350-701 Practice Exam 60 — 20 Questions

Question 1

An organization wants to prevent malware from executing on endpoints by using a file reputation service. Which Cisco technology provides cloud-based file reputation and analysis for endpoint protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Secure Endpoint (AMP for Endpoints). Cisco Secure Endpoint (formerly AMP for Endpoints) is the correct answer because it provides cloud-based file reputation and analysis through its Advanced Malware Protection (AMP) cloud. This service uses global threat intelligence and machine learning to analyze file behavior, assign reputation scores, and block or quarantine malicious files on endpoints in real time.

Answer

Cisco Stealthwatch

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Firepower NGFW

Question 2

A security team is evaluating cloud security solutions. Which TWO of the following are core capabilities of a Cloud Access Security Broker (CASB)?

Accepted Answer

Shadow IT discovery and visibility. Shadow IT discovery and visibility is a core CASB capability. CASBs discover unsanctioned cloud applications (Shadow IT) by analyzing network traffic logs, API integrations, or proxy data to identify cloud services used without IT approval, providing visibility into usage, risk posture, and user activity.

Answer

Provisioning and de-provisioning of cloud resources

Answer

Container image scanning

Answer

Intrusion prevention for virtual machines

Question 3

Refer to the exhibit. An IPsec VPN tunnel between two routers is not passing traffic. IKE phase 1 is not complete (MM_NO_STATE). Phase 2 has no SA. Which issue is most likely causing the problem?

Accepted Answer

IKE policy mismatch (e.g., encryption, hash, or pre-shared key) causes phase 1 failure.. The IKE phase 1 state is MM_NO_STATE, which indicates that the Internet Key Exchange (IKE) Main Mode negotiation has not completed. This typically occurs when the peers cannot agree on the IKE policy parameters (encryption, hash, Diffie-Hellman group, authentication method, or pre-shared key). Since phase 2 (IPsec SA) depends on a successful phase 1, the failure cascades, making an IKE policy mismatch the most likely root cause.

Answer

The remote peer is not reachable due to a routing issue.

Answer

The ACL defining interesting traffic is misconfigured.

Answer

Mismatched IPsec transform sets between the peers.

Question 4

During a network audit, an engineer finds that a switch configured for 802.1X is allowing a device to access the network without authentication. The switch logs show 'MAB failed', 'dot1x failed', but the port is in the forwarding state. The port configuration includes 'authentication fallback final mab' and 'dot1x timeout server-timeout 10'. What is the most likely explanation?

Accepted Answer

The 'authentication fallback final mab' command allows the port to become authorized even if MAB fails. The 'authentication fallback final mab' command includes the 'final' keyword, which configures the switch to authorize the port (place it in the forwarding state) even if MAB fails. In this scenario, both 802.1X and MAB failed, but the 'final' keyword overrides the failure and allows the port to forward traffic. This explains why the device gains network access despite authentication failures.

Answer

The device is using a MAC address that matches a static CAM entry

Answer

The switch has 'aaa authentication dot1x default local' which allows local fallback

Answer

The 'dot1x timeout server-timeout' is too short, causing the switch to skip authentication

Answer

The switch is running an IOS version that treats 'authentication fallback final mab' as a no-op

Question 5

A cloud architect is designing a hybrid network between on-premises and AWS. They need to ensure traffic to the internet from the VPC uses the on-premises security stack for inspection. The VPC has an Internet Gateway (IGW). What must be configured to force outbound traffic to the on-premises firewall?

Accepted Answer

Update the VPC route table to point 0.0.0.0/0 to the virtual private gateway or transit gateway attachment. To force all outbound internet traffic from the VPC through the on-premises firewall, the VPC route table must have a default route (0.0.0.0/0) pointing to the virtual private gateway (VPG) or transit gateway (TGW) attachment. This directs traffic over the VPN or Direct Connect to the on-premises network, where the security stack inspects it before reaching the internet. The Internet Gateway (IGW) remains present but is not used for this traffic because the route table entry overrides it.

Answer

Use VPC Endpoints for all services

Answer

Deploy a NAT Gateway and assign it to the route table

Answer

Configure security groups to block direct internet access

Question 6

Refer to the exhibit. An administrator sees that the file invoice_2024.exe was blocked by both Cisco AMP and ESA. However, a user claims the attachment was delivered. What is the most likely cause?

Accepted Answer

The ESA was configured to 'Deliver then alert' for malware detected by AMP.. When Cisco ESA is configured with 'Deliver then alert' for malware detected by AMP, the email is delivered to the user before the AMP file reputation analysis completes. The ESA sends the file to AMP for analysis, but if the policy is set to deliver first and alert later, the user receives the attachment even if AMP later determines it is malicious. This explains why the administrator sees the block in both AMP and ESA logs, yet the user claims delivery.

Answer

The ESA was not configured to use AMP for file reputation.

Answer

The AMP file reputation check was not performed due to an ACL misconfiguration.

Answer

The file was whitelisted in the AMP policy.

Question 7

A network engineer is deploying TrustSec using SGT over VXLAN in a data center fabric. The fabric switches are configured as VXLAN Tunnel Endpoints (VTEPs). The engineer must ensure that SGT information is propagated from the border leaves to the spine. Which mechanism should be used?

Accepted Answer

VXLAN Group Policy Option (GPO) in the VXLAN header. VXLAN Group Policy Option (GPO) is the correct mechanism because it embeds the SGT directly into the VXLAN header (in the Group Policy ID field, bits 24-31 of the VXLAN Network Identifier). This allows the spine switches, which are also VTEPs, to receive and forward the SGT information without needing a separate control plane protocol. The border leaf encodes the SGT in the VXLAN encapsulation, and the spine decodes it from the header, ensuring end-to-end SGT propagation across the fabric.

Answer

LISP (Locator/ID Separation Protocol)

Answer

SXP (SGT Exchange Protocol) between VTEPs

Answer

IS-IS protocol extensions for SGT

Question 8

Cisco AMP for Endpoints provides endpoint protection. Which two are core capabilities of AMP? (Choose two.)

Accepted Answer

Continuous monitoring. C is correct because Cisco AMP for Endpoints provides continuous monitoring of file activity and telemetry across endpoints, analyzing behavior in real time to detect threats. This capability ensures that even if a file is initially deemed safe, any subsequent malicious activity is identified and blocked, leveraging cloud-based threat intelligence and analytics.

Answer

Privileged access management

Answer

Exploit prevention

Answer

Multi-factor authentication

Question 9

An organization uses Cisco Umbrella for DNS-layer security. They want to block access to a newly discovered malicious domain (malware.example.com) immediately. Which action should the administrator take in the Umbrella dashboard?

Accepted Answer

Add the domain to the 'Block List' under the policy's 'Destination Lists'.. In Cisco Umbrella, the most immediate way to block a specific malicious domain is to add it to the 'Block List' under the policy's 'Destination Lists'. This list is evaluated in real-time for DNS queries, allowing the administrator to enforce the block without waiting for threat intelligence updates or affecting other policies.

Answer

Add the domain to the 'Global Block List' under 'Managed Networks'.

Answer

Add the domain to the 'Temporary Block List' under 'Security Settings'.

Answer

Add the domain to the 'IP Layer Enforcement' list.

Question 10

A company wants to ensure that only authorized applications can run on endpoints. Which feature of Cisco AMP for Endpoints should be used to create a whitelist of allowed applications?

Accepted Answer

Application Control. Application Control in Cisco AMP for Endpoints allows administrators to define a whitelist of approved applications by specifying SHA-256 hashes, file paths, or publisher certificates. This feature enforces a 'deny-by-default' policy, blocking any executable not explicitly allowed, which directly meets the requirement to ensure only authorized applications can run on endpoints.

Answer

Exploit Prevention

Answer

Orbital Advanced Search

Answer

File Reputation

Question 11

An organization is migrating from on-premises Cisco ESA to Cisco Cloud Email Security (CES). They need to ensure that email encryption policies remain consistent after migration. What is the best approach to migrate the encryption policies?

Accepted Answer

Export the configuration from on-premises ESA and import into CES. Cisco Cloud Email Security (CES) supports importing configuration files exported from on-premises Cisco ESA, including encryption policies. This ensures consistency by directly transferring the policy definitions without manual re-creation, leveraging the same underlying policy engine and encryption protocols (e.g., TLS, S/MIME, or PGP) used on-premises.

Answer

Use the Cisco ESA API to migrate policies automatically

Answer

Recreate the policies manually in CES based on existing documentation

Answer

Synchronize the two appliances using Cisco Security Management Suite

Question 12

During a security incident, an engineer needs to quickly quarantine an endpoint that is connected to a switch via 802.1X. The engineer wants to use ISE to send a Change of Authorization (CoA) to move the port to a restrictive VLAN. What must be configured on the switch to allow ISE to send CoA?

Accepted Answer

The switch must have 'aaa server radius dynamic-author' configured with a client entry for ISE. The `aaa server radius dynamic-author` command defines a local RADIUS dynamic-author server on the switch, which listens for Change of Authorization (CoA) and Disconnect messages from ISE. The client entry specifies the ISE server's IP address and shared secret, allowing the switch to accept and process the CoA request to dynamically change the VLAN assignment for the 802.1X-authenticated endpoint.

Answer

The switch must listen on UDP port 1700 for CoA packets

Answer

The switch must have a VTY line configured with 'transport input ssh'

Answer

RADIUS accounting must be enabled on the switch

Answer

The switch must have 'authentication event server dead action authorize' configured

Question 13

Refer to the exhibit. An analyst reviews the log from a Cisco Secure Endpoint connector. The file 'invoice.pdf.exe' was quarantined. What best describes the detection process that occurred?

Accepted Answer

The cloud reputation was unknown, but local analysis detected malicious behavior, triggering quarantine.. The log shows the file 'invoice.pdf.exe' was quarantined based on local analysis after the cloud reputation returned an unknown verdict. Cisco Secure Endpoint uses a multi-layered approach: if the cloud reputation is unknown, the connector performs local analysis (e.g., static analysis, behavioral monitoring) to detect malicious behavior. In this case, the local analysis flagged the file as malicious, triggering the quarantine action.

Answer

The file was blocked at execution time by Exploit Prevention.

Answer

The cloud reputation determined the file was malicious and instructed the connector to quarantine.

Answer

The file was executed and then reverted by the retrospective engine.

Question 14

A company has deployed Cisco AMP for Endpoints and wants to receive immediate notification when a file is detected as malicious by the cloud sandbox analysis. Which policy setting should be enabled?

Accepted Answer

Enable 'Send alerts for malicious files' in the AMP policy. The 'Send alerts for malicious files' setting in the AMP for Endpoints policy directly controls whether the connector sends a real-time alert to the management console when a file is determined to be malicious by the cloud sandbox (e.g., Threat Grid). This ensures immediate notification without relying on periodic polling or batch reporting.

Answer

Configure Syslog forwarding for all events

Answer

Enable 'Exploit Prevention' in block mode

Answer

Set the connector to 'Analyze' mode

Question 15

A company has deployed Cisco ISE for network access control. After a recent upgrade, the operations team notices that some users are being assigned incorrect authorization profiles. The ISE logs show that the users are being matched to the correct identity group, but the authorization result is different from expected. What is the most likely cause?

Accepted Answer

The authorization policy rules are not in the correct order, causing a different rule to match first.. In Cisco ISE, authorization policies are evaluated in top-down order, and the first matching rule is applied. Even if users are correctly assigned to an identity group, a higher-priority authorization policy rule that matches on other conditions (e.g., endpoint profile, device type, or time condition) can override the expected result. This is the most likely cause when authentication and group assignment are correct but the authorization result is unexpected.

Answer

The passive identity feature is overriding the user's group assignment.

Answer

The network device group assignment has changed, causing the device to be in a different group.

Answer

The authentication policy is misconfigured, causing users to be placed in the wrong identity group.

Question 16

Drag and drop the steps to configure a Cisco ASA for remote access VPN using AnyConnect in the correct order.

Accepted Answer

Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group, then Apply to interface. First enable AnyConnect image, then define IP pool, group policy, tunnel group, and apply to interface.

Answer

Apply to interface, then Enable AnyConnect image, then Define IP pool, then Group policy, then Tunnel group

Answer

Enable AnyConnect image, then Group policy, then Define IP pool, then Tunnel group, then Apply to interface

Answer

Enable AnyConnect image, then Define IP pool, then Tunnel group, then Group policy, then Apply to interface

Question 17

A company with 500 employees uses Cisco Web Security Appliance (WSA) as a proxy. They have a policy to block access to social media sites during working hours (9 AM - 5 PM) for all users except the marketing team. The marketing team must have unrestricted access at all times. The WSA is configured with a time-based access policy that blocks the 'Social Networking' category from 9 AM to 5 PM, and an identity policy that identifies the marketing team by Active Directory group. However, marketing users report that they are blocked from social media during working hours. What is the most likely cause?

Accepted Answer

The identity policy for the marketing team has a 'Use Global Policy' action for social networking, which then applies the time-based block.. When an identity policy is set to 'Use Global Policy' for a specific category, it defers to the global access policy, which in this case includes the time-based block for social networking. Since the marketing team's identity policy does not explicitly override the global policy with an 'Allow' or 'Monitor' action for the 'Social Networking' category, the time-based block applies to them as well.

Answer

The time-based policy is set to block social media from 9 AM to 5 PM, but the marketing team's identity policy is not explicitly set to 'Monitor' or 'Allow' for that category.

Answer

The WSA requires authentication for all users, but marketing users are not prompted to authenticate.

Answer

The marketing team's Active Directory group is not being recognized by the WSA due to a synchronization issue.

Question 18

A small business uses Cisco Umbrella for DNS-layer security. They recently enabled multi-factor authentication (MFA) for all administration accounts. The IT manager is unable to log into the Umbrella dashboard; the login page accepts his password but then asks for an MFA code. However, he never set up MFA. He checks his email and finds no registration email. He is the only administrator. How should he regain access to the Umbrella dashboard?

Accepted Answer

Contact Cisco TAC and prove ownership of the account to have MFA reset.. When an administrator is locked out of Cisco Umbrella due to MFA that was never configured, and there is no other administrator to assist, the only recovery path is to contact Cisco TAC. TAC can verify account ownership through a proof-of-ownership process and then reset the MFA enrollment, allowing the administrator to set it up fresh. This is the standard escalation procedure for Umbrella when self-service recovery options are unavailable.

Answer

Create a new Umbrella account and transfer the organization.

Answer

Use the Umbrella API to programmatically disable MFA.

Answer

Have another administrator in the organization disable MFA for his account.

Question 19

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Accepted Answer

RADIUS. Cisco AnyConnect VPN authentication can be performed using RADIUS, which is a widely supported AAA protocol. RADIUS enables centralized authentication, authorization, and accounting for VPN users, and it is natively integrated with Cisco ASA and Firepower Threat Defense (FTD) appliances for remote access VPNs.

Answer

TACACS+

Answer

OSPF

Answer

SNMP

Question 20

Which TWO benefits does centralized RADIUS authentication provide over local authentication on network devices? (Choose two.)

Accepted Answer

Centralized accounting and logging of all authentication attempts. Centralized RADIUS authentication aggregates all authentication, authorization, and accounting (AAA) data on a single server. This provides a unified audit trail for all login attempts across network devices, enabling comprehensive logging and accounting that local authentication cannot offer. Local authentication logs are device-specific and lack centralized aggregation, making forensic analysis and compliance reporting more difficult.

Answer

Faster authentication because of local caching

Answer

Support for multiple authentication protocols like PAP, CHAP, EAP

Answer

No need for a backup authentication method