350-701 Content Security Practice Test 6 — 15 Questions

Question 1

A user in the marketing group reports that they cannot access twitter.com. The access policy summary is shown in the exhibit. What is the most likely reason?

Accepted Answer

The Social Networking category is set to Block in the Marketing-Policy.. Option D is correct because the exhibit shows that the Marketing-Policy has the Social Networking category set to Block. Since twitter.com is classified under Social Networking, this action explicitly denies access for users assigned to that policy, overriding any other settings.

Answer

The default policy is blocking the site because Marketing-Policy is set to Monitor only.

Answer

The access policy has a time-based restriction that blocks social media during work hours.

Answer

The marketing group is not assigned to the Marketing-Policy.

Question 2

An administrator reviewed the log entry from the Cisco ESA exhibit. The DLP policy is set to 'Continue (with disclaimer)' for credit card matches. How should the policy be changed to prevent this data leakage?

Accepted Answer

Change the DLP policy action from 'Continue' to 'Drop'.. Option B is correct because the current DLP policy action 'Continue (with disclaimer)' allows the email to be delivered after appending a disclaimer, which does not prevent data leakage. Changing the action to 'Drop' will block the email entirely, preventing the credit card data from leaving the organization. This directly addresses the requirement to stop the data leakage.

Answer

Remove the DLP policy assignment for the Finance mail flow.

Answer

Lower the DLP sensitivity threshold.

Answer

Enable TLS encryption on the policy.

Question 3

A multinational company has recently deployed Cisco WSA with explicit proxy for 10,000 users across two data centers. The WSA is configured with multiple identities based on IP subnets and authentication via LDAP. Users in the R&D department (subnet 192.168.10.0/24) are configured with an access policy that blocks all social media, but they can access web-based email like Gmail. The administrator receives complaints that R&D users cannot access a critical partner's HTTPS website (https://portal.partner.com) that is not categorized. The access policy for R&D has a default action of 'Monitor' for uncategorized URLs, but the site is blocked. The web reputation score for the site is +1.5 (low risk). The global web reputation threshold is set to -1.0. The administrator checks the access logs and sees that the request is denied with the reason 'URL is blocked by policy'. The R&D policy has an explicit 'Deny' action for the URL category 'Uncategorized URLs' set to 'Block', but the default action for the policy is 'Monitor'. The identity matching is correct. What is the most likely cause and solution?

Accepted Answer

Create a custom URL category for portal.partner.com and configure the R&D policy to allow it.. Option C is correct because the R&D access policy has an explicit 'Deny' action for the 'Uncategorized URLs' category, which overrides the default 'Monitor' action. Since portal.partner.com is uncategorized, it is blocked by this explicit deny. Creating a custom URL category for the partner site and configuring an explicit 'Allow' action in the R&D policy will bypass the uncategorized URL block while preserving the rest of the policy.

Answer

Change the R&D policy's Uncategorized URLs action from Block to Monitor.

Answer

Lower the global web reputation threshold to -2.0 to allow more sites.

Answer

Disable authentication for the R&D identity to bypass policy.

Question 4

A company's Cisco WSA is configured with explicit proxy mode. Users report that they can browse the internet but cannot access internal websites hosted on the company's intranet. What is the most likely cause?

Accepted Answer

The internal websites are not in the proxy bypass list.. In explicit proxy mode, the WSA requires clients to be configured to send traffic to it. If internal websites are not added to the proxy bypass list (or the WSA's PAC file does not direct internal traffic directly), the WSA will attempt to proxy requests for internal sites, which may fail because the WSA cannot route to internal IPs or the internal DNS resolution fails. This is the most likely cause because users can browse the internet (proxied traffic works) but cannot reach internal sites (which should bypass the proxy).

Answer

The WSA is in transparent proxy mode.

Answer

Users are not authenticated to the WSA.

Answer

SSL decryption is blocking the internal sites.

Question 5

An organization uses Cisco ESA to filter inbound email. The security team notices that some phishing emails are reaching users despite having an anti-spam policy. Further analysis reveals that the emails are sent from a domain that is gray-listed but not blocked. What should the administrator do to prevent these emails without impacting legitimate emails?

Accepted Answer

Create a content filter to quarantine the emails based on malicious URLs or attachment type.. Option B is correct because creating a content filter to quarantine emails based on malicious URLs or attachment type directly addresses the phishing threat without affecting legitimate emails. Since the domain is gray-listed (not blocked), the anti-spam policy considers the sender as suspicious but not malicious; a content filter can inspect the email content for specific indicators of compromise (e.g., known malicious URLs or dangerous attachment types like .exe or .js) and quarantine those emails, bypassing the gray-mail classification.

Answer

Disable the Gray Mail feature in the anti-spam policy.

Answer

Enable Retrospective Scanning to detect the phishing emails after delivery.

Answer

Add the sender IP address to the SenderBase block list.

Question 6

A global company uses Cisco Umbrella to enforce security policies across roaming users. Recently, a user reported that they could not access a legitimate business application while connected to a guest Wi-Fi at an airport. The application is categorized as 'Productivity' in Umbrella. Other users outside the office can access it. What is the most likely reason?

Accepted Answer

The user's Umbrella roaming client is unable to authenticate, so the request uses the default policy which blocks the category.. Option D is correct because Umbrella uses identity-based policies; if the roaming security client cannot detect the user identity (e.g., due to no VPN or client failure), the request falls back to the default policy, which might block the category. Option A is wrong because the category is not blocked globally. Option B is wrong because the issue is specific to one user, not location. Option C is wrong because the guest Wi-Fi has no public IP block.

Answer

The application's category is blocked globally in the Umbrella policy.

Answer

The user is in a different geographic location with a stricter policy.

Answer

The guest Wi-Fi's public IP address is on a block list.

Question 7

A network administrator is deploying Cisco AMP for Endpoints to protect against advanced malware. They want to ensure that if a file is initially allowed but later determined to be malicious, the file is automatically blocked and quarantined on all endpoints that have executed it. Which AMP feature should be configured?

Accepted Answer

Retrospective Security (Retrospective). Retrospective Security (Retrospective) is the correct feature because it allows Cisco AMP for Endpoints to re-evaluate files that were initially allowed based on local or cloud reputation. If a file is later determined to be malicious via updated threat intelligence, Retrospective Security automatically blocks and quarantines that file on all endpoints that have executed it, even after the initial execution. This provides continuous protection against advanced malware that evades initial detection.

Answer

TETRA (Technique Extraction and Retrospective Analysis)

Answer

File Analysis via the AMP cloud

Answer

Exclude List for known good files

Question 8

Which TWO of the following are common causes of email delivery delays in Cisco Email Security Appliance (ESA)? (Select exactly two.)

Accepted Answer

High volume of email in the delivery queue. Option B is correct because a high volume of email in the delivery queue indicates that the ESA is experiencing a backlog of messages awaiting delivery. This can occur due to rate limiting, transient delivery failures, or a large number of messages being processed simultaneously, which directly causes delays in email delivery as the queue must be drained sequentially.

Answer

Too many recipients in a single message

Answer

Incorrect MX record for the destination domain

Answer

Improper SPF record on the sender's domain

Question 9

Which THREE of the following are best practices for deploying Cisco Web Security Appliance (WSA) in a large enterprise environment? (Select exactly three.)

Accepted Answer

Use explicit proxy mode with PAC files for user-specific policy enforcement. Option A is correct because explicit proxy mode with PAC files allows the WSA to enforce granular, user-specific policies based on authentication (e.g., via NTLM or LDAP) and destination URL. PAC files enable automatic proxy configuration for clients, ensuring traffic is routed through the WSA without manual browser settings, while still supporting user identity for policy decisions.

Answer

Configure transparent proxy to avoid client configuration

Answer

Disable anti-malware scanning to improve performance

Question 10

A financial services company recently migrated from a legacy web filter to Cisco WSA in explicit proxy mode. The company has 5000 users across three offices, each connected via MPLS. The WSA is deployed in the data center. A week after deployment, users in the remote office report that web pages load extremely slowly, while users in the main office near the data center experience normal speeds. The network team confirms there is no WAN congestion. The WSA administrator checks the logs and sees that the remote users are being authenticated via NTLM and that the WSA's CPU and memory usage are below 50%. However, the number of concurrent connections from the remote office is very high, with many connections in a TIME_WAIT state. What is the most likely cause of the slow web performance for remote users?

Accepted Answer

The WSA is not configured to reuse TCP connections, causing high connection overhead for remote users.. The correct answer is C because the high number of concurrent connections in TIME_WAIT state indicates that TCP connections are being closed after each request instead of being reused. In explicit proxy mode, the WSA can reuse persistent connections to reduce latency, but if connection reuse is not configured, each HTTP request from a remote user requires a new TCP handshake, which adds significant round-trip time (RTT) over the MPLS link. This overhead explains the slow performance for remote users while main office users, with lower latency, are unaffected.

Answer

The WSA's proxy process is overloaded due to high SSL decryption demands.

Answer

Remote users are using an outdated browser that does not support modern protocols.

Answer

NTLM authentication is causing authentication delays over the MPLS link.

Question 11

A university is using Cisco ESA to manage email for 20,000 students and staff. They have implemented anti-spam and anti-virus policies. Recently, the IT helpdesk has been receiving complaints that legitimate emails from external senders (such as admissions notifications) are being marked as spam and quarantined. The administrators check the ESA and find that these emails are being flagged with a spam score above the threshold, but the content appears to be legitimate. The sending domains are not on any blacklist. The ESA is using default anti-spam settings. What should the administrator do to reduce false positives without compromising security?

Accepted Answer

Add the legitimate sender domains or IPs to the ESA's whitelist (SenderBase whitelist).. Option C is correct because adding the legitimate sender domains or IPs to the ESA's SenderBase whitelist explicitly bypasses anti-spam scanning for those trusted sources, reducing false positives while maintaining security for all other inbound email. This approach leverages the ESA's reputation-based filtering to allow known good senders without lowering the global spam threshold or disabling protection entirely.

Answer

Create a content filter to allow any email with 'admissions' in the subject.

Answer

Disable anti-spam scanning for all inbound email.

Answer

Lower the spam threshold to decrease sensitivity.

Question 12

A small business uses Cisco Umbrella to protect its 50 employees. One employee reports that they cannot access a specific website (www.example.com) that is required for their work. The administrator checks the Umbrella dashboard and sees that the domain is categorized as 'Social Networking' and is blocked by the company's policy. However, the employee argues that the website is actually a business tool. The administrator verifies that the website is indeed legitimate. What is the best course of action to restore access while maintaining security?

Accepted Answer

Create a policy override to allow the specific domain while keeping the category blocked.. Option C is correct because Cisco Umbrella allows administrators to create per-domain policy overrides that bypass the category-based block for a specific domain while keeping the broader category (e.g., 'Social Networking') blocked for all other domains. This approach restores access to the legitimate business tool without weakening the overall security posture by disabling the entire category or removing the user from policy enforcement.

Answer

Contact Cisco Umbrella support to re-categorize the domain.

Answer

Disable the 'Social Networking' category blocking policy.

Answer

Remove the user from the Umbrella policy entirely.

Question 13

A multinational corporation uses Cisco AMP for Endpoints with cloud-based file reputation. The security team notices that a file that was previously determined to be clean (disposition: clean) is now reported as malicious by a threat intelligence feed. However, AMP has not taken any action on endpoints that already executed the file. The administrator confirms that retrospective security is enabled. What should the administrator check first to ensure that the file is remediated on all affected endpoints?

Accepted Answer

Check that the policy assigned to the endpoints has the 'Remediate Now' option enabled for files with changed dispositions.. Option C is correct because when a file's disposition changes from clean to malicious in the AMP cloud, the 'Remediate Now' policy setting controls whether AMP automatically triggers remediation actions (such as quarantine or deletion) on endpoints that have already executed the file. Even with retrospective security enabled, the administrator must ensure that the policy assigned to the endpoints has this option enabled; otherwise, the cloud will send the updated disposition but the endpoint will not automatically act on it.

Answer

Verify that the file is not excluded from scanning due to an anti-virus exclusion list.

Answer

Confirm that the endpoints have internet connectivity to the AMP cloud.

Answer

Ensure that the file is being analyzed by the local AMP engine for accurate detection.

Question 14

A large enterprise uses Cisco WSA with integrated Cisco Advanced Malware Protection (AMP) to inspect web traffic. The security policy dictates that all downloaded files should be scanned by AMP. Recently, a user downloaded a PDF file from a trusted vendor site, but the download was blocked by the WSA. The administrator checks the WSA logs and sees that the file was blocked due to AMP's 'File Reputation' score of 10 (high risk). However, the vendor confirms the file is legitimate. The administrator notes that the file is digitally signed by the vendor. What is the most appropriate next step to allow the file while maintaining security?

Accepted Answer

Add the file's SHA-256 hash to the AMP custom allow list to override the reputation.. Option C is correct because Cisco AMP allows administrators to create custom allow lists using file hashes (SHA-256) to override the file reputation score. Since the file is digitally signed and confirmed legitimate, adding its SHA-256 hash to the AMP custom allow list will permit the download while still scanning other files from that domain, preserving security. This approach directly addresses the false positive without broadly reducing security controls.

Answer

Add the vendor's domain to the WSA's global URL whitelist.

Answer

Lower the AMP file reputation threshold from 10 to 7 to allow files with lower risk scores.

Answer

Disable AMP scanning for the vendor's domain in the WSA policy.

Question 15

A hospital uses Cisco ESA for email security. The compliance team requires that all emails containing protected health information (PHI) be encrypted before leaving the organization. The administrator has configured a content filter that matches emails containing patterns like 'Patient ID: [0-9]{9}' and sends them to the encryption service. However, some encrypted emails are being rejected by the recipient's mail server because the encryption is applied after the email has already been processed. What is the most likely reason for this issue?

Accepted Answer

The encryption action is configured as 'deliver then encrypt' instead of 'encrypt then deliver'.. Option A is correct because Cisco ESA processes emails through a series of mail policies and content filters before delivery. If the encryption action is configured as 'deliver then encrypt', the email is first sent to the recipient's mail server, and then encryption is attempted as a separate, asynchronous action. This means the email leaves the organization unencrypted, and the recipient's server may reject it if it expects encryption from the start. The correct configuration should be 'encrypt then deliver', which ensures the email is encrypted before it is queued for delivery, preventing rejection due to unencrypted content.

Answer

The content filter is only applied to incoming emails, not outgoing.

Answer

The recipient's mail server does not support the encryption protocol used.

Answer

The email exceeds the maximum size limit for encryption.

350-701 Content Security Practice Test 6 — 15 Questions

Exhibit

350-701 Content Security Practice Test 6 — 15 Questions

Exhibit