350-701 Practice Exam 57 — 20 Questions

Question 1

An incident responder uses the Cisco AMP for Endpoints console to investigate a potential malware outbreak. The endpoint shows multiple files with high prevalence and cloud verdicts of 'unknown'. The responder wants to quickly identify files that were executed from a malicious parent process. Which console feature best assists this analysis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device Trajectory to review the event timeline.. Device Trajectory provides a chronological timeline of events on the endpoint, allowing the responder to trace file executions back to their parent processes. By reviewing the trajectory, the responder can identify which files with unknown verdicts were spawned by a known malicious parent process, directly answering the investigation need.

Answer

Group Policy to check applied policies.

Answer

Dashboard to view overall threat scores.

Answer

File Search to find files with unknown verdict.

Question 2

A Cisco WSA administrator needs to implement HTTPS inspection for traffic from internal users. The administrator wants to avoid decrypting traffic to financial and healthcare sites due to compliance requirements. Which THREE actions should the administrator take to configure this policy?

Accepted Answer

Create a decryption policy with action 'Decrypt' for all traffic. To selectively decrypt, the administrator should create a decryption policy that decrypts all traffic, then use URL category exceptions to bypass decryption for finance and health categories. Alternatively, create a policy that explicitly decrypts all else and uses bypass rules. The three actions: create a decryption policy with action 'Decrypt', add bypass rules for the specified categories, and ensure CA certificate is deployed.

Answer

Configure the proxy in explicit mode

Answer

Enable AMP file scanning for decrypted traffic

Question 3

A security analyst observes that one endpoint is generating Alerts of type 'Trojan' in Cisco AMP, but other identical endpoints on the same software version show no issues. After verifying that the signature versions are consistent, what is the most likely cause of the discrepancy?

Accepted Answer

A legitimate application on that endpoint is exhibiting behavior that matches a Trojan signature. In Cisco AMP, a single endpoint generating 'Trojan' alerts while identical peers remain clean, with consistent signature versions, strongly indicates a false positive caused by a legitimate application exhibiting behavior that matches a Trojan signature. AMP uses behavioral analysis and signature-based detection; if a benign application performs actions (e.g., file writes, registry modifications, or network connections) that resemble known malware patterns, it can trigger an alert. Since other endpoints with the same software and signatures are unaffected, the issue is localized to that specific endpoint's unique application or configuration, not a global misconfiguration or signature issue.

Answer

The AMP connector is misconfigured and is generating false alerts

Answer

The endpoint's network traffic is being intercepted by a proxy causing AMP to misidentify it

Answer

The endpoint has an outdated operating system patch

Question 4

Which TWO of the following are features of Cisco TrustSec? (Choose TWO)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). Security Group Tag Exchange Protocol (SXP) is a Cisco TrustSec feature that propagates Security Group Tag (SGT) bindings between network devices without requiring inline tagging on every packet. It allows devices that do not natively support SGT in hardware to participate in TrustSec by exchanging IP-to-SGT mappings over TCP, enabling consistent policy enforcement across heterogeneous environments.

Answer

IPsec VPN

Answer

Network Access Control (NAC)

Answer

802.1X authentication

Question 5

An engineer is configuring a Cisco ASA to support a DMZ segment. Which three of the following are best practices for DMZ design? (Choose three.)

Accepted Answer

Place public-facing servers in the DMZ.. DMZ should have a different security level (typically between inside and outside). Traffic from DMZ to inside should be restricted. Services in DMZ should be hardened. The DMZ interface should be a separate physical or VLAN interface.

Answer

Assign the DMZ interface a security level of 0.

Answer

Use the same subnet for DMZ and inside networks.

Question 6

An organization is implementing TrustSec to enforce micro-segmentation. The Security Group Tag (SGT) is assigned to a user via ISE after authentication. However, traffic from this user to a server with SGT 5 is being dropped. The administrator checks the SGACL configuration on the switch and finds the following: 'permit ip source 2 destination 5'. What is the most likely reason for the traffic being dropped?

Accepted Answer

SXP is not configured between ISE and the switch. The SGACL entry 'permit ip source 2 destination 5' exists, but traffic from the user to the server with SGT 5 is still being dropped. This is likely because the switch does not know the user's SGT. TrustSec uses SXP to dynamically propagate SGT mappings from ISE to network devices. Without SXP configured between ISE and the switch, the switch cannot map the user's authentication identity to the correct SGT (e.g., SGT 2). As a result, the switch either treats the user as untagged (SGT 0) or drops the traffic due to lack of a matching SGACL entry for the actual SGT pair. Thus, configuring SXP is essential for the switch to enforce SGACLs based on user-assigned SGTs.

Answer

The PAC on the switch has expired

Answer

The CTRL protocol is not enabled on the switch

Answer

The SGACL defaults to deny if no explicit permit is found for the source-destination SGT pair

Question 7

During a cloud migration, the security team uses Cisco CloudLock for DLP. They notice that the DLP engine is not scanning certain files in Google Drive shared with external users. The CloudLock admin console shows the connector status as 'connected'. What is the most likely cause?

Accepted Answer

The connector lacks permission to scan external files. Cisco CloudLock requires explicit permissions to scan files shared with external users. Even though the connector status shows 'connected', the default OAuth scopes granted during initial setup may not include access to files shared outside the organization. The DLP engine can only inspect files it has read access to; without the 'drive.readonly' scope extended to externally shared items, those files are invisible to scanning.

Answer

The files are too large (over 100 MB)

Answer

The external sharing is disabled in CloudLock policy

Answer

The files are in Google Drive 'My Drive' not 'Shared Drive'

Question 8

An administrator wants to dynamically change the VLAN assignment for a user after a posture assessment determines that the endpoint is missing a critical patch. Which ISE feature accomplishes this?

Accepted Answer

CoA. Change of Authorization (CoA) is the correct answer because it is the ISE feature that allows dynamic, real-time changes to an authenticated session, such as reassigning a VLAN, after a posture assessment. When a posture assessment determines an endpoint is non-compliant (e.g., missing a critical patch), ISE can send a CoA request (RFC 5176) to the network access device (NAD) to modify the session attributes, including VLAN assignment, without requiring the user to reauthenticate.

Answer

TrustSec

Answer

Profiling

Answer

MAB

Question 9

A network administrator wants to implement 802.1X authentication on a switch port that connects a printer. The printer does not support 802.1X, so the administrator configures MAC Authentication Bypass (MAB) as a fallback method. Which command must be included in the switch port configuration to ensure MAB is attempted after 802.1X times out?

Accepted Answer

authentication order dot1x mab. The 'authentication order dot1x mab' command explicitly defines the sequence in which authentication methods are attempted on a switch port. When 802.1X times out (e.g., because the printer does not respond to EAPOL frames), the switch then falls back to MAB. This command ensures MAB is attempted only after 802.1X fails, which matches the requirement.

Answer

authentication priority dot1x mab

Answer

dot1x timeout tx-period 30

Answer

authentication port-control auto

Question 10

A company uses Cisco ISE for network access control. Users connecting via wired 802.1X are successfully authenticated but cannot reach the internet. The administrator checks the authorization policy and notices that the correct dACL is being applied. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server is not sending the dACL attribute in the Access-Accept. The most likely cause is that the RADIUS server (ISE) is not sending the dACL attribute in the Access-Accept packet. Even though the authorization policy applies a dACL, if the RADIUS message does not include the dACL name (e.g., Cisco-AV-Pair = "ip:inacl#100=...") or the switch does not receive it, the switch cannot enforce the filter, leaving the user authenticated but with no internet access due to default deny-all behavior.

Answer

The switchport is configured as dynamic desirable

Answer

The switch port MTU is set to 1500 bytes

Answer

ISE is out of licenses for endpoint devices

Question 11

Which TWO are valid methods for determining the SGT (Security Group Tag) assigned to an endpoint in a TrustSec deployment?

Accepted Answer

Static assignment on the network access device (switch) using the 'cts role-based sgt' command. The 'cts role-based sgt' command on a network access device (switch) statically assigns an SGT to an endpoint based on its IP address or MAC address. Option E is correct because ISE can dynamically assign an SGT to an endpoint as part of an authorization policy during authentication, using RADIUS attributes like cisco-av-pair=CTS:SGT=value.

Answer

DNS resolution of the endpoint hostname

Answer

The IP address of the endpoint

Answer

DHCP Option 141

Question 12

Match each protocol to its default port number.

Accepted Answer

SSH: 22. These are well-known port numbers for common protocols.

Answer

SSH: 21

Answer

HTTPS: 22

Question 13

Refer to the exhibit. A switch port is configured for 802.1X with MAB. The switch has reached its maximum number of authentication sessions (platform limit). When a new device attempts to connect, what happens?

Accepted Answer

The new device is not authenticated and remains unauthorized. When the switch reaches its platform-specific limit for authentication sessions (e.g., 256 sessions on a Catalyst 3850), no new 802.1X or MAB sessions can be initiated. The new device remains in an unauthorized state (typically in the 'critical' or 'auth-fail' VLAN, or simply blocked) because the switch cannot allocate a new session context. There is no automatic fallback or CoA action to free a session; the port stays in the unauthorized state until an existing session expires or is manually cleared.

Answer

The new device is allowed to pass traffic due to fallback

Answer

The switch sends a CoA to ISE to free up a session

Answer

The port is automatically shut down

Question 14

A network administrator is troubleshooting intermittent authentication failures on a switch port configured for 802.1X with MAB fallback. Users can connect but get dropped after a few minutes. What is the most likely cause?

Accepted Answer

Reauthentication timer set too short. The reauthentication timer on the switch port is set too short, causing the 802.1X session to expire and re-initiate authentication frequently. This results in users being dropped after a few minutes as the port cycles through reauthentication, even though MAB fallback may temporarily allow traffic. The default reauthentication timer is typically 3600 seconds, but if misconfigured to a very low value (e.g., 60 seconds), it will cause periodic disconnections.

Answer

Incorrect VLAN assignment

Answer

Incorrect RADIUS shared secret

Answer

MAB timeout set too low

Question 15

Match each VPN type to its characteristic.

Accepted Answer

Site-to-Site VPN: Connects entire networks between different locations using IPsec.. The correct matches are: Site-to-Site VPN (connects networks), Remote Access VPN (connects individual users), MPLS VPN (uses MPLS in provider network), and DMVPN (dynamic tunnels). Common confusions involve swapping site-to-site and remote access characteristics.

Answer

Site-to-Site VPN: Allows individual users to connect to a corporate network from remote locations.

Answer

Remote Access VPN: Connects entire networks between different locations using IPsec.

Question 16

Match each Cisco security command to its function.

Accepted Answer

ip access-group: Applies an access control list to an interface.. The correct matches are: ip access-group applies ACLs to interfaces; ip inspect enables stateful firewall inspection; crypto map configures IPSec. Common confusions include swapping the functions of 'ip access-group' and 'ip access-list', or misattributing encryption to 'ip inspect'.

Answer

ip access-group: Defines an access control list.

Answer

ip inspect: Encrypts all data traffic on an interface.

Answer

crypto map: Applies an ACL to an interface for filtering.

Question 17

Match each Cisco security product to its category.

Accepted Answer

Cisco Firepower: Next-Generation Firewall. Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

Answer

Cisco Firepower: Network Access Control

Answer

Cisco Stealthwatch: Next-Generation Firewall

Question 18

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 19

A security architect is evaluating Cisco Cloud Security portfolio for SaaS access protection. Which two solutions provide inline traffic inspection for cloud applications? (Choose two.)

Accepted Answer

Cisco Secure Firewall. Cisco Secure Firewall (A) provides inline traffic inspection for cloud applications through its Next-Generation Firewall (NGFW) capabilities, including Application Visibility and Control (AVC) and SSL/TLS decryption, allowing it to inspect and enforce policies on traffic to and from SaaS applications. Cisco Umbrella SIG (B) is a cloud-delivered Secure Internet Gateway (SIG) that performs inline proxy-based inspection of all web traffic, including SaaS applications, by intercepting DNS and HTTP/HTTPS requests to enforce security policies such as URL filtering, malware detection, and data loss prevention.

Answer

Cisco Cloudlock

Answer

Cisco DUO

Answer

Cisco Secure Workload

Question 20

A company uses Cisco Umbrella for DNS-layer security. They want to block access to known malicious IPs that may be resolved by non-DNS traffic. Which feature should they enable?

Accepted Answer

IP Layer Enforcement. IP Layer Enforcement is the correct feature because it allows Cisco Umbrella to block traffic to known malicious IP addresses even when the traffic does not originate from a DNS query. This is essential for blocking threats that use hardcoded IPs or non-DNS protocols like direct IP connections, ensuring protection beyond DNS-layer filtering.

Answer

File Analysis

Answer

Application Discovery

Answer

HTTPS Inspection