350-701 Practice Exam 51 — 20 Questions

Question 1

An organization wants to implement multi-factor authentication (MFA) for VPN access using Cisco AnyConnect and Duo. Which TWO authentication factors can Duo provide? (Choose two.)

Accepted Answer

TOTP. Duo provides TOTP (Time-based One-Time Password) as an authentication factor by generating a temporary six-digit code based on RFC 6238, which the user enters during the AnyConnect VPN login process. Push notification is another Duo factor, where a request is sent to the user's registered mobile device, and the user approves or denies the login attempt via the Duo Mobile app. Both factors satisfy the requirement for multi-factor authentication by adding a second layer beyond the primary password.

Answer

LDAP

Answer

802.1X

Answer

RADIUS

Question 2

Which THREE of the following are required for a successful 802.1X authentication on a Cisco switch? (Choose THREE)

Accepted Answer

The switch must be configured as a RADIUS client to ISE. For 802.1X authentication, the switch must act as a RADIUS client (authenticator) forwarding EAP frames to the ISE (authentication server). Without this configuration, the switch cannot communicate with ISE to validate the endpoint's credentials, making it a mandatory requirement.

Answer

Security Group Tag (SGT) must be assigned

Answer

A downloadable ACL (dACL) must be configured on ISE

Question 3

Refer to the exhibit. This JSON policy is part of a Cisco Cloudlock DLP configuration. What will happen when a user attempts to upload a file containing the word 'secret' to a cloud storage service?

Accepted Answer

The file upload is blocked if the content contains the word 'secret'. The JSON policy shown in the exhibit is a Cisco Cloudlock DLP policy that uses a data pattern to match the word 'secret' in file content. The action specified is 'block', which means when a user attempts to upload a file containing 'secret' to a cloud storage service, the upload is blocked and an alert is generated. Option B correctly identifies that the file upload is blocked if the content contains the word 'secret', aligning with the policy's enforcement action.

Answer

An alert is generated but the file is not blocked

Answer

Only files with 'secret' in the title are blocked

Answer

All files are blocked regardless of content

Question 4

Which TWO of the following are common causes of email delivery delays in Cisco Email Security Appliance (ESA)? (Select exactly two.)

Accepted Answer

High volume of email in the delivery queue. A high volume of email in the delivery queue indicates that the ESA is experiencing a backlog of messages awaiting delivery. This can occur due to rate limiting, transient delivery failures, or a large number of messages being processed simultaneously, which directly causes delays in email delivery as the queue must be drained sequentially.

Answer

Too many recipients in a single message

Answer

Incorrect MX record for the destination domain

Answer

Improper SPF record on the sender's domain

Question 5

A company wants to implement software-defined segmentation using Cisco ISE and TrustSec. Which component is responsible for assigning the Security Group Tag (SGT) to packets at the ingress?

Accepted Answer

Cisco Catalyst switch with CTS. The Cisco Catalyst switch with Cisco TrustSec (CTS) is responsible for assigning the Security Group Tag (SGT) to packets at the ingress. When a packet enters the network, the switch performs a lookup based on the source identity (e.g., IP address, user, or device) against the SGT mapping received from Cisco ISE, and then tags the packet with the appropriate SGT using the SGT header (Cisco proprietary, often carried in the MACsec or VXLAN header). This inline tagging at the ingress switch is the core mechanism of software-defined segmentation in TrustSec.

Answer

Endpoint with posture agent

Answer

Firewall with IPS capability

Answer

Cisco ISE Policy Service Node

Question 6

A company is using Cisco ISE for guest access. They have configured a guest portal with a self-registration page. Some guests report that after registering, they are not redirected to the success page but instead see a '401 Unauthorized' error. What is the most likely cause?

Accepted Answer

The central web authentication (CWA) is not enabled on the switch.. Central web authentication (CWA) must be enabled on the switch to redirect HTTP traffic from unauthenticated guests to the ISE portal. If CWA is not enabled, the switch will not redirect the traffic, resulting in a 401 Unauthorized error after registration. Option A is incorrect because HTTP redirect is configured on the ISE portal itself, not the ISE node, and is not the cause of a 401 error. Option B is incorrect because an untrusted portal certificate would cause a browser security warning, not a 401 error. Option D is incorrect because a missing authorization policy would typically result in an 'Access Denied' message after authentication, not a 401 during the registration redirect.

Answer

The ISE node is not configured for HTTP redirect.

Answer

The guest portal certificate is not trusted by the client.

Answer

The authorization policy for guests is missing.

Question 7

A network administrator is troubleshooting why users in the marketing department cannot access a specific cloud storage site through the Cisco WSA. The access policy for marketing is set to 'Monitor' for the File Sharing category, but the site is blocked. What is the most likely reason?

Accepted Answer

A more specific identity or policy is applying a block action.. Cisco WSA applies policies in a hierarchical order, and a more specific identity or policy (e.g., one based on user group, subnet, or time range) can override a broader policy set to 'Monitor'. Even though the marketing department's access policy is configured to monitor the File Sharing category, a more granular rule may explicitly block the cloud storage site, causing the unexpected block.

Answer

Web reputation threshold is set to block the site.

Answer

The site is mis-categorized as an unknown URL.

Answer

URL filtering is disabled for that policy.

Question 8

An engineer is designing a cloud security solution using Cisco SD-WAN with cloud on-ramp. They want to ensure that traffic to a specific IaaS provider is inspected by the Cisco Umbrella SIG. Which configuration is necessary on the SD-WAN edge?

Accepted Answer

Configure a service insertion policy for the cloud security provider. To direct specific traffic to Cisco Umbrella SIG for cloud security inspection, you must configure a service insertion policy on the SD-WAN edge. This policy intercepts traffic based on match criteria (e.g., destination IaaS provider IP/subnet) and forwards it to the cloud security service via a secure tunnel (e.g., IPsec or TLS). Without this policy, the SD-WAN edge will not redirect traffic to Umbrella for inspection.

Answer

Apply a DNS security policy

Answer

Set up a site-to-site VPN to the IaaS

Answer

Enable direct internet access for the branch

Question 9

A network administrator is configuring site-to-site VPN between two Cisco ASA firewalls using IKEv2. The administrator wants to ensure that the VPN tunnel uses the most secure encryption algorithm available. Which encryption algorithm should be selected in the IKEv2 proposal?

Accepted Answer

AES-256. AES-256 provides the highest security among the options. DES and 3DES are weak and deprecated, while AES-128 is less secure than AES-256.

Answer

AES-128

Answer

DES

Answer

3DES

Question 10

A financial institution with a flat Layer 2 network has experienced a ransomware incident where an infected workstation in the accounting department propagated laterally to a server in the finance department. The network spans 10 switches connected in a star topology with a collapsed core. The IT team wants to implement segmentation to contain such threats in the future, without requiring major hardware upgrades and with minimal change to IP addressing. The network currently uses a single VLAN with /16 subnet. Which of the following approaches would BEST achieve the segmentation goal, considering the constraints?

Accepted Answer

Implement internal firewall zones using a next-generation firewall (NGFW) with application inspection and user identity. Implementing internal firewall zones with a next-generation firewall (NGFW) provides granular, stateful inspection and application-level segmentation. It can filter traffic between departments without changing IP addressing and leverages existing switch infrastructure. VLANs with ACLs on the core router are stateless and can be bypassed; also they require reconfiguring IP addressing if VLANs are separate subnets, and ACLs on a core router do not provide the depth of inspection needed. Deploying a VPN for all internal traffic is not scalable and adds latency. Using STP and PVLANs on switches can provide some isolation but does not prevent lateral movement at higher layers and is complex to manage across multiple switches without a fabric. Option C is the most effective given the constraints.

Answer

Use Spanning Tree Protocol with Private VLANs on all switches

Answer

Deploy a full-mesh VPN between all departments to encrypt and restrict traffic

Answer

Deploy VLANs for each department and apply ACLs on the core router to restrict inter-VLAN traffic

Question 11

Refer to the exhibit. Enter the command output from a Cisco Umbrella deployment. An administrator observes that 25 DNS queries were blocked. What does this indicate?

Accepted Answer

Policy enforcement blocking malicious or unwanted domains. The command output from a Cisco Umbrella deployment shows that 25 DNS queries were blocked. In Umbrella, DNS queries are blocked due to policy enforcement, typically when the domain being queried matches a security category (e.g., malware, phishing, command-and-control) or a custom block list. This indicates that Umbrella's cloud-delivered security policy actively prevented resolution of those 25 domains, protecting the network from malicious or unwanted content.

Answer

Successful DNS resolution for those queries

Answer

Internal DNS resolution failures

Answer

Network congestion causing queries to timeout

Question 12

Refer to the exhibit. An engineer has configured the ACL on the GigabitEthernet0/0 interface. Which of the following is true about the effect of this ACL?

Accepted Answer

It blocks traffic sourced from 10.0.0.0/8 entering G0/0, but allows other traffic.. The ACL is applied inbound on GigabitEthernet0/0 with a single deny statement for source IP 10.0.0.0/8. Since ACLs have an implicit deny any at the end, traffic from the 10.0.0.0/8 range is blocked, but all other IP traffic is implicitly permitted because the explicit deny only matches that source range. This makes option B correct.

Answer

It blocks all IP traffic from entering G0/0 because of the deny statement.

Answer

It permits all traffic because the ACL is misconfigured.

Answer

It blocks traffic destined to 10.0.0.0/8 entering G0/0, but allows other traffic.

Question 13

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 14

A company is deploying Cisco Web Security Appliance (WSA) to enforce acceptable use policies. Users report that some legitimate websites are being blocked incorrectly. The security team wants to allow these sites while still blocking known malware sites. Which action should the administrator take?

Accepted Answer

Create a custom URL filtering policy to allow the specific URLs.. The Cisco WSA uses URL filtering policies to control access based on URL categories and individual URLs. By creating a custom URL filtering policy that allows the specific URLs, the administrator can whitelist legitimate sites while the WSA continues to block known malware sites through its reputation-based and category-based filtering. This approach maintains security enforcement without disabling broader protections.

Answer

Disable HTTPS decryption to bypass filtering for encrypted sites.

Answer

Enable Data Loss Prevention (DLP) to allow the sites.

Answer

Increase the HTTPS decryption depth to inspect more content.

Question 15

A Cisco ASA is configured with a modular policy framework to inspect HTTP traffic. The class-map matches HTTP traffic, and the policy-map applies inspection. Which command correctly applies the policy to an interface?

Accepted Answer

service-policy policy-map-name interface inside. The service-policy command applies a policy-map to an interface or globally. The syntax is: service-policy policy-map-name {global | interface interface-name}.

Answer

service-policy inspect http interface inside

Answer

policy-map service-policy inside

Answer

apply service-policy policy-map-name inside

Question 16

An organization uses AWS with a VPC and wants to inspect all traffic between instances in the same subnet using Cisco Firepower. What must be implemented?

Accepted Answer

AWS Traffic Mirroring to send traffic to a Firepower appliance. AWS Traffic Mirroring captures and forwards network traffic from Elastic Network Interfaces (ENIs) to a security appliance, such as a Cisco Firepower instance, for inspection. This allows the organization to monitor all traffic between instances within the same subnet without requiring changes to the routing table or placing the Firepower inline, which is not possible in a VPC without a gateway appliance. Option B is correct because Traffic Mirroring is the native AWS feature designed for out-of-band traffic inspection.

Answer

Configure VPC Endpoints to route traffic through Firepower

Answer

Use AWS Security Groups and log to Firepower

Answer

Deploy Firepower as a transparent bridge in the subnet

Question 17

A cloud operations team reports that after enabling Cisco Secure Cloud Analytics (CSCA) for an AWS account, some legitimate traffic is being flagged as suspicious. The team has fine-tuned the ML models but false positives persist. Which additional step should they take?

Accepted Answer

Customize alert rules based on known good behavior. C is correct because Cisco Secure Cloud Analytics (CSCA) uses machine learning to establish a baseline of normal traffic behavior. When false positives persist despite fine-tuning ML models, the next logical step is to customize alert rules to explicitly whitelist known good behavior, such as trusted IP ranges or specific application flows. This reduces noise without disabling detection or lowering sensitivity, and it directly addresses the root cause: legitimate traffic that deviates from the baseline but is actually benign.

Answer

Disable ML-based detection

Answer

Increase the severity threshold

Answer

Deploy additional sensors in VPC subnets

Question 18

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

Accepted Answer

Use the 'capture' command with trace option to see packet flow and drop reason.. The 'capture' command with the 'trace' option on Cisco FTD provides a detailed, packet-level analysis of how traffic is processed through the firewall pipeline. It shows each step (e.g., ingress, routing, access control, NAT, egress) and explicitly states the drop reason, such as 'action-drop' due to intrusion prevention, URL filtering, or security intelligence, even when the access control policy appears to allow the traffic. This is the only option that directly identifies the specific cause of a drop in the data path.

Answer

Check the 'show access-list' output for the hit count.

Answer

Check the 'show route' output for routing issues.

Answer

Check the 'show conn' output for the connection state.

Question 19

A network administrator is configuring Cisco Firepower Threat Defense (FTD) in routed mode to provide intrusion prevention (IPS) for internal traffic. They create an access control rule that allows traffic from the internal network (10.0.0.0/8) to the internet, and they attach an intrusion policy to this rule. After deploying the configuration, they generate known malicious traffic from a test host and observe that no alerts are triggered in the Firepower Management Center (FMC). The administrator checks the FTD and confirms that the Snort process is running, and the rule is at the top of the access control policy with action 'Allow'. What is the most likely cause of this issue?

Accepted Answer

The access control rule action is set to 'Allow' rather than 'Allow with Intrusion Prevention'.. In Cisco Firepower Threat Defense (FTD), an access control rule with action 'Allow' permits traffic without sending it to the Snort intrusion inspection engine. To enable IPS, the rule action must be 'Allow with Intrusion Prevention', which explicitly invokes the intrusion policy. Since the rule was set to 'Allow', the malicious traffic bypassed Snort inspection entirely, so no alerts were generated.

Answer

The FTD is configured in transparent mode.

Answer

The traffic is being fast-pathed and bypassing the Snort engine.

Answer

The intrusion policy is not associated with the correct preprocessor.

Question 20

An organization uses Cisco Umbrella to secure remote users. The security team wants to ensure that all DNS queries from endpoints are forwarded to Umbrella even when users are off the corporate network. Which deployment method achieves this?

Accepted Answer

Deploy the Cisco Umbrella Roaming Client on endpoints. The Cisco Umbrella Roaming Client is specifically designed to enforce DNS security on endpoints regardless of their network location. It installs a local DNS forwarder that intercepts all DNS queries and sends them to Umbrella's cloud resolvers, ensuring protection even when users are off the corporate network. This method does not rely on network-level configurations that are ineffective for remote users.

Answer

Configure a network-based proxy

Answer

Use a PAC file to redirect traffic

Answer

Use BGP injection to advertise Umbrella IPs