350-701 Practice Test 49 — 15 Questions

Question 1

A university IT team manages 1,000 macOS laptops for students using Cisco AMP for Endpoints. They receive reports that some students' laptops are running slowly and fans are spinning constantly. The team checks the AMP console and sees that these endpoints are performing constant file scans on user directories. The team suspects that the AMP scanning is causing high CPU usage. They want to optimize performance without compromising security. The laptops use the default AMP policy with real-time scanning enabled. What should the team do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add exclusions for common user data directories in the AMP policy.. Adding exclusions for common user data directories (e.g., Documents, Downloads) reduces unnecessary scanning of files that are unlikely to be malicious, thereby lowering CPU usage without compromising security. Real-time scanning remains enabled for all other locations. Option A (reducing alert notifications) does not affect scanning frequency or CPU usage. Option B (increasing scanning interval) is not applicable to real-time scanning, which continuously monitors file operations. Option D (disabling real-time scanning) would leave endpoints vulnerable to real-time threats.

Answer

Reduce the number of alert notifications to limit AMP's background activity.

Answer

Increase the file scanning interval to every 30 seconds instead of real-time.

Answer

Disable real-time scanning and rely on scheduled scans.

Question 2

A security analyst is investigating a malware outbreak that occurred on endpoints protected by Cisco AMP for Endpoints. The malware was initially undetected but later identified as malicious based on new threat intelligence. Which THREE capabilities of AMP allow the analyst to trace the infection and remediate?

Accepted Answer

Endpoint IOC scanning. Device Trajectory shows the timeline of file activity and propagation. Retrospective security allows file disposition to be updated after detection. IOC scanning identifies indicators of compromise on endpoints. Exploit Prevention is a proactive measure, and SHA-256 disposition is a static verdict.

Answer

SHA-256 file disposition

Answer

Exploit Prevention

Question 3

A company is migrating critical workloads to AWS and wants to ensure secure connectivity between their on-premises network and the VPC. Which TWO actions should be taken to meet this requirement?

Accepted Answer

Provision an AWS Direct Connect connection for a private, dedicated link.. Options C and E are correct. AWS Direct Connect (C) provides a private, dedicated link from on-premises to AWS, bypassing the public internet for consistent latency and enhanced security. AWS Site-to-Site VPN (E) also provides secure connectivity over the internet using IPsec tunnels, offering a more cost-effective alternative. Both options meet the requirement for secure connectivity between on-premises and the VPC. Options A and D are incorrect because security groups and internet gateways alone do not establish a secure connection; they require an underlying encrypted transport. Option B is vague and not a best practice for secure connectivity.

Answer

Attach an internet gateway to the VPC and allow all inbound traffic.

Answer

Configure a security group that allows all traffic from the on-premises network.

Answer

Use security groups to allow traffic from the on-premises IP range.

Question 4

A network security engineer is configuring Cisco ASA for remote access VPN using AnyConnect. Which two components must be configured to enable split tunneling? (Choose two.)

Accepted Answer

An access list that defines the networks to be tunneled or excluded.. Split tunneling requires defining an ACL that specifies which traffic goes through the tunnel, and applying that ACL in the group policy. The ACL is configured on the ASA and referenced in the group policy.

Answer

A crypto map that specifies the VPN encryption parameters.

Answer

A dynamic access policy (DAP) that enforces split tunneling.

Answer

A tunnel group that defines the VPN connection parameters.

Question 5

Which security principle ensures that a user or system is granted only the minimum permissions necessary to perform a specific function?

Accepted Answer

Least privilege. The principle of least privilege dictates that a user, process, or system should be granted only the minimum permissions necessary to perform a specific function. In Cisco security contexts, this is enforced through features like Role-Based Access Control (RBAC) on Cisco IOS devices, where privilege levels (0-15) are assigned to restrict command access, or via TrustSec Security Group Tags (SGTs) that limit traffic flows to only required resources.

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 6

A network engineer is troubleshooting an issue where a user's device is successfully authenticated via 802.1X, but the user cannot access the corporate network. ISE logs show that the user was granted access with a downloadable ACL (dACL). What could be the cause of no network access?

Accepted Answer

The switch does not support downloadable ACLs.. If the switch does not support downloadable ACLs, it will ignore the dACL attribute and not apply any filtering, potentially blocking traffic. Option B is incorrect because subnet placement does not affect dACL application. Option C is incorrect because the RADIUS server is not involved after authentication. Option D is incorrect because 'access-session port-control auto' is correct configuration.

Answer

The user's device is in a different subnet.

Answer

The RADIUS server is not reachable after authentication.

Answer

The switch port is configured with 'access-session port-control auto'.

Question 7

A company has deployed Cisco AnyConnect VPN for remote access. They want to enforce that only company-managed devices with compliant antivirus and disk encryption can connect. Which solution should be added to the ASA?

Accepted Answer

Cisco Identity Services Engine (ISE) with posture assessment. Cisco ISE with posture assessment is the correct solution because it integrates with the ASA to enforce endpoint compliance before granting VPN access. Posture assessment checks for specific conditions such as antivirus status, disk encryption, and OS patch levels, ensuring only company-managed devices that meet security policies can connect via AnyConnect.

Answer

Cisco Firepower Threat Defense (FTD) with intrusion policy

Answer

Cisco Umbrella with DNS filtering

Answer

Cisco Stealthwatch with NetFlow

Question 8

A security team is troubleshooting an incident where a compromised application running in a Kubernetes cluster on AWS EKS is being used to exfiltrate data to an external IP. They have deployed Cisco Secure Workload. How would the agent on the container report the exfiltration attempt?

Accepted Answer

By creating a violation for a policy that denies egress to unknown IPs. Cisco Secure Workload uses a policy-based enforcement model where agents enforce micro-segmentation rules. When a container attempts egress to an external IP not permitted by an explicit allow policy, the agent creates a violation event for the deny rule that blocks unknown destinations. This violation is the primary reporting mechanism for policy violations, including exfiltration attempts.

Answer

By generating a syslog alert for outbound traffic

Answer

By sending a NetFlow export to the controller

Answer

By blocking the traffic automatically and terminating the pod

Question 9

An engineer is troubleshooting an IPsec VPN between two Cisco routers. The tunnel is up, but traffic is not passing. The encryption domain on both sides is correctly configured. What is the most likely cause?

Accepted Answer

ACL on the WAN interface blocking ESP traffic. When the IPsec tunnel is up but no traffic passes, the most common cause is that the WAN interface ACL is blocking ESP (protocol 50) or UDP/4500 (NAT-T) traffic. Even though IKE and IPsec SAs are established, if the ACL drops the encrypted packets, the tunnel appears operational but cannot forward data. This is distinct from transform set or IKE mismatches, which would prevent the tunnel from coming up at all.

Answer

Mismatched IPSec transform sets

Answer

Routing loop

Answer

Mismatched IKE phase 1 parameters

Question 10

A security analyst is investigating a malware incident on an endpoint protected by Cisco AMP for Endpoints. The Device Trajectory shows that a file named 'invoice.exe' was detonated from a USB drive. The file's cloud verdict was 'Unknown' at the time of execution. The analyst sees that the file spawned multiple child processes that made outbound connections to a malicious IP. The AMP policy has 'Exploit Prevention' enabled but 'File Reputation' is set to 'Monitor' only. The analyst wants to prevent similar incidents in the future without blocking legitimate applications. Which action should the analyst recommend?

Accepted Answer

Change the File Reputation setting to 'Block' for files with 'Unknown' disposition.. Changing the File Reputation setting to 'Block' for files with 'Unknown' disposition would prevent unknown files like 'invoice.exe' from executing in the future, while still allowing files with known good reputations. This balances security with usability. Option A (blocking all USB execution via Group Policy) is too restrictive as it would block legitimate applications from removable media. Option B (enabling all Exploit Prevention rules) targets exploit techniques, not malware executables like 'invoice.exe'. Option C (adding the hash to a global blacklist) is reactive and would only block that specific hash, not similar unknown files.

Answer

Block all execution of applications from removable media via Group Policy.

Answer

Enable all Exploit Prevention rules, including those for script-based attacks.

Answer

Add the SHA256 hash of 'invoice.exe' to the global blacklist.

Question 11

A financial services company recently migrated from a legacy web filter to Cisco WSA in explicit proxy mode. The company has 5000 users across three offices, each connected via MPLS. The WSA is deployed in the data center. A week after deployment, users in the remote office report that web pages load extremely slowly, while users in the main office near the data center experience normal speeds. The network team confirms there is no WAN congestion. The WSA administrator checks the logs and sees that the remote users are being authenticated via NTLM and that the WSA's CPU and memory usage are below 50%. However, the number of concurrent connections from the remote office is very high, with many connections in a TIME_WAIT state. What is the most likely cause of the slow web performance for remote users?

Accepted Answer

The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.. The high number of concurrent connections in TIME_WAIT state indicates that TCP connections are being closed after each request instead of being reused. In explicit proxy mode, the WSA can reuse persistent connections to reduce latency, but if connection reuse is not configured, each HTTP request from a remote user requires a new TCP handshake, which adds significant round-trip time (RTT) over the MPLS link. This overhead explains the slow performance for remote users while main office users, with lower latency, are unaffected.

Answer

The WSA's proxy process is overloaded due to high SSL decryption demands.

Answer

Remote users are using an outdated browser that does not support modern protocols.

Answer

NTLM authentication is causing authentication delays over the MPLS link.

Question 12

Which THREE considerations must be taken when deploying SSL decryption on a Cisco WSA in explicit proxy mode?

Accepted Answer

Create an HTTPS decryption policy to specify which traffic to decrypt.. An explicit HTTPS decryption policy is required to define which traffic should be intercepted and decrypted. Without this policy, the WSA will not decrypt any HTTPS traffic, even if the CA certificate is installed. The policy specifies criteria such as source IP, destination URL category, or user identity to selectively decrypt traffic.

Answer

Ensure that the WSA can listen on TCP ports below 1024.

Answer

Enable DLP scanning on the WSA to inspect decrypted content.

Question 13

Refer to the exhibit. An administrator notices that DNS responses larger than 512 bytes are being dropped. Which configuration change should be made to allow larger DNS responses?

Accepted Answer

Increase the message-length maximum under the DNS map. DNS inspection on Cisco ASA/Firepower devices uses a DNS map to enforce a default maximum message length of 512 bytes, which aligns with the original DNS specification (RFC 1035). To allow larger DNS responses (e.g., those using EDNS0, which can exceed 512 bytes), you must increase the message-length maximum under the DNS map. This change permits the firewall to reassemble and forward DNS packets that exceed the default limit without dropping them.

Answer

Remove the DNS inspection policy

Answer

Add an access-list to permit the traffic

Answer

Disable the set connection advanced-options command

Question 14

A company is migrating a web application to AWS and wants to protect against DDoS attacks at the application layer. Which Cisco security solution should they deploy?

Accepted Answer

Cisco WAF (Web Application Firewall). A Web Application Firewall (WAF) is the correct solution because it specifically inspects and filters HTTP/HTTPS traffic at the application layer (Layer 7), protecting against DDoS attacks such as HTTP floods, SQL injection, and cross-site scripting. Cisco WAF (often delivered via Cisco Secure Web Application or integrated with AWS WAF) can rate-limit requests, block malicious payloads, and enforce positive security models to mitigate application-layer DDoS. This directly addresses the requirement to protect a web application migrating to AWS against Layer 7 attacks.

Answer

Cisco Umbrella

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Question 15

A security team is implementing a DevSecOps pipeline for containerized applications. Which TWO of the following practices should be included to ensure container security?

Accepted Answer

Secrets management (avoiding hardcoded secrets in images). Container image scanning checks for vulnerabilities in images, and secrets management prevents exposure of sensitive data in code.

Answer

DAST (Dynamic Application Security Testing)

Answer

IaC security scanning

Answer

Manual code review