350-701 Content Security — Timed 50 Questions

Question 1

A company uses Cisco Umbrella to enforce web security. After deploying a new policy that blocks all social media sites, users report that they cannot access a corporate Salesforce instance that uses a social login feature. Which Umbrella setting should be adjusted to resolve the issue without weakening the policy?

Accepted Answer

Add Salesforce to the Application Settings allowed list. Option D is correct because the social login feature for Salesforce is being blocked by the Social Networking content category in Cisco Umbrella. By adding Salesforce to the Application Settings allowed list, you permit the specific application traffic while keeping the broader social media policy intact. This granular control ensures that only the required Salesforce instance bypasses the block, without weakening the overall security posture.

Answer

Create a bypass code for users to access Salesforce

Answer

Disable the Social Networking category under Content Categories

Answer

Configure Intelligent Proxy to inspect Salesforce traffic

Question 2

An engineer is troubleshooting a Cisco WSA that is failing to block malware downloads from a specific cloud storage website. The URL filtering policy is set to block the 'Cloud Storage' category, and the Web Reputation score is set to block scores below -5.0. Users can still download files. What is the most likely cause?

Accepted Answer

The file type is not configured for malware inspection. The Cisco WSA can block malware downloads only if it inspects the file content. If the file type is not configured for malware inspection, the WSA will allow the download even if the URL category and reputation score are set to block. This is because malware inspection requires explicit configuration of file types (e.g., .exe, .zip) to scan for threats, and without it, the WSA bypasses deep content analysis.

Answer

HTTPS proxy decryption is not configured

Answer

The L4 Traffic Monitor is not enabled

Answer

The users are not authenticated

Question 3

A network administrator wants to block access to a specific URL category on the Cisco WSA but allow access to all other categories. Which action should be taken in the Access Policy?

Accepted Answer

Set the action to 'Block' for the category. To block access to a specific URL category while allowing all others, the Access Policy must set the action for that category to 'Block'. The Cisco WSA evaluates URL categories in order of precedence, and a 'Block' action explicitly denies HTTP/HTTPS requests matching that category, while all other categories default to 'Allow' unless otherwise configured.

Answer

Set the action to 'Monitor' for the category

Answer

Set the action to 'Redirect' for the category

Answer

Set the action to 'Warn' for the category

Question 4

An organization is using Cisco ESA to protect against email-borne threats. They notice that some phishing emails are not being caught by the anti-spam engine. The emails contain malicious URLs that are rewritten by the ESA. Which feature should be verified to ensure the rewritten URLs are properly analyzed?

Accepted Answer

URL filtering and analysis settings. B is correct because the URL filtering and analysis settings control how the Cisco ESA rewrites and subsequently analyzes malicious URLs. When a phishing email contains a malicious URL, the ESA can rewrite the URL to point to its own proxy for real-time analysis. If this feature is not properly configured or if the analysis settings (such as reputation scoring or time-of-click verification) are disabled, the rewritten URLs may not be inspected, allowing the threat to bypass detection.

Answer

Data Loss Prevention (DLP) policies

Answer

Anti-Virus scanning engine

Answer

Encryption policies

Question 5

A company is deploying Cisco Umbrella to enforce security policies for remote users. They want to ensure that DNS requests from roaming clients are routed through Umbrella's DNS resolvers. However, some users are bypassing Umbrella by using third-party DNS servers like Google (8.8.8.8). Which configuration should be applied to prevent this?

Accepted Answer

Enable DNS Policy in the Umbrella roaming client. Option D is correct because the Umbrella roaming client's DNS Policy feature forces all DNS traffic from the endpoint to use Umbrella's DNS resolvers, even if the user manually configures a third-party DNS server like Google (8.8.8.8). This is achieved by intercepting DNS requests at the OS level and redirecting them to the Umbrella resolvers, effectively preventing bypass attempts without relying on network-level blocks.

Answer

Configure Content Filtering to block Google DNS

Answer

Add a firewall rule on each client to block port 53 to all but Umbrella

Answer

Enable IP Layer Enforcement in the Umbrella dashboard

Question 6

A network administrator needs to configure Cisco WSA to decrypt HTTPS traffic for inspection. What is the first step that must be completed?

Accepted Answer

Install a Certificate Authority (CA) certificate on the WSA and distribute it to clients. The first step in configuring Cisco WSA for HTTPS decryption is to install a Certificate Authority (CA) certificate on the WSA and distribute it to client devices. This establishes trust because the WSA acts as a man-in-the-middle, generating a new certificate for each HTTPS session signed by this CA; without the CA certificate in the clients' trusted root store, browsers will display certificate warnings and block the connection.

Answer

Create a bypass list for internal sites

Answer

Configure an Access Control List (ACL) to allow decryption

Answer

Configure user authentication

Question 7

An organization is using Cisco ESA and wants to ensure that outgoing emails containing credit card numbers are blocked before leaving the network. Which feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policies. Cisco ESA uses Data Loss Prevention (DLP) policies to inspect outgoing email content for sensitive data such as credit card numbers. DLP can identify patterns (e.g., 16-digit card numbers) using predefined or custom dictionaries and enforce actions like blocking, quarantining, or encrypting the message before it leaves the network. Anti-Spam, Encryption, and Anti-Virus policies do not perform content-based pattern matching for sensitive data.

Answer

Anti-Spam policies

Answer

Encryption policies

Answer

Anti-Virus scanning

Question 8

During a security audit, it is discovered that some malware downloads were not blocked by the Cisco WSA even though the Web Reputation score was set to block scores below -5.0. The logs show that the downloads came from sites with a reputation score of -6.2. What is the most likely reason the downloads were not blocked?

Accepted Answer

The file type was not configured for malware inspection. The Cisco WSA uses Web Reputation filtering to block traffic based on reputation scores, but this filtering operates at the URL or domain level, not at the file content level. Even if a site has a very low reputation score (e.g., -6.2), the WSA will only block the download if the file type is included in the malware inspection configuration. If the file type (e.g., .exe, .zip) is not configured for malware inspection, the WSA will allow the download despite the low reputation score, because reputation-based blocking alone does not inspect the content of the file.

Answer

HTTPS decryption was not enabled

Answer

The users were not authenticated

Answer

The Web Reputation threshold was not applied correctly

Question 9

Which TWO actions are best practices when configuring a Cisco WSA to block malicious websites? (Choose two.)

Accepted Answer

Configure URL filtering categories to block known malicious categories. Option A is correct because Cisco WSA URL filtering categories allow administrators to block entire groups of known malicious sites, such as malware, phishing, or spyware categories, which are pre-classified by Cisco Talos. This provides a broad, proactive defense against threats without needing to maintain individual URL block lists. Option E is correct because Web Reputation filtering uses a scoring system (1–10, with lower scores being more malicious) to dynamically block or warn users about websites with poor reputation, even if they are not in a specific malicious category, adding a layer of behavioral analysis.

Answer

Set the default action to 'Monitor' for all categories

Answer

Disable user authentication to simplify policy

Answer

Allow all HTTPS traffic to improve performance

Question 10

Which THREE features are available in Cisco Umbrella to protect against DNS-based threats? (Choose three.)

Accepted Answer

IP-layer enforcement. Cisco Umbrella provides DNS-layer security (option C) as its core function, intercepting DNS queries to block requests to malicious domains before a connection is established. IP-layer enforcement (option A) extends protection by applying policies based on the destination IP address, blocking traffic to known malicious IPs even if DNS resolution is bypassed. Application control (option B) allows administrators to permit or block specific cloud applications (e.g., Dropbox, Facebook) at the DNS level, preventing data exfiltration or unauthorized usage through DNS-based application identification.

Answer

Data Loss Prevention (DLP)

Answer

Anti-virus scanning

Question 11

Which TWO benefits does the Cisco ESA provide for email security? (Choose two.)

Accepted Answer

Email encryption and data loss prevention. Option A is correct because the Cisco Email Security Appliance (ESA) includes integrated email encryption capabilities via Cisco Registered Envelope Service (CRES) or PGP/SMIME, and it provides Data Loss Prevention (DLP) through pre-defined or custom DLP policies that scan outbound emails for sensitive data patterns such as credit card numbers or PII. These features are core to the ESA's content security functionality.

Answer

DNS-layer security

Answer

Network firewall functionality

Answer

Web content filtering

Question 12

A user in the Engineering group reports that they cannot access a banking website (https://www.examplebank.com). The website is categorized as 'Financial' by the WSA. Based on the exhibit, what is the most likely cause?

Accepted Answer

The Web Reputation threshold of -6.0 is blocking the site due to a low reputation score. The exhibit shows a Web Reputation threshold of -6.0, meaning any website with a reputation score lower than -6.0 will be blocked. The banking site 'examplebank.com' likely has a low reputation score (e.g., due to being newly registered or hosting malicious content), causing it to fall below the threshold and be blocked. This is the most direct cause because the WSA applies reputation-based filtering before other policies, and the user's inability to access the site aligns with a reputation block rather than a category or scanning issue.

Answer

The Malware Scanning action is set to 'Scan' but blocks the site

Answer

The user identification is not configured correctly

Answer

The Social Networking category is set to 'Monitor' and is blocking the site

Question 13

An email administrator sees the above log entry in the Cisco ESA. What will happen to the email?

Accepted Answer

The email will be quarantined and an administrator will review it. The log entry indicates that the email triggered a content filter action set to 'quarantine' in the Cisco ESA. When an email is quarantined, it is held in a designated quarantine mailbox for administrative review, allowing the administrator to release, delete, or further analyze the message. This is the default behavior for policies that require human intervention before delivery.

Answer

The email will be dropped and not delivered

Answer

The email will be encrypted before delivery

Answer

The email will be delivered with a warning

Question 14

A multinational company has recently deployed Cisco Umbrella for DNS-layer security across all offices. The security team receives reports that users in the Asia-Pacific region cannot access a critical cloud-based CRM application (crm.company.com). The CRM is hosted by a third-party provider and uses a custom domain. The Umbrella dashboard shows that DNS requests for crm.company.com are being blocked with the reason 'Cisco Umbrella Intelligence Feed: Blocked Domain'. The domain is not part of any standard security category. The IT team has verified that the domain is legitimate and necessary for business operations. What should the administrator do to restore access while maintaining security?

Accepted Answer

Add crm.company.com to the global allow list in the Umbrella dashboard under Policy > Destination Lists > Allow. Option D is correct because the domain is being blocked by the Cisco Umbrella Intelligence Feed, which is a curated threat intelligence feed. Since the domain is legitimate and not part of a standard security category, the proper method to restore access is to add it to the global allow list under Policy > Destination Lists > Allow. This overrides the block from the intelligence feed while preserving all other security policies.

Answer

Whitelist the CRM server's IP address in the IP-layer enforcement settings

Answer

Configure the local DNS server to forward crm.company.com directly to the CRM provider's DNS

Answer

Disable the Cisco Umbrella Intelligence Feed for the Asia-Pacific region

Question 15

A university is using Cisco WSA to filter web traffic for its students and staff. The WSA is configured with transparent proxy mode and uses Active Directory for authentication. Recently, the IT department received complaints that some users cannot access certain educational websites that are correctly categorized as 'Education'. The WSA policy has a default rule that blocks all categories except those explicitly allowed. The 'Education' category is set to 'Allow'. However, affected users are shown a block page with the reason 'Web Reputation: Low Reputation'. The Web Reputation threshold is set to -5.0. The IT team checked the reputation scores of the blocked sites and found they are around -4.5. What is the most likely reason for the block?

Accepted Answer

The Web Reputation action is set to 'Block' for scores below 0, overriding the URL filtering allow. Option A is correct because the Web Reputation action configured in the WSA policy overrides the URL category-based allow rule. Even though the 'Education' category is set to 'Allow', the Web Reputation threshold is set to -5.0, and the blocked sites have a reputation score of -4.5 (which is below the threshold, meaning worse reputation). The WSA applies the most restrictive action: if Web Reputation is set to 'Block' for scores below 0, it will block traffic regardless of the category allow action, resulting in the block page showing 'Web Reputation: Low Reputation'.

Answer

The 'Education' category is not included in the allowed list for the specific identification profile

Answer

The users are not authenticated properly and are assigned a default policy that blocks education

Answer

The HTTPS decryption is failing for those sites, causing a block

Question 16

A company is deploying Cisco Web Security Appliance (WSA) to enforce acceptable use policies. Users report that some legitimate websites are being blocked incorrectly. The security team wants to allow these sites while still blocking known malware sites. Which action should the administrator take?

Accepted Answer

Create a custom URL filtering policy to allow the specific URLs.. Option A is correct because the Cisco WSA uses URL filtering policies to control access based on URL categories and individual URLs. By creating a custom URL filtering policy that allows the specific URLs, the administrator can whitelist legitimate sites while the WSA continues to block known malware sites through its reputation-based and category-based filtering. This approach maintains security enforcement without disabling broader protections.

Answer

Disable HTTPS decryption to bypass filtering for encrypted sites.

Answer

Enable Data Loss Prevention (DLP) to allow the sites.

Answer

Increase the HTTPS decryption depth to inspect more content.

Question 17

A network administrator is troubleshooting an issue where users cannot send emails with attachments larger than 10 MB through the Cisco Email Security Appliance (ESA). The ESA is configured with a mail flow policy that has a maximum message size of 20 MB. What is the most likely cause of the issue?

Accepted Answer

The ESA default maximum attachment size is 10 MB.. The Cisco ESA has a built-in default maximum attachment size of 10 MB, which is separate from the mail flow policy's maximum message size. Even though the mail flow policy allows messages up to 20 MB, the attachment size limit is enforced by the ESA's default configuration, which caps individual attachments at 10 MB. This default can be overridden in the mail flow policy or system settings, but if not explicitly changed, it remains the limiting factor.

Answer

The mail flow policy maximum message size is set too low.

Answer

The HAT (Host Access Table) maximum message size is set to 10 MB.

Answer

The outgoing mail policy has a smaller attachment size limit.

Question 18

A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?

Accepted Answer

Install the Umbrella roaming client on all endpoints.. The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.

Answer

Deploy the Umbrella virtual appliance in the data center.

Answer

Use BGP to redirect traffic to Umbrella.

Answer

Configure Active Directory integration.

Question 19

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Option A is correct because Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 20

A company is deploying Cisco Email Security Appliance (ESA) to protect against phishing attacks. The security team wants to implement two security features to detect malicious URLs in emails. Which two features should be enabled? (Choose two.)

Accepted Answer

URL reputation filtering. URL reputation filtering is correct because it uses the Cisco Talos threat intelligence to analyze and block emails containing malicious URLs based on real-time reputation scores. Cisco Advanced Phishing Protection is correct because it uses machine learning and behavioral analysis to detect and block sophisticated phishing URLs that may bypass traditional reputation checks.

Answer

DomainKeys Identified Mail (DKIM) signing

Answer

Sender Policy Framework (SPF) verification

Answer

Domain-based Message Authentication, Reporting & Conformance (DMARC)