350-701 Practice Test 6 — 10 Questions

Question 1

An email administrator sees the above log entry in the Cisco ESA. What will happen to the email?

Accepted Answer

The email will be quarantined and an administrator will review it. The log entry indicates that the email triggered a content filter action set to 'quarantine' in the Cisco ESA. When an email is quarantined, it is held in a designated quarantine mailbox for administrative review, allowing the administrator to release, delete, or further analyze the message. This is the default behavior for policies that require human intervention before delivery.

Answer

The email will be dropped and not delivered

Answer

The email will be encrypted before delivery

Answer

The email will be delivered with a warning

Question 2

A security engineer is troubleshooting an issue where a known malicious file (SHA-256: 3a7c...f9e) is not being detected by Cisco Secure Endpoint on a Windows 10 endpoint. The file was downloaded from the internet. The policy has the 'File Reputation' setting set to 'Use cloud lookup', and the 'Exploit Prevention' module is enabled. The endpoint is connected to the internet and can reach the AMP cloud. What is the most likely reason for the missed detection?

Accepted Answer

The endpoint was offline when the file was first written to disk, so the cloud lookup was skipped.. Option A is correct because Cisco Secure Endpoint's 'File Reputation' with 'Use cloud lookup' requires the endpoint to be online at the moment the file is written to disk. If the endpoint was offline during that critical window, the connector cannot perform the SHA-256 cloud lookup against the AMP cloud, and the file is not evaluated for maliciousness. The file remains undetected until a subsequent scan or event triggers a new lookup, which may not happen automatically.

Answer

Windows Defender Real-time Protection is interfering with the AMP connector.

Answer

The Exploit Prevention module is blocking the cloud lookup process.

Answer

The AMP cloud license has expired for the organization.

Question 3

A university is using Cisco ISE to provide secure wireless access for students and faculty. The wireless network uses WPA2-Enterprise with PEAP-MSCHAPv2. Recently, some faculty members reported that they cannot connect to the wireless network from their personal laptops, while student devices connect without issues. The faculty members are using the same SSID and entering their credentials correctly. The ISE logs show that the authentication attempts from faculty devices are failing with 'RADIUS Access-Reject' due to incorrect credentials. However, the faculty members are certain they are using the correct password. The IT department has verified that the user accounts in Active Directory are active and not locked. What is the most likely cause of the issue?

Accepted Answer

The ISE authentication policy is not configured to query Active Directory for faculty users. The most likely cause is that the ISE authentication policy is not configured to query Active Directory for faculty users. Since student devices connect successfully, the policy likely matches students to an AD identity source but fails for faculty because their accounts are in a different AD group or domain not included in the policy. The 'RADIUS Access-Reject' with 'incorrect credentials' error in ISE logs indicates the authentication policy is not finding the user in the configured identity stores, even though the password is correct.

Answer

The faculty laptops do not have a valid client certificate

Answer

The faculty accounts are locked due to multiple failed attempts

Answer

The RADIUS shared secret on the wireless controller is incorrect

Question 4

During a cloud migration, an administrator notices that a workload in Azure is generating outbound traffic that is being blocked by the cloud security group. The workload requires connectivity to a specific SaaS application (Office 365) using TLS. The security group denies all outbound traffic except to specific IP ranges. Which action should the administrator take?

Accepted Answer

Add the Office 365 IP ranges and FQDNs to the allowed list. Option C is correct because the administrator needs to allow outbound traffic to Office 365, which uses TLS over TCP/443. Since the security group denies all outbound traffic except to specific IP ranges, the most direct and secure method is to add the published Office 365 IP ranges and FQDNs to the allowed list. This ensures the workload can reach the SaaS application without bypassing security controls or introducing additional latency.

Answer

Implement a proxy server

Answer

Use Azure Private Link

Answer

Disable the security group temporarily

Question 5

A company is connecting multiple VPCs in AWS to a shared services VPC using AWS Transit Gateway. They want to inspect east-west traffic between VPCs with a common security policy. Which design best achieves this using Cisco solutions?

Accepted Answer

Use AWS Transit Gateway with a centralized Cisco Firepower instance for inspection. Option D is correct because AWS Transit Gateway allows you to route traffic between multiple VPCs through a centralized inspection VPC, where a Cisco Firepower instance can apply a consistent security policy to all east-west traffic. This design avoids deploying separate firewalls in each VPC and ensures that traffic between any two VPCs is inspected by a single, centrally managed policy engine.

Answer

Deploy a Cisco Firepower instance in each VPC

Answer

Use VPC peering with no inspection

Answer

Direct Connect to on-premises Cisco ASA

Question 6

A company is planning to use Cisco Umbrella to secure internet access for branch offices. They already have Cisco Meraki MX appliances at each branch. What is the best way to send DNS traffic from the branches to Umbrella?

Accepted Answer

Enable the Umbrella integration in Meraki dashboard. Option D is correct because Meraki MX can automatically integrate with Umbrella via the built-in connector. Option A is wrong because IPSec tunnel is more complex and not native. Option B is wrong because an on-premises virtual appliance adds infrastructure. Option C is wrong because the roaming client is for endpoints, not branch networks.

Answer

Deploy the Umbrella virtual appliance at each branch

Answer

Install the Umbrella Roaming Client on each user device

Answer

Configure IPSec tunnels between branches and Umbrella data centers

Question 7

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Option A is correct because zero trust architecture operates on the principle of 'never trust, always verify,' which includes assuming that a breach has already occurred or is inevitable. This assumption drives continuous validation of every access request, regardless of source, and enforces least-privilege access to limit lateral movement. In cloud environments, this means treating every API call, workload, and user session as potentially compromised until proven otherwise.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 8

A small business uses Cisco Duo for multi-factor authentication. They want to ensure that employees accessing cloud apps from personal devices are compliant with device security policies. Which Duo feature should they use?

Accepted Answer

Duo Device Health. D is correct because Duo Device Health checks device security posture (OS version, encryption, etc.) before allowing access. A is for SSO. B is for VPN. C is the authenticator app.

Answer

Duo Mobile

Answer

Duo Network Gateway

Answer

Duo Access Gateway

Question 9

A cloud security architect is designing a zero-trust architecture for an enterprise using AWS and Azure. They need to enforce micro-segmentation between application tiers. Which Cisco solution is most appropriate?

Accepted Answer

Cisco Secure Workload. B is correct because Cisco Secure Workload provides micro-segmentation based on application dependencies. A is for firewall, not workload-centric. C is for secure internet gateway. D is for cloud security posture.

Answer

Cisco Umbrella SIG

Answer

Cisco Secure Firewall

Answer

Cisco Secure Cloud Analytics

Question 10

A company wants to use Cisco DUO for MFA to protect access to its Azure AD applications. Which authentication method should be configured for cloud applications?

Accepted Answer

Secondary authentication via DUO after Azure AD. When integrating Cisco DUO with Azure AD for MFA, the recommended approach is to configure DUO as a secondary authentication provider after Azure AD handles primary authentication. This is achieved by using DUO's Azure AD integration, which acts as a custom control or a conditional access policy that triggers DUO MFA after the user has already authenticated against Azure AD. This ensures that Azure AD remains the identity provider (IdP) for primary authentication, while DUO provides an additional layer of security via a secondary push, phone call, or passcode.

Answer

DUO for RADIUS authentication

Answer

DUO as a SAML identity provider

Answer

Primary authentication via DUO

350-701 Practice Test 6 — 10 Questions

Exhibit

350-701 Practice Test 6 — 10 Questions

Exhibit