350-701 Practice Exam 58 — 20 Questions

Question 1

Which THREE of the following are common challenges when securing multi-cloud environments? (Choose three.)

Accepted Answer

Meeting compliance requirements across jurisdictions. Multi-cloud environments span multiple jurisdictions with differing data protection laws (e.g., GDPR, CCPA, LGPD). Meeting compliance requirements becomes a challenge as each cloud provider may have different compliance certifications and data residency controls, requiring careful mapping of data flows and contractual agreements to avoid legal penalties.

Answer

Limited storage capacity in public clouds

Answer

Reducing cloud infrastructure costs

Question 2

A network administrator is configuring endpoint protection policies for a large enterprise. The requirement is to allow only approved software to run on endpoints, while blocking all other executables. Which Cisco Secure Endpoint feature should be configured? (Choose two.)

Accepted Answer

Application Control. Application Control (C) is correct because it allows administrators to define a whitelist of approved software, blocking all other executables from running on endpoints. Lockdown Mode (D) is correct because it enforces a strict policy where only pre-approved applications can execute, effectively preventing any unapproved software from running. Together, these features provide comprehensive control over executable files in a large enterprise environment.

Answer

Exploit Prevention

Answer

Malware Analytics

Answer

File Reputation

Question 3

Cisco ISE is performing profiling on a network. It receives a DHCP request from a device with vendor class identifier 'MSFT 5.0' and an HTTP user-agent 'Mozilla/5.0 (Windows NT 10.0)'. Which probes are most likely used to collect this information?

Accepted Answer

DHCP probe and HTTP probe. The DHCP probe captures DHCP packets, including the vendor class identifier (option 60) which reveals the device type (e.g., 'MSFT 5.0' for Windows). The HTTP probe intercepts HTTP traffic and parses the User-Agent header (e.g., 'Mozilla/5.0 (Windows NT 10.0)') to identify the operating system and browser. Together, these two probes collect the exact information described in the question.

Answer

Device Sensor and SNMP probe

Answer

HTTP probe and Device Sensor

Answer

DHCP probe and SNMP probe

Question 4

A multinational company has recently deployed Cisco Umbrella for DNS-layer security across all offices. The security team receives reports that users in the Asia-Pacific region cannot access a critical cloud-based CRM application (crm.company.com). The CRM is hosted by a third-party provider and uses a custom domain. The Umbrella dashboard shows that DNS requests for crm.company.com are being blocked with the reason 'Cisco Umbrella Intelligence Feed: Blocked Domain'. The domain is not part of any standard security category. The IT team has verified that the domain is legitimate and necessary for business operations. What should the administrator do to restore access while maintaining security?

Accepted Answer

Add crm.company.com to the global allow list in the Umbrella dashboard under Policy > Destination Lists > Allow. The domain is being blocked by the Cisco Umbrella Intelligence Feed, which is a curated threat intelligence feed. Since the domain is legitimate and not part of a standard security category, the proper method to restore access is to add it to the global allow list under Policy > Destination Lists > Allow. This overrides the block from the intelligence feed while preserving all other security policies.

Answer

Whitelist the CRM server's IP address in the IP-layer enforcement settings

Answer

Configure the local DNS server to forward crm.company.com directly to the CRM provider's DNS

Answer

Disable the Cisco Umbrella Intelligence Feed for the Asia-Pacific region

Question 5

A security administrator notices that a significant volume of spam is bypassing the Cisco ESA's anti-spam filters. Upon investigation, they find that the messages have a mid-range SBRS score of 5.0. Which action should the administrator take to improve spam detection?

Accepted Answer

Increase the SBRS threshold to 7.0. The SenderBase Reputation Score (SBRS) ranges from -10 to +10, with lower scores indicating a higher likelihood of spam and higher scores indicating more legitimate senders. The SBRS threshold is the score below which messages are classified as spam. By default, the threshold may be set low (e.g., 3.0), allowing messages with a mid-range score of 5.0 (which is relatively legitimate) to bypass filters. To catch these messages, the administrator should raise the threshold (e.g., to 7.0), so that messages with scores below 7.0 are considered spam, thus including the 5.0 messages. Option A would reverse score interpretation, causing confusion; Option B would lower the threshold, reducing spam detection because fewer messages would be below the threshold; Option D disables the feature entirely.

Answer

Change the SBRS score interpretation to positive

Answer

Lower the SBRS threshold to 3.0

Answer

Disable SenderBase reputation checks

Question 6

A network engineer configures ISE for 802.1X with PEAP-MSCHAPv2. Users report intermittent authentication failures on certain switches. The engineer checks ISE logs and sees 'Authentication failed' with reason 'User not found in identity store'. What is the most likely issue?

Accepted Answer

The user is not in the Active Directory group that ISE is configured to query.. The error 'User not found in identity store' indicates that ISE queried its configured identity sources (e.g., Active Directory) and could not locate the user account. Since PEAP-MSCHAPv2 authenticates users against a backend identity store (not certificates), the most likely cause is that the user is not a member of the specific AD group that ISE is configured to query, or the user object does not exist in the joined domain. This is a common misconfiguration when ISE uses group-based filtering or restricted identity stores.

Answer

The switch port is configured with 'authentication periodic'.

Answer

The switch is not configured with the correct shared secret.

Answer

The user's certificate is expired.

Question 7

A company is implementing a Zero Trust architecture. The security team needs to ensure that all traffic between workloads in a private cloud is encrypted and mutually authenticated. Which solution best meets these requirements?

Accepted Answer

Mutual TLS (mTLS) between workloads. Mutual TLS (mTLS) provides both encryption and mutual authentication by requiring each workload to present a valid X.509 certificate during the TLS handshake. This ensures that only verified workloads can communicate, and all traffic is encrypted at the application layer, making it the ideal choice for a Zero Trust architecture where every connection is authenticated and authorized regardless of network location.

Answer

MACsec on the network interfaces

Answer

IPsec VPN between each pair of workloads

Answer

SSH tunnels between workloads

Question 8

A company deploys Cisco Firepower Threat Defense (FTD) in transparent mode. They create an access control rule to allow HTTP traffic from the inside network (10.10.10.0/24) to a web server at 192.168.1.100. The rule is configured with action 'Allow', a source zone 'inside', a destination zone 'outside', and an intrusion policy attached. After deployment, users report they cannot access the web server. The administrator verifies that the web server is reachable from other networks and that the FTD management interface is accessible. The FTD's packet capture shows no traffic matching the rule. The rule is listed first in the access control policy. What is the most likely cause of the problem?

Accepted Answer

The FTD is in transparent mode, so it does not use zones; the rule should be assigned to an interface pair.. In transparent mode, Cisco Firepower Threat Defense (FTD) operates as a Layer 2 bridge and does not use security zones. Instead, traffic is controlled by interface pairs. The rule configured with source and destination zones will never match traffic because transparent mode bypasses zone-based policy enforcement. The correct approach is to assign the rule to an interface pair (e.g., inside to outside) rather than zones.

Answer

The intrusion policy is blocking the traffic.

Answer

The web server's IP address is not correctly defined in the network object.

Answer

The rule's action is set to 'Monitor' instead of 'Allow'.

Question 9

A network administrator is configuring site-to-site IPsec VPN between two Cisco ASAs using IKEv2. They want to ensure that only specific subnets are encrypted, using Virtual Tunnel Interface (VTI). Which configuration element is essential for VTI?

Accepted Answer

A tunnel interface with an IP address and a crypto map.. VTI uses a tunnel interface that is dedicated to the VPN, and the crypto map is applied to the tunnel interface rather than the physical interface. For IKEv2, the tunnel mode is enabled and the crypto map is applied to the VTI.

Answer

A crypto map applied to the physical interface.

Answer

A transform set with ESP encryption and authentication.

Answer

An ISAKMP policy with pre-shared key.

Question 10

Which component of Cisco AMP for Endpoints is responsible for preventing the execution of known malware by checking files against a continuously updated cloud database before they run?

Accepted Answer

File Reputation. File Reputation is the correct answer because it is the Cisco AMP for Endpoints component that queries a continuously updated cloud database (the AMP Threat Grid) to check the reputation of a file before it executes. If the file is known malware, execution is blocked immediately, preventing the threat from running. This pre-execution check relies on the file's SHA-256 hash and cloud-based reputation scoring.

Answer

Exploit Prevention

Answer

Application Control

Answer

Orbital

Question 11

A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for network access control and Cisco Stealthwatch for network visibility. Recently, they deployed a new web application that is accessed by both internal employees and external customers. The application uses HTTPS on port 443. After deployment, the security team notices that the FTD is dropping some HTTPS sessions that appear legitimate. The drops are inconsistent and seem to occur only during peak hours. The FTD logs show the drop reason as 'TCP state violation'. The team has verified that the web server and clients are configured correctly. The Stealthwatch reports show no anomalies. What is the most likely cause and solution?

Accepted Answer

Configure TCP state bypass on the FTD for the web server traffic. The 'TCP state violation' drops during peak hours indicate that the FTD's stateful inspection engine is seeing TCP segments that do not match the expected state machine, likely due to asymmetric routing or session timeouts under load. Configuring TCP state bypass for the web server traffic disables stateful inspection for those flows, allowing the firewall to forward packets based on ACLs alone without tracking TCP states, which resolves the issue without compromising security for legitimate traffic.

Answer

Enable SSL decryption to inspect the encrypted traffic

Answer

Increase the TCP timeout values on the FTD to accommodate longer sessions

Answer

Block all traffic to the web server except from trusted IPs

Question 12

A security analyst is investigating a compromised endpoint that is part of a botnet. The endpoint is running Cisco Secure Endpoint with TETRA. The analyst notices that the endpoint is communicating with a command-and-control (C2) server over HTTPS. Which TETRA feature would be most effective in detecting this traffic?

Accepted Answer

SSL/TLS decryption and inspection. TETRA (Telemetry and Threat Response Analytics) on Cisco Secure Endpoint can detect C2 traffic over HTTPS by performing SSL/TLS decryption and inspection. This allows the agent to examine encrypted payloads for malicious patterns, such as beaconing or command-and-control protocol artifacts, which would otherwise be hidden in the encrypted tunnel.

Answer

URL filtering against known malicious URL databases

Answer

File reputation and cloud lookup

Answer

Protocol analysis with deep packet inspection

Question 13

A network engineer notices that some Windows 10 clients fail to authenticate via 802.1X after a recent OS update. The supplicant shows 'EAPOL-Start' but never receives an EAP-Request/Identity. The switch port is configured with 'authentication port-control auto' and 'dot1x pae authenticator'. What is the most likely cause?

Accepted Answer

The switch port is configured as a trunk port. The most likely cause is that the switch port is configured as a trunk port. 802.1X authentication is designed for access ports, not trunk ports. On a trunk port, the switch does not process EAPOL frames correctly because the port is expected to carry multiple VLANs and the switch's 802.1X state machine does not initiate the authentication process. As a result, the supplicant sends EAPOL-Start but the switch never responds with an EAP-Request/Identity, leading to authentication failure.

Answer

The switch has 'aaa authentication dot1x default none' globally

Answer

The switch port is configured with 'authentication order mab dot1x'

Answer

The switch is configured with 'snmp-server community' which disables 802.1X

Question 14

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Accepted Answer

Install a trusted root CA certificate on all client devices. To block and decrypt HTTPS traffic for specific categories, you need URL filtering, decryption policy, and identity-based policies for granular control.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 15

A network administrator wants to deploy Cisco WSA as a transparent proxy to inspect web traffic without changing browser settings. Which protocol should be used to redirect traffic to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) allows routers to redirect web traffic to the WSA transparently.

Answer

PAC files

Answer

WPAD

Answer

GRE tunneling

Question 16

Drag and drop the steps to recover a lost password on a Cisco IOS router in the correct order.

Accepted Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Restore config register to 0x2102, Step 8: Reload the router. Enter ROMmon, change register to skip startup-config, boot, copy config, change password, save, and restore register.

Answer

Step 1: Enter ROMmon, Step 2: Boot the router, Step 3: Change config register to 0x2142, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Restore config register to 0x2102, Step 8: Reload the router

Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Restore config register to 0x2102, Step 7: Reload the router

Answer

Step 1: Enter ROMmon, Step 2: Change config register to 0x2142, Step 3: Boot the router, Step 4: Copy startup-config to running-config, Step 5: Change the enable password, Step 6: Save running-config to startup-config, Step 7: Reload the router

Question 17

An organization uses Cisco ESA and wants to implement a policy that automatically encrypts emails containing credit card numbers before delivery. What feature should be used?

Accepted Answer

DLP policy with encryption action. D is correct because Cisco ESA includes a Data Loss Prevention (DLP) feature that can scan email content for sensitive data patterns, such as credit card numbers (matching Luhn algorithm and known issuer prefixes). When a match is found, the DLP policy can trigger an encryption action, automatically encrypting the email before delivery to protect the sensitive information in transit.

Answer

Anti-spam engine

Answer

Anti-virus engine

Answer

Email authentication (SPF, DKIM)

Question 18

Which TWO methods can be used to enforce least privilege within a network infrastructure? (Choose two.)

Accepted Answer

Use Cisco TrustSec with SGTs and security group policies.. Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user or device identity, not just IP addresses. Security group policies then enforce least privilege by allowing or denying communication between SGTs, ensuring that only necessary traffic flows between endpoints.

Answer

Use a single administrator account with full privileges for all IT staff.

Answer

Place all users in the same VLAN without ACLs.

Answer

Configure source NAT on the firewall to hide internal addresses.

Question 19

Cisco ISE is configured to assign Security Group Tags (SGTs) to endpoints based on their identity. This is part of which Cisco security architecture?

Accepted Answer

Cisco TrustSec. Cisco TrustSec is the security architecture that uses Security Group Tags (SGTs) to enforce access control based on identity rather than IP addresses. Cisco ISE acts as the policy decision point, dynamically assigning SGTs to endpoints and distributing them via protocols like SXP or inline tagging, enabling consistent policy enforcement across the network.

Answer

Cisco Duo

Answer

Cisco SecureX

Answer

Cisco AMP

Question 20

Which THREE of the following are benefits of using Cisco ISE for network access control?

Accepted Answer

Firewall integration. Cisco ISE provides centralized policy management (option C) by allowing administrators to define and enforce access policies from a single console, which simplifies network access control across the entire organization. Guest access provisioning (option B) is a native feature of ISE that enables secure, self-service or sponsored guest onboarding with customizable captive portals and role-based access. Firewall integration (option A) is a benefit because ISE can dynamically communicate with Cisco firewalls (e.g., ASA, Firepower) via pxGrid to enforce context-aware policies, such as quarantining an infected endpoint or granting micro-segmentation based on user identity and device posture.

Answer

Storage encryption

Answer

URL filtering