350-701 Practice Exam 59 — 20 Questions

Question 1

Refer to the exhibit. A host with IP address 10.0.0.5 sends traffic to destination 192.168.2.10. The traffic is not being translated. What is the most likely cause?

Accepted Answer

The ACL INSIDE_NAT does not permit traffic to the destination network 192.168.2.0/24.. The access-list INSIDE_NAT permits traffic to network 192.168.3.0/24, but the destination is 192.168.2.10, which is not matched. Therefore, NAT is not applied to that traffic. Option B is correct. Options A, C, and D are not relevant because dynamic NAT is allowed, outside interface has an IP, and security-level does not affect NAT.

Answer

The security-level of the inside interface is too high to allow NAT.

Answer

The interface outside does not have a valid IP address assigned.

Answer

The NAT statement uses source dynamic instead of source static; dynamic cannot translate internal IPs.

Question 2

A large enterprise uses Cisco ISE for network access control with 802.1X authentication (PEAP-MSCHAPv2) on wired ports. Access switches are Cisco Catalyst 3850s running IOS-XE 16.9, and ISE is version 2.7 with all patches. Recently, users in the finance department report intermittent connectivity issues when connecting to the network. The issue is sporadic: a user may connect successfully one day, then fail multiple times the next day. Switch logs show frequent 'EAP timeout' errors for these users. The network team has verified that the RADIUS servers are reachable and have sufficient CPU and memory. The ISE logs show no authentication failures, only that some EAP conversations are dropped mid-exchange. What is the most likely cause of these intermittent failures?

Accepted Answer

The switch is configured with a RADIUS timeout value that is too low.. The EAP timeout errors and intermittent nature point to the RADIUS timeout being too low on the switch, causing it to drop EAP conversations during periods of high latency. Options A, B, and D would cause consistent failures for affected users, not intermittent issues.

Answer

The switch port is configured with a dynamic VLAN assignment that does not exist on the switch.

Answer

The user's machine certificate has expired.

Answer

The ISE server is configured with an incorrect shared secret for the switch.

Question 3

A company wants to use Cisco DUO for MFA to protect access to its Azure AD applications. Which authentication method should be configured for cloud applications?

Accepted Answer

Secondary authentication via DUO after Azure AD. When integrating Cisco DUO with Azure AD for MFA, the recommended approach is to configure DUO as a secondary authentication provider after Azure AD handles primary authentication. This is achieved by using DUO's Azure AD integration, which acts as a custom control or a conditional access policy that triggers DUO MFA after the user has already authenticated against Azure AD. This ensures that Azure AD remains the identity provider (IdP) for primary authentication, while DUO provides an additional layer of security via a secondary push, phone call, or passcode.

Answer

DUO for RADIUS authentication

Answer

DUO as a SAML identity provider

Answer

Primary authentication via DUO

Question 4

Which EAP method used with 802.1X requires a client-side certificate for authentication?

Accepted Answer

EAP-TLS. EAP-TLS uses certificates on both the client and server sides for mutual authentication. PEAP-MSCHAPv2 uses server certificate and client credentials (password).

Answer

LEAP

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Question 5

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

Accepted Answer

The traffic from 10.1.1.100 is entering through a different interface. ACLs process traffic only on the interface and direction to which they are applied. If the ACL is applied inbound on GigabitEthernet0/0 but the traffic from host 10.1.1.100 to 192.168.1.1 enters through a different interface (e.g., GigabitEthernet0/1), the ACL will never evaluate that traffic, allowing it to pass. This is a fundamental behavior of interface-based ACL filtering in Cisco IOS.

Answer

The deny entry should be placed after the permit entry

Answer

The ACL should be applied outbound instead of inbound

Answer

The ACL is applied to the wrong direction; it should be 'out'

Question 6

A Cisco ASA firewall is configured with multiple contexts. The administrator needs to allow traffic from a context to pass through the management context for management purposes. Which type of interface should be used for this inter-context communication?

Accepted Answer

Use a shared interface that is allowed in multiple contexts.. In multiple-context mode on a Cisco ASA, inter-context communication (such as allowing a user context to send management traffic to the management context) is achieved by using a shared interface. A shared interface is assigned to multiple security contexts, enabling them to communicate directly without requiring a physical or virtual crossover cable. This design allows the management context to receive traffic from other contexts for monitoring or administrative purposes while maintaining separation of forwarding tables.

Answer

Configure a virtual interface in each context and bridge them.

Answer

Use a dedicated physical interface for each context and route through the backplane.

Answer

Configure a subinterface on the management interface for each context.

Question 7

During a cloud migration, an administrator notices that a workload in Azure is generating outbound traffic that is being blocked by the cloud security group. The workload requires connectivity to a specific SaaS application (Office 365) using TLS. The security group denies all outbound traffic except to specific IP ranges. Which action should the administrator take?

Accepted Answer

Add the Office 365 IP ranges and FQDNs to the allowed list. The administrator needs to allow outbound traffic to Office 365, which uses TLS over TCP/443. Since the security group denies all outbound traffic except to specific IP ranges, the most direct and secure method is to add the published Office 365 IP ranges and FQDNs to the allowed list. This ensures the workload can reach the SaaS application without bypassing security controls or introducing additional latency.

Answer

Implement a proxy server

Answer

Use Azure Private Link

Answer

Disable the security group temporarily

Question 8

A network administrator is deploying Cisco ISE for network access control. The network includes printers and IP phones that do not support 802.1X. Which TWO methods can be used to authenticate these devices?

Accepted Answer

MAC Authentication Bypass (MAB). MAB allows non-supplicant devices to be authenticated based on their MAC address. Profiling can identify the device type and apply appropriate policies. 802.1X requires a supplicant, and PEAP-MSCHAPv2 is a credential-based EAP method that also requires a supplicant.

Answer

802.1X with EAP-TLS

Answer

Posture assessment

Answer

PEAP-MSCHAPv2

Question 9

A security architect is designing a hybrid cloud with AWS and on-premises data center. They need to enforce consistent security policies across both environments. Which approach is most effective?

Accepted Answer

Use Cisco Secure Cloud Analytics (Stealthwatch) with AWS Cloud integration. Cisco Secure Cloud Analytics (Stealthwatch) integrates with AWS Cloud via API to ingest flow logs, VPC logs, and NetFlow, enabling centralized visibility and consistent policy enforcement across hybrid environments. This approach avoids policy fragmentation by applying a unified security analytics layer that can detect anomalies and enforce responses in both AWS and on-premises networks without requiring separate policy management.

Answer

Deploy separate Cisco Firepower instances in AWS and on-prem, each with independent policies

Answer

Use AWS CloudTrail and AWS Config for on-premises resources

Answer

Establish a site-to-site VPN and use AWS Security Groups for both environments

Question 10

Which THREE of the following are capabilities of Cisco Threat Response (CTR) that integrate with endpoint telemetry for accelerated detection and response?

Accepted Answer

Device Trajectory to visualize the timeline of events on an endpoint. Device Trajectory is a core capability of Cisco Threat Response (CTR) that ingests endpoint telemetry from Cisco Secure Endpoint (formerly AMP for Endpoints). It visualizes a timeline of events—such as process executions, file modifications, and network connections—on a specific endpoint, enabling security analysts to quickly reconstruct the sequence of an attack and accelerate detection and response.

Answer

Real-time blocking of malicious processes at the endpoint

Answer

Automatic deployment of software patches to endpoints

Question 11

A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?

Accepted Answer

Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.. B is correct because Security Group Tags (SGTs) are the fundamental building blocks of Cisco TrustSec, used to classify traffic and enforce role-based access control. SGTs can be defined locally on the switch using the 'cts role-based sgt' command or dynamically assigned via a RADIUS server (such as Cisco ISE) during authentication. Without SGTs, the switch cannot perform the source-based or destination-based policy enforcement that TrustSec relies on.

Answer

Enable MACsec encryption on all trunk links.

Answer

Deploy Cisco ISE as the only policy server.

Answer

Apply IP access-lists on interfaces to filter traffic based on source IP.

Question 12

A company's Cisco WSA is configured with explicit proxy mode. Users report that they can browse the internet but cannot access internal websites hosted on the company's intranet. What is the most likely cause?

Accepted Answer

The internal websites are not in the proxy bypass list.. In explicit proxy mode, the WSA requires clients to be configured to send traffic to it. If internal websites are not added to the proxy bypass list (or the WSA's PAC file does not direct internal traffic directly), the WSA will attempt to proxy requests for internal sites, which may fail because the WSA cannot route to internal IPs or the internal DNS resolution fails. This is the most likely cause because users can browse the internet (proxied traffic works) but cannot reach internal sites (which should bypass the proxy).

Answer

The WSA is in transparent proxy mode.

Answer

Users are not authenticated to the WSA.

Answer

SSL decryption is blocking the internal sites.

Question 13

An organization requires that endpoints must have antivirus running and up-to-date patches before being granted full network access. Cisco ISE is used for authentication. Which ISE component enforces these requirements?

Accepted Answer

Posture assessment. C is correct because Cisco ISE Posture Assessment is the component specifically designed to check endpoints for compliance with security policies, such as having antivirus running and up-to-date patches. It evaluates the endpoint's state before granting full network access, and can enforce remediation or restrict access based on the results.

Answer

Guest access

Answer

TrustSec

Answer

Profiling

Question 14

A company is planning to use Cisco Umbrella to secure internet access for branch offices. They already have Cisco Meraki MX appliances at each branch. What is the best way to send DNS traffic from the branches to Umbrella?

Accepted Answer

Enable the Umbrella integration in Meraki dashboard. Cisco Meraki MX appliances have a native, built-in integration with Cisco Umbrella that can be enabled directly from the Meraki dashboard. This integration automatically redirects all DNS traffic from the branch to Umbrella's DNS resolvers (208.67.222.222 and 208.67.220.220) without requiring additional hardware, software, or complex tunnel configurations. It is the simplest and most efficient method for securing DNS traffic when Meraki MX devices are already deployed.

Answer

Deploy the Umbrella virtual appliance at each branch

Answer

Install the Umbrella Roaming Client on each user device

Answer

Configure IPSec tunnels between branches and Umbrella data centers

Question 15

A large enterprise uses Cisco WSA with integrated Cisco Advanced Malware Protection (AMP) to inspect web traffic. The security policy dictates that all downloaded files should be scanned by AMP. Recently, a user downloaded a PDF file from a trusted vendor site, but the download was blocked by the WSA. The administrator checks the WSA logs and sees that the file was blocked due to AMP's 'File Reputation' score of 10 (high risk). However, the vendor confirms the file is legitimate. The administrator notes that the file is digitally signed by the vendor. What is the most appropriate next step to allow the file while maintaining security?

Accepted Answer

Add the file's SHA-256 hash to the AMP custom allow list to override the reputation.. Cisco AMP allows administrators to create custom allow lists using file hashes (SHA-256) to override the file reputation score. Since the file is digitally signed and confirmed legitimate, adding its SHA-256 hash to the AMP custom allow list will permit the download while still scanning other files from that domain, preserving security. This approach directly addresses the false positive without broadly reducing security controls.

Answer

Add the vendor's domain to the WSA's global URL whitelist.

Answer

Lower the AMP file reputation threshold from 10 to 7 to allow files with lower risk scores.

Answer

Disable AMP scanning for the vendor's domain in the WSA policy.

Question 16

A large enterprise has deployed Cisco ISE for network access control with 802.1X and MAB across its wired and wireless networks. The network consists of Cisco Catalyst switches, Cisco Wireless LAN Controllers (WLCs), and ISE in a distributed deployment with three Policy Service Nodes (PSNs) and an Admin Node. Recently, the company implemented a new security policy requiring all endpoints to pass posture assessment before gaining full network access. The posture assessment uses AnyConnect ISE Posture Module.

Shortly after the change, users report that some wired clients are unable to connect to the network. The ISE logs show that the authentication is successful, but the session is terminated immediately with a 'Session-Timeout' attribute set to 0. The network team notices that the affected clients are all connected to switches running older Cisco IOS versions. The ISE administrator confirms that the authorization profiles for the affected clients include a session-timeout of 1 hour. Which course of action should the network engineer take to resolve the issue?

Accepted Answer

Upgrade the switch IOS to a version that supports the new ISE posture attributes.. Older Cisco IOS versions on the switches may not properly interpret the new RADIUS attributes (such as posture-related attributes) sent by ISE during posture assessment. This can cause the switch to misinterpret the session-timeout value and immediately terminate the session (setting Session-Timeout to 0). Upgrading the switch IOS to a version that supports these attributes resolves the compatibility issue. Option B is incorrect because disabling posture assessment for affected ports bypasses the security policy without addressing the root cause. Option C is incorrect because configuring switches to ignore the Session-Timeout attribute can lead to security risks and does not solve the attribute interpretation problem. Option D is incorrect because increasing the session-timeout value in the ISE authorization profile does not fix the switch's inability to handle the attribute; the attribute is still misinterpreted.

Answer

Disable posture assessment for the affected switch ports using a different authorization policy.

Answer

Configure the switches to ignore the Session-Timeout attribute sent by ISE.

Answer

Increase the session-timeout value in the ISE authorization profile to a larger value.

Question 17

A network administrator wants to implement 802.1X on a Cisco switch port for a device that does not support 802.1X. Which feature should be configured to allow the device to connect?

Accepted Answer

MAC Authentication Bypass (MAB). MAC Authentication Bypass (MAB) is the correct feature because it allows a device that does not support 802.1X supplicant software to authenticate by using its MAC address as the identity. The switch acts as a proxy, sending the MAC address as the username and password to the RADIUS server, which can then grant or deny access based on the MAC address in its database.

Answer

802.1X with EAP-MSCHAPv2

Answer

Downloadable ACL (dACL)

Answer

Web Authentication (WA)

Question 18

Drag and drop the steps to configure a Cisco ISE as a RADIUS server for network access control into the correct order.

Accepted Answer

Add the NAS, then define identity source, then authentication policy, then authorization policy, then test. First add the NAS, then define identity source, authentication policy, authorization policy, and finally test.

Answer

Define identity source, then add the NAS, then authentication policy, then authorization policy, then test

Answer

Add the NAS, then define identity source, then authorization policy, then authentication policy, then test

Answer

Add the NAS, then authentication policy, then define identity source, then authorization policy, then test

Question 19

A company is deploying Cisco Cloud Web Security (CWS) using an on-premises connector. They want to authenticate users via Active Directory and apply granular policies based on user identity. Which authentication method should be configured on the connector?

Accepted Answer

LDAP authentication with transparent user identification. Cisco Cloud Web Security (CWS) with an on-premises connector can integrate with Active Directory via LDAP to perform transparent user identification. This allows the connector to map IP addresses to authenticated user identities without requiring explicit proxy authentication, enabling granular policy enforcement based on AD user or group membership.

Answer

Local user database on the connector

Answer

Transparent proxy with explicit authentication via PAC file

Answer

SAML-based authentication

Question 20

Refer to the exhibit. A network administrator applies the ACL to the interface. What is the effect on traffic inbound to the interface?

Accepted Answer

Only TCP traffic destined to 192.168.1.100 on port 80 is permitted; all other IP traffic is denied. The ACL is applied inbound on the interface and contains a single entry that permits TCP traffic from any source to destination 192.168.1.100 on port 80. Because there is an implicit deny all at the end of every standard and extended ACL, only traffic matching this specific permit statement is allowed; all other IP traffic is denied.

Answer

All TCP traffic is permitted; other IP traffic is denied

Answer

All IP traffic is permitted

Answer

The ACL is applied outbound, so it has no effect on inbound traffic