350-701 Practice Exam 56 — 20 Questions

Question 1

Refer to the exhibit. An ISE administrator sees this error in the logs. What is the most likely cause?

Accepted Answer

The PassiveID identity source is not configured with the correct SGT mapping.. The error indicates that PassiveID received an SGT from a network device but does not have a mapping to convert it to an identity. This typically happens when the PassiveID identity source is not configured with the correct SGT-to-identity mapping. Option A is incorrect because licensing issues would produce different errors. Option C is incorrect because the SGT number range is not the cause of missing mapping. Option D is incorrect because a pxGrid connection failure would show connection-related errors, not a missing SGT mapping.

Answer

The ISE license does not support SGT.

Answer

The SGT number is out of range.

Answer

The pxGrid connection is down.

Question 2

A network engineer is implementing Cisco TrustSec. Which two components are required to enforce Security Group Access Control List (SGACL) policies? (Choose two)

Accepted Answer

Cisco Catalyst switch with CTS. Options B and C are correct. Cisco ISE Policy Service Node (C) defines SGACL rules and distributes them to enforcement points. A Cisco Catalyst switch with CTS (B) is the enforcement point that applies SGACLs based on SGTs. Options A, D, and E are not required components for basic SGACL enforcement.

Answer

Cisco Wireless LAN Controller

Answer

Cisco ASA Firewall

Answer

Cisco AnyConnect Secure Mobility Client

Question 3

The ISE logs show 'Authentication failed - RADIUS attribute Calling-Station-ID is missing' for a wired client. What is the most likely cause?

Accepted Answer

The switch is not configured to include the calling-station-id in RADIUS requests.. The switch must be configured to include the Calling-Station-ID (MAC address) in RADIUS requests (e.g., with the 'access-session include-attributes' command). If this attribute is missing, ISE will fail authentication with the specific error. Option B is incorrect because 'authentication mac-move deny' controls MAC mobility, not attribute delivery. Option C is incorrect because trunk ports can still support 802.1X; the port mode does not directly cause missing Calling-Station-ID. Option D is incorrect because if the MAC is not registered, ISE would return a different failure reason (e.g., 'Unknown client'), not a missing attribute.

Answer

The switch is configured with 'authentication mac-move deny'.

Answer

The switch port is configured as a trunk port.

Answer

The client's MAC address is not registered in ISE.

Question 4

Refer to the exhibit. A network analyst reviews a Stealthwatch flow analysis output. What is the most likely interpretation?

Accepted Answer

This is likely a data exfiltration attempt using a non-standard port.. The flow shows 1.2 GB of data transferred over 5 minutes on a non-standard TCP port 4444 with a high threat score of 85, which is characteristic of data exfiltration attempts. Option B is incorrect because video streaming typically uses standard ports like 80 or 443 and exhibits different traffic patterns. Option C is incorrect because database replication usually uses well-known ports (e.g., 1433 for SQL) and consistent transfer patterns. Option D is incorrect because backup jobs often occur on standard ports and follow regular schedules.

Answer

This is a typical video streaming session.

Answer

This is normal database replication traffic.

Answer

This is a misconfigured backup job.

Question 5

Which TWO methods can be used to propagate SGT information between devices that do not support SGT inline tagging?

Accepted Answer

CDP. The correct methods are CDP and SXP. CDP (Cisco Discovery Protocol) can propagate SGT information between devices that do not support inline tagging, particularly in Cisco environments. SXP (SGT Exchange Protocol) is the primary protocol used to exchange SGT mappings between devices that do not have inline SGT support. NetFlow does not propagate SGTs; it is used for traffic flow monitoring. LLDP (Link Layer Discovery Protocol) does not support SGT. VRF-lite is not related to SGT propagation.

Answer

NetFlow

Answer

LLDP

Answer

VRF-lite

Question 6

An engineer is implementing Cisco ISE posture assessment for corporate Windows laptops. The requirement: endpoints that are missing critical Microsoft security patches must be quarantined in a remediation VLAN. The ISE posture policy uses an 'Application Condition' to check for the patch. However, some laptops with missing patches are still allowed access. During testing, the engineer notices that the posture agent reports 'NAC Agent: Posture Unknown' for those laptops. What is the most likely cause?

Accepted Answer

The authorization policy does not include a posture profile. Posture Unknown indicates that the posture assessment did not complete. This often occurs when the authorization policy does not include a posture profile, so ISE does not issue a posture requirement to the agent, and the agent remains in an unknown state. Option D correctly identifies this cause. Option A (outdated agent) could cause other issues but typically not Posture Unknown. Option B (patches not on ISE list) would lead to non-compliance, not unknown. Option C (ISE unreachable) would cause authentication failure entirely.

Answer

The posture agent software is outdated

Answer

The missing patches are not on the ISE patch list

Answer

The ISE server is unreachable from the client VLAN

Question 7

An organization uses Cisco Umbrella's Secure Internet Gateway (SIG). Which of the following sets of capabilities is typically included in a SIG solution?

Accepted Answer

Cloud-delivered firewall and web proxy. The correct answer is D, which lists two core capabilities of a Secure Internet Gateway (SIG): cloud-delivered firewall and web proxy. Options A, B, and C are incorrect because A (IPS) is often a separate security function, B (DLP for data at rest) is not typically part of a SIG (DLP for data in motion may be included), and C (DNS-layer security only) is a subset but not the full SIG capability.

Answer

Intrusion prevention system (IPS)

Answer

DLP for data at rest

Answer

DNS-layer security only

Question 8

An organization is using Cisco ESA and wants to ensure that outgoing emails containing credit card numbers are blocked before leaving the network. Which feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policies. Cisco ESA uses Data Loss Prevention (DLP) policies to inspect outgoing email content for sensitive data such as credit card numbers. DLP can identify patterns (e.g., 16-digit card numbers) using predefined or custom dictionaries and enforce actions like blocking, quarantining, or encrypting the message before it leaves the network. Anti-Spam, Encryption, and Anti-Virus policies do not perform content-based pattern matching for sensitive data.

Answer

Anti-Spam policies

Answer

Encryption policies

Answer

Anti-Virus scanning

Question 9

A security analyst sees multiple AMP events for 'Trojan.Generic.37283212' on several endpoints. After updating the AMP signatures, the detection still occurs. What is the best next step to reduce false positives?

Accepted Answer

Add the file SHA256 hash to the Custom Whitelist in the AMP policy.. Adding the file SHA256 hash to the Custom Whitelist in the AMP policy explicitly tells the AMP cloud to ignore that specific file, preventing false positives without disabling broader protections. Since the detection persists after signature updates, the file is likely a legitimate application that is being incorrectly flagged by the generic heuristic signature 'Trojan.Generic.37283212'. Whitelisting the exact hash ensures that only this file is exempted, maintaining security for other threats.

Answer

Wait for the next signature update that might remove the detection.

Answer

Disable the signature for Trojan.Generic in the AMP policy.

Answer

Reinstall the AMP connector on the affected endpoints.

Question 10

A security architect is designing a solution to detect and block ransomware using Cisco AMP. The requirement is that when a file executes and attempts to encrypt files in a monitored directory, the event must be captured and the process terminated immediately. Which AMP feature set should be used?

Accepted Answer

Exploit Prevention with Behavioral Protection enabled.. Cisco AMP's Exploit Prevention with Behavioral Protection is designed to monitor file behavior in real time. When a file executes and attempts to encrypt files in a monitored directory, Behavioral Protection detects the anomalous activity (e.g., mass file modifications) and can immediately terminate the process, meeting the requirement to capture and block the ransomware event.

Answer

Application Control with a block list of known ransomware binaries.

Answer

Vulnerability Assessment with real-time patching.

Answer

Device Flow Correlation (DFC) with advanced malware analysis.

Question 11

Which THREE of the following are best practices for deploying Cisco Web Security Appliance (WSA) in a large enterprise environment? (Select exactly three.)

Accepted Answer

Use explicit proxy mode with PAC files for user-specific policy enforcement. Explicit proxy mode with PAC files allows the WSA to enforce granular, user-specific policies based on authentication (e.g., via NTLM or LDAP) and destination URL. PAC files enable automatic proxy configuration for clients, ensuring traffic is routed through the WSA without manual browser settings, while still supporting user identity for policy decisions.

Answer

Configure transparent proxy to avoid client configuration

Answer

Disable anti-malware scanning to improve performance

Question 12

An S3 bucket policy is shown. What does the condition "aws:SecureTransport": "true" enforce?

Accepted Answer

All requests to the bucket must use HTTPS. The condition `"aws:SecureTransport": "true"` in an S3 bucket policy enforces that all requests to the bucket must be made over HTTPS (TLS). This ensures that data in transit is encrypted, preventing man-in-the-middle attacks or eavesdropping. The condition evaluates the `aws:SecureTransport` key, which is `true` only when the request uses SSL/TLS.

Answer

Only requests from specific IP ranges are allowed

Answer

Only requests using server-side encryption with KMS are allowed

Answer

All requests must be authenticated using AWS IAM and MFA

Question 13

Refer to the exhibit. A security analyst sees this syslog message on a Cisco ASA. What does it indicate?

Accepted Answer

A TCP connection from 203.0.113.50 to 10.10.10.10 was denied by the ACL named OUTSIDE.. The syslog message shows an ACL deny action on the OUTSIDE interface for a TCP connection from source 203.0.113.50 to destination 10.10.10.10. The format '%ASA-4-106023' indicates a deny, and the interface name 'OUTSIDE' is explicitly stated. The source IP is listed first in the message, confirming the connection attempt originated from 203.0.113.50.

Answer

A TCP connection from 10.10.10.10 to 203.0.113.50 was denied.

Answer

A TCP connection from 203.0.113.50 to 10.10.10.10 was allowed and logged.

Answer

The ASA interface OUTSIDE is experiencing high CPU due to Denial of Service.

Question 14

A large enterprise uses Cisco TrustSec to enforce segmentation between departments. The network consists of Cisco Catalyst switches running IOS XE with IP ACLs and Security Group Tags (SGTs). The security policy requires that traffic from the Engineering group (SGT=10) to the Finance group (SGT=20) be allowed only to TCP port 443. The administrator configures a Security Group Access Control List (SGACL) on Cisco ISE with a permit statement for TCP 443 and a deny for all other traffic, and pushes it to the switches. After deployment, they notice that Engineering users can access Finance servers not only on TCP 443 but also on other ports. The administrator verifies that the SGACL is correctly configured on ISE and that the switches are receiving the SGTs. Additionally, the switches have IP ACLs on the interfaces. What is the most likely cause of this issue?

Accepted Answer

The IP ACLs on the switches are overriding the SGACL.. The most likely cause is that IP ACLs on the switch interfaces are overriding the SGACL. In Cisco TrustSec, SGACLs are applied after SGT classification and are evaluated in the forwarding path, but if a traditional IP ACL is configured on the same interface, it is processed first and can permit or deny traffic independently of the SGACL. Since the IP ACLs are present and not configured to match the required policy, they allow traffic on ports other than TCP 443, bypassing the SGACL enforcement.

Answer

The SGT classification is not occurring on the access switches.

Answer

The SGACL is applied only on the inbound direction of the interface.

Answer

The switches are not running Cisco TrustSec-compatible software.

Question 15

A network administrator is troubleshooting an issue where users in the Sales VLAN cannot access the internet through the Cisco Firepower Threat Defense (FTD) device. The FTD is configured with a security policy that allows traffic from the Sales subnet to any destination. However, the traffic is being blocked. Which feature should the administrator check first to resolve the issue?

Accepted Answer

URL filtering policy. URL filtering policy. Even though the security policy allows traffic from the Sales subnet to any destination, a URL filtering policy can block internet access by categorizing or matching the destination URLs. If the policy is set to block all URLs or a specific category (e.g., 'Uncategorized URLs'), traffic will be dropped before it reaches the internet, regardless of the allow rule in the access control policy.

Answer

Identity policy

Answer

SSL decryption policy

Answer

Intrusion prevention policy

Question 16

An organization has a Cisco ASA with two interfaces: inside (security 100) and outside (security 0). They want to allow traffic from inside to outside without NAT for a specific subnet. Which configuration achieves this?

Accepted Answer

nat (inside,outside) source static 192.168.1.0 192.168.1.0 no-proxy-arp route-lookup. A NAT exemption rule with 'nat 0' (on ASA 9.x+) or 'nat (inside,outside) source static' with an identity NAT can be used. In modern ASA, 'nat (inside,outside) source static NET NET no-proxy-arp route-lookup' is typical.

Answer

nat (inside,outside) dynamic interface

Answer

nat (inside,outside) source dynamic any interface

Answer

access-list outside_access_in permit ip 192.168.1.0 255.255.255.0 any

Question 17

An organization has deployed Cisco AMP for Endpoints and wants to automatically isolate a host from the network when a high-severity malware detection occurs. Which integration must be configured to enable this automated response?

Accepted Answer

Cisco ISE with pxGrid. Cisco ISE with pxGrid (Platform Exchange Grid) enables automated policy-based responses by allowing Cisco AMP for Endpoints to share threat intelligence with ISE. When AMP detects a high-severity malware, it triggers a pxGrid event that instructs ISE to dynamically quarantine the host by applying a security group access control list (SGACL) or a CoA (Change of Authorization) to block network access. This integration is specifically designed for context sharing and automated remediation across Cisco security products.

Answer

Cisco Stealthwatch with NetFlow

Answer

Cisco Web Security Appliance

Answer

Cisco Firepower Next-Gen Firewall

Question 18

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

Accepted Answer

Change the file exclusion path to the exact full path of app.exe instead of a wildcard.. The current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

Answer

Remove the file exclusion for the FinanceApp folder entirely.

Answer

Remove the process exclusion for app.exe.

Answer

Change the action for unknown files from 'block' to 'detect'.

Question 19

During a threat hunt, you need to retrieve forensic data from a remote endpoint that is currently not communicating with the AMP cloud. Which Cisco tool enables you to perform an on-demand scan and collect telemetry from that endpoint even when it is offline?

Accepted Answer

Cisco Orbital. Cisco Orbital is the correct answer because it is a remote endpoint investigation and response tool that can execute live queries, on-demand scans, and collect forensic telemetry from endpoints even when they are not currently communicating with the AMP cloud. It uses a lightweight agent that caches queries locally and returns results once connectivity is restored, enabling offline data collection.

Answer

Cisco Threat Response

Answer

Cisco Stealthwatch

Answer

Cisco AMP Console

Question 20

A security engineer is troubleshooting an issue where Cisco AMP for Endpoints is not detecting a known malware sample on a Windows endpoint. The endpoint is running Windows 10 with the latest AMP connector installed and is connected to the corporate network. The malware sample was downloaded from a trusted source for testing. Which configuration is most likely causing the lack of detection?

Accepted Answer

The connector is configured to operate in offline mode.. When Cisco AMP for Endpoints is in offline mode, the connector cannot communicate with the cloud-based threat intelligence and reputation servers. This prevents it from performing file reputation lookups and retrieving the latest malware signatures, so even known malware samples will not be detected. The connector relies on cloud lookups for real-time detection of new or known threats, and offline mode disables this critical function.

Answer

The file reputation scanning is disabled.

Answer

Custom detections are not configured for the malware.

Answer

Real-time scanning is disabled for the download directory.