350-701 Practice Test 8 — 10 Questions

Question 1

During an email security audit, it is discovered that encrypted emails sent between two partners are being silently dropped by the Cisco ESA. The ESA uses a policy that decrypts incoming S/MIME messages for scanning. What is the most likely cause of the dropped messages?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ESA cannot decrypt the messages because the sender's certificate is not trusted by the ESA.. The Cisco ESA decrypts incoming S/MIME messages to perform content scanning. If the sender's certificate is not trusted by the ESA (i.e., not in the ESA's trusted certificate store or the certificate chain cannot be validated), the ESA cannot decrypt the message. This causes the message to be silently dropped because the policy requires decryption for scanning, and failure to decrypt results in the message being discarded rather than delivered.

Answer

The ESA is configured to re-encrypt outbound messages that were decrypted.

Answer

The messages contain encrypted attachments that exceed size limits.

Answer

The ESA is using TLS to receive the messages and the partner's certificate is untrusted.

Question 2

A security analyst is reviewing logs and identifies numerous ICMP echo requests from an external IP address to multiple internal hosts. Which type of reconnaissance activity is this?

Accepted Answer

Active scanning. ICMP echo requests (ping sweeps) are used in active scanning to identify live hosts.

Answer

Passive OSINT

Answer

ARP spoofing

Answer

DNS cache poisoning

Question 3

A company wants to protect against DNS-based attacks by filtering malicious domains and providing secure DNS resolution. Which Cisco product should be deployed?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security solution that blocks malicious domains and provides secure internet gateway.

Answer

Cisco AMP

Answer

Cisco ESA

Answer

Cisco WSA

Question 4

A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?

Accepted Answer

Cisco ESA with AMP. Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.

Answer

Cisco AMP for Endpoints

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Question 5

A company wants to implement a Zero Trust architecture. Which THREE principles should be included? (Choose three.)

Accepted Answer

Least privilege access. Zero Trust core principles: never trust, always verify; least privilege; microsegmentation. Defense in depth is a separate concept.

Answer

Single sign-on (SSO)

Answer

Defense in depth

Question 6

A company is planning to deploy a Zero Trust architecture. Which two principles are fundamental to Zero Trust?

Accepted Answer

Never trust, always verify. Zero Trust is based on 'never trust, always verify' and least privilege access.

Answer

Single-factor authentication

Answer

Perimeter-based security

Answer

Implicit trust for internal networks

Question 7

Which of the following is a characteristic of a zero trust security model?

Accepted Answer

Never trust, always verify. Zero trust assumes no implicit trust; every request must be verified regardless of source.

Answer

Implicit trust for internal users

Answer

Trust but verify

Answer

Trust based on network location

Question 8

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 9

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 10

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Accepted Answer

Profiling. Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.

Answer

Application visibility

Answer

NetFlow analysis