350-701 Content Security Practice Test 2 — 15 Questions

Question 1

A company is deploying Cisco Web Security Appliance (WSA) to enforce acceptable use policies. Users report that some legitimate websites are being blocked incorrectly. The security team wants to allow these sites while still blocking known malware sites. Which action should the administrator take?

Accepted Answer

Create a custom URL filtering policy to allow the specific URLs.. Option A is correct because the Cisco WSA uses URL filtering policies to control access based on URL categories and individual URLs. By creating a custom URL filtering policy that allows the specific URLs, the administrator can whitelist legitimate sites while the WSA continues to block known malware sites through its reputation-based and category-based filtering. This approach maintains security enforcement without disabling broader protections.

Answer

Disable HTTPS decryption to bypass filtering for encrypted sites.

Answer

Enable Data Loss Prevention (DLP) to allow the sites.

Answer

Increase the HTTPS decryption depth to inspect more content.

Question 2

A network administrator is troubleshooting an issue where users cannot send emails with attachments larger than 10 MB through the Cisco Email Security Appliance (ESA). The ESA is configured with a mail flow policy that has a maximum message size of 20 MB. What is the most likely cause of the issue?

Accepted Answer

The ESA default maximum attachment size is 10 MB.. The Cisco ESA has a built-in default maximum attachment size of 10 MB, which is separate from the mail flow policy's maximum message size. Even though the mail flow policy allows messages up to 20 MB, the attachment size limit is enforced by the ESA's default configuration, which caps individual attachments at 10 MB. This default can be overridden in the mail flow policy or system settings, but if not explicitly changed, it remains the limiting factor.

Answer

The mail flow policy maximum message size is set too low.

Answer

The HAT (Host Access Table) maximum message size is set to 10 MB.

Answer

The outgoing mail policy has a smaller attachment size limit.

Question 3

A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?

Accepted Answer

Install the Umbrella roaming client on all endpoints.. The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.

Answer

Deploy the Umbrella virtual appliance in the data center.

Answer

Use BGP to redirect traffic to Umbrella.

Answer

Configure Active Directory integration.

Question 4

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Option A is correct because Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 5

A company is deploying Cisco Email Security Appliance (ESA) to protect against phishing attacks. The security team wants to implement two security features to detect malicious URLs in emails. Which two features should be enabled? (Choose two.)

Accepted Answer

URL reputation filtering. URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

Answer

DomainKeys Identified Mail (DKIM) signing

Answer

Sender Policy Framework (SPF) verification

Answer

Domain-based Message Authentication, Reporting & Conformance (DMARC)

Question 6

A network administrator configures the above policy on a Cisco Firepower Threat Defense (FTD) device. Users report that they cannot access the login page at https://www.example.com/login. What is the most likely cause?

Accepted Answer

The 'inspect' action in INSIDE_INSPECT does not permit the traffic; it only inspects.. Option C is correct because in Cisco Firepower Threat Defense (FTD), the 'inspect' action only monitors traffic for threats without explicitly permitting it. For traffic to be allowed through the device, a separate 'allow' or 'permit' action is required in the access control policy. Since INSIDE_INSPECT uses only 'inspect', the HTTPS traffic to the login page is blocked by default, as FTD implicitly denies traffic that is not explicitly permitted.

Answer

The 'match request uri regex ".*evil.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The 'match request body regex ".*malware.*"' in OUTSIDE_INSPECT is blocking the page.

Answer

The class-map HTTP_CLASS is incorrectly matching the host header for example.com.

Question 7

You are a security engineer for a multinational corporation with 5,000 employees. The company uses Cisco Umbrella for DNS-layer security, Cisco Web Security Appliance (WSA) for proxy services in the data center, and Cisco Email Security Appliance (ESA) for email security. Recently, the security team has received multiple reports of users receiving phishing emails that bypass the ESA. The emails contain links to malicious websites that are also not blocked by Umbrella or WSA. Upon investigation, you find that the phishing emails use newly registered domains (less than 24 hours old) and the malicious websites are hosted on cloud infrastructure with frequently changing IP addresses. The company's current security policies rely on signature-based detection and static blocklists. Which action should you take to most effectively mitigate these threats?

Accepted Answer

Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.. Option A is correct because Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.

Answer

Configure the WSA to block all domains registered within the last 30 days.

Answer

Enable Data Loss Prevention (DLP) on the ESA to scan email content for sensitive data.

Answer

Increase the frequency of signature updates on the ESA and WSA to every hour.

Question 8

Which TWO actions are recommended best practices for securing web traffic using Cisco Umbrella?

Accepted Answer

Enable IP-layer enforcement for all destinations.. Option C is correct because enabling IP-layer enforcement in Cisco Umbrella ensures that all traffic to destinations that match a blocked category is dropped at the IP layer, even if DNS-based blocking is bypassed (e.g., via direct IP connections). This provides a second layer of protection by inspecting and blocking traffic based on the destination IP address, preventing users from circumventing DNS filtering by using IP addresses directly.

Answer

Configure SSL decryption to always bypass traffic to trusted domains.

Answer

Configure the network to use the root DNS forwarder for all DNS queries.

Answer

Configure local security stack bypass for all internal IP ranges.

Question 9

Refer to the exhibit. An administrator sees that the file invoice_2024.exe was blocked by both Cisco AMP and ESA. However, a user claims the attachment was delivered. What is the most likely cause?

Accepted Answer

The ESA was configured to 'Deliver then alert' for malware detected by AMP.. Option B is correct because when Cisco ESA is configured with 'Deliver then alert' for malware detected by AMP, the email is delivered to the user before the AMP file reputation analysis completes. The ESA sends the file to AMP for analysis, but if the policy is set to deliver first and alert later, the user receives the attachment even if AMP later determines it is malicious. This explains why the administrator sees the block in both AMP and ESA logs, yet the user claims delivery.

Answer

The ESA was not configured to use AMP for file reputation.

Answer

The AMP file reputation check was not performed due to an ACL misconfiguration.

Answer

The file was whitelisted in the AMP policy.

Question 10

A company with 500 employees uses Cisco Web Security Appliance (WSA) as a proxy. They have a policy to block access to social media sites during working hours (9 AM - 5 PM) for all users except the marketing team. The marketing team must have unrestricted access at all times. The WSA is configured with a time-based access policy that blocks the 'Social Networking' category from 9 AM to 5 PM, and an identity policy that identifies the marketing team by Active Directory group. However, marketing users report that they are blocked from social media during working hours. What is the most likely cause?

Accepted Answer

The identity policy for the marketing team has a 'Use Global Policy' action for social networking, which then applies the time-based block.. Option C is correct because when an identity policy is set to 'Use Global Policy' for a specific category, it defers to the global access policy, which in this case includes the time-based block for social networking. Since the marketing team's identity policy does not explicitly override the global policy with an 'Allow' or 'Monitor' action for the 'Social Networking' category, the time-based block applies to them as well.

Answer

The time-based policy is set to block social media from 9 AM to 5 PM, but the marketing team's identity policy is not explicitly set to 'Monitor' or 'Allow' for that category.

Answer

The WSA requires authentication for all users, but marketing users are not prompted to authenticate.

Answer

The marketing team's Active Directory group is not being recognized by the WSA due to a synchronization issue.

Question 11

Drag and drop the steps to implement Cisco Umbrella (formerly OpenDNS) for DNS-layer security in the correct order.

Question 12

Match each VPN type to its characteristic.

Question 13

A company uses Cisco WSA to proxy web traffic. After configuring a decryption policy to inspect HTTPS traffic to a specific external site, users report they can still access the site without any warning or interruption. Which action should the administrator take to ensure HTTPS inspection is applied?

Accepted Answer

Change the policy action from 'Passthrough' to 'Decrypt'. Option C is correct because the decryption policy must have an action of 'Decrypt' to actually perform HTTPS inspection. If the policy action is set to 'Passthrough', the WSA forwards the traffic without decrypting it, so users experience no warning or interruption. Changing the action to 'Decrypt' forces the WSA to intercept the TLS handshake, decrypt the traffic, and apply security policies.

Answer

Add the site to the 'HTTPS Bypass' list

Answer

Import the WSA root CA certificate into client browsers

Answer

Move the decryption policy to the top of the list

Question 14

A network administrator is configuring Cisco Email Security Appliance (ESA) to prevent outgoing spam. The company wants to ensure that all outgoing emails contain a legal disclaimer and that any email with more than 20 recipients is delayed. Which two features should be combined?

Accepted Answer

Outgoing mail policy with Disclaimer action and Destination Controls. Option A is correct because the requirement to add a legal disclaimer is met by the Disclaimer action within an Outgoing Mail Policy, and the requirement to delay emails with more than 20 recipients is met by Destination Controls, which allow rate-limiting based on recipient count per message. These two features are specifically designed for outgoing email control and can be combined in a single mail policy.

Answer

Data Loss Prevention (DLP) and Outbreak Filters

Answer

Antivirus scanning

Answer

Message Filters with content scanning

Question 15

An enterprise is deploying a hybrid email security solution using Cisco Email Security Appliance (ESA) on-premises and Cisco Cloud Email Security (CES). The organization wants to use the cloud for spam filtering while the on-premises ESA handles DLP and encryption for sensitive data. Inbound emails should be processed by the cloud first, then sent to the on-premises ESA. Which architecture correctly implements this requirement?

Accepted Answer

MX record → Cisco CES → On-premises ESA (internal mail server). Option D is correct because it places Cisco CES (cloud) first in the email flow to handle spam filtering, then forwards the cleaned messages to the on-premises ESA for DLP and encryption before delivery to the internal mail server. This matches the requirement that inbound emails be processed by the cloud first, then the on-premises ESA, with CES acting as the initial SMTP gateway via MX record.

Answer

MX record → On-premises ESA → Internal mail server, with a separate smart host via CES

Answer

MX record → Dual MX pointing to both CES and ESA

Answer

MX record → On-premises ESA → Cisco CES → Internal mail server