350-701 Practice Test 49 — 15 Questions

Question 1

A security architect is designing a cloud environment on Microsoft Azure and needs to protect outbound traffic from virtual machines to the internet. The organization requires that all outbound traffic be inspected by a next-generation firewall, even when the traffic is destined for arbitrary internet IP addresses. Which Azure-native solution should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Firewall with forced tunneling. Azure Firewall is a managed, cloud-native next-generation firewall that provides stateful inspection and filtering. By configuring forced tunneling, all outbound internet traffic is routed through the firewall, ensuring inspection regardless of destination. This meets the requirement for a next-generation firewall to inspect all outbound traffic from virtual machines.

Answer

Azure DDoS Protection Standard

Answer

Azure Application Gateway with WAF

Answer

Network Security Groups (NSGs)

Question 2

An engineer is configuring a Cisco FTD device to inspect traffic between two internal networks. The engineer wants to ensure that the FTD can block malicious traffic based on the latest threat intelligence without manual updates. Which FTD feature should be configured?

Accepted Answer

Security Intelligence with Cisco Talos feeds. The correct answer is Security Intelligence with Cisco Talos feeds. This feature automatically updates threat intelligence and allows the FTD to block traffic based on the latest reputation data. Other options either require manual updates or serve different purposes, such as file analysis or custom intrusion detection, and do not meet the requirement for automatic threat intelligence-based blocking.

Answer

Intrusion policy with custom Snort rules

Answer

Access control policy with manual IP blocklists

Answer

File policy with dynamic analysis

Question 3

A network security administrator is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC to inspect traffic traversing an inline set. The administrator wants to ensure that packets that fail to match any access control rule are logged and blocked. Which action should be configured as the default action in the access control policy?

Accepted Answer

Block with logging enabled. The default action in an FTD access control policy applies to traffic that does not match any explicit rule. To meet the requirement of logging and blocking unmatched packets, the default action must be configured to Block with logging enabled. Block with reset would add a TCP RST that is not requested, Intrusion Prevention would allow the traffic, and Block All Traffic without logging would omit the required logging.

Answer

Intrusion Prevention

Answer

Block with reset

Answer

Access Control: Block All Traffic

Question 4

A security administrator is deploying Cisco AnyConnect for remote access VPN on Cisco ASA. The administrator wants to ensure that the VPN connection uses certificate-based authentication for the headend and also allows users to authenticate with username and password. Which two configurations are required on the ASA to support this? (Choose two.)

Accepted Answer

Configure an authentication, authorization, and accounting (AAA) server group for user authentication.. To support certificate-based authentication of the ASA (headend) and username/password authentication for users in an AnyConnect SSL VPN, the ASA must have a trustpoint with an identity certificate to present to clients, and an AAA server group to validate user credentials. These two elements enable mutual authentication: the client verifies the ASA's certificate, and the ASA verifies the user's credentials against the AAA server.

Answer

Enable DTLS on the outside interface.

Answer

Configure a pre-shared key for the tunnel group.

Answer

Enable IKEv2 on the outside interface.

Question 5

A network engineer is configuring 802.1X authentication on Cisco switches. The engineer wants to ensure that if the RADIUS server becomes unreachable, authenticated endpoints remain connected while new endpoints are denied access. Which feature should be configured?

Accepted Answer

Inaccessible authentication bypass. Inaccessible authentication bypass is designed to handle the case where the RADIUS server is unreachable. It allows endpoints that have already been authenticated to maintain their network access, while new endpoints are either denied or placed into a critical VLAN. This provides a balance between availability for existing users and security for new connections during an outage.

Answer

Guest VLAN

Answer

Critical VLAN

Answer

MAC Authentication Bypass (MAB)

Question 6

A network security engineer is implementing Cisco TrustSec in a campus network. The engineer needs to enableSecurity Group Tagging (SGT) on Cisco Catalyst switches to classify traffic. Which two methods can be used to assign SGTs to packets? (Choose two.)

Accepted Answer

Static classification using CLI commands on the switch port.. SGTs can be assigned statically via CLI on a switch port or dynamically through 802.1X authentication with Cisco ISE. Static classification is useful for devices that cannot authenticate, while dynamic classification scales with identity-based policies. The other options are security or monitoring features that do not assign SGTs.

Answer

SGT assignment via DHCP snooping.

Answer

SGT assignment via ARP inspection.

Answer

SGT assignment via NetFlow.

Question 7

A security administrator is deploying Cisco Umbrella for a branch office and wants DNS-layer protection that blocks requests to malware domains before any connection is made, while still logging all DNS activity for retrospective investigation. The branch uses a Cisco ISR router as its internet gateway. Which deployment method best meets these requirements with minimal configuration on individual endpoints?

Accepted Answer

Configure the ISR's DNS forwarding to point to the Umbrella public DNS resolver IP addresses and register the branch's public IP with the Umbrella dashboard.. Umbrella's network-level deployment forwards DNS from the gateway to Umbrella's public resolvers and ties the branch to an identity in the dashboard using its public IP. This blocks malicious domains at the DNS layer before any connection and logs all queries, while requiring no endpoint agents. It is the least-effort method that still covers every device on the branch network, including unmanaged ones.

Answer

Deploy the Cisco Umbrella SIG (Secure Internet Gateway) connector on the ISR and route all branch traffic through the Umbrella cloud.

Answer

Install the Cisco Umbrella Roaming Client on every laptop and desktop in the branch.

Answer

Configure the Cisco ISR router to forward DNS queries to the Umbrella virtual appliance IP addresses and enable DNS inspection.

Question 8

A financial institution must ensure that data stored in a database is unreadable to anyone who gains access to the storage media, while still allowing authorized applications to query the data. The compliance team also requires that encryption keys be rotated and stored separately from the data. Which control best meets these requirements?

Accepted Answer

Transparent Data Encryption at the database layer with an external key manager. Transparent Data Encryption protects data files and backups at rest while preserving normal query access for authorized applications. Pairing it with an external key manager keeps encryption keys off the database host and enables independent rotation, which addresses both compliance requirements. Disk encryption, transport encryption, and file permissions each protect a different aspect and fail one of the stated conditions.

Answer

Full disk encryption on the database server volumes

Answer

TLS 1.3 for all client connections to the database

Answer

File-level permissions restricting access to the database files

Question 9

A network security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by Firepower Management Center (FMC). The engineer wants to inspect traffic for threats but also needs to ensure that traffic is not blocked due to false positives during the tuning phase. Which action should be selected in the access control rule?

Accepted Answer

Allow with Intrusion Policy set to Detect. Using the Allow action with an intrusion policy in Detect mode enables threat inspection without blocking traffic. In Detect mode, the system generates events for detected intrusions but does not drop packets, allowing the engineer to tune the policy and identify false positives. Once tuned, the policy can be switched to Prevent mode. This approach balances the need for visibility with the need to avoid disrupting legitimate traffic during tuning.

Answer

Allow

Answer

Trust

Answer

Monitor

Question 10

A network security engineer is deploying a Cisco FTD device managed by FMC. The organization requires that outbound HTTP traffic be scanned for malware, but the security team wants to avoid decrypting traffic that contains sensitive personal health information. Which FTD feature should be configured to prevent decryption of specific traffic based on URL categories while still allowing the connection?

Accepted Answer

SSL decryption rule with action 'Do Not Decrypt' and a URL category condition for Health and Medicine.. The correct answer is the SSL decryption rule with 'Do Not Decrypt' action and URL category condition for Health and Medicine. This configuration allows the FTD to inspect outbound HTTP traffic for malware while exempting sensitive health information from decryption, preserving privacy. Other options either block the traffic or decrypt it, which are contrary to the requirement.

Answer

SSL decryption rule with action 'Decrypt - Resign' and an application condition for HTTP.

Answer

SSL decryption rule with action 'Block' and a URL category condition for Health and Medicine.

Answer

Access control rule with action 'Block' and a URL category condition for Health and Medicine.

Question 11

A cloud security team is using Amazon GuardDuty to monitor their AWS environment. They receive a finding indicating that an EC2 instance is communicating with a known cryptocurrency mining pool. Which action should the team take to automatically remediate this finding?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers an AWS Lambda function to isolate the EC2 instance.. Amazon GuardDuty findings can be automatically remediated using Amazon CloudWatch Events (EventBridge) to trigger AWS Lambda functions. This allows for immediate isolation of compromised instances, such as stopping the instance or modifying security groups. This automation is a best practice for responding to security findings in AWS.

Answer

Enable AWS Shield Advanced on the EC2 instance.

Answer

Use Amazon Inspector to automatically patch the EC2 instance.

Answer

Configure AWS WAF to block the cryptocurrency mining pool's IP address.

Question 12

An organization wants to enforce that only company-managed laptops can connect to the corporate wireless network, and that those laptops must have current antivirus and operating system patches before being granted access. Which Cisco solution should be deployed to evaluate endpoint posture and make the authorization decision?

Accepted Answer

Cisco Identity Services Engine (ISE) with posture policies. Cisco ISE is the policy decision point that combines 802.1X authentication with posture assessment. It queries the endpoint for compliance attributes and returns an authorization result to the network access device, which then places the device in the correct VLAN or SGT. This satisfies the requirement to admit only managed, healthy laptops onto the corporate wireless network.

Answer

Cisco Secure Firewall with identity-based access control rules

Answer

Cisco Wireless LAN Controller with 802.1X and PSK authentication

Answer

Cisco Umbrella with DNS-layer security policies

Question 13

A security operations team needs to query endpoint telemetry across thousands of Cisco Secure Endpoint connectors to hunt for indicators of compromise. They want to run SQL-like queries on live endpoint data without deploying additional agents. Which Cisco solution should they use?

Accepted Answer

Cisco Orbital. Cisco Orbital enables SQL-like queries on live endpoint telemetry using the existing Secure Endpoint connector, with no extra agent. It is designed for large-scale threat hunting and can retrieve detailed system and process information. This directly meets the requirement for querying thousands of endpoints.

Answer

Cisco SecureX threat hunting

Answer

Cisco Threat Response

Answer

Cisco Umbrella Investigate

Question 14

A network security engineer is troubleshooting a Cisco FTD device that is not blocking traffic that should be denied by an access control rule. The rule is configured to block traffic from a specific source IP to a specific destination IP. The engineer verifies that the rule is enabled and placed correctly in the policy. What is the most likely reason the traffic is not being blocked?

Accepted Answer

The access control rule is being bypassed by a prefilter policy.. The correct answer is that a prefilter policy is bypassing the access control rule. Prefilter policies are evaluated first and can fastpath or block traffic, preventing access control rules from being applied. The engineer should inspect the prefilter policy for any rules that might match the traffic and bypass the block rule. Other options are less likely given the scenario details.

Answer

The traffic is being decrypted and then re-encrypted, causing the rule to not match.

Answer

The source IP address is being translated by NAT before the access control rule is evaluated.

Answer

The default action of the access control policy is set to allow, which overrides the block rule.

Question 15

A security analyst is investigating alerts generated by Cisco Stealthwatch. The analyst notices a high volume of alerts indicating data exfiltration attempts from an internal host to an external IP address. The analyst wants to quickly identify the application protocol being used for the exfiltration. Which Stealthwatch feature should the analyst use to determine the application protocol?

Accepted Answer

Flow Search with application identification filters.. Stealthwatch Flow Search provides detailed flow records with application identification. By filtering on the internal host and external IP, the analyst can see the application protocol associated with the exfiltration traffic. This feature is designed for granular investigations, unlike summary reports or dashboards that lack per-flow detail.

Answer

Alarm details page with the 'Application' column.

Answer

Host Report showing top protocols by bytes.

Answer

Dashboard widget for top applications.