350-701 Practice Questions 2 — 50 Questions

Question 1

An email administrator sees the above log entry in the Cisco ESA. What will happen to the email?

Accepted Answer

The email will be quarantined and an administrator will review it. The log entry indicates that the email triggered a content filter action set to 'quarantine' in the Cisco ESA. When an email is quarantined, it is held in a designated quarantine mailbox for administrative review, allowing the administrator to release, delete, or further analyze the message. This is the default behavior for policies that require human intervention before delivery.

Answer

The email will be dropped and not delivered

Answer

The email will be encrypted before delivery

Answer

The email will be delivered with a warning

Question 2

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Option A is correct because Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 3

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 4

During a cloud migration, an administrator notices that a workload in Azure is generating outbound traffic that is being blocked by the cloud security group. The workload requires connectivity to a specific SaaS application (Office 365) using TLS. The security group denies all outbound traffic except to specific IP ranges. Which action should the administrator take?

Accepted Answer

Add the Office 365 IP ranges and FQDNs to the allowed list. Option C is correct because the administrator needs to allow outbound traffic to Office 365, which uses TLS over TCP/443. Since the security group denies all outbound traffic except to specific IP ranges, the most direct and secure method is to add the published Office 365 IP ranges and FQDNs to the allowed list. This ensures the workload can reach the SaaS application without bypassing security controls or introducing additional latency.

Answer

Implement a proxy server

Answer

Use Azure Private Link

Answer

Disable the security group temporarily

Question 5

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. Option D is correct because AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 6

A company is planning to use Cisco Umbrella to secure internet access for branch offices. They already have Cisco Meraki MX appliances at each branch. What is the best way to send DNS traffic from the branches to Umbrella?

Accepted Answer

Enable the Umbrella integration in Meraki dashboard. Option D is correct because Meraki MX can automatically integrate with Umbrella via the built-in connector. Option A is wrong because IPSec tunnel is more complex and not native. Option B is wrong because an on-premises virtual appliance adds infrastructure. Option C is wrong because the roaming client is for endpoints, not branch networks.

Answer

Deploy the Umbrella virtual appliance at each branch

Answer

Install the Umbrella Roaming Client on each user device

Answer

Configure IPSec tunnels between branches and Umbrella data centers

Question 7

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Option A is correct because zero trust architecture operates on the principle of 'never trust, always verify,' which includes assuming that a breach has already occurred or is inevitable. This assumption drives continuous validation of every access request, regardless of source, and enforces least-privilege access to limit lateral movement. In cloud environments, this means treating every API call, workload, and user session as potentially compromised until proven otherwise.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 8

A small business uses Cisco Duo for multi-factor authentication. They want to ensure that employees accessing cloud apps from personal devices are compliant with device security policies. Which Duo feature should they use?

Accepted Answer

Duo Device Health. D is correct because Duo Device Health checks device security posture (OS version, encryption, etc.) before allowing access. A is for SSO. B is for VPN. C is the authenticator app.

Answer

Duo Mobile

Answer

Duo Network Gateway

Answer

Duo Access Gateway

Question 9

A cloud security architect is designing a zero-trust architecture for an enterprise using AWS and Azure. They need to enforce micro-segmentation between application tiers. Which Cisco solution is most appropriate?

Accepted Answer

Cisco Secure Workload. B is correct because Cisco Secure Workload provides micro-segmentation based on application dependencies. A is for firewall, not workload-centric. C is for secure internet gateway. D is for cloud security posture.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Firewall

Answer

Cisco Secure Cloud Analytics

Question 10

A company wants to use Cisco DUO for MFA to protect access to its Azure AD applications. Which authentication method should be configured for cloud applications?

Accepted Answer

Secondary authentication via DUO after Azure AD. When integrating Cisco DUO with Azure AD for MFA, the recommended approach is to configure DUO as a secondary authentication provider after Azure AD handles primary authentication. This is achieved by using DUO's Azure AD integration, which acts as a custom control or a conditional access policy that triggers DUO MFA after the user has already authenticated against Azure AD. This ensures that Azure AD remains the identity provider (IdP) for primary authentication, while DUO provides an additional layer of security via a secondary push, phone call, or passcode.

Answer

DUO for RADIUS authentication

Answer

DUO as a SAML identity provider

Answer

Primary authentication via DUO

Question 11

A company uses Amazon Web Services (AWS) and wants to integrate with Cisco Defense Orchestrator (CDO) for centralized security management. Which THREE capabilities does CDO provide when managing AWS security services? (Choose three.)

Accepted Answer

Monitor AWS CloudTrail logs for security events.. A is correct because Cisco Defense Orchestrator (CDO) can ingest and monitor AWS CloudTrail logs to detect security events, such as unauthorized API calls or policy violations. This integration allows CDO to correlate cloud-native audit logs with firewall events for centralized visibility and alerting, which is a key capability for cloud security management.

Answer

Manage AWS Identity and Access Management (IAM) roles.

Answer

Provision and configure AWS VPC subnets.

Question 12

During a cloud migration, the security team uses Cisco CloudLock for DLP. They notice that the DLP engine is not scanning certain files in Google Drive shared with external users. The CloudLock admin console shows the connector status as 'connected'. What is the most likely cause?

Accepted Answer

The connector lacks permission to scan external files. Cisco CloudLock requires explicit permissions to scan files shared with external users. Even though the connector status shows 'connected', the default OAuth scopes granted during initial setup may not include access to files shared outside the organization. The DLP engine can only inspect files it has read access to; without the 'drive.readonly' scope extended to externally shared items, those files are invisible to scanning.

Answer

The files are too large (over 100 MB)

Answer

The external sharing is disabled in CloudLock policy

Answer

The files are in Google Drive 'My Drive' not 'Shared Drive'

Question 13

A network engineer is designing a multi-cloud architecture with AWS and Azure. The company needs consistent security policies across both cloud providers and on-premises data centers. Which Cisco solution should the engineer recommend?

Accepted Answer

Cisco Tetration.. Option B is correct because Cisco Tetration provides workload protection and micro-segmentation across multicloud environments. Option A is wrong because Stealthwatch is for network traffic visibility, not policy orchestration. Option C is wrong because Firepower is more focused on on-premises. Option D is wrong because Umbrella is cloud-delivered security but not for workload segmentation.

Answer

Cisco Umbrella SIG.

Answer

Cisco Firepower NGFW.

Answer

Cisco Stealthwatch Enterprise.

Question 14

A company wants to prevent users from downloading executable files (.exe) from the internet via the WSA. Which policy type should be configured?

Accepted Answer

Access policy with file type filtering. C is correct because an Access policy in WSA allows granular control over web traffic, including the ability to block specific file types such as .exe via the 'File Type Filtering' action. This directly prevents users from downloading executable files from the internet, as the WSA inspects the MIME type or file extension in the HTTP response and applies the configured block action.

Answer

URL filtering policy with category blocking

Answer

Data Security policy

Answer

Web Reputation Security policy

Question 15

An organization is migrating from on-premises Cisco ESA to Cisco Cloud Email Security (CES). They need to ensure that email encryption policies remain consistent after migration. What is the best approach to migrate the encryption policies?

Accepted Answer

Export the configuration from on-premises ESA and import into CES. Exporting the configuration from on-premises ESA and importing into CES ensures consistency. Option A is wrong because manual re-creation is error-prone. Option C is wrong because using the API requires custom scripting and may not capture all policies. Option D is wrong because there is no direct synchronization feature between on-premises and cloud ESA.

Answer

Use the Cisco ESA API to migrate policies automatically

Answer

Recreate the policies manually in CES based on existing documentation

Answer

Synchronize the two appliances using Cisco Security Management Suite

Question 16

A network administrator notices that users in the finance department are unable to access a legitimate business web application that uses custom port 8443. The WSA is configured with a decryption policy that decrypts all traffic on port 443. What is the most likely cause of the issue?

Accepted Answer

The decryption policy is not applied to port 8443, so the WSA treats it as non-decrypted traffic which may be blocked by default. The WSA's decryption policy is configured to decrypt traffic only on port 443 (HTTPS). Since the finance department's web application uses custom port 8443, the traffic is not subject to decryption. By default, the WSA may block non-decrypted traffic that matches certain security or access policies, or it may treat it as untrusted, leading to access failure. The most likely cause is that the decryption policy does not cover port 8443, so the WSA applies a default action (often block) to non-decrypted traffic.

Answer

The WSA is configured with a time-based access rule that only allows access during business hours

Answer

The WSA cannot decrypt traffic on port 8443, causing a certificate mismatch

Answer

The web application is blocked by an identity-based access policy

Question 17

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

Accepted Answer

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA. When using explicit proxy, clients must be configured to use the proxy. To prevent bypass, configure the firewall to block outbound HTTP/HTTPS traffic from non-proxy sources, or use transparent proxy with WCCP. Option A is wrong because enabling SSL decryption alone does not force traffic through proxy. Option B is wrong because authenticating users does not prevent bypass. Option D is wrong because creating a deny URL category for tunnels is ineffective.

Answer

Enable SSL decryption on the WSA

Answer

Configure identity-based authentication for all users

Answer

Create a custom URL category for tunneling websites and block them

Question 18

An administrator is troubleshooting an issue where emails sent to a specific external domain are being delayed by up to 30 minutes. The Cisco ESA is configured with multiple mail exchangers (MX) for delivery. The logs show that the ESA is attempting delivery to the primary MX, which is unresponsive, and failing over to the secondary MX after 30 minutes. What change should be made to reduce the delivery delay?

Accepted Answer

Reduce the delivery queue retry interval in the ESA settings. Configuring a shorter timeout or retry interval on the delivery queue will cause the ESA to fail over faster. Option A is wrong because increasing the number of MX records doesn't change the timeout. Option B is wrong because disabling the primary MX is not a good practice. Option D is wrong because enabling ESMTP does not affect timeout.

Answer

Enable SMTP over TLS (ESMTP) for the delivery

Answer

Increase the number of MX records for that domain

Answer

Remove the primary MX record from DNS

Question 19

A company using Cisco Web Security Appliance (WSA) in explicit proxy mode has enabled HTTPS decryption with a custom CA certificate. A user reports that a specific banking website displays a certificate error message. The administrator verifies that the WSA is generating a certificate for that site. What is the most likely cause of the error?

Accepted Answer

The banking website uses HTTP Public Key Pinning (HPKP) or Certificate Pinning.. Banking websites often use dynamic certificates with extended validation (EV) and may implement certificate pinning. However, the WSA's generated certificate will not match the original certificate's public key or subject alternative names if the site uses pinning. Option B is correct because certificate pinning will cause a mismatch. Option A is incorrect because the CA certificate is already trusted. Option C is incorrect because the WSA's certificate is generated on the fly. Option D is possible but less specific to banking sites.

Answer

The WSA's time is not synchronized with the NTP server, causing certificate validity issues.

Answer

The WSA is not configured to generate certificates for that domain.

Answer

The user's browser does not trust the WSA's CA certificate.

Question 20

Which TWO of the following are best practices when configuring Cisco Email Security Appliance (ESA) anti-spam filters? (Choose two.)

Accepted Answer

Adjust threshold levels per sender group to reduce false positives.. Best practices for ESA anti-spam include enabling multiple anti-spam engines for layered detection and configuring threshold levels per group. Option A is correct because using both Cisco Anti-Spam and third-party engines improves detection. Option E is correct because tuning thresholds per sender group reduces false positives. Option B is incorrect because enabling all engines can cause performance issues. Option C is incorrect because blocking without quarantine may cause loss of legitimate mail. Option D is incorrect because reputation lists are the least accurate.

Answer

Rely solely on IP reputation lists for spam detection.

Answer

Set the anti-spam action to 'Delete' for high-scoring messages.

Answer

Enable all available anti-spam engines to ensure maximum detection.

350-701 Practice Questions 2 — 50 Questions

Exhibit

350-701 Practice Questions 2 — 50 Questions

Exhibit