350-701 Practice Exam 61 — 20 Questions

Question 1

A network engineer is troubleshooting 802.1X authentication failures. Which two components are required for a successful 802.1X authentication? (Choose two.)

Accepted Answer

Authentication server (ISE). In 802.1X authentication, the supplicant (client software) initiates the authentication process by sending an EAPOL-Start message, and the authentication server (ISE) validates the client's credentials via RADIUS. Without both, the authentication cannot complete. The supplicant provides identity, while the authentication server makes the final permit/deny decision.

Answer

DHCP server

Answer

DNS server

Answer

RADIUS proxy

Question 2

Which THREE are characteristics of Cisco Stealthwatch?

Accepted Answer

Can integrate with Cisco ISE for automated threat response. Cisco Stealthwatch can integrate with Cisco ISE (Identity Services Engine) via pxGrid or REST API to enable automated threat response. When Stealthwatch detects anomalous behavior, it can trigger ISE to enforce policy changes such as quarantining an endpoint or dynamically applying a security group access control list (SGACL), closing the loop between detection and remediation.

Answer

Acts as a next-generation firewall

Answer

Functions as an intrusion prevention system (IPS)

Question 3

An email administrator sees the above log entry in the Cisco ESA. What will happen to the email?

Accepted Answer

The email will be quarantined and an administrator will review it. The log entry indicates that the email triggered a content filter action set to 'quarantine' in the Cisco ESA. When an email is quarantined, it is held in a designated quarantine mailbox for administrative review, allowing the administrator to release, delete, or further analyze the message. This is the default behavior for policies that require human intervention before delivery.

Answer

The email will be dropped and not delivered

Answer

The email will be encrypted before delivery

Answer

The email will be delivered with a warning

Question 4

Refer to the exhibit. A user attempts to SSH to the router. The RADIUS server is unreachable. What will happen?

Accepted Answer

The user will be authenticated using the local database. When RADIUS is unreachable and the router is configured for AAA authentication, the default behavior is to fall back to the local database if the 'local' keyword is included in the authentication method list. In this scenario, the user will be authenticated using the local database because the RADIUS server is unreachable, and the router has a local user account configured. This is a standard AAA fallback mechanism to ensure administrative access is not completely lost.

Answer

The user will be denied access because RADIUS is unreachable

Answer

The router will try TACACS+ as a fallback

Answer

The user will be authenticated using RADIUS after a timeout

Question 5

A network engineer is configuring Cisco Umbrella to secure remote users connecting to a SaaS application. The users are not assigned a static public IP and often connect from various locations. Which deployment method best protects these users?

Accepted Answer

Roaming Client. The Roaming Client (Cisco Umbrella Roaming Security Module) is the correct deployment method because it provides DNS-layer security directly on the endpoint, regardless of the user's location or IP address. This ensures that remote users without a static public IP are protected by Umbrella's DNS filtering and threat intelligence, even when connecting from various networks (e.g., home, coffee shop, hotel). The client automatically selects the closest Umbrella data center via Anycast and encrypts DNS queries over HTTPS (DoH) to prevent tampering.

Answer

Virtual Appliances

Answer

DNS forwarding with Network Device binding

Answer

IP layer enforcement with Anycast

Question 6

A network engineer is troubleshooting an endpoint that failed to receive policy updates from the Cisco AMP cloud. The endpoint shows 'Out-of-Date' in the AMP console. The engineer verifies that the endpoint has outbound HTTPS access to the AMP cloud. What additional step should the engineer take to resolve the issue?

Accepted Answer

Verify that the endpoint can resolve the AMP cloud hostname using DNS.. The AMP connector must resolve the AMP cloud hostname (e.g., `amp.cisco.com`) via DNS to establish the HTTPS connection. Even if outbound HTTPS is allowed, a DNS resolution failure would prevent the endpoint from reaching the cloud, causing the 'Out-of-Date' status. Verifying DNS ensures the endpoint can translate the hostname to an IP address, which is a prerequisite for policy updates.

Answer

Configure the AMP connector to use a static IP address for the cloud.

Answer

Reboot the endpoint to force a policy download.

Answer

Verify that SNMP is enabled on the endpoint.

Question 7

A company deploys Cisco ISE for network access control. They want to enforce that only employees with a valid certificate and a compliant posture can access the corporate Wi-Fi. Which policy combination should be used?

Accepted Answer

Authentication using EAP-TLS and a Posture Enforcement Policy (PEP). EAP-TLS provides certificate-based mutual authentication, ensuring only employees with a valid certificate can authenticate. The Posture Enforcement Policy (PEP) then checks the endpoint's compliance (e.g., antivirus, patch level) before granting network access. This combination meets the requirement for both certificate validation and posture compliance enforcement on corporate Wi-Fi.

Answer

Authorization profile with dACL and a Posture Enforcement Policy (PEP)

Answer

Authentication using PEAP-MSCHAPv2 and a Posture Enforcement Policy (PEP)

Answer

Guest portal with self-registration and a Posture Enforcement Policy (PEP)

Question 8

A security engineer is configuring a cloud access security broker (CASB) to protect a SaaS application used by employees. The primary concern is to prevent sensitive data from being uploaded to the application. Which deployment mode should the engineer choose?

Accepted Answer

API-based mode, which connects directly to the SaaS application's APIs to scan and block sensitive data.. API-based mode connects directly to the SaaS application's APIs, allowing the CASB to scan data at rest and in transit using the application's native APIs (e.g., REST or Graph APIs). This mode can block uploads by enforcing data loss prevention (DLP) policies directly within the SaaS application, without requiring traffic redirection or proxy configuration. It is the most effective deployment mode for preventing sensitive data from being uploaded, as it can inspect and block data at the point of storage.

Answer

Forward proxy mode, which intercepts user traffic and inspects it before it reaches the SaaS application.

Answer

Reverse proxy mode, which sits in front of the SaaS application and inspects incoming traffic.

Answer

Web application firewall (WAF) mode, which filters HTTP traffic to the application.

Question 9

Which THREE components are part of a Cisco Cloud Web Security (CWS) deployment with on-premises connectors? (Choose three.)

Accepted Answer

On-premises Connector appliance. The On-premises Connector appliance (option B) is a core component of a Cisco CWS deployment with on-premises connectors. It acts as a local proxy that forwards web traffic from users to the Cisco Cloud Scanning Center for threat inspection, while also caching content locally to reduce latency. This appliance integrates with existing network infrastructure to enable cloud-based web security without requiring full traffic redirection to the cloud.

Answer

Cisco ASA firewall as the forward proxy

Answer

Cisco Web Security Appliance (WSA)

Question 10

A company is implementing zero trust architecture in the cloud. Which TWO principles are fundamental to zero trust? (Choose two.)

Accepted Answer

Assume breach. Zero trust architecture operates on the principle of 'never trust, always verify,' which includes assuming that a breach has already occurred or is inevitable. This assumption drives continuous validation of every access request, regardless of source, and enforces least-privilege access to limit lateral movement. In cloud environments, this means treating every API call, workload, and user session as potentially compromised until proven otherwise.

Answer

Implicit trust for internal traffic

Answer

Use static passwords

Answer

Use perimeter firewalls only

Question 11

Refer to the exhibit. A security administrator implements this S3 bucket policy to restrict access to the bucket 'my-bucket'. What type of condition is being used?

Accepted Answer

IpAddress condition. The condition in the S3 bucket policy uses the `IpAddress` condition key to restrict access based on the requester's IP address. This is explicitly an IP address condition, which evaluates the source IP of the request against the specified CIDR range. Option B is correct because the `aws:SourceIp` key is only valid with the `IpAddress` (or `NotIpAddress`) condition operator.

Answer

String condition

Answer

Bool condition

Answer

Numeric condition

Question 12

A company is deploying Cisco ISE for network access control. They need to authenticate devices that do not support 802.1X, such as printers and IP phones. Which TWO methods can be used to authenticate these devices? (Choose two.)

Accepted Answer

MAB. MAB uses MAC address for authentication. Profiling can identify the device and then ISE can apply policies, but profiling alone does not authenticate; it is often combined with MAB. The question asks for authentication methods, so MAB and (if the device can be profiled and then authenticated via a policy) but typically MAB is the primary method. Another method is to use a device certificate if the device supports it, but the question says non-802.1X devices. So MAB and possibly web authentication (guest portal) for devices that can browse. However, the most common are MAB and web authentication. But from ISE perspective, for non-supplicant devices, MAB and web-auth are options. Since the question says 'authenticate', and web-auth is for guest, I'll include MAB and device registration (which is not standard). Better: MAB and local database authentication via web portal. However, to be precise, the two methods are MAB and authentication using a local or AD account via a web portal (for devices that can do HTTP). But the options: A) 802.1X (not supported), B) MAB, C) Profiling, D) Guest portal, E) Device registration. The correct two: MAB and Guest portal (since guest portal can provide authentication for non-supplicant devices).

Answer

802.1X

Answer

Profiling

Answer

Device registration via posture agent

Question 13

An organization uses Cisco ISE with TrustSec to assign Security Group Tags (SGTs) to endpoints based on their role. An endpoint initially receives an SGT for 'Employees' but after a posture check reveals missing antivirus updates, ISE changes the SGT to 'Quarantine'. Which ISE feature dynamically updates the SGT?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) is the correct answer because it is the RADIUS-based mechanism (RFC 5176) that allows Cisco ISE to dynamically update an endpoint's Security Group Tag (SGT) after a posture check. When the posture assessment detects missing antivirus updates, ISE sends a CoA request to the network access device (e.g., switch or wireless LAN controller) to reauthenticate the session or push a new SGT, effectively moving the endpoint from 'Employees' to 'Quarantine' without requiring the user to manually reconnect.

Answer

Posture assessment

Answer

Guest access

Answer

Profiling

Question 14

A company wants to provide both corporate and guest wireless access using the same access points. They require that guest users be placed into a separate VLAN and have internet-only access. Which Cisco solution should be used?

Accepted Answer

Cisco Identity Services Engine (ISE) with dACL and VLAN assignment. Cisco ISE with downloadable ACLs (dACL) and VLAN assignment is the correct solution because it enables dynamic per-user policy enforcement. When a guest user authenticates, ISE can place them into a dedicated guest VLAN and apply a dACL that restricts traffic to internet-only access, while corporate users remain in their native VLAN with full internal access. This leverages RADIUS CoA (Change of Authorization) and 802.1X to dynamically assign VLANs and filter traffic at the access point or switch.

Answer

Cisco Prime Infrastructure

Answer

Cisco Flexible NetFlow

Answer

Cisco TrustSec with SGT

Question 15

Refer to the exhibit. A security analyst notices this CloudTrail log entry. Which security best practice is being violated?

Accepted Answer

RDP access is allowed from any IP address (0.0.0.0/0). The CloudTrail log shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing RDP (port 3389) from `0.0.0.0/0`, which means any IP on the internet. This violates the security best practice of restricting administrative access to trusted IP addresses only. Allowing RDP from all sources exposes the instance to brute-force attacks and unauthorized access attempts.

Answer

SSH access is allowed from a single IP

Answer

Port 22 is open to the internet

Answer

The user identity is an admin account

Question 16

A security engineer is implementing Cisco Identity Services Engine (ISE) for 802.1X authentication. The requirement is to allow full network access for corporate devices that pass posture assessment, while providing limited access for guest devices. The engineer configures an authorization policy with conditions based on identity group and posture status. However, guest devices are still getting full access. What is the most likely cause?

Accepted Answer

The authorization rule for corporate devices is placed above the guest rule, and guest devices are matching the corporate rule first. Cisco ISE authorization policies are evaluated in top-down order, and the first matching rule is applied. If the corporate device rule is placed above the guest rule, guest devices that do not meet the posture condition may still match the corporate rule if the condition is not restrictive enough (e.g., if the identity group condition is broad or the posture check is not enforced as a required match). This results in guest devices receiving full access instead of the intended limited access.

Answer

The guest devices are not passing the certificate validation

Answer

MAC Authentication Bypass (MAB) is not enabled for the guest devices

Answer

The RADIUS attributes for dACL are not being sent correctly

Question 17

Refer to the exhibit. A network engineer applies a zone-based firewall policy to a router. Users in the INSIDE zone report they can access HTTP servers on the OUTSIDE zone but cannot resolve DNS names or access MS-SQL servers. What does the policy do to DNS and MS-SQL traffic?

Accepted Answer

They are dropped because the BAD_TRAFFIC class explicitly drops them.. The zone-based firewall policy explicitly defines a class map (BAD_TRAFFIC) that matches DNS (UDP/53) and MS-SQL (TCP/1433) traffic and applies the 'drop' action. Since the policy-map uses a 'class-default' action of 'inspect' for GOOD_TRAFFIC, any traffic not matching GOOD_TRAFFIC but matching BAD_TRAFFIC is dropped before inspection can occur. The users' symptoms confirm that DNS and MS-SQL are being dropped, while HTTP (matched by GOOD_TRAFFIC) is inspected and allowed.

Answer

They are allowed because no 'inspect' action is applied to the class.

Answer

They are inspected and allowed through the firewall.

Answer

They are dropped because they do not match the GOOD_TRAFFIC class.

Question 18

A financial company uses Cisco AMP for Endpoints to protect 500 Windows workstations. The security administrator notices that several endpoints in the accounting department are showing 'Out-of-Date' status for over a week. The administrator checks the AMP console and sees that the group policy for accounting has been modified to disable certain scanning features. The endpoints have Internet connectivity but are not updating their policy or receiving new definitions. The administrator suspects a misconfiguration. What should the administrator do first to resolve this issue?

Accepted Answer

Verify that the endpoints can communicate with the AMP cloud by checking the connector's connectivity status.. The most common cause of 'Out-of-Date' endpoints is a communication issue. Checking the AMP connector's connection status (e.g., via the connector GUI) can reveal if the endpoint can reach the cloud. Option A (restarting services) might temporarily fix but does not identify the root cause. Option C (increasing polling interval) does not help if there is a connectivity obstacle. Option D (reinstalling the connector) is drastic and should be a last resort.

Answer

Restart the AMP services on a few affected endpoints to force a policy update.

Answer

Increase the policy polling interval from 60 minutes to 30 minutes.

Answer

Reinstall the AMP connector on all affected endpoints.

Question 19

An organization wants to implement endpoint protection that uses behavioral analysis to detect ransomware. The solution must be able to roll back changes made by the ransomware after detection. Which Cisco endpoint security feature provides this capability?

Accepted Answer

Exploit prevention with ransomware rollback. Cisco's endpoint protection includes a behavioral analysis engine that monitors for ransomware-like activities (e.g., mass file encryption, rapid file modifications). Upon detection, the feature automatically triggers a rollback, restoring affected files to their pre-encryption state using Volume Shadow Copy Service (VSS) snapshots or similar mechanisms, effectively reversing the ransomware's changes.

Answer

File reputation scanning

Answer

Device flow telemetry

Answer

Application blocking via policy

Question 20

A security team suspects that malware is exfiltrating data by encoding it in DNS queries. Which Cisco security solution is specifically designed to analyze DNS traffic for malicious activity?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. It can detect and block DNS-based data exfiltration techniques, such as DNS tunneling, by inspecting DNS request patterns and comparing them against threat intelligence feeds. This makes it the correct choice for analyzing DNS traffic for malicious activity.

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Answer

Cisco Email Security Appliance