350-701 Practice Test 50 — 15 Questions

Question 1

A company uses a SaaS application for customer relationship management. In the cloud shared responsibility model, which security controls are the customer's primary responsibility?

Accepted Answer

Data classification and access policies. In SaaS, the customer is responsible for managing data and access, while the provider handles the underlying infrastructure, application, and OS.

Answer

Patching the underlying operating system

Answer

Physical security of the data center

Answer

Network security for the application servers

Question 2

A company uses AWS and Azure and wants to protect its cloud workloads (VMs and containers) from threats. Which TWO technologies are specifically designed for workload protection in the cloud?

Accepted Answer

CWPP (Cloud Workload Protection Platform). CWPP (Cloud Workload Protection Platform) is specifically for workload security, and container image scanning is a key component of CWPP for containers.

Answer

CASB

Answer

Cloud WAF

Answer

CSPM

Question 3

A company uses Cisco Umbrella to protect remote users. They want to ensure that SSL-encrypted traffic to malicious websites is inspected, but without breaking compliance with privacy regulations. Which Umbrella feature should they enable?

Accepted Answer

Intelligent Proxy. Intelligent Proxy allows selective SSL inspection based on policy, balancing security and privacy.

Answer

Secure Internet Gateway (SIG)

Answer

Roaming Client

Answer

DNS-layer security

Question 4

A cloud security architect is designing zero trust for a multi-cloud environment. Which principle is most critical?

Accepted Answer

Identity as the new perimeter. Zero trust assumes no implicit trust; identity becomes the primary perimeter for access control.

Answer

Use of VPNs for all remote access

Answer

Encryption of all data in transit

Answer

Network segmentation using firewalls

Question 5

An organization is implementing a zero trust strategy for cloud access. They require that all access to cloud resources be authenticated and authorized based on user identity and device health, with session risk assessment. Which Azure AD feature should they primarily use?

Accepted Answer

Conditional Access. Conditional Access policies in Azure AD evaluate signals (user, device, location, risk) to enforce access controls, aligning with zero trust principles.

Answer

Azure AD Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Multi-Factor Authentication

Question 6

What is the correct order of email authentication checks recommended by Cisco?

Accepted Answer

SPF, DKIM, DMARC. The recommended order is SPF, then DKIM, then DMARC policy.

Answer

SPF, DMARC, DKIM

Answer

DMARC, SPF, DKIM

Answer

DKIM, SPF, DMARC

Question 7

Which TWO of the following are capabilities of Cisco Umbrella SIG? (Choose TWO.)

Accepted Answer

Cloud-based proxy for web traffic. Cisco Umbrella SIG provides DNS-layer security (blocking malicious domains) and a cloud-based proxy for web traffic filtering.

Answer

DLP for outbound email

Answer

File sandboxing for attachments

Answer

On-premises email filtering

Question 8

A security engineer is configuring the Cisco ESA to block spam. The engineer wants to rely on a reputation-based system that scores senders based on global email traffic patterns. Which technology should be used?

Accepted Answer

IronPort SenderBase reputation. IronPort SenderBase uses a reputation score (SBRS) ranging from -10 to +10 to classify senders as trusted or spam sources.

Answer

DMARC verification

Answer

Cisco TALOS outbreak filters

Answer

AMP for Email

Question 9

An organization is deploying Cisco TrustSec and uses SXP to propagate SGTs between routers that do not support SGT inline tagging. The SXP connection is established, but the SGT mappings are not being learned. The administrator checks 'show sxp connections' and sees the connection is in 'On' state. What is the most likely issue?

Accepted Answer

The SXP speaker and listener are both configured as listener.. In SXP, one side must act as a speaker and the other as a listener for SGT mappings to be exchanged. If both are configured as listeners, the connection can still reach the 'On' state, but no mappings are propagated because neither side is sending. Option A is incorrect because an unreachable source IP would prevent the connection from establishing, and the state would not be 'On'. Option B is incorrect because the hold-down timer affects the removal of stale mappings after a connection loss, not the initial learning of mappings. Option D is incorrect because an incorrect password would also prevent the connection from reaching the 'On' state.

Answer

The SXP source IP is not reachable.

Answer

The SXP hold-down timer expires too quickly.

Answer

The SXP password is incorrect.

Question 10

A security analyst is configuring Cisco Secure Endpoint (AMP) to detect and respond to threats. Which TWO features are part of the Exploit Prevention capability? (Choose two.)

Accepted Answer

Memory injection protection. Exploit Prevention in Cisco Secure Endpoint includes memory injection protection and other exploit mitigations like rogue process detection.

Answer

File quarantine

Answer

SHA-256 disposition

Answer

Device Trajectory

Question 11

Which authentication protocol is used in Cisco ISE for certificate-based 802.1X authentication?

Accepted Answer

EAP-TLS. EAP-TLS is the Extensible Authentication Protocol that uses certificates for mutual authentication.

Answer

LEAP

Answer

EAP-MD5

Answer

PEAP-MSCHAPv2

Question 12

Match each threat type to its definition.

Accepted Answer

DDoS: Overwhelming a system with traffic from multiple sources. Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Answer

DDoS: Malware that encrypts data and demands payment

Answer

Phishing: Overwhelming a system with traffic from multiple sources

Question 13

Cisco ISE is configured with posture assessment to ensure endpoints meet security requirements before gaining network access. After a posture check, ISE needs to dynamically change the VLAN assignment for a non-compliant endpoint. Which ISE feature enables this real-time change?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically update authentication and authorization attributes such as VLAN assignment.

Answer

TrustSec

Answer

Guest portal

Answer

Profiling

Question 14

A security administrator is tasked with implementing a solution that provides single sign-on (SSO) for users accessing multiple enterprise applications. The solution must support SAML 2.0 and integrate with the existing Microsoft Active Directory. Which component is essential for this architecture?

Accepted Answer

Identity Provider (IdP). An Identity Provider (IdP) is the essential component that authenticates users against Microsoft Active Directory and issues SAML 2.0 assertions to enable single sign-on (SSO) across multiple enterprise applications. The IdP acts as the trusted source of identity, validating credentials and generating signed SAML tokens that Service Providers (SPs) accept without requiring separate logins.

Answer

Certificate Authority (CA)

Answer

RADIUS server

Answer

Service Provider (SP)

Question 15

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Accepted Answer

The DHCP snooping database is not updated because interface Gi0/1 is not trusted. The host cannot ping its default gateway because DHCP Snooping marks interface Gi0/1 as untrusted by default. Since the DHCP server is connected to Gi0/1, the switch drops DHCP replies from that interface, preventing the DHCP snooping binding database from being updated with the host's IP address. Without a valid binding, IP Source Guard on Gi0/0 drops all IP traffic from the host, including pings to the gateway.

Answer

The static IP source binding is configured on the wrong VLAN

Answer

ARP inspection is not enabled, so the switch drops ARP replies

Answer

The 'ip verify source' command is missing the 'port-security' keyword