350-701 Practice Exam 55 — 20 Questions

Question 1

A financial institution uses Cisco ESA and wants to protect against spear phishing attacks targeting executives. The security team configures DMARC with a 'reject' policy for the corporate domain. Additionally, they want to ensure that emails from external sources claiming to be from the CEO are flagged and quarantined. Which THREE security measures should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Impersonation protection (display name spoofing detection). DMARC reject policy handles spoofed domains; impersonation protection can catch display name spoofing; and anti-phishing filters with machine learning detect advanced phishing attempts.

Answer

Outbreak filters

Answer

Anti-spam with SenderBase

Question 2

An organization is implementing email authentication to prevent domain spoofing. They have deployed SPF and DKIM. Which additional record should they publish to instruct receiving mail servers on how to handle emails that fail SPF or DKIM checks?

Accepted Answer

DMARC TXT record. DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers how to handle emails that fail SPF/DKIM (e.g., reject or quarantine).

Answer

CNAME record for DKIM

Answer

TXT record with v=spf1

Answer

MX record with priority 0

Question 3

An engineer is troubleshooting why AMP for Endpoints is not detecting a specific malicious file. The file hash is available and other endpoints detected it. What is the most likely cause for the detection failure on this endpoint?

Accepted Answer

The endpoint's AMP connector has local analysis disabled, preventing hash matching.. When AMP for Endpoints fails to detect a file that is known to be malicious (based on its hash) and other endpoints have already detected it, the most likely cause is that local analysis (also known as local scanning or local hash matching) is disabled on the failing endpoint. AMP for Endpoints uses a combination of cloud-based lookups and local analysis. If local analysis is disabled, the endpoint cannot perform hash-based detection against its local cache or signature database, and it must rely entirely on cloud connectivity. If the cloud lookup is delayed or the endpoint is offline, detection fails. Option B directly addresses this scenario.

Answer

The AMP connector is not configured with a proxy when needed.

Answer

The AMP signature database on that endpoint is outdated.

Answer

The AMP policy is set to 'Block' instead of 'Detect'.

Question 4

A security analyst discovers that a user downloaded a CSV file containing social security numbers from a sanctioned cloud storage app, but no alert was generated. The DLP policy shown in the exhibit was applied. What is the most likely reason the policy failed to trigger?

Accepted Answer

The social security numbers in the file did not contain dashes, so the regex did not match.. The DLP policy uses a regex pattern that expects dashes in the social security numbers (e.g., \d{3}-\d{2}-\d{4}). If the CSV file contained SSNs without dashes (e.g., 123456789), the regex would not match, and no alert would be generated. This is the most likely reason the policy failed to trigger, as the data format did not meet the policy's detection criteria.

Answer

The user bypassed the DLP policy using an API call.

Answer

The policy was not applied to the cloud storage app used by the user.

Answer

The policy only notifies the admin and does not block the download.

Question 5

A security team is implementing endpoint hardening measures. They want to ensure that only approved applications can run, monitor for suspicious behavior, and have the ability to isolate processes if needed. Which THREE Cisco AMP features should they enable? (Choose three.)

Accepted Answer

Host-based IPS (Exploit Prevention). Application whitelisting (via Cisco AMP's application control) restricts execution to approved apps; host-based IPS (Exploit Prevention) monitors behavior; and EDR capabilities (process isolation) allow containment. These three together harden endpoints.

Answer

File quarantine

Answer

Retrospective security

Question 6

Which TWO are valid methods for integrating Cisco Umbrella with an existing network to provide DNS-layer security?

Accepted Answer

Roaming Security client installed on endpoints.. The Cisco Umbrella Roaming Security client, when installed on endpoints, automatically redirects DNS queries to the Umbrella cloud via a local proxy, providing DNS-layer security without requiring network infrastructure changes. This method ensures that all DNS traffic from the endpoint is filtered by Umbrella's policy, even when the device is off the corporate network.

Answer

SNMP monitoring of DNS queries.

Answer

IPsec VPN tunnel to Umbrella cloud.

Answer

BGP peering to route DNS traffic to Umbrella.

Question 7

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

Accepted Answer

Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.. Cisco AMP for Endpoints integrates with Firepower Management Center (FMC) via the AMP cloud API. To enable this, the FMC must have the AMP integration enabled and be configured with the correct API credentials (Client ID and API Key) from the AMP cloud console. This allows the FMC to pull endpoint detection events directly from the AMP cloud, correlating them with network-based detections from the Firepower NGFW.

Answer

Configure the AMP connectors to send Syslog events to the FMC.

Answer

Deploy an on-premises AMP console to forward events to FMC.

Answer

Configure the Firepower NGFW to be the default gateway for the endpoints.

Question 8

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 9

A security analyst is tuning Snort IPS rules to reduce false positives. Which TWO strategies are effective?

Accepted Answer

Disable the rule that is causing false positives. Disabling a rule that is triggering false positives immediately stops those false alerts. Adding a pass rule tells Snort to ignore that traffic, preventing false positives for known benign traffic. Changing the action to 'alert' does not reduce false positives; it only changes the response from dropping to alerting, so the false alerts persist.

Answer

Increase the sensitivity of all rules

Answer

Enable all rules to maximize coverage

Answer

Set the rule action to 'alert' instead of 'drop'

Question 10

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

Accepted Answer

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA. In explicit proxy mode, the WSA only intercepts traffic that is explicitly configured to use it as a proxy. Users can bypass the proxy by configuring their browser or application to use a direct HTTPS connection (e.g., using CONNECT tunnels over port 443). To prevent this, a firewall rule must block all outbound HTTP/HTTPS traffic except traffic originating from the WSA's IP address, forcing all web traffic through the proxy.

Answer

Enable SSL decryption on the WSA

Answer

Configure identity-based authentication for all users

Answer

Create a custom URL category for tunneling websites and block them

Question 11

A Cisco ASA is configured with a site-to-site VPN using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec tunnel?

Accepted Answer

Transform set. A transform set specifies the encryption (e.g., AES) and authentication (e.g., SHA) algorithms for IPsec. ISAKMP policy is for IKE phase 1, and crypto map binds the policy to an interface.

Answer

ISAKMP policy

Answer

IKEv2 proposal

Answer

Crypto map

Question 12

A company has deployed Cisco Umbrella with a virtual appliance (VA) for content filtering. Users report that some websites are not loading properly, and the helpdesk suspects that the VA is blocking legitimate traffic. The network administrator checks the VA dashboard and sees that the VA is passing traffic normally. However, the administrator notices that the VA's upstream DNS server is set to a public resolver (208.67.222.222) instead of the company's internal DNS servers. This causes internal hostnames to resolve incorrectly. The company uses Active Directory with domain-joined computers. What should the administrator do to resolve the issue?

Accepted Answer

Change the upstream DNS server in the VA configuration to point to the internal DNS servers.. The virtual appliance (VA) acts as a forwarding proxy; it receives DNS queries from clients, forwards them to its configured upstream DNS server, and applies content filtering policies. When the upstream DNS is set to a public resolver like 208.67.222.222 (OpenDNS), the VA cannot resolve internal Active Directory domain names (e.g., .local or internal FQDNs) because the public resolver has no knowledge of the private DNS zone. Changing the upstream DNS server to the company's internal DNS servers allows the VA to resolve both internal and external names correctly, while still applying Umbrella's content filtering policies to external traffic.

Answer

Add a conditional forwarder in the internal DNS for all .local domains.

Answer

Configure the clients to use Umbrella's DNS directly instead of the VA.

Answer

Disable Umbrella content filtering for internal domain names.

Question 13

A Cisco FTD is configured with an access control policy that includes a rule to allow traffic from a specific source subnet. However, traffic is being blocked. Which TWO possible causes should be checked?

Accepted Answer

The source subnet is not correctly defined in the network object.. Rule order matters (first match wins) and if an earlier rule blocks the traffic, the allow rule never applies. Also, intrusion policy could block if set to drop.

Answer

The intrusion policy is set to 'No Inspection'.

Answer

The default action is set to 'Allow'.

Answer

The rule has a destination port that is incorrect.

Question 14

A cloud security engineer is evaluating CSPM (Cloud Security Posture Management) solutions. Which TWO capabilities are essential for a CSPM tool? (Select two.)

Accepted Answer

Continuous compliance monitoring with industry standards. CSPM tools are fundamentally designed to continuously monitor cloud environments against industry standards such as CIS, NIST, and PCI DSS. This ensures that the cloud infrastructure remains compliant with regulatory and security frameworks, which is a core requirement for cloud security posture management.

Answer

Vulnerability scanning of container images

Answer

Incident response automation with playbooks

Answer

Real-time network traffic analysis

Question 15

While troubleshooting an issue where Cisco ESA occasionally fails to process inbound messages, the administrator checks the listener settings and sees that the 'Pool of listeners' option is configured. The mail logs show 'Connection refused' errors during peak hours. What is the most likely cause?

Accepted Answer

Listener pool has too few listeners or the pool is misconfigured. The 'Connection refused' error during peak hours indicates that the Cisco ESA's listener service is actively rejecting new SMTP connections because the configured listener pool has reached its maximum capacity. The 'Pool of listeners' option defines a set of listener processes that handle inbound mail; if the pool size is too small for the traffic volume, new connections are refused. This is a resource exhaustion issue specific to the listener pool, not a service outage or external blocking.

Answer

The listener service is stopped

Answer

The sender's IP is blacklisted

Answer

DNS resolution failure for the sending MTA

Question 16

Which TWO of the following are benefits of using Cisco Cloudlock for cloud security? (Choose two.)

Accepted Answer

Shadow IT discovery. Cisco Cloudlock is a cloud access security broker (CASB) that provides visibility into cloud application usage. Option A is correct because Cloudlock's Shadow IT discovery feature identifies unauthorized cloud applications being used by employees, allowing administrators to assess risk and enforce policies. This is a core CASB function that discovers and categorizes cloud apps based on user traffic patterns.

Answer

DDoS protection

Answer

Network firewall capabilities

Answer

Identity and access management

Question 17

In Cisco Firepower Management Center (FMC), which action in an access control rule will send a TCP RST to the source and destination and log the event?

Accepted Answer

Block with reset. The 'Block with reset' action sends RST packets to both endpoints. 'Trust' bypasses inspection, 'Allow' permits traffic, and 'Interactive Block' is for SSL decryption failure.

Answer

Trust

Answer

Allow

Answer

Interactive Block

Question 18

Which TWO of the following are best practices for securing Cisco routers against unauthorized access? (Choose two.)

Accepted Answer

Disable unused services like HTTP server and CDP. C is correct because disabling unused services like HTTP server and CDP reduces the attack surface of the router. The HTTP server can be exploited for web-based attacks, and CDP can leak sensitive network topology information. Cisco best practices recommend disabling all unnecessary services to minimize exposure.

Answer

Enable SNMP read-write community string for monitoring

Answer

Use the 'service password-enforcement' command to encrypt passwords with type 7

Answer

Configure authentication using HTTP with local username/password

Question 19

An engineer is configuring Cisco ISE for 802.1X authentication in a corporate network. A printer that does not support 802.1X needs to be granted network access. Which method should the engineer use to authenticate the printer?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address. The printer's MAC is used as the credential against the authentication server.

Answer

Guest Portal

Answer

PEAP-MSCHAPv2

Answer

EAP-TLS

Question 20

A small business uses Cisco Duo for multi-factor authentication. They want to ensure that employees accessing cloud apps from personal devices are compliant with device security policies. Which Duo feature should they use?

Accepted Answer

Duo Device Health. B (Duo Device Health) is correct because it checks device security posture (OS version, encryption, etc.) before allowing access. A (Duo Mobile) is the authenticator app for push notifications and passcodes. C (Duo Network Gateway) is for VPN access. D (Duo Access Gateway) is for SSO.

Answer

Duo Mobile

Answer

Duo Network Gateway

Answer

Duo Access Gateway