350-701 Practice Exam 63 — 20 Questions

Question 1

A company is deploying workloads in AWS and wants to ensure that the security groups are not overly permissive. They need to continuously monitor for misconfigurations and compare against the CIS AWS Foundations Benchmark. Which tool should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CSPM. CSPM (Cloud Security Posture Management) tools continuously monitor cloud configurations and compare against benchmarks like CIS to detect misconfigurations.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

CASB

Question 2

In the shared responsibility model for PaaS, which of the following is the customer responsible for?

Accepted Answer

Applications and data. In PaaS, the provider manages the runtime, middleware, and OS; the customer manages applications and data.

Answer

Operating system patching

Answer

Runtime environment

Answer

Physical infrastructure

Question 3

A network administrator has configured the above on a Cisco switch port for a device that supports both MAB and 802.1X. The device sends an EAPOL-start but the switch responds with an EAP-Request/Identity. The device does not respond to the EAP-Request/Identity. After a timeout, the switch attempts MAB. However, MAB also fails because the RADIUS server does not have the MAC address. Which of the following best describes the final port state?

Accepted Answer

The port will remain in an unauthorized state, blocking all traffic. When 802.1X authentication fails because the device does not respond to the EAP-Request/Identity, and MAB also fails because the RADIUS server lacks the MAC address, the switch port remains in an unauthorized state. This is the default behavior for a port configured with both authentication methods: if neither succeeds, the port stays in the 802.1X unauthorized state, blocking all traffic until a successful authentication occurs or a fallback action (like a critical VLAN) is explicitly configured.

Answer

The port will be placed in a critical authentication VLAN

Answer

The port will be error-disabled due to authentication failure

Answer

The port will be placed in VLAN 10 with restricted access

Question 4

An administrator is configuring 802.1X on a switch port for both an IP phone and a PC. Which two commands should be configured to support this scenario? (Choose two)

Accepted Answer

authentication host-mode multi-domain. The `authentication host-mode multi-domain` command allows one device in the voice domain (IP phone) and one device in the data domain (PC) to authenticate on the same switch port. This is the standard Cisco configuration for a phone-PC daisy-chain topology, where the phone acts as a bridge and the switch must distinguish between the two devices using separate VLANs (voice and data).

Answer

dot1x pae authenticator

Answer

authentication violation restrict

Answer

authentication host-mode multi-auth

Question 5

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Zero trust is based on 'never trust, always verify' and least privilege access.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 6

You are a security engineer for a multinational corporation that uses a hybrid cloud environment with AWS and Azure. The company has deployed Cisco Cloudlock for SaaS security and Cisco Umbrella for DNS-layer security. Recently, the incident response team detected that an employee's credentials were compromised, and the attacker used them to access the company's Office 365 tenant. The attacker exfiltrated sensitive data by sending emails with attachments to external addresses. Cloudlock logs show that the data exfiltration occurred because the policy for 'Outbound Email with Attachments' was set to 'Allow' for all users. The attacker also used a personal Google Drive account to store stolen data, which was not detected by Cloudlock because Google Drive is not sanctioned. You need to recommend a course of action to prevent similar incidents. Which action should you take first?

Accepted Answer

Modify the Cloudlock policy to block outbound emails with attachments containing sensitive data for all users. The incident occurred due to a misconfigured Cloudlock policy that allowed outbound emails with attachments. By modifying the policy to block outbound emails containing sensitive data, you directly address the exfiltration vector used by the attacker. This is the most immediate and effective control to prevent recurrence of the same attack method.

Answer

Reset the compromised user's password and revoke all active sessions

Answer

Implement multi-factor authentication for all Office 365 users

Answer

Sanction Google Drive and create a Cloudlock policy to monitor it

Question 7

A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)

Accepted Answer

Certificate Authority (CA). PKI relies on a Certificate Authority (CA) to issue certificates and a CRL or OCSP to check revocation. Private keys are part of the key pair, but the PKI components are CA and revocation mechanism.

Answer

Private key of the end user

Answer

Hashing function

Answer

Symmetric encryption algorithm

Question 8

A company is using a SaaS application like Office 365. Which security responsibility falls on the customer according to the shared responsibility model?

Accepted Answer

Data classification and access policies. In SaaS, the provider manages the application and infrastructure, while the customer manages data and access control.

Answer

Operating system patching

Answer

Physical security of servers

Answer

Network firewall management

Question 9

A security analyst is investigating an alert from Cisco AMP for Endpoints. The analyst wants to perform remote actions on the endpoint. Which TWO actions are available in AMP for Endpoints? (Choose two.)

Accepted Answer

File quarantine. AMP for Endpoints allows file quarantine and remote shell for investigation. Process isolation is not a standard action; endpoint isolation is a separate action.

Answer

Just-in-time access

Answer

Password vaulting

Answer

Process isolation

Question 10

A network administrator is configuring management access on a Cisco router. The requirement is to provide encrypted remote access with AAA authentication and fallback to local credentials if the AAA server is unavailable. Which configuration best meets these requirements?

Accepted Answer

Enable SSHv2 with AAA authentication and 'aaa authentication login default group radius local' configured.. SSHv2 provides encrypted remote access, and the command 'aaa authentication login default group radius local' configures AAA authentication with RADIUS as the primary method and local credentials as a fallback if the RADIUS server is unreachable. This meets the requirement for both encrypted access and AAA fallback to local authentication.

Answer

Enable Telnet with a local username and password.

Answer

Enable HTTP with AAA authentication.

Answer

Use SNMPv3 with read-write community strings.

Question 11

Based on the exhibit, what does the 'Isolated: Yes' status indicate?

Accepted Answer

The connector is in a quarantine mode due to a loss of cloud connectivity.. In Cisco AMP (Advanced Malware Protection) for Endpoints, the 'Isolated: Yes' status indicates that the connector has entered quarantine mode because it has lost connectivity to the AMP cloud. This is a security feature that prevents the endpoint from communicating with other hosts on the network while still allowing outbound traffic to the cloud for reconnection attempts. The connector remains functional but isolated to contain potential threats until cloud connectivity is restored.

Answer

The connector is disconnected from the cloud and requires a reboot.

Answer

The connector is permanently blocked by a firewall and needs manual reconfiguration.

Answer

The network component is disabled, preventing network traffic monitoring.

Question 12

An organization wants to use Cisco Umbrella SIG to enforce security policy for remote users. Which deployment method allows Umbrella to inspect traffic for all ports and protocols, not just DNS?

Accepted Answer

Deploying the Umbrella roaming client. Umbrella SIG (Security Internet Gateway) can be deployed as a cloud proxy or with the Umbrella roaming client. The roaming client forwards all traffic to the cloud proxy for full inspection.

Answer

Configuring a PAC file for proxy

Answer

Using IPsec tunnel to Umbrella

Answer

DNS-layer enforcement only

Question 13

In Cisco ESA, which feature uses TALOS intelligence to provide real-time protection against newly identified email threats before signature updates are available?

Accepted Answer

Outbreak Filters. Outbreak Filters leverage TALOS to detect emerging threats in near real-time.

Answer

DLP Policies

Answer

Anti-Spam

Answer

AMP for Email

Question 14

An enterprise migrated its e-commerce application to AWS. They use Cisco Secure Workload (Tetration) for microsegmentation. After enabling enforcement, legitimate traffic between the web tier and database tier is being blocked. The security team verified that the policy allows the traffic based on labels. The Tetration console shows the enforcement mode as 'active blocking'. The database server is in a different VPC, and the web server is in a public subnet. The agents are running on both workloads and report correctly. Which configuration step is most likely missing?

Accepted Answer

The cloud connector (e.g., AWS cloud connector) is not configured. Cisco Secure Workload (Tetration) relies on cloud connectors to synchronize cloud infrastructure metadata (e.g., VPCs, subnets, instances) and enforce microsegmentation policies across VPC boundaries. Without a configured AWS cloud connector, Tetration cannot discover or enforce policies on resources in a different VPC, even if agents are running and labels are correctly assigned. The 'active blocking' enforcement mode indicates the policy is being applied, but the missing connector prevents the policy from being properly mapped to the database server in the separate VPC, causing legitimate traffic to be blocked.

Answer

The enforcement scope does not include the VPC peering connection

Answer

The application dependency mapping needs to be refreshed

Answer

The agents on the database server are not running

Question 15

An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)

Accepted Answer

Never trust, always verify. Zero trust is built on 'never trust, always verify' and 'least privilege' to minimize access.

Answer

Single factor authentication

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 16

An organization wants to enforce endpoint posture compliance before granting network access. In Cisco ISE, which component performs the actual checks on the endpoint to verify antivirus status and patch levels?

Accepted Answer

Posture Agent. The posture agent (Cisco AnyConnect Posture Module or ISE Posture Agent) runs on the endpoint and performs checks for required software, updates, and configurations, then reports back to ISE.

Answer

Network Access Device (switch/WLC)

Answer

ISE Policy Service Node

Answer

Profiling Probe

Question 17

An administrator is configuring Cisco ISE profiling using Device Sensor. Which two types of information can the Device Sensor collect from endpoints? (Choose two.)

Accepted Answer

DHCP details (hostname, vendor class). Cisco Device Sensor can collect DHCP information (e.g., hostname, vendor class) and HTTP information (e.g., user-agent) to identify device type and operating system.

Answer

RADIUS accounting logs

Answer

NetFlow data

Answer

SNMP MIB objects

Question 18

An engineer is configuring Cisco ISE for 802.1X authentication. The organization has a mix of devices, including some that do not support 802.1X supplicants. Which method should the engineer use to allow these non-supplicant devices to authenticate?

Accepted Answer

Enable MAC Authentication Bypass on the authenticator. MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address, which is sent as the username and password.

Answer

Deploy Cisco AMP connectors on all endpoints

Answer

Configure a guest portal for self-registration

Answer

Use EAP-TLS with device certificates

Question 19

A remote user is unable to connect to the corporate VPN using Cisco AnyConnect. The user has internet access and can reach the ASA's public IP. The ASA administrator checks and sees that the remote access VPN configuration is correct. What is the most likely client-side issue?

Accepted Answer

The client's certificate is expired or not trusted.. The user can reach the ASA's public IP and has internet access, which rules out basic connectivity issues. Since the ASA's VPN configuration is correct, the problem is likely on the client side. A common cause is an expired or untrusted certificate, as AnyConnect uses certificate-based authentication for the SSL/TLS handshake; if the client does not trust the server's certificate or the client's own certificate is expired, the VPN tunnel will fail to establish.

Answer

The client is using an outdated version of AnyConnect.

Answer

The client's DNS is not resolving the VPN hostname.

Answer

The client's firewall is blocking TCP port 443.

Question 20

A network engineer is designing a multi-cloud architecture with AWS and Azure. The company needs consistent security policies across both cloud providers and on-premises data centers. Which Cisco solution should the engineer recommend?

Accepted Answer

Cisco Tetration.. Cisco Tetration is the correct recommendation because it provides a multi-cloud workload protection platform that enforces consistent security policies across AWS, Azure, and on-premises environments using a software-based agent and a centralized policy engine. It leverages micro-segmentation and behavioral analytics to automatically generate and enforce whitelist-based policies based on actual traffic flows, ensuring uniform security regardless of the underlying cloud provider.

Answer

Cisco Umbrella SIG.

Answer

Cisco Firepower NGFW.

Answer

Cisco Stealthwatch Enterprise.