350-701 Practice Exam 54 — 20 Questions

Question 1

A security architect is designing a multi-cloud environment that includes AWS, Azure, and on-premises VMware vSphere. The organization wants a single, consistent security policy to be enforced across all workload locations, including east-west traffic between virtual machines. Which Cisco solution should the architect deploy to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Secure Workload. Cisco Secure Workload is purpose-built for microsegmentation and policy enforcement across hybrid and multi-cloud workloads. It uses agents and cloud connectors to map dependencies and then enforce least-privilege policies on east-west traffic. The other options provide internet gateway security, identity-based network access, or traffic analytics, none of which deliver consistent workload-level segmentation across AWS, Azure, and on-premises vSphere.

Answer

Cisco Umbrella SIG

Answer

Cisco Identity Services Engine

Answer

Cisco Secure Network Analytics

Question 2

An administrator is configuring Cisco ESA to handle inbound email. They want to ensure that messages claiming to be from a trusted partner domain are rejected if they fail DMARC alignment, even if they pass SPF or DKIM individually. Which Cisco ESA feature should be configured to enforce this?

Accepted Answer

Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification. DMARC verification on Cisco ESA combines SPF and DKIM results with alignment checks against the From: domain and applies the domain owner's published policy. This allows the administrator to reject messages that fail DMARC, even if they pass SPF or DKIM separately. SPF and DKIM verification alone do not enforce alignment or policy, and AMP for Email focuses on malware, not authentication.

Answer

Cisco Advanced Malware Protection (AMP) for Email

Answer

DomainKeys Identified Mail (DKIM) verification

Answer

Sender Policy Framework (SPF) verification

Question 3

A network administrator is configuring a Cisco Identity Services Engine (ISE) to authenticate users via 802.1X. The administrator wants to ensure that only domain-joined Windows computers with up-to-date antivirus definitions are allowed on the corporate network. Which ISE feature should be used to evaluate the endpoint's compliance with these requirements before granting access?

Accepted Answer

Posture assessment. Cisco ISE Posture assessment is designed to check endpoint compliance with security policies, such as antivirus definitions, patch levels, and domain membership, before granting network access. Profiling identifies devices, guest services manage visitors, and BYOD onboarding handles personal devices. Therefore, posture assessment is the correct feature to meet the requirement.

Answer

BYOD onboarding

Answer

Guest services

Answer

Profiling

Question 4

A cloud security engineer is configuring Cisco Umbrella to protect a branch office. The company wants to block access to known malicious domains and also wants visibility into which internal user or device made each request. The branch uses a Cisco router as the DNS forwarder for all endpoints. Which Umbrella component and configuration should the engineer deploy?

Accepted Answer

Configure the Cisco router to forward DNS queries to the Umbrella Virtual Appliance IP addresses and enable the Virtual Appliance to send internal IP and user mappings to Umbrella.. The Umbrella Virtual Appliance is the on-premises component that lets network devices forward DNS while preserving internal IP and user attribution. Combined with the Active Directory Connector, it maps internal IPs to usernames so Umbrella reports show which user or device generated each DNS request, while still enforcing Umbrella's malicious-domain blocklists.

Answer

Deploy a Cisco Umbrella SIG tunnel from the branch router to Umbrella and enable the Intelligent Proxy for all DNS requests.

Answer

Install the Umbrella Roaming Client on every endpoint and register them to the branch's network identity.

Answer

Point the router's DNS to the public Umbrella resolver IPs and enable EDNS Client Subnet so Umbrella can identify internal users.

Question 5

A security engineer is asked to protect a public web application from application-layer attacks while also ensuring that legitimate user sessions are not blocked during a burst of legitimate traffic. The application team requires granular, signature-based protection for HTTP. Which Cisco solution should be deployed in front of the web servers?

Accepted Answer

Cisco Firepower NGFW with Snort 3 intrusion prevention policies. Application-layer HTTP attacks such as SQL injection and cross-site scripting require deep inspection of request contents, which Snort 3 signatures on Firepower NGFW provide. The platform also supports thresholding and rate-based detection to avoid blocking legitimate traffic during bursts. DNS filtering, flow analytics, and posture enforcement operate at different layers and cannot deliver signature-based HTTP inspection in front of the web servers.

Answer

Cisco Umbrella DNS-layer security

Answer

Cisco Secure Network Analytics flow analysis

Answer

Cisco Identity Services Engine with posture policy

Question 6

A network security engineer is configuring a Cisco ASA with VPN load balancing to distribute remote-access VPN connections across multiple ASA devices. Which technology should be used to achieve this?

Accepted Answer

VPN load balancing cluster. Cisco ASA VPN load balancing cluster allows multiple ASAs to act as a single virtual device, distributing remote-access VPN connections across members. This provides scalability and high availability without external load balancers. The cluster uses a virtual IP address that clients connect to, and the master ASA distributes sessions to other members based on load.

Answer

External load balancer

Answer

AnyConnect with multiple profiles

Answer

Dynamic routing with OSPF

Question 7

A security engineer is configuring Cisco Identity Services Engine (ISE) to enforce posture assessment for employees connecting to the corporate network. The requirement is that endpoints must have the latest antivirus definitions and an active firewall before being granted full access. Which ISE feature should be used to meet this requirement?

Accepted Answer

Configure posture policies with conditions that check antivirus definition date and firewall status, and assign a posture profile that triggers remediation.. Cisco ISE posture policies are designed to assess endpoint compliance with security requirements such as up-to-date antivirus definitions and active firewall. By configuring conditions that check these attributes and associating a posture profile, the engineer can enforce remediation for non-compliant endpoints before granting full network access.

Answer

Implement TrustSec security group tags (SGTs) and enforce a policy that permits only endpoints with a specific SGT.

Answer

Enable Change of Authorization (CoA) to reauthenticate endpoints periodically and apply a redirect URL.

Answer

Create an authorization policy that assigns a downloadable ACL (dACL) based on the endpoint's MAC address.

Question 8

A security administrator is configuring 802.1X on Cisco switches and wants to ensure that both the identity of the endpoint and the user are validated before network access is granted. Which two Cisco ISE features or capabilities support this requirement? (Choose two.)

Accepted Answer

PEAP with MSCHAPv2 for user authentication. EAP-TLS with client certificates validates the machine identity, while PEAP with MSCHAPv2 validates the user identity. Together they ensure both endpoint and user are authenticated. MAB, CoA, and RADIUS accounting do not provide the required identity validation.

Answer

MAC Authentication Bypass (MAB) for devices that do not support 802.1X

Answer

RADIUS accounting to log session start and stop records

Answer

Change of Authorization (CoA) to reauthenticate after posture assessment

Question 9

A security engineer is configuring a Cisco Identity Services Engine (ISE) to authenticate employees connecting to the corporate wireless network. The engineer wants to ensure that only devices that have the latest antivirus definitions and OS patches are allowed access. Which ISE feature should be used to evaluate the device's posture?

Accepted Answer

Posture assessment. Posture assessment is the correct feature because it actively checks endpoints for compliance with security policies, such as up-to-date antivirus and patches, before allowing network access. It integrates with ISE's policy sets to grant or deny access based on the posture result. Other features like profiling or guest services do not evaluate the security state of the device.

Answer

Bring Your Own Device (BYOD) onboarding

Answer

Guest services

Answer

Profiling

Question 10

A security architect is designing a solution to protect user access to SaaS applications. The organization wants to enforce data loss prevention policies, detect anomalous user behavior, and provide granular visibility into sanctioned and unsanctioned cloud apps. Which Cisco technology should be deployed?

Accepted Answer

Cisco Cloudlock. Cisco Cloudlock is a CASB that delivers the needed capabilities: DLP for SaaS data, user behavior analytics to detect anomalies, and discovery of sanctioned/unsanctioned apps. It uses APIs to inspect data at rest and in motion, and applies policies based on user, device, and content. The other options provide network or identity security but lack the specialized SaaS visibility and data protection functions.

Answer

Cisco Umbrella

Answer

Cisco Stealthwatch Cloud

Answer

Cisco Identity Services Engine (ISE)

Question 11

A security operations team wants to detect malicious command-and-control traffic that uses domain fronting and encrypted TLS sessions to well-known cloud services. They need a solution that inspects TLS metadata without full decryption and correlates with threat intelligence. Which Cisco technology best fits this requirement?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch) with Encrypted Traffic Analytics. Secure Network Analytics with Encrypted Traffic Analytics identifies malware in encrypted flows using metadata and machine learning without decrypting TLS. The other options either decrypt traffic, rely on DNS controls, or enforce segmentation, none of which meet the no-decryption, metadata-based detection requirement.

Answer

Cisco Firepower NGFW with SSL decryption policy

Answer

Cisco Identity Services Engine with TrustSec SGTs

Answer

Cisco Umbrella with DNS-layer security

Question 12

A company is migrating its on-premises web application to AWS. The security team wants to protect the application from common web exploits such as SQL injection and cross-site scripting, and also mitigate distributed denial-of-service (DDoS) attacks at the application layer. Which AWS service should they use in conjunction with AWS Shield?

Accepted Answer

AWS WAF. AWS WAF is the appropriate service to protect web applications from application-layer exploits like SQL injection and cross-site scripting. It integrates with AWS Shield, which mitigates DDoS attacks, to provide layered protection. The other services operate at different layers or serve detection/management functions rather than inline web traffic filtering.

Answer

AWS Network Firewall

Answer

Amazon GuardDuty

Answer

AWS Firewall Manager

Question 13

An engineer is deploying Cisco Umbrella for DNS-layer security. The engineer wants to block access to malicious domains for all users on the corporate network without installing any software on endpoints. Which deployment method should be used?

Accepted Answer

Configure the corporate DNS servers to forward queries to Cisco Umbrella's DNS resolvers.. To protect all users without endpoint software, the corporate DNS servers should forward queries to Cisco Umbrella. This ensures that all DNS requests are checked against Umbrella's threat intelligence, blocking malicious domains. Other methods require endpoint software, on-premises appliances, or browser configuration, which do not meet the no-software requirement.

Answer

Install the Cisco Umbrella Roaming Client on each endpoint.

Answer

Deploy Cisco Umbrella virtual appliances on-premises and configure them as DNS servers.

Answer

Configure a PAC file in the web browsers to redirect traffic to Umbrella.

Question 14

A security architect is designing segmentation for a data center using Cisco TrustSec. The requirement is that traffic between the web tier and the database tier must be restricted so that only specific TCP ports are allowed, and the policy must follow the workload even if it is migrated to a different rack and subnet. Which TrustSec component provides this enforcement?

Accepted Answer

Security Group Tag (SGT) applied to the workload, with SGACL enforcement on the egress switch port. TrustSec SGTs tag traffic based on group membership, and SGACLs on the egress device enforce group-to-group rules with port granularity. Because enforcement keys on the tag rather than the IP address or VLAN, the policy remains valid when the workload migrates to a different rack or subnet, which is the defining advantage over VACLs, PVLANs, and IP ACLs.

Answer

IP-based ACL on the data center core routers

Answer

Private VLAN (PVLAN) configuration on the database tier switches

Answer

VLAN ACL (VACL) applied to the database tier VLAN

Question 15

A Cisco Firepower NGFW administrator notices that a specific internal host is repeatedly establishing outbound TCP connections to a known command-and-control server across multiple ports. The administrator wants to quickly identify the malicious domain and IP addresses associated with this activity for further investigation. Which Firepower feature should be used to correlate this threat intelligence?

Accepted Answer

Security Intelligence (SI) feeds. Security Intelligence feeds are the correct choice because they provide curated lists of malicious IPs, URLs, and DNS names that Firepower uses to automatically detect and block traffic to command-and-control servers. This allows the administrator to quickly identify and correlate the threat without manual configuration. Other features like Network Discovery or URL filtering do not offer this specific threat intelligence correlation.

Answer

Access control policy with URL filtering

Answer

Network Discovery policy

Answer

Correlation policy with custom rules

Question 16

A security team is evaluating Cisco Stealthwatch (Secure Network Analytics) to detect threats using network flow data. Which two capabilities are provided by this solution? (Choose two.)

Accepted Answer

Identification of internal hosts communicating with known malicious external IP addresses. Secure Network Analytics ingests NetFlow and IPFIX records to build behavioral baselines and correlate traffic with threat intelligence. It detects exfiltration by flagging hosts whose outbound flow patterns deviate from their peer group, and it identifies compromised hosts by matching destinations against known malicious IP watchlists. These two capabilities reflect its role as a network-based detection and response platform.

Answer

Inline decryption of TLS traffic to inspect payloads for malware signatures

Answer

Enforcement of endpoint antivirus compliance before granting network access

Answer

Blocking of malicious domains at the DNS resolution layer before a connection is made

Question 17

A security analyst at a financial services firm notices a sudden spike in outbound DNS queries from a single internal host, each query targeting a different random subdomain of the same external domain (e.g., a1b2c3.badzone.example). The queries are small and the responses are also small, but the total volume is high. The analyst suspects data exfiltration. Which technique is MOST likely being used?

Accepted Answer

DNS tunneling. The high volume of small DNS queries to random subdomains of a single domain is a classic indicator of DNS tunneling, where data is encoded in the subdomain labels and exfiltrated via DNS. Unlike DGA, which uses many different domains, or fast flux, which rotates IPs, DNS tunneling maintains a consistent domain but varies subdomains to carry data.

Answer

Domain generation algorithm (DGA) beaconing

Answer

DNS cache poisoning

Answer

Fast flux DNS

Question 18

A security team is configuring Cisco Umbrella to protect a remote branch where users frequently connect directly to the internet without VPN. They want to enforce web filtering policies and block malicious domains for these roaming users without installing a virtual appliance on the branch router. Which deployment method should they use?

Accepted Answer

Umbrella Roaming Client. The requirement is to protect roaming users who connect directly to the internet without VPN and without a virtual appliance at the branch. The Umbrella Roaming Client is installed on endpoints and enforces DNS-layer security wherever the user goes. It ensures web filtering and malicious domain blocking without relying on network infrastructure, making it the appropriate choice for this scenario.

Answer

Umbrella SIG tunnel

Answer

Umbrella Virtual Appliance

Answer

Cisco Firepower DNS policy

Question 19

A company is migrating its customer-facing web application to Microsoft Azure. The security team must ensure that only HTTP and HTTPS traffic reaches the web tier from the internet and that no other inbound ports are exposed. Which Azure feature should they configure?

Accepted Answer

Azure Network Security Group applied to the web tier subnet, with inbound rules allowing only TCP 80 and 443 from the Internet and a default deny for all other inbound traffic.. Azure Network Security Groups are the native stateful packet filter for subnets and network interfaces in a virtual network. By allowing only TCP 80 and 443 from the Internet and leaving the default deny rule in place, the team restricts the web tier to web traffic while the stateful engine permits return flows, which is the simplest correct control for this requirement.

Answer

Azure Firewall deployed in a hub virtual network with a DNAT rule translating public IP port 80 and 443 to the web tier's private IP addresses.

Answer

Azure Application Gateway with a Web Application Firewall policy in Prevention mode attached to the web tier.

Answer

Azure DDoS Protection Standard enabled on the virtual network hosting the web tier.

Question 20

An administrator is configuring a Cisco ASA firewall for AnyConnect VPN. The administrator wants to ensure that after a user authenticates, the VPN session is terminated if the endpoint does not have the latest antivirus signature. Which ASA feature should be configured?

Accepted Answer

HostScan with posture assessment. HostScan is the ASA feature that performs endpoint posture assessment, including checking antivirus signatures. When configured with posture assessment, it can evaluate the endpoint and if it fails, the ASA can terminate the session or apply restricted access. Other options do not perform the actual posture check. DAP can enforce policies based on posture results, but it relies on HostScan to gather the information.

Answer

Dynamic Access Policy (DAP)

Answer

AnyConnect Custom Attributes

Answer

Clientless SSL VPN with bookmarks