350-701 Practice Test 5 — 10 Questions

Question 1

Which cloud workload protection platform (CWPP) capability is essential for protecting containerized applications?

Accepted Answer

Container image vulnerability scanning. CWPP for containers includes image scanning for vulnerabilities and runtime security, but image scanning is a fundamental capability.

Answer

Web application firewall

Answer

Network micro-segmentation

Answer

Identity and access management

Question 2

In a DevSecOps pipeline, a security engineer wants to automatically scan Infrastructure as Code (IaC) templates for security misconfigurations before deployment. Which tool is commonly used for static analysis of Terraform templates?

Accepted Answer

Checkov. Checkov is a static analysis tool specifically designed for scanning IaC files like Terraform to find security misconfigurations.

Answer

SAST scanner

Answer

DAST scanner

Answer

Container image scanner

Question 3

An organization is implementing privileged access management (PAM) with Cisco SecureX and CyberArk. Which feature allows administrators to grant temporary elevated privileges for a specific task, after which the privileges are automatically revoked?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Application whitelisting

Answer

Password vaulting

Question 4

What is the primary function of a Certificate Revocation List (CRL) in a PKI?

Accepted Answer

List revoked certificates. CRL lists certificates that have been revoked before their expiration date, allowing relying parties to verify validity.

Answer

Store private keys

Answer

Validate certificate signatures

Answer

Generate new certificates

Question 5

A security analyst notices that a file previously marked as 'clean' on an endpoint was later determined to be malicious. Using Cisco Secure Endpoint, which feature allows the analyst to see the propagation of that file across the system and understand its impact?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco Secure Endpoint provides a timeline of events showing file propagation and system changes, enabling retrospective analysis.

Answer

IOC scanning

Answer

SHA-256 disposition

Answer

Exploit Prevention

Question 6

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

Accepted Answer

Zero Trust. Zero Trust assumes no implicit trust and verifies every access request.

Answer

Defense in depth

Answer

Least privilege

Answer

Network segmentation

Question 7

A PKI administrator needs to check the revocation status of a certificate without causing a heavy load on the CA. Which protocol should be used?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol) provides real-time revocation status without requiring clients to download a full CRL.

Answer

EST

Answer

SCEP

Answer

CRL

Question 8

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Accepted Answer

Install a trusted root CA certificate on all client devices. Option A is correct because HTTPS decryption on the Cisco WSA requires the WSA's certificate authority to be trusted by clients; otherwise browsers will show certificate warnings and the decrypted traffic will be rejected, so the WSA root CA (or a subordinate CA) must be installed in each client's trusted root store. Option B is correct because the administrator explicitly wants to decrypt HTTPS traffic for the social media and streaming video categories; this is done by enabling HTTPS/SSL decryption in the WSA's decryption policy and applying it to those URL categories. Option C is correct because blocking access to social media and streaming video is accomplished through URL filtering by selecting the 'Social Networking' and 'Streaming Media' categories in an access policy and setting the action to Block. Option D is not required because AMP file scanning is a malware/file reputation feature and does not enforce acceptable use or category-based blocking. Option E is not required because WCCP is only one possible method of redirecting client traffic to the WSA (typically on a router or Layer 4 switch); it is a deployment/redirection choice, not a required configuration step for filtering and decrypting these categories.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 9

An organization implements a policy where every access request must be authenticated and authorized, even if it originates from within the internal network. Network segments are isolated, and lateral movement is restricted through microsegmentation. Which security model does this align with?

Accepted Answer

Zero Trust. Zero Trust requires verification for every request regardless of network location, and uses microsegmentation to limit movement.

Answer

CIA triad

Answer

AAA model

Answer

Defense in depth

Question 10

An organization implements multi-factor authentication requiring a password and a fingerprint scan. Which two authentication factors are being used?

Accepted Answer

Knowledge and inherence. Password is a knowledge factor, fingerprint is an inherence (biometric) factor.

Answer

Knowledge and possession

Answer

Inherence and location

Answer

Possession and inherence