350-701 Practice Test 47 — 15 Questions

Question 1

A security administrator is deploying a Cisco Firepower Threat Defense (FTD) device managed by a Firepower Management Center (FMC) in a high-availability pair. The administrator wants to ensure that if the primary FTD fails, the secondary takes over with minimal disruption. Which failover configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active/Standby failover with a dedicated failover link and a state link.. Active/Standby failover is the standard high-availability configuration for a pair of FTD devices managed by FMC. It uses a failover link for health monitoring and a state link for connection state synchronization, ensuring that the standby unit can take over immediately if the primary fails. This provides minimal disruption and is simpler than Active/Active or clustering.

Answer

Standalone FTD with manual failover using a script.

Answer

Active/Active failover with asymmetric routing enabled.

Answer

Clustering with multiple FTD devices in a single cluster.

Question 2

A network security engineer is designing a defense-in-depth strategy for a new data center. The engineer needs to select a control that will detect and alert on malicious activity after it has already bypassed perimeter defenses, without actively blocking the traffic. Which type of security control should be implemented?

Accepted Answer

Detective control. A detective control is designed to identify and alert on security incidents after they occur, providing visibility into malicious activity that has bypassed preventive measures. In a defense-in-depth strategy, detective controls such as IDS or SIEM are essential for identifying compromises and enabling timely response, without actively blocking traffic as a preventive control would.

Answer

Corrective control

Answer

Preventive control

Answer

Deterrent control

Question 3

A security engineer is analyzing a packet capture and notices that an attacker is sending a large number of TCP SYN packets to a web server from various spoofed source IP addresses. The server's SYN backlog is filling up, causing legitimate connection attempts to be dropped. Which type of attack is this?

Accepted Answer

SYN flood. The scenario describes a SYN flood attack, where an attacker overwhelms a server with TCP SYN packets from spoofed sources, exhausting the SYN backlog and preventing legitimate connections. UDP flood, ping flood, and Smurf attack involve different protocols (UDP or ICMP) and mechanisms, so they do not match the observed TCP SYN behavior.

Answer

UDP flood

Answer

Ping flood

Answer

Smurf attack

Question 4

A hospital must protect a medical imaging server that stores patient records from both external attackers and malicious insiders. The security team wants a control that segments east-west traffic between the imaging VLAN and the clinical workstation VLAN, and that can enforce policy based on user identity and device posture. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Identity Services Engine enforcing TrustSec security group tags between the VLANs. Segmenting internal east-west traffic while enforcing policy based on user identity and device posture requires an identity-aware segmentation technology. Cisco TrustSec with ISE assigns security group tags and enforces group-based policies in the network fabric, which isolates the imaging server from unauthorized clinical workstations and limits lateral movement for both external and insider threats.

Answer

Cisco Secure Network Analytics monitoring NetFlow to build behavioral baselines

Answer

Cisco Secure Email Gateway scanning attachments sent to clinical staff mailboxes

Answer

Cisco Umbrella DNS-layer security applied to the clinical workstation subnet

Question 5

A financial services firm is designing a new remote access solution. The security policy requires that administrators connecting to the data center must be authenticated with a hardware token, and that the resulting session must be tied to a specific user and device identity so that authorization decisions can be made per session. Which Cisco solution provides this combination of strong authentication and per-session identity context?

Accepted Answer

Cisco Identity Services Engine acting as a RADIUS server for the VPN headend with certificate-based and token-based authentication. The requirement is strong, token-based authentication combined with session identity that can drive authorization. ISE as the RADIUS and policy engine for the VPN headend enforces certificate and token credentials and then applies authorization profiles that bind the session to user and device, enabling per-session policy and downstream enforcement through TrustSec or dynamic ACLs.

Answer

Cisco Secure Email Gateway with strong TLS enforcement for administrator mail

Answer

Cisco Umbrella roaming client with DNS-layer protection on the administrator laptops

Answer

Cisco Secure Network Analytics with flow-based anomaly detection for VPN traffic

Question 6

A security administrator is configuring a Cisco Identity Services Engine (ISE) to enforce endpoint compliance. The administrator wants to ensure that only endpoints with up-to-date antivirus signatures and operating system patches are allowed full network access. Which ISE feature should be used to assess the endpoint's posture before granting access?

Accepted Answer

Posture assessment. Posture assessment is the Cisco ISE feature that evaluates endpoint compliance with security policies, such as antivirus updates and OS patches, before allowing network access. It ensures that only healthy endpoints receive full access, while non-compliant devices can be quarantined or remediated, directly addressing the administrator's requirement.

Answer

BYOD onboarding

Answer

Guest services

Answer

Profiling

Question 7

An engineer is configuring a Cisco ASA firewall to allow external users to access an internal web server using HTTPS. The internal server IP is 10.1.1.10, and the public IP is 203.0.113.5. Which ASA feature should be configured to map the public IP to the internal server?

Accepted Answer

Static NAT. Static NAT provides a fixed one-to-one mapping between a public IP and an internal server IP, enabling external users to access the server consistently. Dynamic NAT and PAT are for outbound translations and do not provide the persistent mapping required for inbound access.

Answer

Dynamic NAT

Answer

Dynamic PAT

Answer

Identity NAT

Question 8

A security architect is designing a data loss prevention strategy for a company that uses Cisco Secure Email Gateway and Cisco Secure Web Appliance. The architect must select controls that prevent sensitive data from leaving the organization through both email and web channels. Which two Cisco capabilities should be included in the design? (Choose two.)

Accepted Answer

Data Loss Prevention policies on Cisco Secure Email Gateway that scan outbound messages for sensitive content patterns. Covering both email and web exfiltration paths requires content inspection on each channel. Secure Email Gateway DLP scans outbound messages and attachments, while Secure Web Appliance DLP inspects outbound HTTP and HTTPS uploads and form submissions. Together they enforce data classification policies across the two channels the architect must protect, which the other listed controls cannot do.

Answer

Cisco Identity Services Engine with posture policies requiring disk encryption on endpoints

Answer

Cisco Secure Network Analytics with encrypted traffic analytics for outbound flows

Answer

Cisco Umbrella DNS-layer security with category-based blocking for file-sharing domains

Question 9

A network administrator is deploying Cisco Umbrella to protect users from malicious domains. The administrator wants to block requests to known malicious domains and see which internal hosts are making those requests. Which Umbrella feature provides this visibility and enforcement?

Accepted Answer

DNS-layer security with intelligent proxy and logging to the Umbrella dashboard.. Cisco Umbrella's DNS-layer security blocks DNS requests to malicious domains using threat intelligence and logs the requesting internal host IP addresses. The Umbrella dashboard provides detailed reporting, enabling administrators to see which hosts attempted to access blocked domains. This fulfills both enforcement and visibility requirements.

Answer

Cisco Identity Services Engine (ISE) with profiling and posture.

Answer

Cisco Firepower Next-Generation Firewall with SSL decryption.

Answer

Cisco Secure Network Analytics (Stealthwatch) with DNS analytics.

Question 10

A security engineer is deploying Cisco Identity Services Engine (ISE) to enforce 802.1X wired authentication for corporate laptops and MAB for printers. The engineer must ensure that the corporate laptops are placed into the correct VLAN after authentication, while printers are placed into a quarantine VLAN until they are profiled. Which ISE policy element should be configured to dynamically assign the VLAN to the switch port?

Accepted Answer

Authorization policy with a VLAN attribute in the authorization result. Dynamic VLAN assignment in ISE is achieved through the authorization policy, which returns RADIUS tunnel attributes to the network access device. The switch then places the port into the specified VLAN. This allows different VLANs for corporate laptops and quarantined printers based on identity and profiling. The authentication policy verifies credentials, while the authorization policy enforces the VLAN assignment.

Answer

Authorization policy with a downloadable ACL (dACL)

Answer

Authentication policy with an internal user database

Answer

Profiling policy with a static assignment

Question 11

A security operations center observes an attacker who has compromised a workstation and is now moving laterally to enumerate domain controllers using valid but stolen credentials. The attacker has not triggered any signature-based alerts. Which Cisco security capability is specifically designed to detect this kind of credential-based lateral movement by analyzing network telemetry and correlating it with identity information?

Accepted Answer

Cisco Secure Network Analytics with Identity Services Engine integration for user-to-IP mapping. Detecting lateral movement that uses valid credentials requires behavioral analysis of network flows enriched with identity context. Secure Network Analytics builds baselines from flow telemetry, and ISE integration maps IP addresses to authenticated user accounts, allowing the platform to flag anomalies like one identity touching many internal hosts, which signature-based tools would miss.

Answer

Cisco Secure Endpoint with exploit prevention and file reputation lookups

Answer

Cisco Umbrella with DNS tunneling detection enabled on the corporate resolver

Answer

Cisco Secure Firewall with Snort intrusion prevention rules tuned for SMB exploits

Question 12

A security architect at a financial services firm is deploying a new multi-tier web application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores sensitive customer data in an Amazon RDS database. The security team wants to block common web exploits such as SQL injection and cross-site scripting at the edge before traffic reaches the EC2 instances, and they want to use a managed AWS service that integrates with AWS WAF. Which AWS service should the architect use to provide this protection?

Accepted Answer

Amazon CloudFront with AWS WAF. The requirement is to block web exploits such as SQL injection and cross-site scripting at the edge, before traffic reaches the EC2 instances, using a managed AWS service that integrates with AWS WAF. Amazon CloudFront, when associated with AWS WAF, inspects HTTP/HTTPS requests at edge locations and can enforce AWS Managed Rules to block these attacks. The other services provide DDoS protection, network-layer filtering, or threat detection, but not inline application-layer web exploit prevention.

Answer

AWS Shield Advanced

Answer

Amazon GuardDuty

Answer

AWS Network Firewall

Question 13

A company deploys a Cisco Umbrella virtual appliance on-premises so that internal endpoints are identified individually in reporting. After deployment, all internal client DNS requests still show only the public egress IP address in Umbrella Investigate and reporting. Which configuration step was most likely missed?

Accepted Answer

The internal DNS forwarders were not reconfigured to point to the virtual appliance IP addresses.. Umbrella virtual appliances provide internal client IP identity by receiving DNS queries directly from internal resolvers. When forwarders keep using external resolvers, Umbrella sees only the NAT egress address. Pointing internal DNS forwarders at the virtual appliance addresses restores per-client attribution, so reporting and policy can distinguish individual endpoints instead of a single public IP.

Answer

The DNS-over-HTTPS policy was not enabled for the internal networks.

Answer

The identity provider integration was not configured for the internal networks.

Answer

The virtual appliance was not registered with a valid API token in the Umbrella dashboard.

Question 14

A security operations center (SOC) analyst is investigating an alert from Cisco SecureX about a suspicious file executed on an endpoint. The analyst needs to determine the file's reputation and gather threat intelligence from multiple sources. Which action should the analyst take within SecureX?

Accepted Answer

Use the SecureX threat response feature to pivot on the file hash and view enrichment from Cisco Talos and other integrated sources.. Cisco SecureX threat response enables analysts to investigate observables such as file hashes by aggregating threat intelligence from Cisco Talos and other integrated sources. This provides immediate reputation and context, allowing the SOC analyst to determine if the file is malicious and take appropriate action.

Answer

Use Cisco Identity Services Engine (ISE) to check the endpoint's posture compliance status.

Answer

Check the Cisco Umbrella DNS logs for the file hash to see if it was queried.

Answer

Run a packet capture on the endpoint using Cisco Firepower and analyze the PCAP for file transfer.

Question 15

A user receives an email that appears to come from the CEO and asks for an urgent wire transfer. The message uses a lookalike domain with a single character changed. Which social engineering technique is being used?

Accepted Answer

Phishing. Email that impersonates a trusted executive and uses a lookalike domain to prompt an urgent action is phishing. The defining characteristics are the email delivery channel, the impersonation of a trusted sender, and the manipulation of the recipient into acting quickly. Business email compromise campaigns commonly use this exact approach, making phishing the correct classification.

Answer

Whaling

Answer

Vishing

Answer

Smishing