350-701 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The interface Gi0/1/1 is not configured as a trusted interface for RA guard.. RA Guard protection is applied per interface based on trust configuration. The exhibit shows the device with MAC aaaa.bbbb.cccc is reachable via Gi0/1/1, but if that interface is not explicitly configured as trusted for RA Guard (e.g., using `ipv6 nd raguard trust`), the switch will not apply RA Guard filtering to RAs received on that port. This allows rogue RA messages from that device to bypass protection, making A the correct answer.

Answer

The device is not in the same VLAN as the RA guard policy.

Answer

The device tracking entry for aaaa.bbbb.cccc is invalid.

Answer

The device tracking table has reached its limit.

Question 2

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. Option A is correct because the AMP for Endpoints connector policy must be configured to point file submissions to the on-premises Threat Grid appliance, which is done by selecting the private Threat Grid appliance as the analysis destination in the policy's file analysis settings. Option C is correct because the on-premises Threat Grid appliance must be registered with the AMP cloud as a private analysis provider, which establishes the trust and routing so the AMP cloud knows to send files to that appliance for analysis. Option B is incorrect because SSL decryption is unrelated to file submission to Threat Grid and is not a required configuration step. Option D is incorrect because the Threat Grid appliance initiates outbound connections to the AMP cloud and does not require inbound internet traffic to function as a private analysis provider. Option E is incorrect because the Threat Grid Connector is not installed on endpoints; integration is handled through the AMP connector policy and cloud registration.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 3

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 4

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Accepted Answer

Fileless attack techniques (e.g., PowerShell injection). Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

Answer

Malicious DNS queries

Answer

Phishing email headers

Answer

Anomalous network traffic patterns

Question 5

Refer to the exhibit. An engineer notices that a malicious file disguised as 'app.exe' in the FinanceApp folder (SHA-256 unknown to AMP) was blocked. However, another unknown executable in the same folder was also blocked, causing a false positive. What should the engineer change in the policy to allow only the legitimate 'app.exe' while still blocking unknown executables?

Accepted Answer

Change the file exclusion path to the exact full path of app.exe instead of a wildcard.. The current policy uses a wildcard file exclusion for the entire FinanceApp folder, which causes the AMP engine to skip scanning all files within that folder, including unknown executables. By changing the exclusion to the exact full path of the legitimate 'app.exe', only that specific file is excluded from scanning, while other unknown executables in the folder remain subject to the 'block' action for unknown files. This allows the known good file to execute without being blocked, while still blocking other unknown files that may be malicious.

Answer

Remove the file exclusion for the FinanceApp folder entirely.

Answer

Remove the process exclusion for app.exe.

Answer

Change the action for unknown files from 'block' to 'detect'.

Question 6

A company uses FMC to manage FTD devices. After deploying a new intrusion policy, the analyst sees that no events are generated for a known vulnerability, even though the policy includes a rule for it. The analyst checks and the rule is enabled and the policy is applied. What is the most likely cause?

Accepted Answer

The access control policy before the intrusion policy is blocking traffic.. In a Cisco Firepower deployment, the access control policy (ACP) is evaluated before the intrusion policy. If the ACP is configured to block traffic matching the vulnerability's characteristics, the traffic never reaches the intrusion policy for inspection, so no intrusion events are generated even if the intrusion rule is enabled and applied.

Answer

The rule is configured to 'Drop and Generate Events' but the device is in inline tap mode.

Answer

The device has not been rebooted after policy deployment.

Answer

The intrusion policy rule has a false-positive suppression.

Question 7

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

Accepted Answer

Enable DMARC with reject policy. Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Answer

Disable SPF checking

Answer

Increase the SBRS threshold

Answer

Reduce DLP scanning sensitivity

Question 8

A cloud security team is investigating a possible data exfiltration incident involving an AWS S3 bucket configured with cross-region replication. Which Cisco Cloudlock feature can detect unusual replication patterns that may indicate data theft?

Accepted Answer

Cloudlock User and Entity Behavior Analytics (UEBA). Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.

Answer

Umbrella threat intelligence

Answer

Stealthwatch Cloud flow logs

Answer

Firepower IPS signatures

Question 9

A financial company is deploying Cisco ISE with TrustSec to enforce segmentation between application tiers (web, app, DB). They have a Cisco Catalyst 9500 as the core, and Catalyst 9300s as access switches. The SXP is configured between ISE and core switch, and the core switch propagates SGTs to access switches via SGT inline tagging on trunk ports. The engineer has configured SGTs for web (SGT=2), app (SGT=3), DB (SGT=4). However, when testing from a web server (IP 10.1.1.10, SGT=2) to an app server (IP 10.1.2.20, SGT=3), the app server sees the traffic without SGT in the packet, so the access switch cannot enforce policy. The engineer checks 'show cts role-based sgt-map' on the core and sees the mapping for 10.1.1.10 -> 2. What is the most likely issue?

Accepted Answer

The trunk between core and access is not configured for SGT inline tagging. For SGT inline tagging to work, the trunk link between the core switch and the access switch must be explicitly configured to carry SGTs (e.g., using 'cts role-based enforcement' and 'cts inline tagging' on the interface). Since the core has the correct SGT mapping but the access switch sees no SGT in the packet, the most likely cause is that the trunk is not tagging the frames with SGT. This prevents the access switch from enforcing role-based policies.

Answer

The ISE policy does not allow the traffic from web to app

Answer

The access switch does not have the security group ACL configured

Answer

The SXP connection between ISE and core is not established

Question 10

A network administrator is configuring an ASA to enforce that traffic between two internal zones must be inspected by the firewall. Which security principle is being applied?

Accepted Answer

Microsegmentation. Microsegmentation is the practice of dividing a network into small, isolated segments and enforcing granular security controls between them — here, the ASA is enforcing that traffic between two internal zones must pass through and be inspected by the firewall. This is the defining characteristic of microsegmentation: east-west traffic between internal segments is subject to policy enforcement rather than being implicitly trusted. The ASA's zone-based policy (using security zones and inter-zone policies) is a classic implementation of this principle.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense in Depth

Question 11

During a security incident, a SOC analyst notices that a malicious file was executed on an endpoint. Using Cisco AMP for Endpoints, which feature should the analyst use to visualize the file's propagation and activities across the network over time?

Accepted Answer

Device Trajectory. Cisco AMP for Endpoints' Device Trajectory feature provides a visual timeline of file and process activity on an endpoint, showing how a file arrived, what it executed, and how it propagated across the network. It is specifically designed for incident investigation and root-cause analysis, allowing analysts to trace a malicious file's lineage and network activities over time.

Answer

Orbital Advanced Search

Answer

IOC Scan

Answer

File Reputation Lookup

Question 12

A company uses Cisco ISE for network access control. They want to authenticate users connecting via VPN using multi-factor authentication. Which solution integrates with ISE to provide MFA for AnyConnect VPN?

Accepted Answer

Cisco Duo. Cisco Duo integrates with ISE and AnyConnect to provide multi-factor authentication for VPN access.

Answer

Cisco AMP for Endpoints

Answer

Cisco SecureX

Answer

CyberArk

Question 13

A DevSecOps team is implementing secrets management for a cloud-native application. They want to avoid storing secrets in environment variables or code. Which solution should they use?

Accepted Answer

Use HashiCorp Vault to dynamically generate and manage secrets. HashiCorp Vault is a dedicated secrets management solution that dynamically generates, leases, and revokes secrets, and integrates with cloud-native platforms via sidecars or CSI drivers. It avoids hardcoding secrets in images, environment variables, or repositories by providing secure injection at runtime.

Answer

Embed secrets in the container image

Answer

Pass secrets via command-line arguments

Answer

Store secrets in a configuration file in the repository

Question 14

Refer to the exhibit. A network administrator is troubleshooting device tracking on a Cisco switch. The output shows two devices in VLAN 100. The switch is configured with IPv6 first-hop security features. The administrator notices that the device with MAC address aaaa.bbbb.cccc is not receiving RA guard protection. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch drops all traffic from the host with source IP 192.168.1.20.. IP Source Guard uses DHCP snooping binding table to enforce IP-to-port mapping. When the host at GigabitEthernet0/2 with MAC 0050.7966.6801 attempts to use IP 192.168.1.20 instead of its DHCP-assigned IP 192.168.1.10, the switch compares the source IP of the packet against the binding table. Since 192.168.1.20 is not bound to that port and MAC, the switch drops all traffic from that host with source IP 192.168.1.20, preventing IP spoofing.

Answer

The switch sends an ARP probe to verify the IP is unused, then updates the binding.

Answer

The switch updates the binding table to allow 192.168.1.20.

Answer

The switch allows the traffic because the host is trusted on that port.

Question 15

During a security incident, it is observed that a server behind a Cisco ASA is being accessed repeatedly with different source IPs in a short time. The firewall logs show many dropped packets to the server's IP on port 443. What is the most effective mitigation to reduce the impact while maintaining legitimate access?

Accepted Answer

Enable TCP Intercept with a low threshold. TCP Intercept with a low threshold is the most effective mitigation because it protects the server from a SYN flood attack by intercepting TCP SYN packets and completing the three-way handshake on behalf of the server. This allows legitimate traffic to proceed while dropping excessive SYN requests from rapidly changing source IPs, which is exactly the behavior described in the scenario. Unlike other options, TCP Intercept dynamically manages connection attempts without blocking all unknown sources or disrupting legitimate access.

Answer

Increase the connection timeout

Answer

Implement an access-list to allow only known source IPs

Answer

Configure a static route to null0 for the server's IP

Question 16

An attacker sends a flood of SYN packets with spoofed IP addresses to a server, causing it to allocate resources for half-open connections until it can no longer accept legitimate traffic. This is which type of DDoS attack?

Accepted Answer

Protocol DDoS. SYN flood is a protocol-based DDoS attack that exploits the TCP handshake.

Answer

Application layer DDoS

Answer

Volumetric DDoS

Answer

Amplification DDoS

Question 17

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. EDR (Endpoint Detection and Response) focuses on detecting, investigating, and responding to threats on endpoints, so process isolation (B) is correct because it lets the agent terminate or suspend a malicious process to stop its execution while preserving forensic state. Remote shell investigation (C) is correct because EDR platforms provide remote access to an endpoint's command shell or live-response console so analysts can run commands, inspect memory, and gather artifacts without disrupting the user. File quarantine (E) is correct because EDR can automatically or manually move malicious files to an isolated location, neutralizing the threat while retaining the sample for analysis. Multi-factor authentication (A) is an identity/access control measure, not an endpoint detection-and-response function, and application whitelisting (D) is a preventive application-control technique rather than an EDR detection/investigation/response capability.

Answer

Multi-factor authentication

Answer

Application whitelisting

Question 18

A large enterprise with over 2,000 employees recently experienced a security breach. An attacker gained initial access through a phishing email and then moved laterally across the network to reach a critical database server. The network currently has a flat Layer 2 topology with all devices in a single large VLAN. The company wants to prevent lateral movement in the future while maintaining operational simplicity. They have a Cisco ISE deployment already but it is only used for wireless guest access. The security team is evaluating options. Option A: Deploy 802.1X with dynamic VLAN assignment across all wired ports. This would authenticate users and assign them to different VLANs based on identity. Option B: Implement micro-segmentation using Cisco TrustSec with Security Group Tags (SGTs) on the existing switches and enforce SGT-based policies on the firewalls. This would allow traffic control between groups regardless of IP. Option C: Install a next-generation firewall at the internet edge and enable IPS to block known attack signatures. Option D: Upgrade all access switches to support Private VLANs (PVLANs) and configure promiscuous ports for servers. Which solution BEST addresses the lateral movement problem while leveraging existing infrastructure?

Accepted Answer

Implement micro-segmentation using Cisco TrustSec with SGTs and enforce policies on firewalls.. Cisco TrustSec with Security Group Tags (SGTs) enables micro-segmentation at Layer 2, allowing traffic control between user groups and servers based on identity rather than IP address. This directly prevents lateral movement by enforcing policies that restrict which endpoints can communicate, even within the same VLAN, and it leverages the existing Cisco ISE deployment for policy management without requiring major topology changes.

Answer

Install a next-generation firewall at the internet edge and enable IPS.

Answer

Upgrade all access switches to support Private VLANs (PVLANs).

Answer

Deploy 802.1X with dynamic VLAN assignment across all wired ports.

Question 19

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Option C is correct because Cisco CloudLock DLP policies rely on content-matching rules that identify sensitive data such as PII using predefined or custom regex/pattern definitions, which is the detection mechanism required before any alerting can occur. Option D is correct because the scenario specifically requires detecting and alerting on external sharing of PII files, so a policy must be configured with the external-sharing trigger and an alert action tied to the PII DLP rule. Option A is incorrect because the requirement is to detect and alert, not to automatically block, and blocking all external PII sharing exceeds the stated scope. Option B is incorrect because disabling external sharing application-wide is a blunt control that prevents legitimate collaboration and does not provide the required detection and alerting. Option E is incorrect because a transparent proxy inspects network traffic and is not the mechanism used to enforce CloudLock SaaS API-based DLP policies on files shared within a cloud application.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 20

A Cisco ESA administrator is investigating an increase in false positive detections from the outbreak filter. The filter is configured to use TALOS intelligence and has a threshold of 'Medium'. Which action would most effectively reduce false positives while maintaining protection against new outbreaks?

Accepted Answer

Change the threshold to 'High'. The outbreak filter in Cisco ESA uses Talos intelligence and a threshold that determines sensitivity. Raising the threshold from 'Medium' to 'High' makes the filter more selective, requiring stronger evidence before classifying a message as an outbreak, which reduces false positives while still catching clear, high-confidence outbreaks. This maintains protection against genuine new outbreaks without disabling the filter.

Answer

Change the threshold to 'Low'

Answer

Disable the outbreak filter

Answer

Exempt all internal senders from the filter