350-701 Content Security Practice Test 3 — 15 Questions

Question 1

A company uses Cisco WSA in transparent mode. They want to bypass proxy processing for all traffic to a specific internal server (10.0.0.5) to reduce latency. They create an access policy with a custom URL category and add the server's IP to the 'Proxy Bypass' list. However, traffic to that server is still being proxied. What is the most likely cause?

Accepted Answer

The proxy bypass list does not apply in transparent mode; instead use network ACLs to bypass WSA. In transparent mode, the Cisco WSA intercepts traffic at the network layer without explicit client configuration. The 'Proxy Bypass' list is designed for explicit proxy deployments where clients are configured to send traffic to the WSA; it does not function in transparent mode because the WSA cannot distinguish bypass requests from intercepted traffic. To bypass proxy processing in transparent mode, you must use network ACLs on upstream routers or switches to redirect traffic away from the WSA, or configure WCCP exclusion rules.

Answer

The IP address is incorrectly formatted in the bypass list

Answer

The access policy is placed after a deny rule

Answer

The client is required to authenticate

Question 2

An administrator wants to prevent confidential data (e.g., credit card numbers) from being sent via email using Cisco ESA. Which feature should be enabled and configured with the appropriate dictionary?

Accepted Answer

Data Loss Prevention (DLP) with a predefined credit card dictionary. Cisco ESA's Data Loss Prevention (DLP) feature is specifically designed to inspect outbound messages for sensitive data patterns, such as credit card numbers, using predefined dictionaries. By enabling DLP and selecting the appropriate credit card dictionary, the administrator can enforce policies to block or quarantine emails containing confidential information, directly addressing the requirement.

Answer

Outbreak Filters with file reputation

Answer

Anti-Spam with URL reputation

Answer

Message Filters with regex pattern matching

Question 3

While troubleshooting an issue where Cisco ESA occasionally fails to process inbound messages, the administrator checks the listener settings and sees that the 'Pool of listeners' option is configured. The mail logs show 'Connection refused' errors during peak hours. What is the most likely cause?

Accepted Answer

Listener pool has too few listeners or the pool is misconfigured. The 'Connection refused' error during peak hours indicates that the Cisco ESA's listener service is actively rejecting new SMTP connections because the configured listener pool has reached its maximum capacity. The 'Pool of listeners' option defines a set of listener processes that handle inbound mail; if the pool size is too small for the traffic volume, new connections are refused. This is a resource exhaustion issue specific to the listener pool, not a service outage or external blocking.

Answer

The listener service is stopped

Answer

The sender's IP is blacklisted

Answer

DNS resolution failure for the sending MTA

Question 4

A company is deploying Cisco Cloud Web Security (CWS) using an on-premises connector. They want to authenticate users via Active Directory and apply granular policies based on user identity. Which authentication method should be configured on the connector?

Accepted Answer

LDAP authentication with transparent user identification. Option C is correct because Cisco Cloud Web Security (CWS) with an on-premises connector can integrate with Active Directory via LDAP to perform transparent user identification. This allows the connector to map IP addresses to authenticated user identities without requiring explicit proxy authentication, enabling granular policy enforcement based on AD user or group membership.

Answer

Local user database on the connector

Answer

Transparent proxy with explicit authentication via PAC file

Answer

SAML-based authentication

Question 5

An administrator wants to block the download of executable files (.exe) via HTTP using Cisco WSA. Which approach is most effective?

Accepted Answer

Create a URL filtering policy with action 'Block' for the category 'Executable Files'. Option C is correct because Cisco WSA's URL filtering policies include a predefined content category called 'Executable Files' that specifically targets file extensions like .exe, .dll, and .msi. By setting the action to 'Block' for this category, the administrator can prevent HTTP downloads of executable files without affecting other traffic. This is the most direct and effective method as it operates at the application layer, inspecting the URL path for file extensions.

Answer

Enable Anti-Malware scanning for executables

Answer

Configure a Web Reputation policy to block low-reputation sites

Answer

Use a PAC file to bypass the proxy for executable downloads

Question 6

A company uses Cisco WSA with multiple authentication realms (LDAP, RADIUS, and local). They want to require multi-factor authentication (MFA) for external users but allow single sign-on (SSO) for internal corporate users. Which configuration approach should be used?

Accepted Answer

Configure two authentication realms: one for internal (LDAP with Kerberos SSO) and one for external (RADIUS with MFA), then assign each realm to appropriate access policies. Option C is correct because Cisco WSA supports multiple authentication realms, allowing you to assign different realms to different access policies. By configuring an internal realm with LDAP and Kerberos SSO for seamless authentication, and a separate external realm with RADIUS and MFA for stronger security, you can enforce MFA only for external users while maintaining SSO for internal users. This approach directly maps authentication methods to user groups based on policy, not on client IP or a single realm.

Answer

Use a single authentication realm with both LDAP and RADIUS configured, and rely on the client IP to choose method

Answer

Configure a SSL VPN on WSA to differentiate user groups

Answer

Use SAML authentication with an Identity Provider that supports MFA

Question 7

Which TWO actions can be configured in a Cisco ESA DLP policy to respond to a violation involving outbound credit card numbers? (Choose two.)

Accepted Answer

Encrypt the message using a secure policy. Option B is correct because Cisco ESA DLP policies can automatically encrypt outbound messages containing sensitive data like credit card numbers. This ensures that even if the message is intercepted, the content remains protected, which is a common compliance requirement for PCI DSS.

Answer

Deliver the message with a CC to the compliance team

Answer

Add a disclaimer that the message is confidential

Answer

Bounce the message back to the sender

Question 8

Which THREE steps should the administrator take to troubleshoot slow web browsing when using Cisco WSA? (Choose three.)

Accepted Answer

Check the WSA's network interface statistics for errors or drops. Option A is correct because checking the WSA's network interface statistics for errors or drops helps identify physical-layer issues (e.g., duplex mismatches, CRC errors) that can cause packet loss and retransmissions, directly slowing web browsing. This is a fundamental first step in isolating whether the problem is at the network layer rather than within the proxy itself.

Answer

Restart the proxy services to clear any temporary issues

Answer

Configure the WSA to use a public DNS server like 8.8.8.8

Question 9

Which THREE components are part of a Cisco Cloud Web Security (CWS) deployment with on-premises connectors? (Choose three.)

Accepted Answer

On-premises Connector appliance. The On-premises Connector appliance (option B) is a core component of a Cisco CWS deployment with on-premises connectors. It acts as a local proxy that forwards web traffic from users to the Cisco Cloud Scanning Center for threat inspection, while also caching content locally to reduce latency. This appliance integrates with existing network infrastructure to enable cloud-based web security without requiring full traffic redirection to the cloud.

Answer

Cisco ASA firewall as the forward proxy

Answer

Cisco Web Security Appliance (WSA)

Question 10

A company uses Cisco Web Security Appliance (WSA) to filter web traffic. The security team wants to block access to a specific category of websites (e.g., 'Social Networking') for all users except the HR department. Which WSA feature should be used to achieve this policy?

Accepted Answer

Identity-based policy. Identity-based policies in Cisco WSA allow you to apply different access rules based on the user or group identity, typically authenticated via Active Directory or LDAP. By creating an identity-based policy that exempts the HR department (e.g., via an AD group) and blocks the 'Social Networking' category for all other users, you achieve the required granular control without affecting the entire organization.

Answer

Routing policy

Answer

Decryption policy

Answer

Global access policy

Question 11

An organization is migrating from on-premises Cisco ESA to Cisco Cloud Email Security (CES). They need to ensure that email encryption policies remain consistent after migration. What is the best approach to migrate the encryption policies?

Accepted Answer

Export the configuration from on-premises ESA and import into CES. Exporting the configuration from on-premises ESA and importing into CES ensures consistency. Option A is wrong because manual re-creation is error-prone. Option C is wrong because using the API requires custom scripting and may not capture all policies. Option D is wrong because there is no direct synchronization feature between on-premises and cloud ESA.

Answer

Use the Cisco ESA API to migrate policies automatically

Answer

Recreate the policies manually in CES based on existing documentation

Answer

Synchronize the two appliances using Cisco Security Management Suite

Question 12

A network administrator notices that users in the finance department are unable to access a legitimate business web application that uses custom port 8443. The WSA is configured with a decryption policy that decrypts all traffic on port 443. What is the most likely cause of the issue?

Accepted Answer

The decryption policy is not applied to port 8443, so the WSA treats it as non-decrypted traffic which may be blocked by default. The WSA's decryption policy is configured to decrypt traffic only on port 443 (HTTPS). Since the finance department's web application uses custom port 8443, the traffic is not subject to decryption. By default, the WSA may block non-decrypted traffic that matches certain security or access policies, or it may treat it as untrusted, leading to access failure. The most likely cause is that the decryption policy does not cover port 8443, so the WSA applies a default action (often block) to non-decrypted traffic.

Answer

The WSA is configured with a time-based access rule that only allows access during business hours

Answer

The WSA cannot decrypt traffic on port 8443, causing a certificate mismatch

Answer

The web application is blocked by an identity-based access policy

Question 13

A company wants to allow employees to access webmail services but block any upload of attachments that contain malware. Which feature of Cisco WSA should be configured?

Accepted Answer

Malware scanning with DVS engine. Option D is correct because the Dynamic Vectoring and Scoring (DVS) engine in Cisco WSA provides advanced malware detection by analyzing file attachments in real time, including webmail uploads. It uses multiple scanning techniques, such as reputation analysis and file-type identification, to block malware before it reaches the user. This directly addresses the requirement to prevent malware-laden attachments in webmail traffic.

Answer

Data Loss Prevention (DLP) policy

Answer

Application Visibility and Control (AVC)

Answer

URL filtering policy

Question 14

During a security audit, it is discovered that some users are bypassing the proxy by using HTTPS tunnels over port 443. The WSA is configured with an explicit proxy mode. What additional configuration is needed to prevent such bypass?

Accepted Answer

Implement a firewall rule to block outbound HTTP/HTTPS traffic except from the WSA. When using explicit proxy, clients must be configured to use the proxy. To prevent bypass, configure the firewall to block outbound HTTP/HTTPS traffic from non-proxy sources, or use transparent proxy with WCCP. Option A is wrong because enabling SSL decryption alone does not force traffic through proxy. Option B is wrong because authenticating users does not prevent bypass. Option D is wrong because creating a deny URL category for tunnels is ineffective.

Answer

Enable SSL decryption on the WSA

Answer

Configure identity-based authentication for all users

Answer

Create a custom URL category for tunneling websites and block them

Question 15

An administrator is troubleshooting an issue where emails sent to a specific external domain are being delayed by up to 30 minutes. The Cisco ESA is configured with multiple mail exchangers (MX) for delivery. The logs show that the ESA is attempting delivery to the primary MX, which is unresponsive, and failing over to the secondary MX after 30 minutes. What change should be made to reduce the delivery delay?

Accepted Answer

Reduce the delivery queue retry interval in the ESA settings. Configuring a shorter timeout or retry interval on the delivery queue will cause the ESA to fail over faster. Option A is wrong because increasing the number of MX records doesn't change the timeout. Option B is wrong because disabling the primary MX is not a good practice. Option D is wrong because enabling ESMTP does not affect timeout.

Answer

Enable SMTP over TLS (ESMTP) for the delivery

Answer

Increase the number of MX records for that domain

Answer

Remove the primary MX record from DNS