350-701 Practice Exam 53 — 20 Questions

Question 1

A network administrator is deploying Cisco TrustSec in a campus network. The administrator needs to enforce access policies based on Security Group Tags (SGTs) between endpoints. Which two statements about SGT enforcement are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SGTs are assigned to endpoints by Cisco ISE during authentication.. SGTs are assigned by Cisco ISE during authentication and can be propagated to non-TrustSec devices via SXP. These are core principles of Cisco TrustSec, enabling scalable segmentation without VLANs. The other statements are false: VLANs are not required for SGT enforcement, SGTs are supported on many platforms beyond Catalyst switches, and SGT assignment is not based solely on MAC address but on rich policy conditions.

Answer

SGT enforcement requires the use of VLANs to separate traffic.

Answer

SGTs are assigned based on the endpoint's MAC address only.

Answer

SGTs are only supported on Cisco Catalyst switches and not on routers or firewalls.

Question 2

A network security engineer is deploying Cisco Stealthwatch to detect anomalies in a large enterprise network. The engineer needs to ensure that Stealthwatch can analyze traffic from all endpoints, including those in remote branch offices that do not have a local Stealthwatch Flow Collector. Which deployment option should be used to meet this requirement?

Accepted Answer

Configure NetFlow on the branch office routers and send the flow data to a central Stealthwatch Flow Collector.. Cisco Stealthwatch relies on flow data, such as NetFlow, for visibility. For branch offices without a local Flow Collector, enabling NetFlow on the branch routers and exporting to a central Flow Collector allows Stealthwatch to analyze branch traffic without additional hardware, providing centralized visibility.

Answer

Install a Stealthwatch Management Console at each branch office to collect local flow data.

Answer

Enable Cisco TrustSec on the branch office switches to tag traffic and send SGTs to Stealthwatch.

Answer

Deploy a Stealthwatch Flow Sensor at each branch office to export NetFlow to the central Flow Collector.

Question 3

A security administrator is configuring Cisco Web Security Appliance (WSA) to inspect HTTPS traffic. The administrator wants to decrypt and inspect traffic from internal users while avoiding certificate errors on managed endpoints. Which two actions must be performed to achieve this? (Choose two.)

Accepted Answer

Enable HTTPS Proxy on the WSA and configure a certificate for decryption.. To inspect HTTPS traffic without certificate errors, the WSA must be enabled for HTTPS Proxy with a decryption certificate, and the corresponding root CA certificate must be trusted by all managed endpoints. Enabling HTTPS Proxy allows decryption, while installing the root certificate ensures clients trust the dynamically generated certificates. Other options either do not enable decryption or do not address endpoint trust.

Answer

Configure the WSA to use a self-signed certificate for all HTTPS connections.

Answer

Configure the WSA to use upstream proxies for all HTTPS connections.

Answer

Enable the HTTPS decryption policy and set it to monitor only.

Question 4

A network security engineer is configuring Cisco Firepower Management Center (FMC) to block traffic based on the URL category of websites. The engineer wants to ensure that when a user attempts to access a site categorized as 'Malware', the connection is blocked and an event is generated. Which type of policy should be used to accomplish this?

Accepted Answer

Access Control Policy with URL filtering enabled.. URL filtering in Cisco Firepower is configured within the Access Control Policy. By adding a rule that matches the URL category 'Malware' and setting the action to Block, the engineer can block connections and generate events. Other policy types like Intrusion Prevention, SSL, or DNS do not provide URL category-based blocking; they serve different functions in the traffic inspection pipeline.

Answer

DNS Policy with sinkhole action.

Answer

SSL Policy with decryption rules.

Answer

Intrusion Prevention Policy with a custom rule.

Question 5

A security engineer is implementing a VPN solution for remote workers. The engineer wants to ensure that the VPN uses a protocol that provides strong encryption and supports both IPv4 and IPv6. Which VPN technology should be chosen?

Accepted Answer

IPsec. IPsec is a suite that provides strong encryption and authentication for both IPv4 and IPv6 traffic. It is a standard choice for VPNs requiring protocol-level security. PPTP is insecure, L2TP lacks encryption without IPsec, and SSL VPN, while secure, operates at a different layer and is not a protocol that inherently encrypts IP packets.

Answer

L2TP

Answer

SSL VPN

Answer

PPTP

Question 6

Based on the exhibit, what is the most likely reason that traffic matching the AMP_block access-list is not being blocked?

Accepted Answer

The access-list is not referenced in any policy-map or class-map. The correct answer is C: the access-list is not referenced in any policy-map or class-map. An ACL by itself only classifies traffic; it must be referenced by a class-map (match access-group) that is then used in a policy-map with a drop/block action, and the policy-map must be applied to an interface via service-policy for traffic to actually be blocked. Because the AMP_block ACL is not tied into any class-map or policy-map, no enforcement action is ever taken against matching traffic. Option A is wrong because a malformed remark would not prevent blocking since remarks are only comments and do not affect matching. Option B is wrong because a policy-map missing an action would only matter if the ACL were already referenced in a class-map within that policy-map. Option D is wrong because interface application is a later step; the primary issue is that the ACL is not referenced in any class-map or policy-map at all.

Answer

The remark command is incorrectly formatted

Answer

The policy-map does not include a pass or block action for the access-list

Answer

The access-list is not applied to an interface

Question 7

A security engineer is implementing a VPN solution for remote workers. The organization requires that the VPN uses strong encryption, supports perfect forward secrecy, and is widely supported on various client platforms without requiring third-party software. Which VPN technology should the engineer choose?

Accepted Answer

IPsec IKEv2 with AES-256 and SHA-256. IKEv2 with AES-256 and SHA-256 provides strong encryption, supports perfect forward secrecy via Diffie-Hellman, and is natively supported on major client platforms. IKEv1 with SHA-1 is weaker, SSL/TLS VPN may need clients for full tunnel, and PPTP is insecure. Thus, IKEv2 is the best choice for the stated requirements.

Answer

IPsec IKEv1 with AES-256 and SHA-1

Answer

PPTP with MPPE

Answer

SSL/TLS VPN using a web browser

Question 8

A multinational company plans to deploy Cisco AMP for Endpoints across 10,000 endpoints in geographically diverse offices. The security team is concerned about WAN bandwidth usage when endpoints communicate with the AMP cloud. Which design approach best minimizes cloud communication traffic while maintaining effective protection?

Accepted Answer

Deploy an AMP Private Cloud appliance on-site to handle local reputation queries.. Option D is correct because deploying an AMP Private Cloud appliance on-site lets endpoints send reputation and telemetry queries to a local appliance instead of traversing the WAN to the AMP cloud, which directly reduces WAN bandwidth consumption while preserving full AMP protection. The appliance synchronizes with the Cisco AMP cloud in the background, so endpoints still receive current threat intelligence without each of the 10,000 endpoints making direct cloud connections. Option A is wrong because disabling real-time file scanning weakens protection and does not address cloud communication efficiently. Option B only reduces lookup frequency and still sends traffic over the WAN, and it can delay detection of newly seen files. Option C is not a supported AMP design for caching cloud reputation responses and would not provide the local reputation handling that Private Cloud does.

Answer

Disable real-time file scanning and rely on scheduled scans only.

Answer

Reduce the frequency of file reputation lookups by setting a longer cache time.

Answer

Deploy a forward proxy to cache AMP cloud responses.

Question 9

A security administrator is configuring a Cisco Firepower Next-Generation Firewall (NGFW) to inspect traffic for malicious patterns. The administrator wants to detect and block exploits that target known vulnerabilities in web servers. Which Firepower feature should be enabled to achieve this?

Accepted Answer

Intrusion policy. Cisco Firepower's intrusion policy uses Snort rules to detect and block exploits targeting known vulnerabilities. It inspects packet payloads for malicious patterns. Access control, SSL, and DNS policies serve different functions and do not provide the required exploit detection for web server traffic.

Answer

DNS policy

Answer

SSL policy

Answer

Access control policy

Question 10

A security team is deploying a web application in a public cloud. They need to protect it from common web exploits like SQL injection and cross-site scripting, and also mitigate bot attacks. Which Cisco cloud security solution provides these capabilities with minimal configuration and integrates with cloud-native load balancers?

Accepted Answer

Cisco Cloud Web Application Firewall (WAF). Cisco Cloud Web Application Firewall (WAF) is designed to protect web applications from common exploits and bot attacks. It integrates with cloud load balancers and offers easy deployment. The other options provide DNS security, SaaS security, or network monitoring, none of which include WAF capabilities. Therefore, the Cloud WAF is the correct solution for this scenario.

Answer

Cisco Cloudlock

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Umbrella

Question 11

A security analyst is investigating a potential data breach. The analyst needs to determine which internal host communicated with a known malicious IP address over the past week. Which Cisco Stealthwatch feature should be used to query historical flow data and identify the host?

Accepted Answer

Flow Search. Flow Search is the correct feature because it enables granular queries of historical flow data, allowing the analyst to filter by the malicious IP and time range to identify the internal host. Other features like Alarm Manager or Host Report are either not queryable or require prior knowledge of the host. Policy Management is unrelated to forensic search.

Answer

Host Report

Answer

Policy Management

Answer

Alarm Manager

Question 12

A network security engineer is deploying a Cisco Firepower Threat Defense (FTD) device in a high-availability active/standby pair. The engineer wants to ensure that the standby unit can take over immediately if the active unit fails, without dropping existing connections. Which feature should be configured to meet this requirement?

Accepted Answer

Stateful failover. Stateful failover is designed to replicate connection state between active and standby units, enabling the standby to assume control without dropping existing connections. This is critical for high-availability deployments where session continuity is required. Other features like EtherChannel or dynamic routing do not provide state replication.

Answer

EtherChannel

Answer

Failover link

Answer

Dynamic routing

Question 13

An organization is deploying a new PKI for internal services and needs a certificate that will be used to sign other certificates, including subordinate CA certificates. Which type of certificate should be issued for this purpose?

Accepted Answer

Root CA certificate. A root CA certificate is the trust anchor and includes the CA basic constraint, allowing it to sign subordinate CA certificates and end-entity certificates. End-entity, self-signed server, and CRL signing certificates serve different purposes and cannot issue subordinate CAs.

Answer

End-entity certificate

Answer

Self-signed server certificate

Answer

Certificate Revocation List signing certificate

Question 14

A Cisco engineer is designing a secure remote-access VPN that must support clientless connections to internal web applications, full tunnel access for managed laptops, and integration with Cisco Identity Services Engine for posture assessment. Which Cisco solution should be deployed to meet all these requirements in a single platform?

Accepted Answer

Cisco Secure Client (AnyConnect) with Cisco Secure Firewall ASA headend. Cisco Secure Client deployed with an ASA or Secure Firewall headend supports clientless portal access, full tunnel VPN, and ISE posture integration in one solution. The other options address cloud web security, branch interconnect, or identity services alone, none of which provide the combined remote-access capabilities required.

Answer

Cisco Umbrella with SIG tunneling from branch offices

Answer

Cisco Identity Services Engine with pxGrid and passive identity

Answer

Cisco SD-WAN with IPsec tunnels between branches

Question 15

A security operations center (SOC) uses Cisco Secure Endpoint and wants to proactively hunt for indicators of compromise (IOCs) across all endpoints. The team needs to query running processes, loaded modules, and network connections on demand without disrupting endpoint operations. Which Secure Endpoint feature should they use?

Accepted Answer

Orbital Advanced Search. Orbital Advanced Search is designed for live endpoint interrogation using SQL-like queries, enabling SOC teams to hunt for IOCs across the fleet. It queries current state without disruption. Other features are for historical analysis, file sandboxing, or signature creation, not proactive live hunting.

Answer

Custom Detections

Answer

File Analysis

Answer

Device Trajectory

Question 16

An administrator must allow a remote user to access the corporate network over a VPN so that the user receives an internal address and traffic is tunneled to the headend while split tunneling is disabled. Which technology matches this requirement?

Accepted Answer

Remote-access IPsec/IKEv2 VPN using Cisco Secure Client. A remote-access IPsec/IKEv2 VPN with Cisco Secure Client gives the roaming user an internal address from a configured pool and tunnels traffic to the headend. With split tunneling disabled, all traffic including internet-bound flows traverses the tunnel, matching the requirement. Site-to-site, clientless, and GRE options lack the per-user client tunnel and internal address assignment.

Answer

Site-to-site IPsec VPN between two firewalls

Answer

GRE tunnel between two routers

Answer

Clientless SSL VPN through a browser portal

Question 17

A network administrator is deploying Cisco TrustSec in a campus network. The administrator needs to enforce access policies based on Security Group Tags (SGTs) between endpoints. Which two statements about SGT enforcement are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the connector to use a proxy with credentials in the policy settings.. The correct approach is to configure proxy settings within the Secure Endpoint policy, including any required authentication. This allows the connector to communicate through the proxy to the Cisco cloud. Other options either do not exist, are for different scenarios, or would not work in a proxy-restricted environment.

Answer

Enable 'Cloud Communication' in the connector's local GUI and specify a PAC file.

Answer

Set the connector to 'Offline Mode' and manually upload detection data.

Answer

Configure the connector to use a direct connection and bypass the proxy.

Question 18

A security administrator is configuring Cisco TrustSec on a switch and wants to assign a Security Group Tag (SGT) to traffic based on the user's identity without relying on 802.1X supplicant configuration on the endpoint. Which feature should be used to dynamically assign the SGT?

Accepted Answer

Cisco ISE integration with the switch using Change of Authorization. Dynamic SGT assignment based on user identity is achieved through Cisco ISE integration, where ISE authenticates the user and sends a Change of Authorization to the switch with the appropriate SGT. This method does not require an 802.1X supplicant because ISE can use web authentication or MAB. Static or manual methods do not provide identity-based dynamic tagging.

Answer

Static SGT assignment on the switch port

Answer

MACsec encryption on the access port

Answer

Configuring a manual SGT in the access control list

Question 19

A financial institution uses Cisco Secure Endpoint and wants to integrate it with Cisco Threat Response (CTR) to accelerate investigations. An analyst receives an alert about a suspicious file and wants to automatically enrich the investigation with endpoint telemetry, such as process lineage and network connections, without manually running queries. Which Cisco Secure Endpoint feature should the analyst leverage within CTR?

Accepted Answer

SecureX Threat Response (CTR) built-in AMP for Endpoints module. Cisco Threat Response (CTR) includes a built-in integration with Cisco Secure Endpoint (formerly AMP for Endpoints) that automatically pulls endpoint telemetry when an alert is investigated. This module enriches the investigation with detailed file trajectory, process lineage, and network connections, enabling analysts to quickly understand the scope of an incident without manual queries. Other features like Orbital require manual query creation and do not provide automatic enrichment.

Answer

File Reputation Lookup

Answer

Endpoint Isolation

Answer

Orbital Advanced Search

Question 20

A financial services company uses Cisco Umbrella to protect users accessing SaaS applications. The security team needs to block uploads of files containing personally identifiable information (PII) to unsanctioned cloud storage services while allowing uploads to approved services. Which Cisco Umbrella capability should be configured?

Accepted Answer

Cloud Access Security Broker (CASB) with DLP. Cisco Umbrella's CASB with DLP is designed to provide granular, content-aware control over SaaS application usage. It can discover unsanctioned cloud storage services, inspect file uploads for sensitive data patterns like PII, and enforce policies that block only the risky uploads while permitting approved services. The other capabilities operate at DNS, URL, or network layers without content inspection.

Answer

Firewall rules with application control

Answer

Secure Web Gateway (SWG) URL filtering

Answer

DNS-layer security policies