350-701 Practice Test 9 — 10 Questions

Question 1

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes provides end-to-end visibility into SaaS and internet application performance by running synthetic tests and path visualization from agents to the application, exposing latency, loss, and hop-by-hop issues. It is the designated Cisco tool for SaaS performance monitoring.

Answer

Cisco Firepower URL filtering

Answer

Cisco Umbrella SIG

Answer

Cisco WSA bandwidth controls

Question 2

Which cryptographic algorithm is a symmetric block cipher commonly used in modern VPNs and is considered secure?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher standardized by NIST (FIPS 197) that operates on 128-bit blocks with key sizes of 128, 192, or 256 bits. It is widely used in modern VPNs (e.g., IPsec, OpenVPN, WireGuard) because it is fast, secure, and resistant to known cryptanalytic attacks. AES is the de facto standard for symmetric encryption in network security.

Answer

ECC

Answer

RSA

Answer

3DES

Question 3

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center, now known as Microsoft Defender for Cloud, is correct (A) because it is Microsoft's core CSPM solution that continuously assesses Azure resources against security benchmarks like the Microsoft Cloud Security Benchmark, surfaces secure score, and provides recommendations to remediate misconfigurations. Azure Policy is also correct (B) because it enforces organizational standards and compliance by evaluating resources against built-in or custom policy definitions and applying deny, audit, or deployIfNotExists effects, which is a foundational CSPM control mechanism. Microsoft Entra ID (C) is an identity and access management service, not a posture management tool, so it does not belong. Azure Monitor (D) is a telemetry and observability platform for metrics, logs, and alerts rather than a compliance posture service. Azure WAF (E) is a web application firewall that protects HTTP/S traffic from exploits like SQL injection and XSS, which is workload protection, not CSPM.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 4

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. If guests are auto-approved without sponsor interaction, the guest portal's access setting is likely configured for Self-Registration rather than Sponsor Approval. In Cisco ISE, the guest portal's 'Access setting' determines whether guests self-register or require sponsor approval, so this misconfiguration directly explains the symptom.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device

Question 5

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy values are p=none (monitor only), p=quarantine (treat failing mail as suspicious, typically spam/junk), and p=reject (instruct receivers to reject outright). Since the administrator wants receivers to reject messages that fail SPF or DKIM alignment, p=reject is the correct policy. This is the strictest DMARC enforcement level and provides the strongest protection against spoofing.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 6

A university is using Cisco WSA to filter web traffic for its students and staff. The WSA is configured with transparent proxy mode and uses Active Directory for authentication. Recently, the IT department received complaints that some users cannot access certain educational websites that are correctly categorized as 'Education'. The WSA policy has a default rule that blocks all categories except those explicitly allowed. The 'Education' category is set to 'Allow'. However, affected users are shown a block page with the reason 'Web Reputation: Low Reputation'. The Web Reputation threshold is set to -5.0. The IT team checked the reputation scores of the blocked sites and found they are around -4.5. What is the most likely reason for the block?

Accepted Answer

The Web Reputation action is set to 'Block' for scores below 0, overriding the URL filtering allow. The Web Reputation action configured in the WSA policy overrides the URL category-based allow rule. Even though the 'Education' category is set to 'Allow', the Web Reputation threshold is set to -5.0, and the blocked sites have a reputation score of -4.5 (which is below the threshold, meaning worse reputation). The WSA applies the most restrictive action: if Web Reputation is set to 'Block' for scores below 0, it will block traffic regardless of the category allow action, resulting in the block page showing 'Web Reputation: Low Reputation'.

Answer

The 'Education' category is not included in the allowed list for the specific identification profile

Answer

The users are not authenticated properly and are assigned a default policy that blocks education

Answer

The HTTPS decryption is failing for those sites, causing a block

Question 7

When a certificate is revoked, which protocol allows a client to check the revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP (Online Certificate Status Protocol). OCSP (Online Certificate Status Protocol, RFC 6960) lets a client query a responder in real time for the revocation status of a specific certificate, returning 'good', 'revoked', or 'unknown' without downloading the entire CRL. This avoids the latency and bandwidth cost of full CRL downloads and provides fresher status. It is the standard real-time revocation check used in TLS handshakes via the OCSP stapling extension.

Answer

CRL (Certificate Revocation List)

Answer

PKI certificate chain

Answer

SSL/TLS handshake

Question 8

Which Cisco ISE node is responsible for authenticating endpoints and enforcing access policies?

Accepted Answer

Policy Service Node (PSN). The Policy Service Node (PSN) is the Cisco ISE component that performs endpoint authentication, authorization, and accounting (AAA) and enforces access policies by processing RADIUS requests from network access devices (NADs). It handles posture assessment, guest services, and client provisioning, making it the direct enforcement point for network access control.

Answer

Administration Node

Answer

pxGrid

Answer

Monitoring Node

Question 9

A company has deployed Cisco Umbrella with a virtual appliance (VA) for content filtering. Users report that some websites are not loading properly, and the helpdesk suspects that the VA is blocking legitimate traffic. The network administrator checks the VA dashboard and sees that the VA is passing traffic normally. However, the administrator notices that the VA's upstream DNS server is set to a public resolver (208.67.222.222) instead of the company's internal DNS servers. This causes internal hostnames to resolve incorrectly. The company uses Active Directory with domain-joined computers. What should the administrator do to resolve the issue?

Accepted Answer

Change the upstream DNS server in the VA configuration to point to the internal DNS servers.. The virtual appliance (VA) acts as a forwarding proxy; it receives DNS queries from clients, forwards them to its configured upstream DNS server, and applies content filtering policies. When the upstream DNS is set to a public resolver like 208.67.222.222 (OpenDNS), the VA cannot resolve internal Active Directory domain names (e.g., .local or internal FQDNs) because the public resolver has no knowledge of the private DNS zone. Changing the upstream DNS server to the company's internal DNS servers allows the VA to resolve both internal and external names correctly, while still applying Umbrella's content filtering policies to external traffic.

Answer

Add a conditional forwarder in the internal DNS for all .local domains.

Answer

Configure the clients to use Umbrella's DNS directly instead of the VA.

Answer

Disable Umbrella content filtering for internal domain names.

Question 10

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses techniques such as heap spraying protection, stack canary enforcement, and behavioral monitoring to block memory-corruption and other exploitation attempts that target unpatched or unknown vulnerabilities, which is exactly what zero-day attacks leverage. Malware Analytics with sandboxing (C) is correct because it detonates suspicious files in an isolated cloud or on-premises sandbox and uses retrospective verdicts and continuous file analysis to detect never-before-seen malicious behavior, catching zero-day malware that signature-based methods miss. File Reputation (A) is not correct here because it relies on known file hashes and cloud lookups, so it cannot identify a brand-new zero-day binary with no prior reputation record. Application Control (D) is not correct because it enforces allow/block lists of known applications rather than detecting exploitation of unknown vulnerabilities. Device Control (E) is not correct because it governs peripheral usage such as USB mass storage, not zero-day exploit or malware detection.

Answer

File Reputation

Answer

Application Control

Answer

Device Control