350-701 Practice Exam 53 — 20 Questions

Question 1

A network team is configuring Cisco FTD for a new branch office. They want to allow outbound web traffic but block all inbound traffic except for a specific public server. Which policy type should be used to allow the return traffic for outbound connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A stateful access rule. Cisco FTD uses a stateful firewall engine that tracks the state of outbound connections. When a stateful access rule permits outbound web traffic, the firewall automatically creates a dynamic pinhole for the return traffic, eliminating the need for explicit inbound rules. This is the correct policy type because it maintains session state and allows only related return packets, aligning with the requirement to block all other inbound traffic.

Answer

A stateless ACL

Answer

A NAT rule

Answer

SSL decryption

Question 2

Which TWO actions can be taken on a malicious file detected by Cisco AMP for Endpoints?

Accepted Answer

Block execution of the file. Cisco AMP for Endpoints uses a combination of signature-based and behavioral analysis to detect malicious files. When a file is determined to be malicious, the administrator can choose to block execution of the file, which prevents the process from running on the endpoint. Additionally, the file can be quarantined into a safe location, isolating it from the system to prevent further harm while retaining the file for analysis.

Answer

Allow the file after a scan

Answer

Encrypt the file to prevent harm

Answer

Delete the file

Question 3

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

Question 4

Which THREE of the following are capabilities of Cisco Email Security Appliance (ESA) for content filtering? (Choose three.)

Accepted Answer

Anti-spam filtering. B is correct because Cisco ESA includes a sophisticated anti-spam filtering engine that uses multiple techniques such as SenderBase reputation, contextual analysis, and signature-based detection to identify and block unwanted email messages. This is a core content security capability of the ESA, operating at the email gateway to filter inbound and outbound traffic.

Answer

Intrusion Prevention System (IPS)

Answer

Zero-day malware protection using sandboxing

Question 5

A security analyst needs to investigate a potential breach on an endpoint. Cisco AMP for Endpoints provides several EDR capabilities. Which three actions can the analyst perform using AMP's EDR features? (Choose three.)

Accepted Answer

Remote shell investigation. Cisco AMP's EDR capabilities include file quarantine, process isolation, and remote shell investigation. These allow investigation and containment of threats on endpoints.

Answer

SGT assignment

Answer

VLAN reassignment

Question 6

Which cryptographic algorithm is considered deprecated and should be avoided due to known vulnerabilities, especially when used in digital signatures and certificate signing?

Accepted Answer

MD5. MD5 is a hashing algorithm with known collision vulnerabilities, making it unsuitable for security-sensitive applications like digital signatures.

Answer

SHA-256

Answer

SHA-3

Answer

AES-256

Question 7

An organization deploys Cisco ISE for network access control. After successful 802.1X authentication, a user's device is found to be missing critical patches via posture assessment. The administrator wants to dynamically move the user to a remediation VLAN without requiring the user to reconnect. Which ISE capability enables this?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change authorization attributes (e.g., VLAN, ACL) for an already authenticated session.

Answer

RADIUS Accounting

Answer

MAB reauthentication

Answer

Device Sensor profiling

Question 8

A multinational company needs to gain centralized visibility into cloud security posture across AWS, Azure, and GCP. Which Cisco product provides multi-cloud security posture management (CSPM) capabilities?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is the correct answer because it provides Cloud Security Posture Management (CSPM) capabilities across multi-cloud environments, including AWS, Azure, and GCP. It continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks, offering centralized visibility and remediation guidance. This aligns directly with the requirement for multi-cloud CSPM in the question.

Answer

Cisco Firepower Threat Defense

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Umbrella

Question 9

An engineer is deploying a Cisco FTD in inline mode and wants to inspect SSL/TLS traffic using the 'decrypt-resign' action. What must be configured on the client devices to avoid certificate errors?

Accepted Answer

Install the organization's CA certificate in the client's trusted root store.. When using 'decrypt-resign', the FTD generates a new certificate signed by a CA that the organization controls. Clients must trust the organization's CA certificate (root CA) that is used to sign the re-encrypted certificates. Without that, clients will see certificate errors.

Answer

Disable certificate validation on all client browsers.

Answer

Install the FTD's self-signed certificate on each client.

Answer

Use 'decrypt-known-key' instead, which does not require client configuration.

Question 10

An enterprise is deploying a hybrid email security solution using Cisco Email Security Appliance (ESA) on-premises and Cisco Cloud Email Security (CES). The organization wants to use the cloud for spam filtering while the on-premises ESA handles DLP and encryption for sensitive data. Inbound emails should be processed by the cloud first, then sent to the on-premises ESA. Which architecture correctly implements this requirement?

Accepted Answer

MX record → Cisco CES → On-premises ESA (internal mail server). It places Cisco CES (cloud) first in the email flow to handle spam filtering, then forwards the cleaned messages to the on-premises ESA for DLP and encryption before delivery to the internal mail server. This matches the requirement that inbound emails be processed by the cloud first, then the on-premises ESA, with CES acting as the initial SMTP gateway via MX record.

Answer

MX record → On-premises ESA → Internal mail server, with a separate smart host via CES

Answer

MX record → Dual MX pointing to both CES and ESA

Answer

MX record → On-premises ESA → Cisco CES → Internal mail server

Question 11

An organization uses AWS and Azure. They deploy Cisco Secure Workload to enforce microsegmentation. They discover that after deploying agents on EC2 instances, some traffic is misclassified due to overlapping IPs across multiple VPCs. Which configuration change best resolves this?

Accepted Answer

Use Cloud Connector to map instance metadata. C is correct because Cloud Connector in Cisco Secure Workload (formerly Tetration) integrates with AWS and Azure APIs to retrieve instance metadata, such as VPC ID, subnet, and instance ID. This metadata allows Secure Workload to uniquely identify workloads even when they have overlapping IP addresses across different VPCs, enabling accurate traffic classification and policy enforcement.

Answer

Reassign unique labels for each workload

Answer

Enable VRF-like segmentation within Secure Workload

Answer

Configure separate enforcement scopes for each VPC

Question 12

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP (Online Certificate Status Protocol). OCSP (Online Certificate Status Protocol) provides real-time revocation status without the overhead of CRLs.

Answer

CRL (Certificate Revocation List)

Answer

PKI certificate chain

Answer

SSL/TLS handshake

Question 13

Drag and drop the steps to configure NetFlow on a Cisco IOS router for traffic monitoring in the correct order.

Accepted Answer

Enable flow on interface, then configure exporter, then create monitor, then apply to interface, then verify.. First enable flow on interface, then configure exporter, create monitor, apply to interface, and verify.

Answer

Configure exporter, then create monitor, then enable flow on interface, then apply to interface, then verify.

Answer

Create monitor, then configure exporter, then enable flow on interface, then apply to interface, then verify.

Answer

Enable flow on interface, then create monitor, then configure exporter, then apply to interface, then verify.

Question 14

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

Accepted Answer

Implement IKEv2 redirect mechanism to direct spokes to the optimal hub.. The IKEv2 redirect mechanism allows a hub to inform a spoke of a more optimal hub based on metrics such as latency or load. The spoke then initiates a new IKEv2 connection to the recommended hub, enabling dynamic hub selection without manual configuration. This is the standard Cisco solution for FlexVPN deployments requiring proximity-based tunnel establishment.

Answer

Configure static priority on each hub and use priority-based selection.

Answer

Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.

Answer

Use DHCP option 121 to push static routes for hub selection.

Question 15

A security team notices that an AWS Lambda function is allowed to access an S3 bucket containing PII. The Lambda role has an attached policy that grants s3:PutObject and s3:GetObject to the bucket. Which action would be the most effective to ensure least privilege?

Accepted Answer

Add a bucket policy that restricts access to the Lambda execution role and includes conditions. Adding a bucket policy that restricts access to the Lambda execution role and includes conditions (such as aws:SourceArn or aws:SourceAccount) enforces least privilege at the resource level. This ensures that only the specific Lambda function can perform s3:PutObject and s3:GetObject on the S3 bucket, preventing any other principal or service from abusing the role's permissions.

Answer

Enable S3 default encryption using AWS KMS

Answer

Apply AWS WAF rules to the Lambda function

Answer

Remove the role and create a new role with full S3 access

Question 16

An organization wants to implement MAC Authentication Bypass (MAB) for devices that do not support 802.1X. Which configuration is required on a Cisco switch to allow MAB fallback?

Accepted Answer

authentication order mab dot1x. The 'authentication order mab dot1x' command configures the switch to attempt MAB first and then fall back to 802.1X if MAB fails. This is the exact requirement for devices that do not support 802.1X, ensuring they are authenticated via MAC address while still allowing 802.1X for capable devices.

Answer

authentication priority dot1x mab

Answer

authentication port-control auto

Answer

authentication fallback mab

Question 17

A security engineer is configuring Cisco Umbrella Intelligent Proxy to selectively decrypt and inspect HTTPS traffic. The goal is to balance security and user privacy by only inspecting traffic to high-risk domains. How does Intelligent Proxy decide which traffic to inspect?

Accepted Answer

It evaluates domains against Cisco's security categories and only inspects domains that match certain categories.. Intelligent Proxy uses Cisco Umbrella's security intelligence to categorize domains and selectively apply SSL inspection to those classified as high risk or based on policy.

Answer

It inspects all HTTPS traffic by default.

Answer

It uses a list of manually configured domains.

Answer

It inspects traffic based on the user's identity.

Question 18

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.

Question 19

A company wants to prevent sensitive data such as credit card numbers from being sent via email. Which Cisco ESA feature should be enabled?

Accepted Answer

Data Loss Prevention (DLP). C is correct because Data Loss Prevention (DLP) is the Cisco ESA feature specifically designed to inspect email content and attachments for sensitive data patterns, such as credit card numbers, and enforce policies to prevent their unauthorized transmission. DLP uses predefined or custom dictionaries and message filters to detect and block or quarantine such data, directly addressing the requirement to prevent sensitive data from being sent via email.

Answer

Anti-Spam

Answer

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Answer

Anti-Malware

Question 20

A network engineer is configuring Cisco TrustSec on a switch to enforce segmentation. Which THREE components are required for TrustSec to assign a Security Group Tag (SGT) to a user after successful authentication via ISE?

Accepted Answer

802.1X authentication. B is correct because 802.1X authentication is the foundational mechanism that initiates the identity-based access control flow. When a user connects to the switch port, 802.1X (using EAP over LAN) authenticates the user against ISE, which then triggers the assignment of a Security Group Tag (SGT) via RADIUS attributes. Without 802.1X, the switch has no user identity to classify, and TrustSec cannot enforce segmentation at the user level.

Answer

SGT classification on the switch

Answer

VLAN assignment