350-701 Practice Exam 52 — 20 Questions

Question 1

Which TWO benefits does the Cisco ESA provide for email security? (Choose two.)

Accepted Answer

Email encryption and data loss prevention. The Cisco Email Security Appliance (ESA) includes integrated email encryption capabilities via Cisco Registered Envelope Service (CRES) or PGP/SMIME, and it provides Data Loss Prevention (DLP) through pre-defined or custom DLP policies that scan outbound emails for sensitive data patterns such as credit card numbers or PII. These features are core to the ESA's content security functionality.

Answer

DNS-layer security

Answer

Network firewall functionality

Answer

Web content filtering

Question 2

Refer to the exhibit. A Cisco ASA firewall is deployed in a cloud environment. After applying this ACL to an interface, users report that they cannot access cloud instances from on-premises. What is the most likely cause?

Accepted Answer

The ACL blocks all RFC 1918 private addresses, which may include the cloud VPC CIDR. The ACL shown in the exhibit (which is not provided but implied by the question) blocks RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Cloud VPCs commonly use these private IP ranges for their instances. If the cloud VPC CIDR falls within an RFC 1918 range, the ACL will deny traffic to those cloud instances, preventing on-premises users from accessing them.

Answer

The ACL allows all traffic but users need NAT

Answer

The ACL is applied to the wrong interface

Answer

The ACL permits only private addresses

Question 3

Which TWO are valid considerations for deploying Cisco Firepower NGIPS with inline mode? (Choose two.)

Accepted Answer

Inline interfaces can drop malicious packets based on signatures and anomalies.. Inline mode in Cisco Firepower NGIPS allows the system to actively drop malicious packets based on signature matches and anomaly detection. Unlike passive monitoring, inline interfaces sit directly in the traffic path, enabling the IPS engine to enforce blocking actions in real time.

Answer

Inline mode automatically decrypts SSL traffic without configuration.

Answer

The IPS engine inspects all traffic regardless of prefilter policies.

Answer

Inline mode requires the use of passive interfaces for failover.

Question 4

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

Accepted Answer

Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.. It uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.

Answer

Create an ACL that permits all inbound and outbound traffic between DMZ and internet.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.

Question 5

A network administrator is configuring Cisco ISE to authenticate devices that do not support 802.1X supplicant software. Which authentication method should be used for these non-supplicant devices?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) uses the device's MAC address for authentication, allowing non-supplicant devices to gain network access.

Answer

PEAP-MSCHAPv2

Answer

EAP-TLS

Answer

EAP-FAST

Question 6

A company uses Microsoft Azure and has deployed Cisco CloudCenter for workload lifecycle management. They also use Cisco Firepower NGFW in Azure. A security analyst notices that the Firepower logs show outbound connections from a workload to an IP address in a known threat feed. The workload is a Linux server that runs a custom application. The analyst checks Azure Network Security Groups (NSGs) and finds that outbound traffic is not restricted. The company's policy requires that all outbound traffic be inspected and logged. The analyst wants to block the specific IP while allowing other outbound traffic. Which action should be taken?

Accepted Answer

Create a Firepower Access Control policy rule to block traffic to the threat IP and log it.. Cisco Firepower NGFW is the inline security enforcement point in this Azure deployment, and it can inspect and log all outbound traffic. Creating a Firepower Access Control policy rule to block the specific threat IP and log it directly enforces the security policy at the firewall layer, which is the only device capable of deep packet inspection and logging as required by company policy. NSGs operate at Layer 3/4 and cannot inspect application-layer traffic or integrate with threat feeds for granular IP blocking without affecting other traffic.

Answer

Configure the NSG to deny all outbound traffic and then add allow rules for known good destinations.

Answer

Add a network security group rule to block the specific IP address.

Answer

Modify the route table to send all outbound traffic through a firewall, bypassing the NSG.

Question 7

Which TWO of the following are valid methods for deploying Cisco Web Security Appliance in a network? (Choose two.)

Accepted Answer

Explicit proxy mode. Explicit proxy mode requires clients to be manually configured to send web traffic directly to the WSA's IP address and port (typically 3128 or 8080). This gives the administrator granular control over which devices use the proxy and allows for authentication at the proxy layer, making it a valid deployment method for the Cisco Web Security Appliance.

Answer

VPN concentrator mode

Answer

DNS proxy mode

Answer

Bridge mode

Question 8

Which TWO of the following are valid detection methods used by Cisco AMP for Endpoints to identify malicious activity?

Accepted Answer

Exploit Prevention using vulnerability-based rules. Cisco AMP for Endpoints includes Exploit Prevention, which uses vulnerability-based rules to detect and block exploit attempts targeting specific software vulnerabilities. These rules are tailored to the exploit technique rather than the malware file itself, allowing protection against zero-day exploits that leverage known vulnerabilities.

Answer

Heuristic analysis of unknown files

Answer

Anomaly-based behavioral detection

Answer

Signature-based IPS scanning

Question 9

Which TWO of the following are correct about Cisco Umbrella's multi-layered security approach? (Choose two.)

Accepted Answer

DNS-layer security. DNS-layer security is a core component of Cisco Umbrella's multi-layered approach. It blocks requests to malicious domains at the earliest stage of the connection, before any IP address resolution occurs, by inspecting DNS queries against threat intelligence feeds. This prevents users from reaching known phishing, malware, or command-and-control (C2) domains.

Answer

Firewall as a Service

Answer

IP reputation filtering

Answer

Sandboxing for malicious file analysis

Question 10

A security engineer is configuring Cisco WSA to block access to a new social media site that is not in any predefined URL category. Which action should the engineer take to ensure the site is blocked for all users?

Accepted Answer

Create a custom URL category with the site and apply a block action in the access policy.. Cisco WSA allows administrators to create custom URL categories for sites not covered by predefined categories. By adding the URL to a custom category and applying a block action in the access policy, the engineer ensures the site is blocked for all users, as access policies evaluate custom categories before predefined ones.

Answer

Disable the URL filtering engine and use only web reputation.

Answer

Add the URL to the existing Social Networking category.

Answer

Enable Dynamic Content Analysis to detect and block the site.

Question 11

A security analyst notices that a file previously marked as 'clean' on an endpoint was later determined to be malicious. Using Cisco Secure Endpoint, which feature allows the analyst to see the propagation of that file across the system and understand its impact?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco Secure Endpoint provides a timeline of events showing file propagation and system changes, enabling retrospective analysis.

Answer

IOC scanning

Answer

SHA-256 disposition

Answer

Exploit Prevention

Question 12

A security team wants to enforce application whitelisting on endpoints to prevent unauthorized software execution. Which Cisco AMP for Endpoints feature can be used to implement this control?

Accepted Answer

Application whitelisting (via AMP policy). Application whitelisting is an endpoint hardening technique that can be enforced using Cisco AMP's advanced policies, including file and application control.

Answer

IOC scanning

Answer

Exploit Prevention

Answer

Device Trajectory

Question 13

Refer to the exhibit. A network administrator reviews the ISE live log for a successful 802.1X authentication. After authentication, the user is unable to make VoIP calls. What is the most likely cause?

Accepted Answer

The authorization profile does not include a voice VLAN.. The authorization profile applied to the user does not include a voice VLAN assignment, which is required for VoIP traffic. Even though the RADIUS attribute 'device-traffic-class=voice' is present, this only marks the traffic for QoS and does not assign a VLAN. Without a voice VLAN configured in the authorization profile, the phone cannot obtain the necessary VLAN for voice services. Option A is incorrect because whether the phone is configured for 802.1X is irrelevant; the issue is about VLAN assignment. Option B is incorrect because the RADIUS attribute 'device-traffic-class=voice' is correctly formatted for QoS marking, not for VLAN assignment. Option C is incorrect because multi-domain mode is used for scenarios with a phone behind a PC, but here the user's phone is authenticating directly and the problem is the lack of voice VLAN in the authorization profile.

Answer

The user's phone is not configured for 802.1X.

Answer

The RADIUS attribute 'device-traffic-class=voice' is incorrect.

Answer

The switch port is not configured with 'authentication host-mode multi-domain'.

Question 14

An administrator configures Cisco ISE for guest access with a sponsor portal. What is the primary purpose of the sponsor portal?

Accepted Answer

Allow sponsors to create and manage guest accounts. The sponsor portal in Cisco ISE is specifically designed to allow authorized users (sponsors) to create, manage, and approve guest accounts. This enables controlled guest access where a sponsor, such as an employee or administrator, provisions credentials for visitors, ensuring accountability and policy enforcement without requiring guests to self-register.

Answer

Provide network access for non-supplicant devices

Answer

Enable guests to authenticate with MFA

Answer

Allow guests to self-register

Question 15

A government agency is deploying Cisco ISE with a posture agent to ensure endpoints comply with security policies before accessing the network. The posture policy requires that all Windows computers have antivirus (AV) software running. The engineer configures a condition 'AV installed and running' and binds it to an authorization profile that grants full access if compliant, or quarantine if not. During testing, a computer that has AV installed and running (verified manually) is placed in quarantine. ISE logs show 'Posture - AV condition not satisfied'. The engineer checks the ISE posture configuration: the AV condition uses a default Cisco AV dictionary. What is the most likely cause?

Accepted Answer

The AV vendor is not supported by the ISE default posture dictionary. The posture condition uses a dictionary that maps known AV products. If the specific AV brand is not in the Cisco default dictionary, the condition will fail even if AV is running. Option A is correct. Option B is incorrect because the condition does not require the AV version. Option C would cause other issues like no posture assessment. Option D is possible but less likely.

Answer

The posture policy is configured to require the AV version as well

Answer

The client's ISE posture agent is not installed

Answer

The client's firewall is blocking communication with ISE

Question 16

Which TWO are valid options for configuring a switch port to handle authentication failures in an 802.1X environment? (Select two.)

Accepted Answer

authentication event no-response action authorize vlan 100. The 'authentication event no-response action authorize vlan 100' command configures the switch port to place the endpoint into a restricted VLAN (e.g., VLAN 100) when the supplicant fails to respond to 802.1X authentication requests. This is a valid method for handling authentication failures, specifically a 'no-response' scenario, by authorizing the port with a limited-access VLAN instead of denying all traffic.

Answer

dot1x critical profile

Answer

authentication event server dead action reinitialize

Answer

authentication port-control force-authorized

Question 17

A user in the marketing group reports that they cannot access twitter.com. The access policy summary is shown in the exhibit. What is the most likely reason?

Accepted Answer

The Social Networking category is set to Block in the Marketing-Policy.. The exhibit shows that the Marketing-Policy has the Social Networking category set to Block. Since twitter.com is classified under Social Networking, this action explicitly denies access for users assigned to that policy, overriding any other settings.

Answer

The default policy is blocking the site because Marketing-Policy is set to Monitor only.

Answer

The access policy has a time-based restriction that blocks social media during work hours.

Answer

The marketing group is not assigned to the Marketing-Policy.

Question 18

A large enterprise has deployed Cisco ISE for network access control. The network consists of multiple access switches and wireless LAN controllers. The security team wants to enforce that only domain-joined Windows computers with up-to-date antivirus can access the corporate network. Non-compliant devices should be placed in a quarantine VLAN with limited access to remediation servers. The ISE policies are configured with posture assessment. However, during a test, a non-compliant Windows computer is granted full network access instead of being quarantined. The ISE logs show that the posture assessment passed, but the computer's antivirus is outdated. What is the most likely reason for this behavior?

Accepted Answer

The posture policy is configured with 'continue' action for non-compliant status, allowing the user to proceed to authorization.. In Cisco ISE, when a posture policy is configured with a 'continue' action for non-compliant status, the session does not terminate; instead, it proceeds to the authorization policy. This means the endpoint is evaluated by authorization rules, which may grant full network access if no quarantine rule is matched. The logs show the posture assessment passed because the 'continue' action treats non-compliance as a passing state for policy flow, not a failure.

Answer

The authorization policy is matching before the posture policy is evaluated.

Answer

The posture agent is not installed on the endpoint, so the assessment is skipped.

Answer

The posture requirement is set to 'mandatory' but the agent is set to 'any', allowing non-compliant devices.

Question 19

Which component of the CIA triad ensures that data is not altered by unauthorized entities during transmission?

Accepted Answer

Integrity. Integrity ensures that data remains accurate and unaltered during storage or transmission, preventing unauthorized modifications.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 20

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Answer

show crypto engine statistics

Answer

debug crypto isakmp

Answer

show crypto isakmp sa