350-701 Practice Exam 52 — 20 Questions

Question 1

A security engineer is reviewing the shared responsibility model for a company that is using a SaaS-based email service. The company wants to understand which security controls they are responsible for managing. According to the shared responsibility model, which area is the customer's responsibility in a SaaS deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management of user access and identity. In a SaaS deployment, the customer's responsibility is primarily focused on data, user access, and identity management. The provider manages the application, operating system, hypervisor, and physical infrastructure. Therefore, managing user access and identity is the correct answer, while the other options are provider responsibilities.

Answer

Patching of the underlying operating system

Answer

Physical security of the data center

Answer

Configuration of the hypervisor

Question 2

A security engineer is deploying Cisco Secure Firewall to inspect traffic for malicious content. The engineer needs to ensure that the firewall can detect and block threats in both inbound and outbound directions, and that file transfers are inspected for malware. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure intrusion prevention policy. To detect and block threats in both directions and inspect file transfers, the firewall must have both a file policy with malware inspection and an intrusion prevention policy. The file policy handles file reputation and malware analysis, while the IPS policy detects and blocks exploit traffic. Together, they provide comprehensive threat inspection. SSL decryption and network discovery may enhance visibility but are not strictly required to meet the stated detection and blocking objectives.

Answer

Deploy a DNS sinkhole policy

Answer

Enable SSL decryption for all traffic

Answer

Configure a network discovery policy

Question 3

A network engineer is configuring a Cisco Catalyst switch to enforce 802.1X on a port that connects to an IP phone with a PC daisy-chained behind it. The phone must authenticate first, and then the PC must authenticate separately. Which command sequence correctly enables this behavior on the switch port?

Accepted Answer

authentication host-mode multi-domain. The multi-domain host mode is designed for voice and data convergence on a single switch port. It allows one authentication session for the voice domain (typically the IP phone) and a separate session for the data domain (the PC). This provides independent authentication and policy enforcement for each device, which is exactly what the scenario requires.

Answer

authentication host-mode multi-auth

Answer

authentication host-mode single-host

Answer

authentication host-mode multi-host

Question 4

An administrator is configuring Cisco Firepower Management Center to block outbound access to a list of known malicious domains. The requirement is to use the reputation data that Cisco curates and updates automatically, without manually maintaining the domain list. Which Firepower feature should be used?

Accepted Answer

Security Intelligence feeds with DNS and URL reputation lists. Security Intelligence feeds in Firepower Management Center provide Cisco-curated, automatically updated reputation data for DNS, URL, and IP indicators. Using these feeds in an access control policy blocks outbound access to known malicious domains without manual list maintenance. Custom URL groups require manual upkeep, SSL decryption is only a supporting function, and network discovery provides visibility rather than enforcement.

Answer

Custom URL object group with manually entered malicious domains

Answer

Network discovery policy with host input from Cisco Talos

Answer

Access control policy with an SSL policy that decrypts all outbound traffic

Question 5

A company uses Cisco Secure Email Gateway and wants to prevent outbound email from being flagged as spam by recipients because of spoofing. The security team has already published SPF records and wants to add cryptographic signing so that receiving servers can verify the domain. Which record should be published in DNS?

Accepted Answer

A DKIM record containing the public key for the signing selector. Cryptographic signing of outbound email is provided by DKIM, which publishes a public key in DNS so receivers can verify the signature added by the sending gateway. SPF authorizes sending IPs but does not sign messages, DMARC defines handling policy based on SPF or DKIM results, and BIMI controls logo display. Only the DKIM record supplies the public key needed for signature verification.

Answer

An SPF record with a hard fail qualifier of -all

Answer

A DMARC record with a policy of p=reject

Answer

A BIMI record with a logo URL and authority evidence

Question 6

A university's security team uses Cisco Secure Endpoint to protect research workstations. A professor reports that an application used for genomic analysis is being repeatedly quarantined, disrupting research. The team verifies the application is legitimate and signed by a trusted vendor. The team wants to prevent future quarantine of this specific application while keeping all other protections active. What should the team configure in Cisco Secure Endpoint?

Accepted Answer

Add the application's file hash or path to the exclusion list in the policy.. Adding the legitimate application's hash or path to the exclusion list in the Cisco Secure Endpoint policy prevents the connector from quarantining it, while all other engine protections continue to operate normally. This is the targeted, least-disruptive way to resolve a false positive on a signed research application.

Answer

Change the policy from Protect mode to Audit mode for all engines.

Answer

Disable the Ethos engine on the affected workstations.

Answer

Create a custom detection list entry for the application's hash.

Question 7

A security analyst is using Cisco Secure Endpoint's device trajectory feature to investigate a suspicious process on a Windows endpoint. The analyst wants to identify the parent-child process relationships and the files accessed by the process. Which two actions can the analyst perform within the device trajectory view to achieve this? (Choose two.)

Accepted Answer

Expand the process tree to view parent and child processes.. The device trajectory view in Cisco Secure Endpoint is designed to visualize process lineage and associated events. Expanding the process tree reveals parent-child relationships, and clicking a process shows its file and network events. These two actions directly provide the required information. Other options involve separate tools or features that are not part of the device trajectory view.

Answer

Use the 'File Analysis' button to submit the process executable to Threat Grid.

Answer

Run a custom query in Cisco Orbital to retrieve the process's command-line arguments.

Answer

Generate a report of all endpoints that have executed the same process hash.

Question 8

A security analyst is investigating an alert from Cisco Secure Network Analytics (formerly Stealthwatch) indicating a host is communicating with a known command-and-control server. The analyst wants to quickly identify the user and device associated with the host IP address. Which Cisco solution should be integrated with Secure Network Analytics to provide this identity context?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the identity services platform that maintains a mapping of users and devices to IP addresses. Through pxGrid, it shares this context with Secure Network Analytics, enabling analysts to see the username and device associated with a suspicious IP. This integration is essential for rapid incident response and is a common exam objective.

Answer

Cisco Secure Firewall Management Center (FMC)

Answer

Cisco Umbrella

Answer

Cisco Secure Email Gateway (ESA)

Question 9

A network security administrator is deploying Cisco TrustSec in a large enterprise. The company wants to assign Security Group Tags (SGTs) to endpoints based on the VLAN they belong to, without requiring 802.1X authentication. Which Cisco TrustSec feature should the administrator use to accomplish this?

Accepted Answer

Static VLAN-to-SGT mapping on the switch. In Cisco TrustSec, static VLAN-to-SGT mapping allows administrators to assign SGTs to endpoints based on their VLAN membership without requiring 802.1X. This is configured on the switch and is useful when dynamic authentication is not feasible. SGACLs enforce policies after tagging, dynamic SGT assignment requires authentication, and SXP propagates mappings but does not assign them.

Answer

Security Group ACLs (SGACLs)

Answer

Dynamic SGT assignment via Cisco ISE

Answer

SGT Exchange Protocol (SXP) listener

Question 10

A network administrator is configuring MACsec on a Cisco switch to secure traffic between two switches. The administrator wants to ensure that the MACsec session uses a pre-shared key for authentication. Which MACsec key agreement protocol should be used?

Accepted Answer

MKA (MACsec Key Agreement) with pre-shared key. MACsec on Cisco switches uses the MACsec Key Agreement (MKA) protocol to establish secure sessions. When a pre-shared key is used, the administrator configures a Connectivity Association Key (CAK) and a Connectivity Association Key Name (CKN) on both switches. MKA then negotiates the Secure Association Key (SAK) for encrypting traffic. This method is efficient for switch-to-switch links where a pre-shared key is acceptable and no external authentication server is needed.

Answer

IKEv2 with pre-shared key

Answer

RADIUS with MACsec extensions

Answer

802.1X EAP-TLS with MACsec

Question 11

A security operations team is using Cisco Identity Services Engine (ISE) to enforce endpoint compliance. They want to ensure that endpoints connecting to the network have up-to-date antivirus signatures and operating system patches before being granted full access. Which ISE feature should they configure?

Accepted Answer

Posture assessment. Posture assessment in Cisco ISE evaluates endpoints for compliance with security policies, including antivirus signature updates and OS patches. It can be configured to require remediation before granting full access. Other features like profiling, guest services, and TrustSec serve different purposes and do not check endpoint health. Thus, posture assessment is the correct feature for this scenario.

Answer

TrustSec

Answer

Profiling

Answer

Guest services

Question 12

A network administrator is deploying Cisco TrustSec in a data center. The requirement is to assign Security Group Tags (SGTs) to traffic based on the source IP address of the endpoint, without relying on 802.1X or any client software. The administrator plans to use a Cisco Identity Services Engine (ISE) and a Cisco Nexus switch as the enforcement point. Which ISE feature should be used to assign SGTs dynamically based on IP address?

Accepted Answer

IP-to-SGT mapping in ISE. ISE supports IP-to-SGT mapping, which allows SGTs to be assigned to endpoints based on their IP address. This mapping can be distributed to network devices via SXP or directly queried from ISE. This method does not require 802.1X or any client software, making it suitable for the data center scenario where only source IP is available for classification.

Answer

Security Group Access (SGA) with SXP

Answer

802.1X with EAP-TLS

Answer

RADIUS Change of Authorization (CoA) with MAB

Question 13

A security administrator is deploying Cisco ISE with posture assessment for VPN users. The company uses AnyConnect as the VPN client and ISE for posture policy. After a user connects via VPN, the posture assessment reports the endpoint as non-compliant due to missing antivirus updates. The administrator wants to automatically remediate the endpoint by triggering an antivirus update and then re-assess. Which ISE feature should be configured to achieve this?

Accepted Answer

Configure a posture remediation policy that pushes a remediation action to the AnyConnect client, such as an antivirus update command.. Cisco ISE posture remediation policies allow administrators to define actions that endpoints must take to become compliant. For AnyConnect, remediation can include triggering antivirus updates or other software actions. After remediation, the endpoint is re-assessed. This automates the process and ensures compliance without manual intervention, which is exactly what the administrator needs.

Answer

Use ISE's external RESTful API to trigger a script on the endpoint that updates antivirus and then re-runs posture.

Answer

Configure a posture condition that checks for antivirus version and automatically grants access if the version is within one revision.

Answer

Enable Change of Authorization (CoA) to disconnect the user and force re-authentication after remediation.

Question 14

A security administrator is configuring Cisco ISE to enforce endpoint compliance. The administrator wants to ensure that endpoints without the latest antivirus definitions are denied network access. Which ISE policy element should be used to evaluate the antivirus status?

Accepted Answer

Posture policy. Cisco ISE posture policies are designed to assess the compliance of endpoints against specific conditions, including antivirus definition updates. The posture policy uses posture conditions to check the endpoint's state, and if the condition is not met, the endpoint is marked non-compliant. The authorization policy then uses this result to deny or restrict access. Therefore, the posture policy is the correct element for evaluating antivirus status.

Answer

Authentication policy

Answer

Authorization policy

Answer

Client provisioning policy

Question 15

A network administrator is configuring 802.1X on a Cisco switch. The switch is connected to a Cisco ISE server for authentication. The administrator wants to ensure that if the RADIUS server is unreachable, the switch will place the port in a restricted VLAN instead of denying access. Which command should be configured on the switch port?

Accepted Answer

authentication event server dead action authorize vlan 100. The authentication event server dead action authorize vlan command is used to define fallback behavior when the RADIUS server is unreachable. It allows the switch to place the port into a specific VLAN, ensuring that devices can still gain limited network access. This is commonly used for critical devices that must remain operational even if authentication infrastructure fails.

Answer

authentication event server alive action reinitialize

Answer

authentication event fail action authorize vlan 100

Answer

authentication event no-response action authorize vlan 100

Question 16

A security administrator is configuring Cisco ISE to enforce endpoint posture. The policy requires that endpoints must have the latest antivirus definitions and an enabled personal firewall. After a posture assessment, some endpoints are marked as non-compliant but remain in the original VLAN instead of being moved to a remediation VLAN. The administrator has verified that the posture policy conditions are correct and the remediation VLAN is configured. Which action should be taken to ensure non-compliant endpoints are moved to the remediation VLAN?

Accepted Answer

Verify that the switch supports and is configured for Change of Authorization (CoA) and that ISE is sending CoA requests.. For posture-based VLAN assignment to work, ISE must be able to send a Change of Authorization (CoA) to the switch after the posture assessment. The switch must support CoA and be configured to accept it. Without CoA, the endpoint remains in its initial VLAN even if marked non-compliant.

Answer

Configure the switch port to use the 'authentication violation restrict' command.

Answer

Ensure the switch is configured with the 'cisco-av-pair' attribute for VLAN assignment in the authorization profile.

Answer

Configure the posture policy to use the 'quarantine' action instead of 'remediate'.

Question 17

A security administrator is configuring Cisco ISE to support BYOD onboarding. The administrator wants to ensure that employee personal devices are automatically registered and provisioned with the necessary certificates. Which ISE feature should be used?

Accepted Answer

BYOD onboarding portal. Cisco ISE BYOD onboarding portal is specifically designed to allow employees to register their personal devices and automatically provision them with certificates and supplicant settings. It simplifies the onboarding process and ensures that devices are properly configured for secure network access. The portal can be customized and integrated with Active Directory for user authentication, making it the correct feature for this scenario.

Answer

Posture policy

Answer

Client provisioning policy

Answer

Guest portal

Question 18

A security administrator is configuring Cisco ISE to monitor endpoints connecting to the network. The goal is to create a report that shows all endpoints that have connected in the past 30 days, including their MAC addresses, IP addresses, and operating systems. Which ISE feature should be used to generate this report?

Accepted Answer

Context Visibility. Context Visibility is the ISE feature that provides endpoint visibility and reporting. It aggregates data from various sources, including profiling, authentication, and accounting, and presents it in dashboards. Administrators can generate reports on endpoints, including historical data, and filter by attributes such as MAC address, IP address, and OS. This meets the requirement for a 30-day endpoint report.

Answer

Profiling Policy

Answer

Endpoint Identity Group

Answer

Live Logs

Question 19

A network administrator is implementing Cisco TrustSec in a campus network. The administrator wants to enforce access policies based on user roles without changing IP addresses or VLANs. Which component of Cisco TrustSec is responsible for tagging packets with Security Group Tags (SGTs)?

Accepted Answer

Ingress Policy Enforcement Point (PEP). In Cisco TrustSec, the ingress Policy Enforcement Point (PEP) tags packets with Security Group Tags (SGTs) based on the source's identity. This tagging allows other devices in the TrustSec domain to enforce policies without needing to re-authenticate the source, enabling scalable role-based access control.

Answer

Security Group Tag Exchange Protocol (SXP)

Answer

Identity Services Engine (ISE)

Answer

Egress Policy Enforcement Point (PEP)

Question 20

A network administrator is configuring 802.1X on a Cisco switch. The switch is configured for single-host mode. A user connects a small unmanaged switch to the 802.1X-enabled port and attaches three devices. Only the first device authenticates successfully; the other devices cannot access the network. What is the most likely reason?

Accepted Answer

The switch port is configured for single-host mode, allowing only one MAC address to authenticate.. In 802.1X single-host mode, the switch port permits only one authenticated MAC address. When multiple devices connect through an unmanaged switch, only the first device to authenticate gains access; others are blocked. Multi-domain mode allows one data and one voice device, not multiple data devices. The unmanaged switch and authentication server are not the limiting factors.

Answer

The authentication server is configured to allow only one session per port.

Answer

The unmanaged switch does not support 802.1X pass-through.

Answer

The switch port is configured for multi-domain mode.