350-701 Practice Exam 62 — 20 Questions

Question 1

Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change global_sensitivity to medium. The http_inspect preprocessor's global_sensitivity setting controls how aggressively it normalizes HTTP traffic before analysis. Setting it to 'medium' reduces false positives from legitimate HTTP floods by relaxing the threshold for anomalous HTTP behavior, while still allowing the preprocessor to detect real attacks that exhibit more extreme deviations. This is the most targeted change because it directly addresses the flood of HTTP traffic without disabling the preprocessor entirely.

Answer

Disable the http_inspect preprocessor

Answer

Change frag3 policy to bsd

Answer

Change stream5_tcp policy to linux

Question 2

Which Cisco ESA feature uses SHA-256 cloud lookups to detect malware in email attachments?

Accepted Answer

AMP for Email. Cisco ESA's AMP for Email (Advanced Malware Protection) leverages SHA-256 cloud lookups to compare file hashes of email attachments against Talos threat intelligence. When an attachment is processed, its SHA-256 hash is computed and sent to the AMP cloud for real-time verdict (malicious, clean, or unknown). This is distinct from signature-based detection, as it relies on cloud-based file reputation analysis.

Answer

Outbreak Filters

Answer

DLP Policies

Answer

Anti-spam (SenderBase)

Question 3

An organization deploys AMP for Endpoints with the Orbital module to perform advanced endpoint telemetry. The team wants to create a query that retrieves all running processes with a network connection to an external IP address. Which Orbital query language syntax is correct?

Accepted Answer

SELECT * FROM all_processes WHERE remote_ip IN (SELECT ip FROM connections WHERE direction = 'OUT'). The Orbital query language uses SQL-like syntax, and the correct way to retrieve all running processes with a network connection to an external IP address is to join the `all_processes` table with the `connections` table, filtering for outbound connections (`direction = 'OUT'`) and checking that the `remote_ip` is not a private IP (though the query as written uses a subquery to get IPs from outbound connections). This directly matches the requirement of processes with external network connections.

Answer

SELECT * FROM all_processes WHERE ip = 'external'

Answer

SELECT * FROM all_processes WHERE listening = 'true'

Answer

SELECT * FROM processes WHERE network_connection = 'true'

Question 4

A network administrator is configuring 802.1X for wired access on a Cisco switch. The switch is configured for RADIUS using a Cisco ISE server. During testing, a client that supports 802.1X is unable to authenticate and fails to gain network access. The administrator checks the switch logs and sees "Authentication failed: invalid EAP code received". What is the most likely cause?

Accepted Answer

The client is using an unsupported EAP method (e.g., EAP-TLS instead of PEAP).. The error 'invalid EAP code received' indicates that the switch received an EAP packet with a code it does not support, which typically occurs when the client uses an unsupported EAP method. Option A is correct because if the client attempts a method like EAP-TLS while the switch or RADIUS server expects PEAP, the EAP code may be unrecognized. Option B is wrong because RADIUS unreachability would result in timeouts or 'no response' errors, not EAP code errors. Option C is wrong because a shared secret mismatch would cause RADIUS authentication rejections (e.g., 'Access-Reject'), not EAP parsing issues. Option D is wrong because a trunk port configuration would cause VLAN mismatches or connectivity issues, not EAP code errors.

Answer

The RADIUS server is unreachable.

Answer

The switch is configured with the wrong shared secret for RADIUS.

Answer

The switch port is configured as a trunk port rather than an access port.

Question 5

A security architect is designing a zero-trust architecture for a remote workforce using Cisco SD-WAN. The company requires that all traffic between branch sites and the data center is encrypted and authenticated, and that no device can access resources unless it has a valid certificate. Which technology should be used to enforce device identity?

Accepted Answer

Cisco TrustSec. Cisco TrustSec uses Security Group Tags (SGTs) and device identity based on certificates to enforce access control in a zero-trust architecture. It integrates with SD-WAN to ensure that only devices with valid certificates can communicate, meeting the requirement for encrypted and authenticated traffic between branch sites and the data center.

Answer

802.1X with EAP-TLS

Answer

Network Access Control (NAC)

Answer

IPsec VPN

Question 6

A network architect is designing a DMZ for a web server that must be accessible from the internet. The server should not initiate connections to the internal network. Which firewall rule best achieves this?

Accepted Answer

Permit HTTP from outside to DMZ; deny all from DMZ to inside.. To allow inbound traffic to the DMZ server but block outbound from DMZ to inside, an ACL on the DMZ interface should permit inbound traffic from outside and deny outbound to inside.

Answer

Permit HTTP from DMZ to outside; deny all from inside to DMZ.

Answer

Permit any from outside to DMZ; permit any from DMZ to inside.

Answer

Permit any from outside to DMZ; deny any from DMZ to outside.

Question 7

An organization is implementing Cisco Secure Cloud Insights (formerly CloudCenter). Which three capabilities does this tool provide? (Choose three.)

Accepted Answer

Cloud security posture management. Cisco Secure Cloud Insights (formerly CloudCenter) provides cloud security posture management (CSPM) by continuously monitoring cloud environments for misconfigurations, compliance violations, and security risks. It helps organizations enforce security policies across multi-cloud deployments, ensuring alignment with frameworks like CIS and NIST.

Answer

User behavior analytics

Answer

Network traffic analysis

Question 8

A network engineer needs to implement a security solution that provides encryption, integrity, and authentication at Layer 2 between two switches. Which technology should be used?

Accepted Answer

MACsec. MACsec (IEEE 802.1AE) provides hop-by-hop encryption, integrity, and authentication at Layer 2 (the data link layer) directly on Ethernet frames. It uses GCM-AES-128 or GCM-AES-256 to encrypt the entire payload and authenticate the frame, ensuring confidentiality and integrity between directly connected switches without requiring IP-layer processing.

Answer

SSL/TLS

Answer

IPsec

Answer

802.1X

Question 9

A security administrator discovers that users are evading the corporate firewall by using SSH to tunnel HTTP traffic to external servers. Which action can be taken on a Cisco ASA firewall to detect and prevent this?

Accepted Answer

Enable SSH inspection using the 'inspect ssh' command in the global policy. Enabling SSH inspection with the 'inspect ssh' command on a Cisco ASA allows the firewall to monitor SSH control channel negotiations and detect when SSH is being used to tunnel other protocols (like HTTP). The ASA can then enforce policies to block such tunneling, preventing users from bypassing the corporate firewall.

Answer

Configure a dynamic PAT rule to limit the number of SSH sessions

Answer

Create an access-list to block port 22 entirely

Answer

Implement SSL decryption to inspect the encrypted SSH payload

Question 10

A company has 500 users who work remotely and connect to cloud-based SaaS applications. The security team is concerned about malware downloads from these applications. They have deployed Cisco Umbrella with the SIG feature. However, after deployment, a test shows that downloading a file from Dropbox is not being inspected by the cloud security stack. The Umbrella dashboard indicates that the policy is active and the SIG feature is enabled. The network team confirms that the users are using the Umbrella roaming client and that the traffic is correctly forwarding to Umbrella. What is the most likely issue?

Accepted Answer

The traffic is bypassed because of an explicit bypass rule for Dropbox. Cisco Umbrella's SIG (Security Internet Gateway) feature can be configured with explicit bypass rules for specific applications or domains. Even when the SIG is enabled and traffic is forwarding correctly, an administrator may have inadvertently created a bypass rule for Dropbox, causing its traffic to skip cloud security inspection. This explains why the policy is active but downloads from Dropbox are not inspected.

Answer

The SIG inspection only applies to HTTP traffic, not HTTPS

Answer

The Dropbox application uses non-standard ports

Answer

The users' devices are not configured with the Umbrella roaming client

Question 11

A network administrator is troubleshooting an issue where users cannot send emails with attachments larger than 10 MB through the Cisco Email Security Appliance (ESA). The ESA is configured with a mail flow policy that has a maximum message size of 20 MB. What is the most likely cause of the issue?

Accepted Answer

The ESA default maximum attachment size is 10 MB.. The Cisco ESA has a built-in default maximum attachment size of 10 MB, which is separate from the mail flow policy's maximum message size. Even though the mail flow policy allows messages up to 20 MB, the attachment size limit is enforced by the ESA's default configuration, which caps individual attachments at 10 MB. This default can be overridden in the mail flow policy or system settings, but if not explicitly changed, it remains the limiting factor.

Answer

The mail flow policy maximum message size is set too low.

Answer

The HAT (Host Access Table) maximum message size is set to 10 MB.

Answer

The outgoing mail policy has a smaller attachment size limit.

Question 12

Drag and drop the steps to configure a site-to-site IPsec VPN on a Cisco ASA into the correct order.

Accepted Answer

Step 1: Configure IKE policy (Phase 1), Step 2: Set pre-shared key, Step 3: Define interesting traffic via ACL, Step 4: Configure crypto map (binding Phase 2), Step 5: Apply crypto map to interface. IKE policy defines Phase 1 parameters, then pre-shared key is set, interesting traffic is defined via ACL, crypto map binds Phase 2 parameters, and it is applied to the interface.

Answer

Step 1: Define interesting traffic via ACL, Step 2: Configure IKE policy, Step 3: Set pre-shared key, Step 4: Configure crypto map, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Configure crypto map, Step 4: Define interesting traffic ACL, Step 5: Apply to interface

Answer

Step 1: Configure IKE policy, Step 2: Set pre-shared key, Step 3: Define interesting traffic ACL, Step 4: Apply crypto map to interface, Step 5: Configure crypto map

Question 13

A network administrator is configuring 802.1X authentication on Cisco switches for wired endpoints. Which protocol is used between the client (supplicant) and the switch (authenticator)?

Accepted Answer

EAP over LAN (EAPoL). In 802.1X authentication, the client (supplicant) communicates with the switch (authenticator) using EAP over LAN (EAPoL), which is defined in IEEE 802.1X-2004. EAPoL encapsulates EAP frames in Ethernet frames, allowing the supplicant to send authentication credentials to the authenticator before granting network access. The authenticator then relays these EAP messages to the authentication server (typically a RADIUS server) using RADIUS, but the direct protocol between client and switch is EAPoL.

Answer

RADIUS

Answer

EAP over UDP

Answer

TACACS+

Question 14

A company is designing a secure segmentation strategy for a three-tier web application. They want to isolate the web, application, and database tiers while allowing only necessary traffic. Which design best achieves defense-in-depth while minimizing complexity?

Accepted Answer

Use VRF-Lite with SGTs and enforce policies via Cisco ISE.. VRF-Lite with Security Group Tags (SGTs) and Cisco ISE provides scalable, policy-based segmentation that follows the defense-in-depth principle. VRF-Lite creates separate routing tables for each tier, while SGTs enforce granular, identity-based access control at the network layer, reducing complexity compared to multiple firewalls or ACLs. This design allows necessary traffic between tiers without relying on IP addresses alone, aligning with zero-trust architecture.

Answer

Place each tier in a separate VLAN and rely on ACLs on the distribution switch.

Answer

Deploy a dedicated firewall for each tier and connect them in series.

Answer

Place a single stateful firewall between each tier with separate interfaces.

Question 15

An organization is deploying Cisco Secure Endpoint (AMP) for the first time in a Windows environment. The security team wants to ensure that any file executed from a USB drive is automatically scanned and blocked if malicious. Which policy feature should be enabled to achieve this?

Accepted Answer

Enable Removable Media Scan in the policy.. Cisco Secure Endpoint (AMP) includes a dedicated 'Removable Media Scan' policy feature that automatically scans files executed from USB drives and other removable media. When enabled, this feature triggers a scan of any file launched from a removable device, and if the file is determined to be malicious based on local or cloud reputation, it can be blocked or quarantined before execution completes.

Answer

Enable File Reputation to check files against the cloud.

Answer

Enable Exploit Prevention to block malicious code execution.

Answer

Configure Quarantine actions for all file events.

Question 16

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Accepted Answer

First assign interfaces to zones, then create class-map, then create policy-map, then create zone-pair, then apply the policy to the zone-pair.. First assign interfaces to zones, then create class-map, policy-map, zone-pair, and apply the policy to the zone-pair.

Answer

First create class-map, then create policy-map, then assign interfaces to zones, then create zone-pair, then apply the policy.

Answer

First create zone-pair, then assign interfaces to zones, then create class-map, then create policy-map, then apply the policy.

Answer

First assign interfaces to zones, then create zone-pair, then create class-map, then create policy-map, then apply the policy.

Question 17

A security team deploys Cisco AMP for Endpoints and wants to detect and block memory injection attacks. Which AMP feature should be enabled to achieve this?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques.

Answer

Device Trajectory

Answer

IOC scanning

Answer

File quarantine

Question 18

In a Cisco ISE 802.1X deployment, which component acts as the authenticator?

Accepted Answer

Authenticator (switch/WLC). The authenticator is the network device (switch or wireless LAN controller) that enforces authentication before granting access.

Answer

RADIUS server

Answer

Authentication server (ISE)

Answer

Supplicant (client software)

Question 19

A security engineer wants to implement file reputation analysis using Cisco AMP for Endpoints. The policy must block files that are known to be malicious in the cloud and quarantine unknown files for further analysis. Which AMP policy configuration achieves this?

Accepted Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Quarantine.. Cisco AMP for Endpoints File Reputation rules allow granular control over file disposition. Setting 'Malware -> Block' ensures files with a known malicious disposition are prevented from executing, while 'Unknown -> Quarantine' sends files with an unknown disposition to the AMP cloud for retrospective analysis and containment. This directly matches the requirement to block known threats and quarantine unknowns for further analysis.

Answer

Create a policy with Application Control to block all executables from the internet.

Answer

Create a policy with File Reputation rules: Malware -> Block, Unknown -> Allow.

Answer

Create a policy with Custom Detection rules for specific SHA256 hashes only.

Question 20

Which Cisco Duo authentication method involves a one-time code generated by a hardware token?

Accepted Answer

Hardware token. Hardware token generates a one-time passcode (OTP) that the user enters to authenticate.

Answer

Bypass codes

Answer

TOTP

Answer

Push notification