350-701 Practice Test 47 — 15 Questions

Question 1

Which Cisco content security solution uses DNS to block access to malicious domains and provides cloud-based proxy protection?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that uses DNS to block requests to malicious domains. It also includes a cloud proxy for full URL filtering and threat protection.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Question 2

Which TWO statements about Cisco Umbrella SIG are true?

Accepted Answer

It can enforce URL filtering policies via a cloud proxy. Cisco Umbrella SIG provides cloud-based security including DNS-layer filtering and a cloud proxy. It can enforce URL filtering and blocks threats before connection. It does not require on-premises hardware and can be used with any internet connection.

Answer

It only protects traffic that goes through a VPN

Answer

It requires on-premises hardware for deployment

Answer

It does not provide reporting or analytics

Question 3

A company is deploying Cisco ISE for guest access. They want to provide a self-service portal where guests can register their devices and receive a temporary username and password. Which ISE component is used to accomplish this?

Accepted Answer

Guest Portal. C is correct because the Guest Portal in Cisco ISE is specifically designed to provide a self-service registration page where guests can create their own accounts, receive temporary credentials, and gain network access. This portal handles the entire guest lifecycle, including sponsor approval if required, and can deliver the username/password via SMS, email, or on-screen display.

Answer

BYOD Portal

Answer

Mobile Device Management (MDM)

Answer

Profiler Service

Question 4

An ASA firewall is configured as shown. A web server is behind the ASA with IP 10.1.1.100. Which additional configuration is required to allow HTTPS traffic from the internet to the web server?

Accepted Answer

Configure static NAT for the web server. The ASA firewall requires static NAT to translate the public IP address (typically the ASA's outside interface IP or a dedicated public IP) to the private IP address of the web server (10.1.1.100). Without static NAT, the ASA will not perform the necessary destination address translation for inbound HTTPS traffic, and the web server's private IP is not routable on the internet.

Answer

Add a route to the web server's subnet

Answer

Increase the security level of the inside interface

Answer

Apply the access-group to the inside interface

Question 5

A security analyst notices that a file initially deemed 'unknown' by Cisco AMP for Endpoints was later reclassified as 'malicious'. The analyst needs to investigate the propagation of this file across endpoints. Which Cisco AMP feature provides a timeline view of file activity and spread?

Accepted Answer

Device Trajectory. Device Trajectory is the correct feature because it provides a timeline view of a file's activity across endpoints, including its origin, propagation, and subsequent actions. When Cisco AMP for Endpoints reclassifies a file from 'unknown' to 'malicious', Device Trajectory allows the analyst to trace the file's spread and interactions on each affected endpoint, enabling a thorough investigation of the infection chain.

Answer

SHA-256 disposition

Answer

Exploit Prevention

Answer

IOC scanning

Question 6

Refer to the exhibit. An engineer configured ISE to use both Active Directory and LDAP for authentication. Users from Active Directory are unable to authenticate. What is the most likely reason?

Accepted Answer

The LDAP identity store is unreachable and ISE is attempting LDAP before AD. When ISE is configured with both Active Directory and LDAP identity stores, the authentication sequence determines the order in which they are tried. If the sequence is set to 'LDAP then AD' and the LDAP server is unreachable, ISE will attempt LDAP first, fail (due to unreachability), and then proceed to AD. However, if the LDAP server is unreachable but the sequence is 'AD then LDAP', AD would be tried first and succeed for AD users. The most likely reason AD users fail is that the sequence is 'LDAP then AD' and LDAP is unreachable, causing ISE to attempt LDAP first and fail before ever reaching AD, or the sequence is misconfigured such that AD is not tried at all. This aligns with the exhibit's implication that LDAP is attempted before AD, and LDAP being unreachable blocks AD authentication.

Answer

Active Directory users are not allowed in the policy

Answer

The Active Directory identity store is disconnected

Answer

The authentication sequence is set to 'AD then LDAP'

Question 7

A company is moving workloads to Google Cloud and needs private connectivity between its on-premises data center and VPC without traversing the internet. Which service should be used?

Accepted Answer

Google Cloud Dedicated Interconnect. Google Cloud Dedicated Interconnect provides direct private physical connections between on-premises and GCP VPCs.

Answer

Azure ExpressRoute

Answer

AWS Direct Connect

Answer

Cloud VPN

Question 8

A network administrator is configuring port security on a Cisco switch port connected to a single endpoint. The requirement is that only the first device that connects to the port is allowed, and any subsequent device that attempts to connect must trigger an error-disabled state. Which two features must be configured to meet this requirement?

Accepted Answer

switchport port-security mac-address sticky. The 'switchport port-security mac-address sticky' command dynamically learns the MAC address of the first connected device and saves it as a sticky secure MAC address in the running configuration. Option E is correct because setting the maximum number of secure MAC addresses to 1 ensures that only the first device's MAC address is allowed; any additional device will trigger a security violation. Together, these two features enforce that only the first device can connect, and subsequent devices cause the port to enter an error-disabled state when combined with the shutdown violation mode.

Answer

switchport port-security aging type inactivity

Answer

switchport port-security mac-address 0000.1111.2222

Answer

switchport port-security violation shutdown

Question 9

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

Question 10

A network administrator is configuring NAT on a Cisco ASA to allow internal users to access the internet using a single public IP address. The internal network uses RFC 1918 addresses. Which type of NAT should be configured?

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation) allows many internal IPs to share a single public IP by using unique source ports. Dynamic NAT would require a pool of public IPs, and static NAT provides one-to-one mapping.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Identity NAT

Question 11

After deploying a Cisco Cloudlock policy, a user reports that a sanctioned application (Salesforce) is being blocked for file downloads. What is the most likely cause?

Accepted Answer

The Cloudlock policy for Salesforce is set to 'Block' due to misconfiguration. Cloudlock policies are configured to enforce actions such as 'Allow', 'Block', or 'Monitor' on sanctioned applications like Salesforce. If a policy is misconfigured to 'Block' for file downloads, Cloudlock will intercept the API call and deny the download regardless of the file's content. This is a common administrative error when setting granular controls for cloud app activities.

Answer

The Salesforce API token has expired

Answer

The file being downloaded contains sensitive data flagged by DLP

Answer

The user's browser is not configured with the corporate proxy

Question 12

An administrator configures a Cisco ASA with an interface named 'inside' at security level 100 and 'outside' at security level 0. Which statement about traffic flow is true?

Accepted Answer

Traffic from inside to outside is allowed by default if the connection is statefully inspected.. By default, traffic from a higher security level (inside) to a lower security level (outside) is allowed without an ACL if stateful inspection permits.

Answer

Traffic from inside to outside is denied unless NAT is configured.

Answer

All traffic between inside and outside is denied without an ACL.

Answer

Traffic from outside to inside is allowed by default.

Question 13

Which THREE of the following are valid characteristics of a next-generation firewall (NGFW) compared to a traditional stateful firewall? (Choose three.)

Accepted Answer

Decryption and inspection of SSL/TLS traffic. A is correct because NGFWs can perform SSL/TLS decryption and inspection, allowing them to examine encrypted traffic for threats. Traditional stateful firewalls only inspect packet headers and state information, leaving encrypted payloads unexamined. This capability is critical for detecting malware or data exfiltration hidden in HTTPS sessions.

Answer

Support for network address translation (NAT)

Answer

Support for site-to-site VPNs

Question 14

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Accepted Answer

Trust action bypasses all further inspection modules.. Trust bypasses all further inspection. Allow permits traffic but subjects it to inspection. Block drops traffic. Interactive Block challenges the user with a block page and allows them to proceed if they accept.

Answer

Allow action is the default action if no rule matches.

Answer

Block action logs the traffic and allows it to pass.

Answer

Allow action applies only URL filtering but not IPS.

Question 15

A network engineer is configuring NAT on a Cisco ASA for internal servers to be accessible from the internet. One server (10.1.1.10) must always be reachable via a fixed public IP (203.0.113.10). Which NAT type should be used?

Accepted Answer

Static NAT. Static NAT provides a one-to-one fixed mapping between a private IP and a public IP, ensuring the server is always reachable via the same public address.

Answer

Identity NAT

Answer

Dynamic NAT

Answer

Dynamic PAT (overload)