350-701 Practice Test 48 — 15 Questions

Question 1

An organization uses Cisco AnyConnect SSL VPN with DTLS enabled. What is the primary benefit of DTLS?

Accepted Answer

It uses UDP to avoid TCP-over-TCP issues and improve performance.. DTLS provides UDP-based transport for VPN traffic, reducing latency and improving performance for real-time applications compared to TCP-based TLS.

Answer

It provides stronger encryption than TLS.

Answer

It is required for DAP policies.

Answer

It allows split tunneling without configuration.

Question 2

On a Cisco ASA, which table holds information about translated addresses for active connections?

Accepted Answer

Xlate table. The xlate table stores translation entries (NAT translations) for active sessions.

Answer

ARP table

Answer

Conn table

Answer

Routing table

Question 3

An engineer wants to configure NAT on a Cisco ASA such that multiple internal hosts share a single public IP address when accessing the internet. Which NAT type should be used?

Accepted Answer

PAT (overload). PAT (Port Address Translation) or NAT overload allows multiple internal hosts to share a single public IP by using unique port numbers.

Answer

Static NAT

Answer

Dynamic NAT

Answer

Identity NAT

Question 4

Which Cisco Firepower feature uses SHA-256 hashes to determine the disposition of files and block malware?

Accepted Answer

File policy. File policy with AMP cloud lookup uses SHA-256 to check file reputation.

Answer

Intrusion policy

Answer

SSL policy

Answer

Network discovery

Question 5

An engineer is configuring Dynamic Access Policy (DAP) on an ASA for AnyConnect VPN. They want to assign different access policies based on the client's anti-virus status and device posture. What must be configured to obtain this information?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with posture module. DAP can use endpoint attributes from the AnyConnect client, such as antivirus status, via the Secure Endpoint or posture module. The ASA obtains this information through the AnyConnect client's posture assessment.

Answer

Group policy with split tunneling enabled

Answer

Cisco ISE as the AAA server

Answer

SSL VPN with DTLS enabled

Question 6

Which of the following is a characteristic of a 'false negative' in intrusion detection?

Accepted Answer

Malicious traffic is not detected.. A false negative occurs when the IDS/IPS fails to detect an actual attack. It misses the malicious activity.

Answer

The signature database is updated.

Answer

The system crashes due to high resource usage.

Answer

An alert is generated for benign traffic.

Question 7

Which statement accurately describes the difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Anomaly-based detection compares traffic against a baseline of normal behavior.. Signature-based detection matches known attack patterns; anomaly-based detects deviations from a baseline of normal traffic.

Answer

Signature-based detection generates fewer false positives than anomaly-based detection.

Answer

Anomaly-based detection is more effective against known attacks than signature-based.

Answer

Signature-based detection uses machine learning to identify unknown attacks.

Question 8

Which of the following is a benefit of using Dynamic Access Policy (DAP) for AnyConnect SSL VPN?

Accepted Answer

It enforces access based on endpoint security posture.. DAP allows granular access based on endpoint attributes such as antivirus status, registry keys, and location.

Answer

It eliminates the need for group policies.

Answer

It enables split tunneling automatically.

Answer

It provides load balancing across multiple VPN peers.

Question 9

A company with 5000 endpoints uses Cisco Secure Endpoint (AMP) and Cisco ISE. Users report that legitimate software installations are being quarantined, causing delays. The security team receives many alerts for file executions. The AMP policy is set to "High Security" with "Block Unknown" enabled. Network traffic is monitored by Cisco Stealthwatch. The team wants to reduce operational overhead while maintaining security. What should they do?

Accepted Answer

Create an AMP exclusion for software installation directories and enable "File Reputation" with "Cloud Lookups". Creating an AMP exclusion for software installation directories reduces false positives by preventing scanning of known legitimate installations. Enabling File Reputation with Cloud Lookups maintains detection by checking unknown files against cloud intelligence, thus not sacrificing security. Option A is too broad; disabling 'Block Unknown' would allow unknown threats to execute. Option C lowers the security level to 'Medium Security' which may miss some threats and 'Application Blocking with Allow List' is not directly related to the issue. Option D removes endpoint protection entirely, increasing risk.

Answer

Disable "Block Unknown" and rely solely on Stealthwatch for threat detection

Answer

Change AMP policy to "Medium Security" and enable "Application Blocking with Allow List"

Answer

Disable AMP and use only ISE for endpoint posture checks

Question 10

An attacker intercepts traffic between a client and a server and modifies the communication without either party knowing. Which type of attack is being performed?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle (MITM) attack involves interception and potential modification of communications.

Answer

Phishing

Answer

Replay attack

Answer

Denial of service

Question 11

What is the primary purpose of a digital signature?

Accepted Answer

Verify the sender's identity and data integrity. Digital signatures provide authentication, integrity, and non-repudiation by signing data with a private key.

Answer

Encrypt data

Answer

Generate random numbers

Answer

Compress data

Question 12

A company's remote employees use Cisco AnyConnect to connect to the corporate network. The VPN is configured with split tunneling so that only traffic to the corporate subnet (10.0.0.0/8) goes through the tunnel, and all other traffic goes directly to the internet. Recently, several employees reported that they cannot access the corporate file server (IP 10.2.3.4) even though they can connect to the VPN. The network team checks the ASA configuration and confirms that the split tunnel ACL includes the corporate subnet. The AnyConnect client shows that it is connected. What is the most likely cause of the issue?

Accepted Answer

The DNS resolution for the file server is failing due to VPN DNS settings.. When split tunneling is configured, DNS queries for corporate resources are often sent to the corporate DNS server through the tunnel. If the VPN adapter's DNS settings are not properly configured or the corporate DNS server is unreachable, the client cannot resolve the file server's hostname to its IP address (10.2.3.4), even though the IP itself is reachable via the tunnel. This is a common misconfiguration where the client uses its local DNS server, which does not have records for the internal corporate domain.

Answer

The ASA is performing NAT on the VPN traffic.

Answer

The file server's firewall is blocking VPN traffic.

Answer

The split tunnel ACL is not being applied correctly, and traffic is going direct to internet.

Question 13

An organization is using Cisco ISE to enforce posture compliance. Endpoints that are non-compliant should be placed into a quarantine VLAN. Which ISE policy component is used to assign the VLAN?

Accepted Answer

Authorization profile. An Authorization Profile in Cisco ISE defines the enforcement actions to be applied to an endpoint after successful authentication and authorization. When a posture assessment determines an endpoint is non-compliant, the authorization policy can match that condition and return an authorization profile that includes a specific VLAN ID (e.g., quarantine VLAN) via RADIUS attributes such as Tunnel-Private-Group-ID (RFC 2868). This VLAN assignment is a core function of the authorization profile, not of authentication or profiling.

Answer

Policy set

Answer

Profiling policy

Answer

Authentication policy

Question 14

Which email authentication method allows the domain owner to publish a policy that instructs receiving mail servers on how to handle messages that fail SPF and DKIM checks?

Accepted Answer

DMARC. DMARC builds on SPF and DKIM to specify policies (none, quarantine, reject) for failed messages.

Answer

SPF

Answer

SenderBase

Answer

DKIM

Question 15

A cloud engineer is deploying a web application on AWS and needs to control inbound and outbound traffic at both the instance and subnet levels. Which two AWS security controls should they configure? (Select two.)

Accepted Answer

Security Groups. Security groups act as instance-level firewalls, and NACLs provide stateless subnet-level filtering.

Answer

AWS PrivateLink

Answer

AWS WAF

Answer

AWS Shield