350-701 Practice Test 46 — 15 Questions

Question 1

A security analyst is investigating a potential insider threat. Which TWO indicators are most commonly associated with malicious insider activity? (Choose two.)

Accepted Answer

Accessing files outside normal working hours without justification. Insider threats often involve unusual access patterns (e.g., accessing sensitive data not needed for the role) and attempts to bypass security controls (e.g., disabling logging).

Answer

Frequent password changes as required by policy

Answer

Receiving a promotion to a higher security clearance

Answer

Using a company-approved VPN for remote access

Question 2

Which Cisco product provides advanced malware protection for endpoints, including file analysis and retrospective security?

Accepted Answer

Cisco Advanced Malware Protection (AMP). Cisco AMP for Endpoints provides endpoint protection with advanced malware analysis.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Web Security Appliance (WSA)

Answer

Cisco Email Security Appliance (ESA)

Question 3

An attacker intercepts communication between a client and server by spoofing ARP messages to associate the attacker's MAC address with the server's IP. This is an example of which type of attack?

Accepted Answer

Man-in-the-middle (MITM). ARP spoofing allows an attacker to intercept traffic, a classic man-in-the-middle (MITM) technique.

Answer

Reconnaissance

Answer

DNS cache poisoning

Answer

DDoS attack

Question 4

Which three cryptographic algorithms are considered secure for use in modern systems? (Choose three.)

Accepted Answer

ECDSA. AES (symmetric), RSA (asymmetric), and ECDSA (asymmetric) are widely accepted secure algorithms.

Answer

MD5

Answer

3DES

Question 5

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a widely used symmetric block cipher with key sizes of 128, 192, or 256 bits.

Answer

ECC

Answer

RSA

Answer

3DES

Question 6

A company's server is infected with malware that encrypts files and demands payment for decryption. Which type of malware is this?

Accepted Answer

Ransomware. Ransomware encrypts files and demands a ransom for the decryption key.

Answer

Remote Access Trojan (RAT)

Answer

Botnet C2

Answer

Keylogger

Question 7

An organization is adopting Cisco's security portfolio. Which THREE products are correctly paired with their primary function? (Choose three.)

Accepted Answer

Cisco Umbrella - Cloud-delivered DNS security and secure web gateway. Cisco Firepower is an NGFW/IPS, ISE provides identity and access control, and Umbrella is a DNS/cloud security solution. ASA is a stateful firewall, not NGFW; Stealthwatch is for network detection, not endpoint protection.

Answer

Cisco Stealthwatch - Endpoint detection and response

Answer

Cisco ASA - Next-generation firewall with advanced malware protection

Question 8

A company uses Cisco Umbrella SIG to enforce security policies. An employee attempts to visit a website categorized as 'Phishing' but the request is allowed. What is the most likely cause?

Accepted Answer

The policy is set to 'Allow' for the Phishing category. If the security policy does not block the 'Phishing' category, or if the destination is not categorized, the request may be allowed by default.

Answer

The employee is using a VPN that bypasses the proxy

Answer

DNS security is disabled

Answer

The website uses HTTPS and Umbrella cannot inspect it

Question 9

A SOC analyst is investigating a BEC attack. Which three indicators should be examined in the email headers to detect the spoofing? (Choose three.)

Accepted Answer

DKIM result. SPF, DKIM, and DMARC results indicate authentication status and potential spoofing.

Answer

Subject line

Answer

Message body content

Question 10

Which Cisco content security solution provides DNS-layer protection and a cloud proxy to enforce security policies?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG provides DNS security and a cloud-based proxy for web filtering.

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Question 11

A security engineer needs to block access to social media websites for all users except those in the HR department. The solution must integrate with Active Directory. Which Cisco WSA feature should be used?

Accepted Answer

Identity-based policies with AD integration. Cisco WSA identity-based policies with AD integration allow different URL filtering rules per user group.

Answer

SSL/TLS decryption

Answer

Explicit proxy with PAC file

Answer

Transparent proxy with WCCP

Question 12

A DevOps team is deploying microservices in Azure Kubernetes Service (AKS). They need to enforce inter-container communication policies based on labels. Which Cisco solution provides micro-segmentation for containers in AKS?

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload (formerly Tetration) is the correct solution because it provides micro-segmentation for containers in Azure Kubernetes Service (AKS) by enforcing inter-container communication policies based on labels. It uses a Kubernetes-native approach, integrating with the Kubernetes API to discover pods and services, and applies label-based policies via eBPF or sidecar proxies to control traffic between containers without modifying the application.

Answer

Cisco Firepower

Answer

Cisco ACI

Answer

Cisco ISE

Question 13

An organization wants to protect against Business Email Compromise (BEC) attacks where attackers spoof the CEO's email address to request wire transfers. Which email authentication method is specifically designed to help prevent domain spoofing by allowing senders to specify how email that fails authentication should be handled?

Accepted Answer

DMARC. DMARC builds on SPF and DKIM to provide a policy telling receiving mail servers how to handle email that fails authentication, helping prevent spoofing.

Answer

SPF

Answer

DKIM

Answer

SenderBase

Question 14

Which EAP method used with 802.1X provides certificate-based mutual authentication and is commonly used with Cisco ISE?

Accepted Answer

EAP-TLS. EAP-TLS uses certificates for both client and server authentication, providing strong security.

Answer

EAP-MD5

Answer

EAP-FAST

Answer

EAP-GTC

Question 15

A company uses Cisco WSA in transparent mode. They want to bypass proxy processing for all traffic to a specific internal server (10.0.0.5) to reduce latency. They create an access policy with a custom URL category and add the server's IP to the 'Proxy Bypass' list. However, traffic to that server is still being proxied. What is the most likely cause?

Accepted Answer

The proxy bypass list does not apply in transparent mode; instead use network ACLs to bypass WSA. In transparent mode, the Cisco WSA intercepts traffic at the network layer without explicit client configuration. The 'Proxy Bypass' list is designed for explicit proxy deployments where clients are configured to send traffic to the WSA; it does not function in transparent mode because the WSA cannot distinguish bypass requests from intercepted traffic. To bypass proxy processing in transparent mode, you must use network ACLs on upstream routers or switches to redirect traffic away from the WSA, or configure WCCP exclusion rules.

Answer

The IP address is incorrectly formatted in the bypass list

Answer

The access policy is placed after a deny rule

Answer

The client is required to authenticate