350-701 Practice Test 8 — 10 Questions

Question 1

A global company uses Cisco Umbrella to enforce security policies across roaming users. Recently, a user reported that they could not access a legitimate business application while connected to a guest Wi-Fi at an airport. The application is categorized as 'Productivity' in Umbrella. Other users outside the office can access it. What is the most likely reason?

Accepted Answer

The user's Umbrella roaming client is unable to authenticate, so the request uses the default policy which blocks the category.. Option D is correct because Umbrella uses identity-based policies; if the roaming security client cannot detect the user identity (e.g., due to no VPN or client failure), the request falls back to the default policy, which might block the category. Option A is wrong because the category is not blocked globally. Option B is wrong because the issue is specific to one user, not location. Option C is wrong because the guest Wi-Fi has no public IP block.

Answer

The application's category is blocked globally in the Umbrella policy.

Answer

The user is in a different geographic location with a stricter policy.

Answer

The guest Wi-Fi's public IP address is on a block list.

Question 2

A company wants to prevent sensitive data such as credit card numbers from being sent via email. Which Cisco ESA feature should be enabled?

Accepted Answer

Data Loss Prevention (DLP). C is correct because Data Loss Prevention (DLP) is the Cisco ESA feature specifically designed to inspect email content and attachments for sensitive data patterns, such as credit card numbers, and enforce policies to prevent their unauthorized transmission. DLP uses predefined or custom dictionaries and message filters to detect and block or quarantine such data, directly addressing the requirement to prevent sensitive data from being sent via email.

Answer

Anti-Spam

Answer

Secure/Multipurpose Internet Mail Extensions (S/MIME)

Answer

Anti-Malware

Question 3

A security analyst notices that a Cisco Firepower Threat Defense (FTD) device is not applying file policies to detect malware in HTTP traffic. The access control policy has an HTTPS decryption rule that decrypts traffic from external sources. The file policy is associated with the same rule. What is the missing configuration?

Accepted Answer

The HTTP inspection is not enabled in the access control policy's advanced settings.. File policies in Firepower are applied based on network analysis and file inspection. For HTTP traffic, the FTD must have the appropriate inspection engine enabled. Option C is correct because the HTTP inspection profile must be configured to inspect traffic and apply file policies. Option A is not directly related. Option B is incorrect because decryption is already in place. Option D is unnecessary as file policies work independently of URL filtering.

Answer

The file policy is set to 'Detect' but not 'Block' for malware.

Answer

SSL decryption is not configured for the internal network.

Answer

The URL category is not defined in the file policy.

Question 4

A Cisco WSA receives intermittent complaints that legitimate websites are being blocked. The access policy uses reputation scoring and URL filtering. The administrator checks the logs and finds that the blocked requests have a web reputation score of -2.0. What action should be taken to allow these legitimate sites while still blocking malicious ones?

Accepted Answer

Create a custom URL category for the legitimate sites and apply an allow action above the reputation policy.. Option A is correct because creating a custom URL category for the legitimate sites and placing an allow action above the reputation policy ensures that traffic matching that category bypasses the reputation scoring check. This allows the legitimate sites while the reputation policy continues to block malicious sites with scores below the threshold. In Cisco WSA, access policies are evaluated in order, so a higher-priority allow rule for trusted URLs overrides the lower-priority reputation-based block.

Answer

Lower the reputation threshold to -1.0.

Answer

Set the reputation action to 'Monitor' for suspicious scores.

Answer

Disable web reputation filtering for that policy.

Question 5

A network administrator is troubleshooting why users in the marketing department cannot access a specific cloud storage site through the Cisco WSA. The access policy for marketing is set to 'Monitor' for the File Sharing category, but the site is blocked. What is the most likely reason?

Accepted Answer

A more specific identity or policy is applying a block action.. The correct answer is C because Cisco WSA applies policies in a hierarchical order, and a more specific identity or policy (e.g., one based on user group, subnet, or time range) can override a broader policy set to 'Monitor'. Even though the marketing department's access policy is configured to monitor the File Sharing category, a more granular rule may explicitly block the cloud storage site, causing the unexpected block.

Answer

Web reputation threshold is set to block the site.

Answer

The site is mis-categorized as an unknown URL.

Answer

URL filtering is disabled for that policy.

Question 6

A small business uses Cisco Umbrella to protect its 50 employees. One employee reports that they cannot access a specific website (www.example.com) that is required for their work. The administrator checks the Umbrella dashboard and sees that the domain is categorized as 'Social Networking' and is blocked by the company's policy. However, the employee argues that the website is actually a business tool. The administrator verifies that the website is indeed legitimate. What is the best course of action to restore access while maintaining security?

Accepted Answer

Create a policy override to allow the specific domain while keeping the category blocked.. Option C is correct because Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

Answer

Contact Cisco Umbrella support to re-categorize the domain.

Answer

Disable the 'Social Networking' category blocking policy.

Answer

Remove the user from the Umbrella policy entirely.

Question 7

A company wants to deploy Cisco AMP for Endpoints to protect against advanced malware. Which best practice should be followed when configuring the policy for the first time?

Accepted Answer

Start with 'Audit' or 'Detect' mode to baseline endpoint behavior before enforcing blocks.. Option D is correct because starting with 'Audit' mode allows observation without disruption. Option A is wrong because blocking all unknown files may cause false positives. Option B is wrong because disabling the firewall weakens security. Option C is wrong because disabling file analysis reduces detection capability.

Answer

Disable file analysis for known good file types to improve performance.

Answer

Set the policy to 'Block' immediately to maximize protection.

Answer

Disable AMP's network firewall to reduce complexity.

Question 8

Which TWO of the following are required for successful registration of an AMP for Endpoints connector with the cloud?

Accepted Answer

Outbound HTTPS access to the AMP cloud backend servers.. Option C is correct because the AMP for Endpoints connector must establish an outbound HTTPS (TCP/443) connection to the AMP cloud backend servers to communicate telemetry, receive policy updates, and perform health checks. Without this outbound access, the connector cannot register or maintain its connection to the cloud.

Answer

A locally installed SQL database for event storage.

Answer

A proxy server configured in the connector settings.

Answer

An inbound firewall rule allowing connections from the AMP cloud.

Question 9

An analyst reviews an AMP for Endpoints event where a file was detected as malware but later determined to be a false positive. The analyst wants to prevent this file from being flagged in the future. What is the recommended action?

Accepted Answer

Add the file hash to the custom detection list with action 'Allow' or 'Uncategorized'.. Option D is correct because adding a file hash to the custom detection list as an exception prevents future alerts. Option A is wrong because disabling detection for that file type is too broad. Option B is wrong because changing policy to 'Audit' reduces protection. Option C is wrong because only the cloud can update dispositions, but custom exceptions are used for false positives.

Answer

Submit the file to Cisco TALOS for reanalysis.

Answer

Disable AMP detection for that file type globally.

Answer

Change the AMP policy from 'Detect' to 'Audit' for the endpoint.

Question 10

A company uses Cisco AMP for Endpoints and also deploys Cisco Firepower Next-Generation Firewall (NGFW) with AMP integration. The security team wants to see endpoint detections in the Firepower Management Center (FMC). What must be configured to enable this integration?

Accepted Answer

Enable the AMP integration in the FMC and ensure the AMP cloud account is configured with the correct API credentials.. Option A is correct because the AMP connector must be registered with the AMP cloud, and the FMC must be configured to pull events via API. Option B is wrong because the firewall does not need to be the default gateway. Option C is wrong because Syslog is not the primary method; API integration is used. Option D is wrong because the AMP cloud account is already used; the issue is registration.

Answer

Configure the AMP connectors to send Syslog events to the FMC.

Answer

Deploy an on-premises AMP console to forward events to FMC.

Answer

Configure the Firepower NGFW to be the default gateway for the endpoints.