350-701 Practice Test 50 — 15 Questions

Question 1

A security administrator is configuring a Cisco Secure Firewall to inspect traffic between two internal departments that reside in different security zones on the same appliance. The requirement is to log all connection events and to reset any session that matches a specific intrusion rule, while still allowing the rest of the traffic. Which configuration element must be applied to the access control policy to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An access control rule with an intrusion policy that has a rule action of Drop and Reset on the specific signature. Intrusion-based actions are configured inside the intrusion policy attached to an access control rule whose action is Allow. Marking the specific signature as Drop and Reset causes the firewall to drop the triggering packet and send a TCP reset, terminating only that session. Other connections that do not match the signature continue to be inspected and allowed, and connection events are logged as required.

Answer

An access control rule with an intrusion policy and the action set to Block with reset

Answer

A network analysis policy with a custom TCP stream configuration applied to the zones

Answer

A prefilter policy with a fastpath action and logging enabled for the inter-zone traffic

Question 2

A security team has deployed Cisco Secure Endpoint (formerly AMP for Endpoints) connectors running in audit mode on 500 Windows servers. The team now wants to enforce a policy that will quarantine any file that the cloud verdict engine identifies as malicious within 30 seconds of execution. Which policy setting should they modify?

Accepted Answer

Set the 'Quarantine' action for the 'Malicious' file disposition in the Outbreak Control policy.. The Outbreak Control policy is the component that maps file dispositions (e.g., Malicious, Clean, Unknown) to actions such as Quarantine, Block, or Monitor. To automatically quarantine a file upon a malicious cloud verdict, the Quarantine action must be set for the Malicious disposition. Other settings like Cloud Lookup or File Fetch enable detection but do not enforce the quarantine.

Answer

Enable 'Cloud Lookup' under the Advanced Settings of the endpoint policy.

Answer

Set the 'Application Control' policy to block execution of files with a malicious verdict.

Answer

Configure 'File Fetch' to retrieve files for analysis and set the action to 'Block'.

Question 3

A security team is evaluating Cisco Cloudlock to protect data stored in SaaS applications such as Microsoft 365 and Google Workspace. The team wants to understand which capabilities Cloudlock provides natively. (Choose two.)

Accepted Answer

Data Loss Prevention that classifies and protects sensitive content in sanctioned SaaS applications.. Cisco Cloudlock is an API-based Cloud Access Security Broker that provides data loss prevention for sanctioned SaaS applications and user behavior analytics to detect compromised accounts and insider threats. It does not perform DNS filtering, firewall inspection, or web proxy TLS decryption, which belong to other Cisco cloud and network security products.

Answer

DNS-layer security that blocks resolution of malicious domains before a connection is established.

Answer

Next-generation firewall inspection of east-west traffic between workloads in a public cloud VPC.

Answer

Secure web gateway proxy that decrypts and inspects TLS traffic from branch users to unsanctioned websites.

Question 4

A security engineer is tuning a Cisco Secure Email Gateway (ESA) to reduce false positives for inbound mail. The organization receives a high volume of legitimate marketing messages that are being quarantined. The engineer wants to use features that influence spam scoring based on sender reputation and message content. Which two ESA features should be examined to adjust how messages are evaluated? (Choose two.)

Accepted Answer

Content Filters. SBRS and Content Filters are the two ESA features that directly influence how inbound messages are scored and acted upon. SBRS provides a reputation-based score that can be tuned or overridden for trusted senders, while Content Filters allow granular rules that can exempt legitimate marketing content from quarantine. Together they address the false-positive problem without disabling broader anti-spam protections.

Answer

Email Encryption

Answer

Data Loss Prevention (DLP)

Answer

Message Tracking

Question 5

A security team is using Cisco Umbrella to protect users who access cloud applications. They want to enforce a policy that prevents users from uploading files containing credit card numbers to any unsanctioned cloud storage service, while still allowing uploads to approved services. Which Cisco Umbrella capability should they configure?

Accepted Answer

Cloud Access Security Broker (CASB) with data loss prevention. The requirement is to prevent uploads of files containing credit card numbers to unsanctioned cloud storage while allowing them to approved services. This demands content inspection within cloud applications, which is the domain of a CASB. Cisco Umbrella's CASB, enhanced by Cloudlock, provides API-based scanning of cloud services, DLP engines that recognize sensitive data patterns, and the ability to enforce granular policies based on app sanction status. DNS, SWG, and firewall policies lack the necessary depth.

Answer

DNS-layer security policies

Answer

Secure Web Gateway (SWG) with file inspection

Answer

Firewall policies with application control

Question 6

A security architect is designing a multi-account AWS environment for a financial services company. The company requires that all API activity across every account be centrally logged, retained for seven years, and protected from modification even by account administrators. Which combination of AWS services should the architect implement to meet these requirements?

Accepted Answer

AWS CloudTrail with an organization trail delivering logs to a centralized S3 bucket protected by S3 Object Lock in compliance mode, with a bucket policy denying deletion.. Centralized, immutable audit logging across an AWS Organization is achieved with an organization trail that automatically applies to all current and future accounts. Delivering those logs to an S3 bucket with Object Lock in compliance mode enforces write-once-read-many semantics that even privileged administrators cannot override, meeting both the seven-year retention and the protection-from-modification requirements.

Answer

AWS CloudTrail in each account with logs delivered to a local CloudWatch Logs group, and a subscription filter forwarding events to a central Kinesis Data Firehose stream.

Answer

AWS Config with an aggregator collecting configuration snapshots from all accounts, stored in a DynamoDB table with point-in-time recovery enabled.

Answer

Amazon GuardDuty enabled in every account with findings exported to a central security account via EventBridge and archived in an S3 bucket with versioning.

Question 7

A security architect is deploying a multicloud environment that spans AWS, Azure, and GCP. The organization requires a centralized, agentless solution that discovers all workloads, detects misconfigurations against CIS benchmarks, and provides a unified compliance dashboard across all three providers. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM). Cisco CSPM is purpose-built for agentless multicloud workload discovery and continuous compliance assessment against standards like CIS benchmarks, with a unified dashboard. The other options address different security domains: Cloudlock for SaaS, Secure Workload for microsegmentation, and Umbrella for internet gateway security, none of which deliver the required multicloud posture management.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Secure Workload

Question 8

A security team is deploying a multi-tier web application on AWS. They need to continuously monitor for misconfigured S3 buckets and overly permissive IAM policies, and receive alerts when deviations occur. Which Cisco solution should they implement to achieve this?

Accepted Answer

Cisco Cloud Security Posture Management (CSPM). Cisco Cloud Security Posture Management (CSPM) is designed to continuously assess cloud infrastructure for misconfigurations and compliance issues, including S3 bucket permissions and IAM policies. It provides visibility and alerts for deviations, enabling security teams to remediate risks. The other options focus on different security layers, such as SaaS security, network traffic analysis, or DNS security, and do not provide the required configuration monitoring.

Answer

Cisco Cloudlock

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch Cloud

Question 9

A company is migrating its on-premises web application to AWS. The security team must ensure that only HTTP and HTTPS traffic from the internet reaches the application, while all other inbound ports are blocked. Which AWS feature should they configure to meet this requirement?

Accepted Answer

AWS Security Group. Security groups are stateful, instance-level virtual firewalls in AWS. By creating a security group with inbound rules that permit only TCP 80 and 443 from any source and relying on the implicit deny for all other traffic, the team restricts access exactly as required. Network ACLs are subnet-level and stateless, WAF inspects layer 7 content, and Shield Advanced mitigates DDoS, so none of them replace the port-filtering function of a security group.

Answer

AWS Network ACL

Answer

AWS WAF

Answer

AWS Shield Advanced

Question 10

A network security team is deploying Cisco Firepower Threat Defense (FTD) managed by Cisco Secure Firewall Management Center. They need to decrypt outbound HTTPS traffic so that file policies can inspect downloaded files, but they must not break connections to sites that use certificate pinning. Which FTD feature should be used to selectively bypass decryption for those sites?

Accepted Answer

SSL policy with a Do Not Decrypt rule that matches the pinned sites. Selective decryption in FTD is controlled by the SSL policy, which can contain Do Not Decrypt rules that match traffic by category, URL, or certificate attributes. A Do Not Decrypt rule for the pinned sites preserves those connections while other HTTPS traffic is decrypted and inspected by file policies. Access control blocking, file policy actions, and intrusion preprocessor settings do not influence the decryption decision.

Answer

Access control policy with an SSL inspection action set to Block

Answer

File policy with a Block Malware action

Answer

Intrusion policy with a preprocessor rule to ignore TLS handshake errors

Question 11

A security architect is designing a cloud access security broker (CASB) deployment for a company that uses Microsoft 365 and Salesforce. The company wants to apply data loss prevention (DLP) policies to data at rest within these SaaS applications without installing endpoint agents, and it wants to maintain full visibility into which users are sharing files externally. Which CASB deployment mode should the architect choose?

Accepted Answer

API-based CASB. API-based CASB integration is the correct choice because it uses the SaaS provider's own APIs to inspect data at rest, apply DLP policies, and enumerate external sharing without any endpoint agent. Forward-proxy and reverse-proxy modes are inline or application-facing and only see traffic in motion, while log collection is passive and cannot enforce policy.

Answer

Forward-proxy CASB

Answer

Reverse-proxy CASB

Answer

Log-collection CASB

Question 12

A security team is deploying Cisco Umbrella for DNS-layer security. They want to prevent endpoint users from bypassing the DNS filtering by manually changing their DNS server settings to an external resolver. Which Cisco Umbrella component should they implement to enforce this?

Accepted Answer

Cisco Umbrella Roaming Client. The Umbrella Roaming Client is specifically designed to enforce DNS-layer security on endpoints by intercepting DNS requests and directing them to Umbrella, regardless of the device's configured DNS servers. This ensures that users cannot bypass filtering by manually changing DNS settings. Other Umbrella components like the Virtual Appliance or Investigate do not provide this endpoint-level enforcement.

Answer

Cisco Umbrella Investigate

Answer

Cisco Umbrella SIG Essentials

Answer

Cisco Umbrella Virtual Appliance

Question 13

A security operations team is using Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to monitor a hybrid cloud environment. They want to detect threats such as cryptomining and data exfiltration across AWS, Azure, and on-premises networks without deploying agents on every workload. Which statement describes how Cisco Secure Cloud Analytics achieves this?

Accepted Answer

It ingests VPC flow logs, Azure NSG flow logs, and on-premises NetFlow/IPFIX to build behavioral models and detect anomalies.. Cisco Secure Cloud Analytics is an agentless network traffic analysis solution that ingests flow logs from public clouds and on-premises networks. It builds behavioral baselines and detects anomalies such as cryptomining, data exfiltration, and lateral movement without requiring agents on workloads. The other options describe agent-based, DNS-based, or API-based approaches that do not match its primary detection mechanism.

Answer

It relies on DNS query logs from Cisco Umbrella to identify malicious domains contacted by workloads.

Answer

It uses agent-based sensors installed on each virtual machine to capture process-level telemetry.

Answer

It uses API calls to cloud providers to inventory resources and check against CIS benchmarks.

Question 14

A security operations team is investigating alerts from Cisco Secure Email and Web Manager (formerly Cisco Content Security Management Appliance). They want to reduce false positives in Cisco ESA spam detection without degrading legitimate mail flow. Which two actions should they take? (Choose two.)

Accepted Answer

Add trusted senders to an allowed list in the mail policy. Reducing false positives in Cisco ESA spam detection involves tuning quarantine thresholds with review, and using allowed lists for known legitimate senders. These actions target the specific misclassification problem while preserving protection for the broader mail stream. Disabling reputation filtering, auto-deleting quarantine, or lowering the spam threshold all either weaken security or increase false positives, so they do not satisfy the requirement.

Answer

Set the spam quarantine to automatically delete all messages after one hour

Answer

Disable SenderBase reputation filtering entirely

Answer

Lower the spam threshold so more messages are quarantined

Question 15

A security administrator is configuring Cisco Web Security Appliance (WSA) to inspect HTTPS traffic for malware. The administrator wants to ensure that the WSA can decrypt, inspect, and re-encrypt traffic without causing certificate errors for users. Which configuration is required on the WSA?

Accepted Answer

Upload a CA-signed certificate and enable HTTPS Proxy with a decryption policy.. HTTPS decryption on Cisco WSA requires a trusted CA-signed certificate that the appliance uses to generate per-site certificates. The decryption policy determines which traffic to decrypt. This setup allows the WSA to act as a man-in-the-middle, decrypting and inspecting traffic before re-encrypting it to the destination. Without a trusted certificate, users would see certificate errors, so uploading a CA-signed certificate and enabling the decryption policy is essential.

Answer

Enable SSLv3 and use a self-signed certificate for decryption.

Answer

Install a client certificate on all user devices and enable mutual authentication.

Answer

Configure a passthrough policy for all HTTPS traffic and enable malware scanning.