350-701 Practice Questions 2 — 50 Questions

Question 1

An attacker injects a malicious SQL query into a web application's login form, bypassing authentication. Which type of exploitation is this?

Accepted Answer

SQL injection. SQL injection is an attack where malicious SQL statements are inserted into an entry field for execution.

Answer

Cross-site request forgery (CSRF)

Answer

Buffer overflow

Answer

Cross-site scripting (XSS)

Question 2

A company wants to implement Zero Trust principles in their cloud environment. Which THREE of the following are key Zero Trust tenets?

Accepted Answer

Assume breach (minimize blast radius). Option A (Assume breach, minimize blast radius) is a core Zero Trust tenet because it directs architects to segment networks, limit lateral movement, and contain incidents under the assumption that attackers are already inside. Option C (Use least privilege access) is correct because Zero Trust requires just-in-time and just-enough-access (JIT/JEA) so identities receive only the minimum permissions needed, reducing the attack surface. Option D (Verify explicitly) is correct because Zero Trust demands continuous authentication and authorization of every request using all available signals (identity, device health, location, data sensitivity) rather than trusting based on network location. Option B (MFA everywhere) is a valuable identity control that supports Zero Trust but is an implementation mechanism, not one of the three foundational tenets themselves. Option E (Assume the perimeter is secure) directly contradicts Zero Trust, which rejects the castle-and-moat model and assumes no implicit trust from network location.

Answer

Implement multifactor authentication (MFA) everywhere

Answer

Assume that the perimeter is secure

Question 3

A Cisco FTD device managed by FMC is processing traffic. An access control rule is configured with the action 'Interactive Block'. What behavior does this action trigger?

Accepted Answer

The user is shown a block page and can click to bypass the block for a specified time.. The Interactive Block action in a Cisco FTD access control rule is designed to give users a chance to override a block decision. When traffic matches the rule, the user's browser is presented with a customizable block page that includes a button allowing them to bypass the block for a configurable time period (default 600 seconds). This is distinct from a hard Block, which silently drops traffic, and from Allow, which permits it outright.

Answer

The packet is dropped and logged without any user notification.

Answer

The connection is reset and the source IP is added to a block list permanently.

Answer

The traffic is allowed but inspected more closely.

Question 4

Which component in the 802.1X architecture is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (e.g., switch or wireless LAN controller) acts as a proxy, forwarding EAP messages between the supplicant (client) and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication Server

Answer

Policy Service Node

Question 5

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the external interface. The most likely issue is that the crypto map is not applied to the external interface. In IPsec VPN configuration, the crypto map must be applied to the interface that sends and receives encrypted traffic (typically the outside/public-facing interface). Without this application, the router does not know which traffic to protect or how to negotiate the IPsec tunnel, even if the tunnel is established (e.g., IKE Phase 1 completes). The tunnel may show as up due to successful ISAKMP negotiation, but no traffic will be encrypted because the crypto map's policy (including the access-list and transform set) is never enforced on the interface.

Answer

The transform set uses wrong encryption

Answer

The access-list is too permissive

Answer

The peer address is wrong

Question 6

A company uses multiple SaaS applications and wants to enforce data loss prevention (DLP) policies to prevent sensitive data from being shared externally. Which technology provides the ability to scan data in transit and at rest within these SaaS applications?

Accepted Answer

CASB. CASB solutions can inspect data in transit and at rest within SaaS applications to enforce DLP policies.

Answer

Cisco Umbrella

Answer

CSPM

Answer

CWPP

Question 7

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

Accepted Answer

UDP flood. UDP flood (A) is volumetric because it blasts the target with massive numbers of User Datagram Protocol packets, consuming bandwidth and processing resources without needing a handshake. DNS amplification (B) is volumetric because small spoofed DNS queries trigger large responses from open resolvers, multiplying traffic volume and saturating the victim's link. ICMP flood (D) is volumetric because it sends enormous volumes of ICMP Echo Request packets (e.g., ping floods) that fill the bandwidth pipe. HTTP GET flood (C) is an application-layer (Layer 7) attack that exhausts web server resources with seemingly legitimate requests rather than raw bandwidth. SYN flood (E) is a protocol/state-exhaustion attack that depletes TCP connection tables via half-open connections, not primarily a volumetric bandwidth flood.

Answer

HTTP GET flood

Answer

SYN flood

Question 8

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. The Modular Policy Framework on a Cisco ASA is built from three core building blocks: class-map, policy-map, and service-policy. Option C (Class-map) is correct because it defines the traffic classification criteria (for example, matching an ACL, a TCP/UDP port, or an inspection default class) that identifies which traffic the MPF will act upon. Option E (Policy-map) is correct because it binds actions to those classes, such as inspect, police, priority, or set connection parameters, thereby defining what happens to the matched traffic. Option A (Service-policy) is correct because it activates the policy-map by attaching it to an interface and direction (global, interface, or a specific direction), which is what actually enforces the MPF configuration on the ASA. Option B (Route-map) is not part of MPF; it is used for route redistribution and policy-based routing on routers, not for ASA traffic inspection. Option D (Access-list) is also not an MPF component by itself; although ACLs can be referenced inside a class-map to match traffic, the ACL is a separate matching tool and not one of the three MPF building blocks.

Answer

Route-map

Answer

Access-list

Question 9

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints was later determined to be malicious after execution. Which feature allows the administrator to see the file's propagation and impact on endpoints?

Accepted Answer

Device Trajectory. Device Trajectory is the correct answer because it provides a chronological timeline of a file's activity across all endpoints, showing its origin, propagation, and actions taken after execution. This feature is specifically designed to visualize the impact and spread of malicious files that were initially unknown but later determined to be malicious by Cisco AMP for Endpoints.

Answer

Exploit Prevention

Answer

Endpoint IOC Scanning

Answer

SHA-256 Disposition

Question 10

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Accepted Answer

show asp drop. The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

Answer

show access-list

Answer

show conn

Answer

show service-policy

Question 11

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

Question 12

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Option C, 'Never trust, always verify,' is a foundational zero-trust principle because zero-trust treats every access request as untrusted regardless of source, requiring continuous authentication and authorization of users, devices, and sessions before granting access to resources. Option E, 'Least privilege access,' is also core to zero-trust because it enforces just-enough-access (JEA) and just-in-time (JIT) permissions so identities receive only the minimum rights needed, limiting lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: A, 'Single perimeter defense,' reflects the traditional castle-and-moat model that zero-trust explicitly replaces with microsegmentation and identity-centric controls; B, 'Implicit trust for internal networks,' is the opposite of zero-trust, which assumes no implicit trust based on network location; and D, 'Trust but verify,' is a legacy governance phrase, not a zero-trust principle, since zero-trust starts from 'never trust' rather than granting trust first.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 13

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule matches on a literal content string ('malicious') within TCP traffic, which is the defining characteristic of signature-based detection. Snort rules that use the content keyword look for known byte patterns or strings associated with malicious traffic. This is a static pattern match, not a behavioral or statistical model.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 14

An FTD device is deployed in passive mode. Which statement about its traffic processing is true?

Accepted Answer

It receives traffic from a network tap or SPAN port and cannot block traffic.. An FTD device in passive mode receives a copy of traffic from a network tap or SPAN port rather than sitting inline in the traffic path. Because it is not inline, it cannot drop or reset packets; it can only analyze, alert, and log. Therefore, it cannot block malicious traffic, and statements claiming it can send TCP resets or apply Block actions are false.

Answer

It can block malicious traffic by sending TCP resets.

Answer

It operates as a transparent firewall with inline inspection.

Answer

It can use the 'Block' action in access control rules.

Question 15

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 16

During a security incident, an analyst needs to isolate a compromised endpoint and perform remote forensic analysis using Cisco AMP for Endpoints. Which capability allows the analyst to execute commands on the endpoint remotely?

Accepted Answer

Remote shell investigation. Remote shell investigation is the correct answer because Cisco AMP for Endpoints includes a feature that allows an analyst to establish a secure, encrypted shell session directly with the compromised endpoint. This enables the execution of arbitrary commands for live remote forensic analysis without requiring additional tools or manual intervention on the endpoint.

Answer

Device Trajectory

Answer

File quarantine

Answer

Process isolation

Question 17

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 18

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a cryptographic signature added to outgoing email headers, which the receiving server verifies against a public key published in DNS. This provides cryptographic authentication that the message was sent by the domain and was not altered in transit. The question specifically asks for a cryptographic signature, which is the defining characteristic of DKIM.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 19

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 20

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Answer

SHA-256 file disposition