350-701 Practice Test 46 — 15 Questions

Question 1

Which authentication factor relies on something the user is, such as a fingerprint or retina scan?

Accepted Answer

Inherence. Inherence is the authentication factor based on something the user is, such as biometric characteristics like fingerprints, retina scans, or facial recognition. This is a fundamental category in multi-factor authentication.

Answer

Knowledge

Answer

Possession

Answer

Location

Question 2

What is the primary purpose of a digital signature?

Accepted Answer

Verify the sender's identity and ensure message integrity. A digital signature provides authentication, integrity, and non-repudiation.

Answer

Compress the data

Answer

Prevent replay attacks

Answer

Encrypt the message

Question 3

A Cisco Stealthwatch Enterprise deployment is being reviewed after a security analyst reports that the appliance is not detecting long-lived, low-volume data exfiltration flows from a compromised internal host to an external IP. The flow collector is receiving NetFlow v9 records and the management console shows all sensors as healthy. Which telemetry gap is the most likely cause of the missed detection?

Accepted Answer

The flow records are being exported with a short active timeout, causing long-duration flows to be split into multiple records that fall below the detection threshold.. Long-lived, low-volume exfiltration is detected by Stealthwatch through behavioral baselines that depend on observing the full duration of a flow. When the exporting device uses a short active timeout, the session is fragmented into many short records, each of which looks benign. The analytics engine never sees the sustained connection that would trigger a concern index alarm, so the exfiltration evades detection despite a healthy collector.

Answer

The management console has not been synchronized with the Cisco Talos threat intelligence feed, so the external destination IP is not flagged as malicious.

Answer

The flow collector is configured to export only ingress flows, so egress traffic from the compromised host is never observed.

Answer

NetFlow v9 does not support byte counters, so the appliance cannot measure the exfiltration volume and therefore cannot trigger a volume-based alarm.

Question 4

A security engineer is configuring Cisco Umbrella to protect a remote branch that uses the Cisco AnyConnect Secure Mobility Client. The engineer wants DNS requests from roaming users to be inspected by Umbrella even when they are off the corporate network. Which configuration on the Umbrella dashboard is required to accomplish this?

Accepted Answer

Enable the Umbrella roaming client module in the AnyConnect profile and associate it with the organization's Umbrella tenant.. The requirement is to inspect DNS from roaming users who are off the corporate network. Only a client-side component that runs on the endpoint and sends DNS to Umbrella regardless of the local network can satisfy this. The Umbrella roaming client module in AnyConnect does exactly that, whereas network-based identities, forwarders, and tunnels depend on traffic passing through a fixed network device.

Answer

Create an Umbrella site-to-site VPN tunnel between the branch office and the Umbrella data centers.

Answer

Add the public IP address of the branch office to the Umbrella network identities.

Answer

Configure a DNS Forwarder on the branch office router to point to the Umbrella resolvers.

Question 5

A company is deploying Cisco Email Security Appliance (ESA) in a clustered configuration. The administrator wants to ensure that if the primary ESA fails, inbound SMTP connections are not lost and mail delivery continues with minimal interruption. Which feature should be configured to achieve this?

Accepted Answer

Configure multiple ESA nodes in a cluster and publish multiple MX records with equal priority pointing to each node.. For SMTP continuity in an ESA deployment, the recommended approach is to cluster multiple appliances and publish multiple MX records with equal priority. This allows sending servers to retry delivery to any available node if one fails. It uses standard SMTP retry behavior and the ESA cluster's shared configuration, avoiding the need for an external load balancer or a non-existent HA feature.

Answer

Configure the ESA cluster with a load balancer in front that distributes SMTP connections to all ESA nodes.

Answer

Set up a single ESA with a hot standby using the High Availability (HA) feature.

Answer

Enable the SMTP conversation failover feature in the cluster configuration.

Question 6

A security operations center (SOC) analyst is investigating a potential security incident. The analyst observes that an attacker has gained initial access to a workstation and is now attempting to move laterally to other systems by exploiting a vulnerability in the Server Message Block (SMB) protocol. The analyst wants to correlate this activity with known adversary tactics and techniques. Which framework should the analyst use to map the observed behavior to a specific technique ID?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the appropriate framework for mapping adversary behavior to specific tactics and techniques. It provides a comprehensive matrix of techniques, each with a unique ID, enabling analysts to correlate observed activities like SMB exploitation for lateral movement to a standardized technique. The other options serve different purposes: NIST CSF for risk management, CVSS for vulnerability severity, and STIX/TAXII for threat intelligence sharing.

Answer

STIX/TAXII

Answer

CVSS (Common Vulnerability Scoring System)

Answer

NIST Cybersecurity Framework

Question 7

A network security engineer is configuring a Cisco Identity Services Engine (ISE) to enforce endpoint compliance. The engineer wants to ensure that only devices with up-to-date antivirus definitions and operating system patches are allowed on the corporate network. Which ISE feature should be used to achieve this?

Accepted Answer

Posture assessment. To enforce endpoint compliance based on antivirus and patch status, Cisco ISE's posture assessment feature is used. It checks devices against predefined policies and controls network access accordingly. Other features like profiling, guest services, and BYOD onboarding serve different purposes and do not provide the required security posture evaluation.

Answer

Profiling

Answer

Guest services

Answer

BYOD onboarding

Question 8

A security engineer at a financial institution is designing a new threat detection system. The organization wants to identify ongoing attacks by observing real-time network traffic and comparing it against known malicious patterns, but they do not want to block any traffic yet. Which type of security control should the engineer implement?

Accepted Answer

Intrusion detection system (IDS). An intrusion detection system (IDS) passively monitors network traffic and compares it to known malicious signatures or behavioral anomalies, generating alerts without interfering with traffic flow. This aligns perfectly with the need to identify attacks in real time while avoiding any blocking. An IPS would block, a WAF is web-specific, and a stateful firewall enforces policies rather than detecting threats.

Answer

Web application firewall (WAF)

Answer

Stateful firewall

Answer

Intrusion prevention system (IPS)

Question 9

A network security analyst is reviewing logs and notices that an attacker is attempting to guess user passwords by trying common words and variations rapidly. Which type of attack is this?

Accepted Answer

Brute-force attack. A brute-force attack is characterized by repeated, automated attempts to guess credentials, often using dictionaries or common password patterns. The scenario describes rapid guessing of common words, which aligns with brute-force. Phishing is social, SQL injection targets databases, and XSS targets web users, none of which match the described behavior.

Answer

SQL injection

Answer

Phishing

Answer

Cross-site scripting (XSS)

Question 10

A network security administrator is deploying 802.1X authentication on Cisco switches. The administrator wants to ensure that if the RADIUS server becomes unreachable, authenticated supplicants remain connected while new supplicants are denied access. Which command should be configured on the switch ports to achieve this behavior?

Accepted Answer

authentication event server dead action authorize. The correct command is 'authentication event server dead action authorize' because it instructs the switch to keep existing authenticated supplicants in an authorized state when the RADIUS server is dead, while denying new supplicants. This ensures business continuity for already connected users. The other commands either target voice traffic, disrupt sessions, or handle server recovery, not the dead condition.

Answer

authentication event server dead action authorize voice

Answer

authentication event server alive action reinitialize

Answer

authentication event server dead action reinitialize vlan

Question 11

A security architect is designing a network segmentation strategy to protect a cardholder data environment (CDE). The architect wants to ensure that systems in the CDE can only communicate with necessary services and that any lateral movement is contained. Which technology should be implemented to achieve microsegmentation within the data center?

Accepted Answer

Cisco TrustSec with security group tags (SGTs). Cisco TrustSec with SGTs enables microsegmentation by tagging packets with security group information and enforcing policies based on those tags, allowing granular control and containment of lateral movement. VLANs with ACLs are coarse, 802.1Q is just trunking, and PVLANs are Layer 2 only. TrustSec is designed for dynamic, scalable segmentation in data centers.

Answer

VLANs with ACLs on core switches

Answer

802.1Q trunking with native VLAN

Answer

Private VLANs (PVLANs)

Question 12

A security analyst at a financial institution is investigating suspicious outbound traffic from a workstation. The analyst observes that the traffic is encapsulated in DNS TXT record queries to a domain that resolves to an IP address in a known malicious range. The volume of queries is high but each query contains a small, encoded payload. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling. The scenario describes a covert channel using DNS queries to a malicious domain, with small encoded payloads and high query volume. This is classic DNS tunneling, often used for data exfiltration or command-and-control. Other DNS-based attacks like cache poisoning, amplification, or rebinding have different characteristics and goals, making DNS tunneling the correct identification.

Answer

DNS cache poisoning

Answer

DNS amplification attack

Answer

DNS rebinding

Question 13

A security team deploys Cisco Umbrella to protect roaming users who connect their laptops to public Wi-Fi at airports and coffee shops. Users report that web filtering policies still apply even when they are not connected to the corporate VPN. Which Cisco Umbrella capability makes this enforcement possible?

Accepted Answer

DNS-layer security that resolves recursive DNS queries through Umbrella's global network. Umbrella enforces policy at the DNS resolution step, so the roaming laptop sends its recursive queries to Umbrella's resolvers no matter which network it joins. Because blocking occurs before the TCP connection to a malicious or disallowed domain is established, protection persists without a VPN or an on-premises appliance, which matches the reported behavior on untrusted Wi-Fi.

Answer

TLS decryption of every HTTPS session using a certificate pinned to the endpoint

Answer

Full inline next-generation firewall inspection performed by a virtual appliance on the endpoint

Answer

Endpoint-based application allow listing enforced by the Cisco Secure Client posture module

Question 14

A Cisco administrator is configuring AnyConnect for a remote-access VPN and wants to ensure that unmanaged endpoints are denied access if they lack the required antivirus software. Which Cisco solution should be integrated with the ASA to enforce this endpoint posture requirement?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the centralized policy engine that integrates with ASA to perform endpoint posture assessment for VPN users. It evaluates compliance attributes like antivirus, patches, and processes, then enforces access decisions. The other options provide network security or visibility but lack posture assessment and enforcement capabilities. ISE uniquely satisfies the need to deny unmanaged endpoints that fail posture checks.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella Roaming Client

Question 15

A Cisco Secure Network Analytics (Stealthwatch) administrator notices that a host is generating a high volume of DNS queries for randomly generated domain names, and the host has begun communicating with newly registered domains. The administrator needs to identify the specific threat behavior and the best mitigation. Which conclusion and action are most appropriate?

Accepted Answer

The host is likely infected with malware using Domain Generation Algorithms (DGA); isolate the host and investigate using Cisco SecureX threat response.. The combination of high-volume DNS queries for random domains and communication with newly registered domains strongly indicates a Domain Generation Algorithm (DGA) used by malware for command-and-control. The appropriate response is to isolate the infected host and use Cisco SecureX threat response to investigate and remediate, rather than implementing broad DNS blocks that could impact legitimate traffic.

Answer

The host is performing a DNS tunneling data exfiltration; configure Cisco Firepower to block all DNS TXT records.

Answer

The host is participating in a peer-to-peer botnet; block all outbound DNS traffic at the perimeter firewall.

Answer

The host is experiencing a DNS amplification attack; enable DNS rate limiting on the Cisco Umbrella virtual appliance.