350-701 Practice Exam 51 — 20 Questions

Question 1

A security team is evaluating Cisco Cloudlock to protect data in a sanctioned SaaS environment. They want to understand which capabilities Cisco Cloudlock provides for data security in cloud applications. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User and entity behavior analytics (UEBA) to detect anomalous cloud application activity. Cisco Cloudlock provides API-based data loss prevention for data at rest in sanctioned SaaS applications and user and entity behavior analytics to detect anomalous cloud activity. DNS-layer enforcement belongs to Umbrella, inline TLS decryption belongs to secure web gateway or SIG functions, and NAT is a networking function unrelated to Cloudlock's cloud access security broker capabilities.

Answer

Network address translation (NAT) for cloud workloads

Answer

DNS-layer security enforcement for roaming endpoints

Answer

Inline decryption and inspection of TLS traffic between users and SaaS applications

Question 2

A network security engineer is configuring Cisco Firepower NGFW to block access to a specific URL category. They want to ensure that the policy applies to both HTTP and HTTPS traffic without decrypting SSL. Which feature should they use?

Accepted Answer

URL Filtering with category-based rules. URL filtering with category-based rules on Cisco Firepower NGFW can block or allow traffic based on URL categories. For HTTPS traffic without decryption, the system uses the server name indication (SNI) to determine the category. This allows enforcement without SSL decryption. Other options like SSL decryption would require decryption, application filtering may not cover all URLs in a category, and DNS sinkholing is for threat blocking, not category-based control.

Answer

SSL decryption policy with category-based rules

Answer

Application filtering with application-based rules

Answer

DNS sinkholing with Umbrella integration

Question 3

A security administrator is configuring Cisco ESA to protect against inbound email that contains malicious attachments. The administrator wants to quarantine messages that contain files with macro-enabled Office extensions before they reach user mailboxes. Which Cisco ESA feature should be configured to meet this requirement?

Accepted Answer

Message filters with attachment file type conditions. Message filters are the Cisco ESA mechanism that inspects message attributes such as attachment file type and applies actions like quarantine. Because the requirement is to quarantine inbound messages based on macro-enabled Office extensions, a message filter with an attachment file type condition and a quarantine action is the correct control. Other features address sender reputation, outbreak intelligence, or domain authentication rather than deterministic attachment-type enforcement.

Answer

SenderBase reputation filtering (SBRS)

Answer

Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification

Answer

Outbreak Filters with outbreak quarantine

Question 4

A cloud operations team is deploying a multi-tier application in Microsoft Azure. The security team wants to ensure that only HTTP and HTTPS traffic from the internet can reach the web tier, while the database tier should accept connections only from the web tier. They also want to log allowed and denied flows for auditing. Which Azure feature should they configure to meet these requirements?

Accepted Answer

Azure Network Security Group (NSG). Network security groups are the correct Azure feature because they provide stateful allow/deny rules at the subnet or NIC level, support service tags and source restrictions, and can generate NSG flow logs for auditing. Azure Firewall is a broader managed firewall, ASGs are grouping constructs used inside NSG rules, and DDoS Protection Standard mitigates attacks rather than segmenting application tiers.

Answer

Azure Application Security Group (ASG)

Answer

Azure DDoS Protection Standard

Answer

Azure Firewall

Question 5

A network security engineer is configuring TrustSec on Cisco Catalyst switches. The engineer wants to enforce a policy where traffic from the 'Engineering' Security Group (SGT 10) to the 'Finance' Security Group (SGT 20) is denied, while all other inter-group traffic is permitted. The engineer has already configured SGTs and SGACLs on Cisco ISE and downloaded them to the switches. Which additional step is required on the switches to enforce this policy?

Accepted Answer

Enable SGACL enforcement on the switch by configuring 'cts role-based enforcement' globally and on the VLANs.. TrustSec enforcement requires enabling role-based enforcement on the switches, both globally and on the relevant VLANs or interfaces. Even if SGTs and SGACLs are correctly configured on ISE and downloaded, without this step the switch will not apply the SGACLs to traffic. The other options are either authentication mechanisms or visibility features that do not directly enforce the group-based policy.

Answer

Enable IP Device Tracking on all access ports to detect endpoint IP addresses for SGT mapping.

Answer

Configure 802.1X on all access ports to authenticate users and assign SGTs dynamically.

Answer

Configure the switch to use Cisco ISE as the RADIUS server for authentication and authorization.

Question 6

A security operations team at a hospital is using Cisco Secure Endpoint (formerly AMP for Endpoints) to protect clinical workstations. The team must ensure that when a clinician opens a document from a USB drive, the file is checked against Cisco Talos threat intelligence before it is allowed to execute, and that the check happens locally on the endpoint without sending the full file to the cloud. Which Cisco Secure Endpoint engine component performs this on-endpoint lookup using a cached copy of the Talos reputation database?

Accepted Answer

The Ethos engine. The Ethos engine is the local file-reputation component of the Cisco Secure Endpoint connector. It maintains a cached copy of the Talos reputation database and can render a verdict on a file without uploading the full file to the cloud, which matches the requirement for an on-endpoint check of a document opened from a USB drive.

Answer

The Exploit Prevention engine

Answer

The ClamAV engine

Answer

The Tetragon engine

Question 7

A security analyst is investigating a ransomware outbreak on several endpoints protected by Cisco Secure Endpoint. The analyst wants to identify the initial infection vector and the subsequent command-and-control (C2) domains contacted. Which Secure Endpoint console feature provides a unified timeline of file, network, and process events for a specific endpoint?

Accepted Answer

Device Trajectory. Device Trajectory is purpose-built to show the chronological sequence of events on an endpoint, including file executions, network connections, and process activities. This makes it the correct tool for tracing a ransomware infection's root cause and C2 communications. Other features lack the unified timeline or focus on different data sets.

Answer

Orbital Query

Answer

Advanced Search

Answer

File Analysis Report

Question 8

A network security team is deploying Cisco Secure Web Appliance to enforce acceptable use and malware protection for outbound web traffic. They need to integrate the appliance with the existing Cisco identity infrastructure so that policies can be applied per user rather than per IP address. Which two authentication mechanisms should they configure on the WSA to achieve user-based policy enforcement? (Choose two.)

Accepted Answer

Kerberos authentication with transparent user identification. Per-user policy enforcement on Cisco Secure Web Appliance requires the appliance to know the identity of the user making each web request. LDAP authentication against Active Directory and Kerberos transparent identification both provide that identity. SNMPv3, TACACS+, and RADIUS serve monitoring, device administration, or network access functions and do not supply web user identity to the WSA policy engine.

Answer

RADIUS authentication for wireless client onboarding

Answer

SNMPv3 authentication to correlate user sessions with network devices

Answer

TACACS+ authentication for administrative access to the WSA CLI

Question 9

A financial services firm uses Cisco Secure Endpoint and Cisco SecureX. An analyst receives an alert that a spreadsheet opened on an accounting workstation spawned a command shell that attempted to reach an external IP address. The analyst wants to see, in a single view, the file trajectory of the spreadsheet, the process lineage on the endpoint, and any related threat intelligence from Talos. Which Cisco Secure Endpoint capability provides this correlated, single-pane investigative view?

Accepted Answer

SecureX threat response. SecureX threat response is the Cisco platform capability that correlates endpoint telemetry, including file trajectory and process lineage from Secure Endpoint, with Talos threat intelligence and other sources in a single investigative interface. This gives the analyst the unified view needed to investigate the spreadsheet-triggered command shell activity.

Answer

File trajectory

Answer

Endpoint Isolation

Answer

Device trajectory

Question 10

A security administrator is configuring Cisco WSA to scan outbound uploads for data loss prevention. They want to ensure that files containing credit card numbers are blocked when uploaded to any website. Which WSA feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policies with custom identifiers. To block outbound uploads containing credit card numbers, the administrator must configure DLP policies on Cisco WSA. DLP policies inspect content for patterns like credit card numbers and can block or quarantine the transaction. Acceptable Use Controls and Anti-Malware do not inspect for sensitive data, and HTTPS decryption is only an enabler for inspection, not the blocking mechanism itself.

Answer

Anti-Malware scanning with file reputation

Answer

Acceptable Use Controls with URL categories

Answer

HTTPS decryption policy for outbound traffic

Question 11

A security administrator is configuring a Cisco Secure Email Gateway (formerly ESA) to detect and block outbound messages containing customer credit card numbers. The compliance team requires that messages be quarantined when a valid card number pattern is found, and that the detection engine ignore common false-positive patterns such as sequential digits. Which feature should the administrator configure to meet these requirements?

Accepted Answer

Data Loss Prevention (DLP) policies with custom classifiers. DLP policies in Cisco Secure Email Gateway are purpose-built to inspect message content for sensitive data patterns such as credit card numbers. They include predefined classifiers and allow custom classifiers, enabling the administrator to detect valid card numbers while excluding common false positives like sequential digits. Applying a quarantine action to matching messages fulfills the compliance requirement without relying on brittle literal-string dictionaries or unrelated authentication and anti-malware features.

Answer

Outbreak Filters with outbreak quarantine

Answer

Sender Policy Framework (SPF) verification

Answer

Message filters configured with content dictionaries

Question 12

A security engineer is deploying Cisco TrustSec in a large enterprise. The engineer wants to assign Security Group Tags (SGTs) to endpoints based on user identity and device type, and enforce policies across multiple network devices without using VLANs or ACLs on every device. Which component is responsible for propagating the SGT information to network enforcement devices?

Accepted Answer

Security Group Exchange Protocol (SXP). SXP is specifically designed to propagate IP-to-SGT mappings from devices that have the mapping (like access switches that receive it from ISE) to other devices that need to enforce TrustSec policies but lack direct ISE integration or inline tagging capability. It allows for gradual deployment and interoperability with non-TrustSec hardware. The other options either assign SGTs (ISE), provide context sharing (pxGrid), or are a transport mechanism (inline tagging), but none are the dedicated propagation protocol for SGT mappings.

Answer

Cisco TrustSec inline tagging

Answer

Cisco ISE as the SGT Assignment Authority

Answer

Cisco Platform Exchange Grid (pxGrid)

Question 13

A security operations team wants to automatically contain a compromised endpoint by blocking all network communication except for the Cisco Secure Endpoint cloud and the management console. The team is using Cisco Secure Endpoint (formerly AMP for Endpoints) and needs to enforce this containment without relying on network segmentation. Which feature should they use to achieve this?

Accepted Answer

Network isolation via the Secure Endpoint console. Cisco Secure Endpoint's network isolation capability is designed to contain compromised endpoints by blocking all network communication except for the Secure Endpoint cloud and management console. This allows incident responders to investigate and remediate the threat remotely without the risk of lateral movement. The other options are network-based controls that do not provide the same level of endpoint-centric containment and management exceptions.

Answer

Cisco TrustSec Security Group Tagging (SGT) to deny traffic

Answer

802.1X dynamic VLAN assignment to a quarantine VLAN

Answer

Host-based firewall policy blocking all inbound and outbound traffic

Question 14

A company has deployed Cisco Secure Firewall (Firepower) with SSL decryption to inspect outbound HTTPS traffic. Users report that some banking websites fail to load and show certificate errors after decryption is enabled. The security team wants to allow these sites without decryption while still inspecting other HTTPS traffic. Which action should be taken on the Secure Firewall to resolve this?

Accepted Answer

Add the banking sites to the SSL policy's Do Not Decrypt list using URL categories.. The SSL policy on Cisco Secure Firewall includes Do Not Decrypt rules that can match on URL category, reputation, or other criteria. By placing the banking sites in a Do Not Decrypt rule, the firewall passes their traffic without interception, eliminating certificate errors. Other HTTPS traffic continues to be decrypted and inspected, preserving security visibility.

Answer

Enable certificate pinning exceptions in the SSL policy.

Answer

Create a custom URL category for the banking sites and apply a block action.

Answer

Disable SSL decryption globally on the Secure Firewall.

Question 15

A security analyst is investigating a suspicious file that was executed on an endpoint protected by Cisco Secure Endpoint. The analyst wants to determine the file's lineage and all processes it spawned. Which Cisco Secure Endpoint feature provides this information?

Accepted Answer

File trajectory. File trajectory in Cisco Secure Endpoint provides a detailed view of a file's execution history, including its origin, the endpoints it touched, and the processes it spawned. This is essential for understanding the scope of an infection and the file's lineage. Device trajectory, vulnerability correlation, and IoC management serve different purposes and do not offer the specific lineage and process relationship view required.

Answer

Indicators of compromise (IoC) management

Answer

Vulnerability correlation

Answer

Device trajectory

Question 16

A retail company is deploying Cisco Secure Endpoint on point-of-sale terminals running Windows 10. The security team wants the connector to automatically terminate a malicious process and quarantine the associated file when a high-severity detection occurs, without requiring an analyst to take action. Which policy configuration in Cisco Secure Endpoint accomplishes this?

Accepted Answer

Enable the Quarantine action for the relevant engine and set the policy to Protect mode.. Setting the relevant engine to Protect mode with the Quarantine action enabled makes the Cisco Secure Endpoint connector automatically block, quarantine, and terminate malicious activity upon detection. This is the standard policy configuration for hands-off containment, which matches the requirement to protect point-of-sale terminals without analyst intervention.

Answer

Set the engine mode to Audit for all engines.

Answer

Configure a scheduled scan to run every hour.

Answer

Enable Endpoint Isolation for all point-of-sale terminals.

Question 17

A security engineer is deploying Cisco Secure Network Analytics (formerly Stealthwatch) to detect anomalous traffic that may indicate data exfiltration. The engineer needs to configure the system to monitor internal-to-external traffic and generate alarms for suspicious flows. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Define inside and outside networks in the Secure Network Analytics configuration.. To detect anomalous internal-to-external traffic, Secure Network Analytics requires flow data (NetFlow, IPFIX, etc.) exported from network devices, and the definition of inside and outside networks to establish traffic direction and baselines. These two actions enable the system to monitor flows and generate alarms for suspicious activity. Other options are either not required or address different security functions.

Answer

Deploy a Cisco Umbrella virtual appliance for DNS security.

Answer

Configure SNMP traps on all network devices to send alerts to the Secure Network Analytics Manager.

Answer

Enable application visibility and control on the firewalls.

Question 18

A security engineer is configuring Cisco ISE to enforce endpoint posture compliance. The engineer wants to ensure that endpoints without the latest antivirus definitions are denied network access and placed in a remediation VLAN. After configuring the posture policy, the engineer notices that some non-compliant endpoints are still granted full access. The engineer verifies that the posture policy conditions are correct and that the endpoints are being profiled correctly. Which action should the engineer take to resolve this issue?

Accepted Answer

Verify that the posture policy is assigned to the correct authorization policy and that the authorization result for non-compliance is set to the remediation VLAN.. The authorization policy is responsible for enforcing the outcome of posture assessment. Even if posture policies correctly identify non-compliance, the authorization policy must have a rule that matches the non-compliant posture status and assigns the remediation VLAN. Without this, endpoints will fall through to a default permit rule. Therefore, verifying the authorization policy configuration is the correct action.

Answer

Ensure that the endpoint's supplicant is configured to send the posture assessment to ISE and that the posture agent is installed.

Answer

Check that the remediation VLAN is configured on the switch and that the switch port is set to access mode.

Answer

Restart the Cisco ISE posture service to ensure that posture policies are applied correctly.

Question 19

A security administrator is deploying Cisco Secure Endpoint (AMP for Endpoints) connectors on a fleet of Windows servers. The administrator wants to ensure that the connectors automatically receive the latest policy updates and threat intelligence from the cloud without manual intervention. Which component of the Cisco Secure Endpoint architecture is responsible for this automatic synchronization?

Accepted Answer

The Cisco Secure Endpoint cloud console. The Cisco Secure Endpoint cloud console is the authoritative source for policies and threat intelligence. Connectors are designed to regularly check in with the cloud to download any policy changes and updated detection data. This automatic process ensures endpoints remain current without manual intervention. Other components like Threat Grid, FMC, and ISE serve different roles and do not perform this synchronization.

Answer

The Cisco Firepower Management Center

Answer

The Cisco Identity Services Engine

Answer

The Cisco Threat Grid appliance

Question 20

A security operations center is using Cisco Firepower Management Center (FMC) to manage a Firepower NGFW. They want to block outbound traffic that matches known malware command-and-control (C2) domains and IP addresses. The analyst wants to ensure the blocklist is automatically updated from Cisco Talos intelligence. Which feature should be configured on the FMC?

Accepted Answer

Security Intelligence with DNS and IP blocklists sourced from Talos. Cisco Firepower's Security Intelligence feature leverages Talos feeds to dynamically block traffic to known malicious domains and IPs. By configuring DNS and IP blocklists with Talos as the source, the FMC automatically updates the blocklist, ensuring protection against current C2 infrastructure. This is the most efficient and accurate method for the scenario.

Answer

SSL Decryption policy with certificate pinning

Answer

Intrusion Prevention System (IPS) with custom signatures

Answer

Access Control Policy with manual IP blocklist entries