350-701 Practice Test 7 — 10 Questions

Question 1

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

Question 2

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Option C, 'Never trust, always verify,' is a foundational zero-trust principle because zero-trust treats every access request as untrusted regardless of source, requiring continuous authentication and authorization of users, devices, and sessions before granting access to resources. Option E, 'Least privilege access,' is also core to zero-trust because it enforces just-enough-access (JEA) and just-in-time (JIT) permissions so identities receive only the minimum rights needed, limiting lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: A, 'Single perimeter defense,' reflects the traditional castle-and-moat model that zero-trust explicitly replaces with microsegmentation and identity-centric controls; B, 'Implicit trust for internal networks,' is the opposite of zero-trust, which assumes no implicit trust based on network location; and D, 'Trust but verify,' is a legacy governance phrase, not a zero-trust principle, since zero-trust starts from 'never trust' rather than granting trust first.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 3

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule matches on a literal content string ('malicious') within TCP traffic, which is the defining characteristic of signature-based detection. Snort rules that use the content keyword look for known byte patterns or strings associated with malicious traffic. This is a static pattern match, not a behavioral or statistical model.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 4

An FTD device is deployed in passive mode. Which statement about its traffic processing is true?

Accepted Answer

It receives traffic from a network tap or SPAN port and cannot block traffic.. An FTD device in passive mode receives a copy of traffic from a network tap or SPAN port rather than sitting inline in the traffic path. Because it is not inline, it cannot drop or reset packets; it can only analyze, alert, and log. Therefore, it cannot block malicious traffic, and statements claiming it can send TCP resets or apply Block actions are false.

Answer

It can block malicious traffic by sending TCP resets.

Answer

It operates as a transparent firewall with inline inspection.

Answer

It can use the 'Block' action in access control rules.

Question 5

A network security engineer needs to block malicious file downloads on endpoints regardless of the user's location. Which Cisco solution should be integrated with the company's existing endpoint protection platform to achieve cloud-delivered threat intelligence?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is the correct answer because it provides cloud-delivered threat intelligence that can be integrated with existing endpoint protection platforms (EPPs) to block malicious file downloads regardless of the user's location. Umbrella uses DNS-layer security and cloud-based threat feeds to enforce policies on endpoints even when they are off the corporate network, making it ideal for location-agnostic protection.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco ISE

Question 6

During a security incident, an analyst needs to isolate a compromised endpoint and perform remote forensic analysis using Cisco AMP for Endpoints. Which capability allows the analyst to execute commands on the endpoint remotely?

Accepted Answer

Remote shell investigation. Remote shell investigation is the correct answer because Cisco AMP for Endpoints includes a feature that allows an analyst to establish a secure, encrypted shell session directly with the compromised endpoint. This enables the execution of arbitrary commands for live remote forensic analysis without requiring additional tools or manual intervention on the endpoint.

Answer

Device Trajectory

Answer

File quarantine

Answer

Process isolation

Question 7

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 8

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a cryptographic signature added to outgoing email headers, which the receiving server verifies against a public key published in DNS. This provides cryptographic authentication that the message was sent by the domain and was not altered in transit. The question specifically asks for a cryptographic signature, which is the defining characteristic of DKIM.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 9

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Starting with 'Audit' or 'Detect' mode is a best practice because it allows the security team to observe endpoint behavior, identify false positives, and understand the baseline environment without disrupting operations. Cisco AMP for Endpoints uses cloud-based threat intelligence and file reputation analysis; beginning in a non-blocking mode ensures that legitimate applications are not inadvertently quarantined before the policy is tuned.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 10

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Answer

SHA-256 file disposition