350-701 Practice Test 8 — 10 Questions

Question 1

In Cisco ISE, which protocol is used for EAP-TLS authentication, and what is the primary requirement for the client to successfully authenticate?

Accepted Answer

EAP-TLS, requiring a client certificate. EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) uses mutual certificate-based authentication, meaning both the client and the server present X.509 certificates. The primary client requirement is a valid client certificate issued by a trusted CA, which ISE validates during the TLS handshake.

Answer

EAP-FAST, requiring a PAC file

Answer

LEAP, requiring a shared secret

Answer

PEAP-MSCHAPv2, requiring username and password

Question 2

An organization wants to enforce multi-factor authentication (MFA) for VPN access using Cisco AnyConnect. Which Cisco product integrates with AnyConnect to provide MFA via push notifications or one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Answer

Cisco SecureX

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 3

A network administrator is configuring 802.1X on a Cisco switch for corporate Windows laptops. The organization uses certificates for authentication. Which EAP method should be configured on the supplicant and ISE to provide certificate-based mutual authentication?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST

Question 4

A security analyst notices that a user is downloading a file from a website. The Cisco WSA is configured to perform AMP file scanning. What happens when the file's SHA-256 hash is not found in the local cache?

Accepted Answer

The file is sent to the cloud for analysis and a verdict is returned.. When Cisco WSA performs AMP file scanning and the file's SHA-256 hash is not found in the local cache, the file is sent to the Cisco Talos cloud for analysis. Talos returns a verdict based on its global threat intelligence, and the WSA enforces the configured policy, which may allow, block, or quarantine the file. This cloud lookup is the core mechanism of AMP for file reputation.

Answer

The file is allowed immediately.

Answer

The file is quarantined until an administrator reviews it.

Answer

The file is blocked permanently.

Question 5

An ISE deployment uses TrustSec with SGTs assigned by Active Directory group membership. A group of users in the 'Finance' AD group is correctly receiving SGT 5, but a new user added to that group is getting SGT 0. The ISE policy is unchanged, and other users in the group work fine. What is the most likely cause?

Accepted Answer

ISE has not synchronized the latest AD group membership. ISE uses Active Directory (AD) as an identity source and must synchronize group membership changes before it can map the new user to the correct Security Group Tag (SGT). If the AD group membership has not been refreshed via the scheduled or manual sync, ISE will not know the new user belongs to the 'Finance' group, resulting in a default SGT of 0 (unknown/untrusted). Other users already in the group work fine because their membership was present during the last successful sync.

Answer

The user endpoint has not been profiled by ISE yet

Answer

The user endpoint is running antivirus software that blocks SGT assignment

Answer

The user does not have a PAC (Protected Access Credential)

Answer

The switchport is configured with 'authentication violation restrict' which blocks the new user

Question 6

An administrator needs to ensure that only authorized hosts can connect to a switch port. The port is connected to a single PC. Which 802.1X host mode should be configured?

Accepted Answer

Single-Host. The Single-Host mode (option A) is correct because it allows only one authenticated host per port, which matches the requirement of a single PC connected to the switch port. In this mode, the port is authorized only after a single supplicant successfully completes 802.1X authentication, and no other devices can gain network access through that port, ensuring strict access control.

Answer

Multi-Domain

Answer

Multi-Auth

Answer

Multi-Host

Question 7

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. A suppression filter tells Snort to stop generating alerts for a specific rule when the traffic matches a defined condition, such as a specific source IP, destination IP, or subnet. This preserves the rule's detection capability for other traffic while eliminating the false positives from the known-benign source.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 8

In the shared responsibility model for cloud security, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Operating system and application security. In IaaS, the cloud provider manages the physical infrastructure, virtualization, and network, while the customer manages the operating system, applications, and data.

Answer

Hypervisor security

Answer

Network infrastructure security

Answer

Physical security of the data center

Question 9

An endpoint security engineer wants to protect against memory injection attacks on endpoints running Windows. Which Cisco AMP feature should be enabled?

Accepted Answer

Exploit Prevention. Cisco AMP's Exploit Prevention feature is specifically designed to protect against memory injection and other exploitation techniques by monitoring process behavior and blocking attempts to inject code into running processes. It addresses the exact threat described, making it the correct choice for memory injection attacks on Windows endpoints.

Answer

Retrospective security

Answer

IOC scanning

Answer

Device Trajectory

Question 10

An incident responder is analyzing an endpoint that was compromised despite AMP for Endpoints being deployed. The AMP logs show the malware file had a disposition of 'Unknown' shortly before compromise, but later changed to 'Malicious' after cloud analysis. What is the most likely reason the file was not blocked initially?

Accepted Answer

The AMP policy was configured to 'Allow' or 'Detect' for files with disposition 'Unknown'.. C is correct because AMP for Endpoints can be configured with a policy that defines the action for files with a disposition of 'Unknown' — typically 'Allow' or 'Detect' — rather than 'Block'. In this scenario, the file was allowed to execute locally because the policy did not block unknown files, and only after cloud analysis returned a 'Malicious' verdict did the disposition change. This explains why the file was not blocked initially despite AMP being deployed.

Answer

The cloud analysis result was delayed due to high traffic.

Answer

The local analysis engine was disabled, so the file was not analyzed locally.

Answer

The endpoint did not have connectivity to the AMP cloud at the time of execution.