cisco switch. The switch logs show: 'Authentication failed for user 'jdoe' on interface GigabitEthernet1/0/24: EAP session timeout.' What is the most likely cause?

Accepted Answer

The wired authentication timeout on the switch is too low.. The 'EAP session timeout' error specifically indicates that the authentication process did not complete within the configured timeout period on the switch. Option A is incorrect because an incorrect EAP method would typically result in an EAP failure or NAK, not a timeout. Option C is incorrect because an unreachable RADIUS server would cause a different error, such as 'RADIUS server timeout' or 'No response from server'. Option D is incorrect because if the switch had no RADIUS server configured, it would not even attempt 802.1X authentication or would fall back to other methods.

Answer

The supplicant is using an incorrect EAP method.

Answer

The RADIUS server is unreachable.

Answer

The switch is not configured with a RADIUS server.

Question 6

A DevSecOps team is integrating security into their CI/CD pipeline. They want to scan Terraform configuration files for misconfigurations before deployment. Which tool is specifically designed for that purpose?

Accepted Answer

Checkov. Checkov is an open-source static analysis tool for IaC (Terraform, CloudFormation) to detect security misconfigurations.

Answer

DAST scanner

Answer

SAST scanner

Answer

Container image scanner

Question 7

A company wants to use Cisco Umbrella to block access to malicious domains. They have deployed the Umbrella roaming client on all endpoints. However, traffic from a specific application is still reaching a known malicious domain. What is the most likely reason?

Accepted Answer

The application uses a hardcoded IP address or non-DNS protocol.. Cisco Umbrella operates at the DNS layer, meaning it can only block domains that are resolved via DNS queries. If an application uses a hardcoded IP address or communicates using a non-DNS protocol (e.g., direct IP connections or protocols like HTTP/HTTPS without DNS resolution), the traffic bypasses Umbrella's DNS-based enforcement entirely. This is why the malicious domain is still reachable despite the roaming client being deployed.

Answer

The Umbrella policy is configured to allow that specific application.

Answer

The domain is not categorized as malicious in Umbrella's database.

Answer

The Umbrella roaming client is not installed on the server.

Question 8

A company is deploying Cisco Email Security Appliance (ESA) to protect against phishing attacks. The security team wants to implement two security features to detect malicious URLs in emails. Which two features should be enabled? (Choose two.)

Accepted Answer

URL reputation filtering. URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

Answer

DomainKeys Identified Mail (DKIM) signing

Answer

Sender Policy Framework (SPF) verification

Answer

Domain-based Message Authentication, Reporting & Conformance (DMARC)

Question 9

In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?

Accepted Answer

Intermediate CA. An intermediate CA (subordinate CA) is a CA that is signed by the root CA and issues certificates to end entities, forming a chain of trust.

Answer

Registration Authority (RA)

Answer

Root CA

Answer

Certificate Revocation List (CRL)

Question 10

An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) enables real-time checking of a certificate's revocation status by querying the CA's responder, avoiding the need to download the entire CRL.

Answer

SCEP

Answer

EST

Answer

CRL

Question 11

An attacker uses a tool to scan a target network for open ports and running services. Which type of reconnaissance does this represent?

Accepted Answer

Active scanning. Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.

Answer

DNS cache poisoning

Answer

Social engineering

Answer

Passive OSINT

Question 12

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

Accepted Answer

Inherence. Inherence factors are biometric characteristics unique to the user.

Answer

Knowledge

Answer

Possession

Answer

Location

Question 13

Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-based security solution that provides DNS-layer protection to block malicious domains before a connection is established.

Answer

AMP for Endpoints

Answer

Firepower NGFW

Answer

Stealthwatch

Question 14

Which Cisco security product provides identity-based access control and policy enforcement for wired and wireless networks?

Accepted Answer

Cisco ISE. Cisco Identity Services Engine (ISE) is a policy platform for secure access control.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 15

Which three components are part of the CIA triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability.

Answer

Authentication

Answer

Authorization