350-701 Practice Exam 54 — 20 Questions

Question 1

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ISE has not synchronized the latest AD group membership. ISE uses Active Directory (AD) as an identity source and must synchronize group membership changes before it can map the new user to the correct Security Group Tag (SGT). If the AD group membership has not been refreshed via the scheduled or manual sync, ISE will not know the new user belongs to the 'Finance' group, resulting in a default SGT of 0 (unknown/untrusted). Other users already in the group work fine because their membership was present during the last successful sync.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 2

A multinational corporation is deploying Cisco ISE to enforce network access for both wired and wireless users. The company has 5,000 employees and 2,000 guest users daily. The ISE deployment consists of two nodes: a primary Administration Node (PAN) and a Monitoring Node (MNT). All policies are configured on the PAN. Recently, the company has experienced intermittent authentication failures during peak hours. The failures affect both wired 802.1X and wireless users. The syslogs show 'RADIUS request dropped' messages on the ISE nodes. The network team has verified that the RADIUS shared secret is correct and that the network devices can reach the ISE nodes. The ISE nodes have sufficient CPU and memory. However, the authentication failures correlate with times when the number of concurrent sessions exceeds 500. What is the most likely cause of the issue?

Accepted Answer

The ISE node is running out of RADIUS session capacity. The 'RADIUS request dropped' messages and correlation with concurrent sessions exceeding 500 indicate that the ISE node has reached its RADIUS session capacity. Cisco ISE nodes have a finite number of RADIUS session contexts (typically 500 for a single node in many deployments), and once this limit is exceeded, new authentication requests are dropped. This is a licensing and resource limitation, not a CPU or memory issue, and it explains why failures occur only during peak hours.

Answer

The ISE nodes are not reachable from the network devices

Answer

The RADIUS shared secret is mistyped on some network devices

Answer

The CPU and memory are insufficient despite appearing sufficient

Question 3

An organization is deploying Cisco ESA and wants to ensure that outbound emails containing credit card numbers are blocked. The administrator configures a DLP policy to scan for credit card patterns. However, some legitimate emails with credit card numbers are being incorrectly blocked. What is the best approach to reduce false positives while still preventing data leakage?

Accepted Answer

Change the DLP action from 'Block' to 'Confirm with Sender'. Changing the DLP action from 'Block' to 'Confirm with Sender' allows the Cisco ESA to send a notification to the sender when a credit card pattern is detected, asking them to confirm whether the email should be sent. This reduces false positives by giving legitimate senders a chance to override the block, while still preventing accidental data leakage by requiring explicit confirmation. The DLP policy remains active, so unauthorized or unconfirmed outbound emails containing credit card numbers are still stopped.

Answer

Disable the DLP policy for outbound email

Answer

Increase the DLP sensitivity threshold

Answer

Add all senders to a DLP exemption list

Question 4

Which TWO are required to successfully deploy Cisco AMP for Endpoints in a Windows domain environment with Group Policy?

Accepted Answer

Install the AMP connector on each endpoint. The AMP for Endpoints connector is the agent software that must be installed on each endpoint to provide malware detection, file trajectory, and retrospective security analysis. Without the connector, the endpoint cannot communicate with the AMP cloud or enforce any security policies, making deployment non-functional.

Answer

Configure the firewall to block outbound HTTPS traffic

Answer

Install the AMP connector on a domain controller

Answer

Ensure all endpoints are joined to the domain

Question 5

An administrator reviewed the log entry from the Cisco ESA exhibit. The DLP policy is set to 'Continue (with disclaimer)' for credit card matches. How should the policy be changed to prevent this data leakage?

Accepted Answer

Change the DLP policy action from 'Continue' to 'Drop'.. The current DLP policy action 'Continue (with disclaimer)' allows the email to be delivered after appending a disclaimer, which does not prevent data leakage. Changing the action to 'Drop' will block the email entirely, preventing the credit card data from leaving the organization. This directly addresses the requirement to stop the data leakage.

Answer

Remove the DLP policy assignment for the Finance mail flow.

Answer

Lower the DLP sensitivity threshold.

Answer

Enable TLS encryption on the policy.

Question 6

Which THREE capabilities are provided by Cisco ISE's visibility services within the Secure Network Access domain? (Choose three.)

Accepted Answer

Endpoint profiling and classification (including IoT). Cisco ISE visibility services focus on identifying and profiling endpoints, managing guest access, and collecting contextual data. Option A (Endpoint profiling and classification, including IoT) is correct because ISE uses profiling probes to classify devices. Option D (Guest user registration and sponsor workflows) is correct as ISE provides a guest portal for registration and sponsor approval. Option E (Passive identity monitoring and contextual data collection) is correct as ISE can monitor network traffic passively via integrations like pxGrid to collect identity and context. Options B and C are incorrect: 802.1X authentication is an enforcement mechanism, not a visibility service, and Security Group Access (SGA) enforcement is a policy enforcement feature, not visibility.

Answer

802.1X authentication for wired and wireless

Answer

Security group access control enforcement

Question 7

A company uses Cisco Threat Response (CTR) to investigate a potential breach. The analyst sees an observable (SHA256) with a score of 90 in the threat grid. However, the AMP connector on the endpoint shows 'Allow' for that file. What could cause this discrepancy?

Accepted Answer

The AMP policy uses 'Local Analysis' and the local analysis determined the file was safe.. Cisco AMP for Endpoints uses a layered approach: cloud-based file reputation (Threat Grid) provides a score, but if the policy has Local Analysis enabled, the endpoint's local engine can override the cloud verdict. In this scenario, the local analysis determined the file was safe, so the file was allowed despite the high cloud score of 90. This explains the discrepancy between the Threat Grid score and the AMP connector's 'Allow' action.

Answer

The 'File Blocking' setting is set to 'Off' for the policy, ignoring cloud scores.

Answer

The AMP policy has file reputation disabled, so all files are allowed.

Answer

The file was blocked but the AMP console shows 'Allow' due to delayed event ingestion.

Question 8

Refer to the exhibit. A security engineer reviews the Cisco Secure Endpoint policy. If an endpoint is offline when a user downloads a file, what will happen?

Accepted Answer

The file will be allowed because local cache will store an unknown disposition.. When an endpoint is offline, Cisco Secure Endpoint cannot perform a cloud lookup to determine the file's disposition. The local cache stores the disposition as 'unknown' for files that have not been seen before, and the file is allowed to execute because the default action for an unknown disposition in an offline scenario is to permit the file. This behavior is controlled by the policy setting for 'Unknown' files, which defaults to 'Allow' when the cloud is unreachable.

Answer

The file will be held until the endpoint comes online and a cloud lookup completes.

Answer

The file will be quarantined due to the aggressive exploit prevention level.

Answer

The file will be blocked immediately by scan-on-write.

Question 9

An engineer is troubleshooting a site-to-site IPsec VPN between two Cisco routers. The tunnel is not establishing. Which command would verify that IKE phase 1 negotiations have completed successfully?

Accepted Answer

show crypto isakmp sa. The 'show crypto isakmp sa' command displays the state of IKE (Internet Key Exchange) Phase 1 security associations (SAs). A successful Phase 1 negotiation is indicated by a state of 'MM_ACTIVE' (Main Mode) or 'QM_IDLE' (Aggressive Mode), confirming that the peers have mutually authenticated and established a secure ISAKMP tunnel. This is the direct verification command for Phase 1 completion.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

debug crypto isakmp

Question 10

Refer to the exhibit. The engineer configured a file type filter for executables on access policy Policy_A. However, .exe files from trusted_sites are still being allowed. What is the most likely reason for this behavior?

Accepted Answer

The file type filter action is set to 'monitor' instead of 'block'.. The file type filter action is set to 'monitor' (which only logs) instead of 'block'. The access policy action is 'allow', so without a block action in the file type filter, executables are allowed. Option A is wrong because the file type filter is applied to Policy_A. Option B is wrong because the filter is on executables category, not URL. Option D is wrong because policy order is not shown to be an issue.

Answer

The file type filter is applied to the wrong access policy.

Answer

The URL category for trusted_sites is blocking the file type filter from being evaluated.

Answer

The access policy order is incorrect; a less specific policy is matching before Policy_A.

Question 11

A network administrator is deploying Cisco AMP for Endpoints to protect against advanced malware. They want to ensure that if a file is initially allowed but later determined to be malicious, the file is automatically blocked and quarantined on all endpoints that have executed it. Which AMP feature should be configured?

Accepted Answer

Retrospective Security (Retrospective). Retrospective Security (Retrospective) is the correct feature because it allows Cisco AMP for Endpoints to re-evaluate files that were initially allowed based on local or cloud reputation. If a file is later determined to be malicious via updated threat intelligence, Retrospective Security automatically blocks and quarantines that file on all endpoints that have executed it, even after the initial execution. This provides continuous protection against advanced malware that evades initial detection.

Answer

TETRA (Technique Extraction and Retrospective Analysis)

Answer

File Analysis via the AMP cloud

Answer

Exclude List for known good files

Question 12

A company is implementing a cloud security posture management (CSPM) solution. Which TWO of the following are primary functions of CSPM?

Accepted Answer

Detection and remediation of cloud resource misconfigurations (e.g., open S3 buckets).. CSPM is designed to detect and remediate cloud resource misconfigurations, such as publicly accessible S3 buckets, which are a leading cause of data breaches. It continuously assesses cloud infrastructure against security best practices and compliance frameworks like CIS and PCI DSS. Unlike network-based tools, CSPM focuses on the configuration state of cloud resources rather than inspecting traffic or managing identities.

Answer

Real-time inspection of network traffic for malicious patterns.

Answer

Vulnerability scanning of virtual machine operating systems.

Answer

Managing user identities and access permissions.

Question 13

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. The AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 14

During a security incident, an analyst uses Cisco AMP for Endpoints to remotely investigate a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to continue the investigation. Which AMP action should be taken?

Accepted Answer

Isolate. Process isolation is not a standard AMP action; however, AMP allows endpoint isolation (network containment) and remote shell for investigation. The best option is to isolate the endpoint and use remote shell. But since only one action is allowed, 'Isolate' is the correct answer as it blocks network traffic while allowing AMP management.

Answer

Process isolation

Answer

File quarantine

Answer

Remove connector

Question 15

Refer to the exhibit. What happened to the file 'crack.exe'?

Accepted Answer

The file was blocked from executing.. The exhibit shows that Cisco AMP for Endpoints detected 'crack.exe' as malicious and applied the 'BLOCK' action, which prevents the file from executing on the endpoint. This is indicated by the 'BLOCK' disposition in the event details, meaning the file was blocked before it could run. Option B is correct because the file was blocked from executing based on the detection and policy configured in AMP.

Answer

The file was allowed because it was detected as malicious.

Answer

The file was detected but no action was taken.

Answer

The file was quarantined to a secure folder.

Question 16

Which Cisco WSA feature allows administrators to control bandwidth usage per user or group by limiting the amount of bandwidth consumed for specific applications?

Accepted Answer

Bandwidth controls. The WSA includes bandwidth controls that can be applied per user/group and per application category, allowing traffic shaping and rate limiting.

Answer

URL filtering

Answer

AVC (Application Visibility and Control)

Answer

Decryption policies

Question 17

A company is deploying a multi-tier application on AWS. The web servers must be accessible from the internet only on ports 80 and 443, while the database servers should be accessible only from the web servers on port 3306. Which combination of cloud network security controls should be used?

Accepted Answer

Security groups for each tier and a Network ACL on the database subnet. Security groups act as instance-level firewalls, allowing stateful filtering. NACLs are stateless and applied at the subnet level. Typically, security groups for each tier and NACLs for subnet-level filtering are used.

Answer

Only security groups for both tiers, no NACLs

Answer

Only Network ACLs for both subnets, no security groups

Answer

Network ACLs for the web tier and security groups for the database tier

Question 18

An endpoint security engineer wants to protect against memory injection attacks on endpoints running Windows. Which Cisco AMP feature should be enabled?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory-based attacks by monitoring and blocking techniques like buffer overflows and code injection.

Answer

Retrospective security

Answer

IOC scanning

Answer

Device Trajectory

Question 19

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 20

A network administrator wants to deploy Cisco WSA as a transparent proxy using WCCP. Which traffic redirection method does WCCP use?

Accepted Answer

WCCP redirects traffic from the router to the WSA. WCCP allows routers to redirect web traffic to the WSA transparently without client configuration.

Answer

GRE tunneling

Answer

DNS redirection

Answer

PAC file configuration on clients