350-701 Practice Questions 1 — 50 Questions

Question 1

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Answer

show crypto engine statistics

Answer

debug crypto isakmp

Answer

show crypto isakmp sa

Question 2

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Accepted Answer

Self-registration guest portal. The self-registration guest portal is the correct choice because it allows guests to create their own credentials and, crucially, includes a configurable step where the user must accept an Acceptable Use Policy (AUP) before being granted network access. This portal type is specifically designed for scenarios where guests self-onboard and must acknowledge a policy, which is a core requirement for compliance in many guest access deployments.

Answer

Sponsored guest portal

Answer

Hotspot guest portal

Answer

BYOD portal

Question 3

A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for network access control and Cisco Stealthwatch for network visibility. Recently, they deployed a new web application that is accessed by both internal employees and external customers. The application uses HTTPS on port 443. After deployment, the security team notices that the FTD is dropping some HTTPS sessions that appear legitimate. The drops are inconsistent and seem to occur only during peak hours. The FTD logs show the drop reason as 'TCP state violation'. The team has verified that the web server and clients are configured correctly. The Stealthwatch reports show no anomalies. What is the most likely cause and solution?

Accepted Answer

Configure TCP state bypass on the FTD for the web server traffic. The 'TCP state violation' drops during peak hours indicate that the FTD's stateful inspection engine is seeing TCP segments that do not match the expected state machine, likely due to asymmetric routing or session timeouts under load. Configuring TCP state bypass for the web server traffic disables stateful inspection for those flows, allowing the firewall to forward packets based on ACLs alone without tracking TCP states, which resolves the issue without compromising security for legitimate traffic.

Answer

Enable SSL decryption to inspect the encrypted traffic

Answer

Increase the TCP timeout values on the FTD to accommodate longer sessions

Answer

Block all traffic to the web server except from trusted IPs

Question 4

A company is implementing Cisco Umbrella to provide DNS-layer security. They want to block access to known malicious domains while allowing all other traffic. Which policy configuration should be used?

Accepted Answer

Create a block list with known malicious domains. Cisco Umbrella's DNS-layer security operates by intercepting DNS queries and comparing them against policy-defined lists. A block list containing known malicious domains is the correct approach because Umbrella will block DNS resolution for those domains while allowing all other traffic to pass through normally. This aligns with the requirement to block only malicious destinations without affecting access to legitimate sites.

Answer

Enable selective proxy for all traffic

Answer

Create an allow list with only safe domains

Answer

Use a custom policy with both allow and block lists

Question 5

Which THREE are characteristics of Cisco Stealthwatch?

Accepted Answer

Can integrate with Cisco ISE for automated threat response. Option A is correct because Cisco Stealthwatch can integrate with Cisco ISE (Identity Services Engine) via pxGrid or REST API to enable automated threat response. When Stealthwatch detects anomalous behavior, it can trigger ISE to enforce policy changes such as quarantining an endpoint or dynamically applying a security group access control list (SGACL), closing the loop between detection and remediation.

Answer

Acts as a next-generation firewall

Answer

Functions as an intrusion prevention system (IPS)

Question 6

Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?

Accepted Answer

802.1X authentication. 802.1X authentication is a valid NAC method because it enforces port-based access control by requiring end devices to authenticate via EAP (Extensible Authentication Protocol) before gaining network access. It integrates with a RADIUS server (e.g., Cisco ISE) to validate credentials and dynamically assign VLANs or ACLs based on policy, making it a core NAC technology.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP source guard

Answer

DHCP snooping

Question 7

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Option C is correct because certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 8

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

Accepted Answer

An ACL to match the traffic to be translated. For NAT to translate traffic, the firewall must know which traffic to translate. An ACL is used to match the source IP addresses (or networks) that should be translated. Without an ACL applied to the NAT rule, the firewall has no criteria to identify traffic from VLAN 10 for translation, so packets are forwarded without NAT, causing internet access to fail while internal routing works.

Answer

A NAT pool with available public IP addresses

Answer

Port Address Translation (PAT) configuration

Answer

A route map to apply NAT based on destination

Question 9

A network administrator is configuring IKEv2 on a Cisco router and wants to ensure that the router does not initiate connections but only responds to incoming IKEv2 requests. Which configuration command should be applied?

Accepted Answer

crypto ikev2 passive. The 'crypto ikev2 passive' command configures the router to only respond to incoming IKEv2 requests and never initiate its own IKEv2 connections. This is essential for scenarios where the router must act as a responder only, such as in hub-and-spoke VPN topologies where the hub should not initiate tunnels.

Answer

crypto ikev2 no initiate

Answer

crypto ikev2 limit max-incoming-sa 10

Answer

crypto ikev2 limit max-negotiations 10

Question 10

A multinational corporation is migrating its on-premises data center to a public cloud provider. The security policy requires that all traffic between cloud VPCs and the on-premises network must be inspected by a next-generation firewall (NGFW) deployed in the cloud. The on-premises network uses BGP for dynamic routing. Which design meets the requirement while minimizing latency and administrative overhead?

Accepted Answer

Deploy a transit VPC with an NGFW instance and configure BGP dynamic routing between the transit VPC, other VPCs, and the on-premises network.. Option A is correct because a transit VPC with an NGFW instance allows centralized traffic inspection while using BGP dynamic routing to exchange routes between the transit VPC, other VPCs, and the on-premises network. This design minimizes administrative overhead by avoiding static route management and reduces latency by keeping inspection within the cloud, rather than hair-pinning traffic on-premises. BGP enables automatic failover and route propagation, meeting the dynamic routing requirement.

Answer

Use AWS Transit Gateway with static routes pointing to the NGFW instance for inspection.

Answer

Create a site-to-site VPN between each VPC and the on-premises network, and configure the NGFW on-premises.

Answer

Use AWS Direct Connect to connect all VPCs to the on-premises network and place the NGFW on-premises.

Question 11

A security team suspects that malware is exfiltrating data by encoding it in DNS queries. Which Cisco security solution is specifically designed to analyze DNS traffic for malicious activity?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. It can detect and block DNS-based data exfiltration techniques, such as DNS tunneling, by inspecting DNS request patterns and comparing them against threat intelligence feeds. This makes it the correct choice for analyzing DNS traffic for malicious activity.

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Answer

Cisco Email Security Appliance

Question 12

An engineer is troubleshooting a site-to-site IPsec VPN between two Cisco routers. The tunnel is not establishing. Which command would verify that IKE phase 1 negotiations have completed successfully?

Accepted Answer

show crypto isakmp sa. The 'show crypto isakmp sa' command displays the state of IKE (Internet Key Exchange) Phase 1 security associations (SAs). A successful Phase 1 negotiation is indicated by a state of 'MM_ACTIVE' (Main Mode) or 'QM_IDLE' (Aggressive Mode), confirming that the peers have mutually authenticated and established a secure ISAKMP tunnel. This is the direct verification command for Phase 1 completion.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

debug crypto isakmp

Question 13

An organization uses Cisco Umbrella for DNS-layer security. They want to block access to a newly discovered malicious domain (malware.example.com) immediately. Which action should the administrator take in the Umbrella dashboard?

Accepted Answer

Add the domain to the 'Block List' under the policy's 'Destination Lists'.. Option C is correct because in Cisco Umbrella, the most immediate way to block a specific malicious domain is to add it to the 'Block List' under the policy's 'Destination Lists'. This list is evaluated in real-time for DNS queries, allowing the administrator to enforce the block without waiting for threat intelligence updates or affecting other policies.

Answer

Add the domain to the 'Global Block List' under 'Managed Networks'.

Answer

Add the domain to the 'Temporary Block List' under 'Security Settings'.

Answer

Add the domain to the 'IP Layer Enforcement' list.

Question 14

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Option A is correct because Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 15

You are a security engineer for a multinational corporation with 5,000 employees. The company uses Cisco Umbrella for DNS-layer security, Cisco Web Security Appliance (WSA) for proxy services in the data center, and Cisco Email Security Appliance (ESA) for email security. Recently, the security team has received multiple reports of users receiving phishing emails that bypass the ESA. The emails contain links to malicious websites that are also not blocked by Umbrella or WSA. Upon investigation, you find that the phishing emails use newly registered domains (less than 24 hours old) and the malicious websites are hosted on cloud infrastructure with frequently changing IP addresses. The company's current security policies rely on signature-based detection and static blocklists. Which action should you take to most effectively mitigate these threats?

Accepted Answer

Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.. Option A is correct because Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.

Answer

Configure the WSA to block all domains registered within the last 30 days.

Answer

Enable Data Loss Prevention (DLP) on the ESA to scan email content for sensitive data.

Answer

Increase the frequency of signature updates on the ESA and WSA to every hour.

Question 16

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. Option A is correct because the AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 17

A network administrator is troubleshooting an issue where users in the finance VLAN are unable to access a critical server in the server VLAN. The switch logs show multiple 'Authentication failed' messages for MAC addresses in the finance VLAN. The switchport security feature is enabled on the access ports. What is the most likely cause of the issue?

Accepted Answer

Switchport security violation has caused the ports to error-disable or drop traffic.. The switch logs show 'Authentication failed' messages for MAC addresses in the finance VLAN, and switchport security is enabled. When a switchport security violation occurs (e.g., due to a MAC address limit or an unauthorized MAC address), the port can be configured to error-disable or drop traffic. This explains why users in the finance VLAN cannot reach the server, as the access ports are effectively blocking traffic due to the security violation.

Answer

The switch ports are configured as trunks and are not allowing the finance VLAN.

Answer

802.1X authentication is failing for the finance users.

Answer

Spanning Tree Protocol (STP) is blocking the ports in the finance VLAN.

Question 18

In a Cisco TrustSec deployment, security group tags (SGTs) are used to represent user and device roles. These tags must be propagated across the network. Which protocol is used to carry SGT information in Ethernet frames?

Accepted Answer

IEEE 802.1Q with SGT encapsulation (Cisco proprietary). Cisco TrustSec uses SGTs to enforce role-based access control. To propagate SGT information across the network, Cisco developed a proprietary extension to IEEE 802.1Q that embeds the SGT into the Ethernet frame header, specifically using the CMD (Cisco MetaData) field. This allows switches and routers to enforce security policies based on the SGT without requiring additional encapsulation overhead.

Answer

MPLS

Answer

VXLAN

Answer

GRE

Question 19

Which TWO of the following are valid methods for deploying Cisco Firepower Threat Defense (FTD) in high availability?

Accepted Answer

Clustering. Cisco FTD supports high availability through Active/Standby failover (option D) and clustering (option B). Active/Standby failover provides stateful redundancy with one unit handling traffic while the other monitors and takes over upon failure. Clustering groups multiple FTD devices into a single logical unit for both high availability and scalability, distributing traffic across members.

Answer

Active/Active failover

Answer

Load balancing with external load balancer

Answer

StackWise

Question 20

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Accepted Answer

Profiling. Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.

Answer

Application visibility

Answer

NetFlow analysis