350-701 Exam Simulation — 90 Questions

Question 1

A company uses Cisco Stealthwatch Cloud for network visibility in AWS. They notice a spike in encrypted traffic from an EC2 instance to an unknown external IP. Which Stealthwatch Cloud feature can analyze this traffic for threats without decrypting it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypted Traffic Analytics (ETA). Encrypted Traffic Analytics (ETA) is the correct feature because it uses machine learning and behavioral analysis to inspect metadata (e.g., flow records, packet lengths, timing) of encrypted traffic without decrypting it. This allows Stealthwatch Cloud to detect anomalies like command-and-control communication or data exfiltration even when the payload is encrypted.

Answer

NetFlow generation

Answer

Deep Packet Inspection (DPI)

Answer

SSL Decryption

Question 2

A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?

Accepted Answer

Remote Access Trojan (RAT). Port 4444 is commonly associated with Blaster worm and remote access tools. A Remote Access Trojan (RAT) allows remote control and often communicates on such ports.

Answer

Ransomware

Answer

Keylogger

Answer

Botnet C2 client

Question 3

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Accepted Answer

DNS query flood. Application layer DDoS attacks target specific applications, such as HTTP floods, Slowloris, and DNS query floods.

Answer

DNS amplification

Answer

SYN flood

Question 4

Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-based DNS security solution that blocks requests to malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 5

Which Cisco cloud-based security solution provides DNS-layer security to block requests to malicious domains?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Security Internet Gateway) is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. When a user attempts to resolve a domain, Umbrella checks the request against its threat intelligence database and blocks the resolution if the domain is known to be malicious, preventing the connection before it is established.

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Answer

Cisco ESA

Question 6

A security analyst is tuning Snort rules to reduce false positives. The analyst identifies a rule that triggers on a common benign application. Which action should be taken to suppress alerts for that specific traffic without disabling the rule entirely?

Accepted Answer

Add a 'threshold' rule to limit the number of alerts.. Snort allows using 'threshold' or 'suppress' options to limit alerts. The 'suppress' keyword can suppress alerts for specific source/destination IPs. Alternatively, creating a pass rule in the local policy could bypass inspection for that traffic. However, directly modifying the rule's action to 'pass' is not standard; using threshold is common.

Answer

Delete the rule from the policy.

Answer

Change the rule action to 'alert'

Answer

Set the rule to 'drop' action.

Question 7

Which Cisco technology provides visibility into the performance of SaaS applications such as Microsoft 365?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Umbrella SIG

Question 8

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) filter traffic between subnets based on rules.

Answer

Azure DDoS Protection

Answer

Azure Policy

Answer

Azure Firewall

Question 9

An organization is adopting a cloud-first strategy and wants to ensure least-privilege access for cloud resources. Which THREE measures should be implemented as part of a cloud IAM strategy? (Select three.)

Accepted Answer

Use managed identities for access. Managed identities (such as Azure Managed Identities or AWS IAM Roles for EC2) eliminate the need to store credentials in code or configuration files. The cloud provider automatically rotates the credentials and binds the identity to the compute resource, enforcing least-privilege by granting only the permissions required for that resource to function.

Answer

Store secrets in source code repositories for ease of deployment

Answer

Enable single sign-on with multi-factor authentication

Question 10

A network engineer is configuring OSPF on a Cisco router and needs to enable authentication between neighbors. The authentication type should be MD5. Which configuration step is required?

Accepted Answer

ip ospf authentication message-digest under the interface. To enable OSPF MD5 authentication on a Cisco router, the 'ip ospf authentication message-digest' command must be applied under the specific interface. This command tells OSPF to use MD5 (message-digest) authentication for that interface, and it must be paired with an 'ip ospf message-digest-key' command to define the actual key. The authentication type is configured at the interface level, not globally under the OSPF routing process.

Answer

ospf authentication-key under router ospf

Answer

area 0 authentication command in router configuration

Answer

ip ospf authentication null

Question 11

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. 'Never trust, always verify' is the foundational principle of the Cisco Zero Trust security model, which mandates that no user, device, or network segment is trusted by default, regardless of its location relative to the network perimeter. This principle eliminates implicit trust and requires authentication and authorization for every access request, aligning with the Zero Trust architecture defined in NIST SP 800-207.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 12

An organization uses Cisco Umbrella to block malicious domains. What is the primary security benefit of DNS-layer security?

Accepted Answer

It blocks malicious domains before a connection is made. DNS-layer security blocks requests to malicious domains at the DNS level, preventing the connection from being established.

Answer

It performs deep packet inspection on all traffic

Answer

It provides SSL decryption for all web traffic

Answer

It encrypts all DNS traffic to prevent eavesdropping

Question 13

An organization uses ISE for wireless LAN authentication via 802.1X with PEAP-MSCHAPv2. Users authenticate against Active Directory. Recently, some users report that after changing their domain password, they cannot connect to the wireless network for about 30 minutes. What is the most likely cause?

Accepted Answer

ISE has cached the previous password and is still using it for authentication. ISE caches user credentials for efficiency, including the password used during 802.1X authentication. When a user changes their domain password, ISE may still have the old password cached and will attempt to authenticate with it until the cache expires (typically up to 30 minutes). Option A is incorrect because DNS updates are not related to cached passwords; stale DNS records would affect all users, not just those with recent password changes. Option C is incorrect because wireless controllers do not cache passwords for 802.1X; they forward credentials to the RADIUS server (ISE). Option D is incorrect because the RADIUS server (ISE) is the one caching credentials, not the wireless controller.

Answer

DNS records for the domain controller have not updated

Answer

The wireless controller has a local password cache

Answer

The RADIUS server on the wireless controller is caching credentials

Question 14

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 15

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Accepted Answer

Inherence. Fingerprints are inherent characteristics of a person, placing them in the 'inherence' category (something you are).

Answer

Possession

Answer

Knowledge

Answer

Location

Question 16

A company is deploying a multi-tier application in a Cisco cloud security environment. The web servers must be accessible from the internet, but the database servers should only be reachable from the web servers. Which Cisco security controls should be used to enforce this?

Accepted Answer

Assign a Cisco TrustSec security group tag (SGT) to web servers allowing HTTP/S from 0.0.0.0/0, and a separate SGT for databases allowing traffic only from the web server SGT. Cisco TrustSec Security Group Tags (SGTs) provide granular, scalable segmentation based on logical groups rather than IP addresses. They are stateful and can be used to allow traffic from web servers to database servers based on source SGT. This is more effective than stateless ACLs or subnet-level controls, and Cisco CloudLock is primarily a CASB, not for network segmentation.

Answer

Use Cisco ASA access-lists to allow inbound traffic to web servers from 0.0.0.0/0 and deny all traffic to database servers

Answer

Place web servers in a public subnet and database servers in a private subnet, and use a Cisco Firepower access control policy to block all traffic to the private subnet

Answer

Use Cisco CloudLock to restrict access to database servers based on source IP

Question 17

An organization wants to enforce multi-factor authentication for remote VPN access. Cisco AnyConnect is used as the VPN client. Which Cisco product integrates with AnyConnect to provide MFA capabilities such as push notifications and one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo is the correct answer because it is the Cisco product specifically designed to integrate with AnyConnect for multi-factor authentication (MFA). Duo provides push notifications, one-time passwords (OTP), and other MFA methods by acting as an authentication proxy that validates secondary factors via RADIUS or SAML before allowing VPN access.

Answer

Cisco ISE

Answer

Cisco SecureX

Answer

Cisco AMP for Endpoints

Question 18

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Accepted Answer

access-list outside_in extended deny ip host 10.1.1.1 any. The ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

Answer

access-list outside_in extended deny ip any host 10.1.1.1

Answer

access-list outside_in extended deny tcp any host 10.1.1.1

Answer

access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Question 19

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

Accepted Answer

Transparent user identification using Active Directory agent. Transparent user identification on WSA can be achieved via NTLM authentication or Kerberos, but the most common transparent method is using NTLM challenge/response, or via AD agent. However, the question asks for transparent identification without client software; typical methods include using the AD agent or IP-based mapping. The best answer is 'NTLM authentication with browser integration' which is transparent to the user after initial login. But among options, 'Transparent user identification using Active Directory agent' is correct.

Answer

LDAP bind with user credentials

Answer

Explicit proxy with PAC file

Answer

Kerberos authentication with keytab file

Question 20

An organization wants to prevent users from accessing known malicious websites. Which Cisco WSA feature should be configured to block access based on website reputation?

Accepted Answer

URL Filtering. Cisco WSA uses Cisco Talos web reputation scores to block access to malicious websites based on their reputation.

Answer

SSL/TLS Decryption

Answer

AMP File Scanning

Answer

AVC (Application Visibility and Control)