350-701 Matching — 10 Questions

Question 1

Match each security technology to its primary function.

Accepted Answer

Firewall: Filters traffic based on stateful inspection and access control lists.. Firewall filters traffic based on rules; IDS/IPS monitors for threats; VPN provides secure tunnels; NAC enforces compliance. Common mistakes include confusing IDS/IPS with firewall and NAC with VPN.

Answer

Firewall: Monitors network traffic for malicious activity and can block or alert.

Answer

VPN: Enforces endpoint compliance and access policies.

Question 2

Match each Cisco security solution to its primary use case.

Accepted Answer

Cisco ASA: Provides stateful firewall and VPN capabilities.. Cisco ASA is a firewall/VPN solution, Firepower is NGFW/IPS, and ISE handles network access control. Common confusions involve mixing ASA with ISE or Firepower with Umbrella.

Answer

Cisco ASA: Enforces network access control and policy.

Answer

Cisco Firepower: Provides DNS-layer security for internet traffic.

Question 3

Match each Cisco ASA feature to its description.

Accepted Answer

Cut-Through Proxy: Authenticates users before allowing traffic through the firewall. The correct matches are: Cut-Through Proxy (user authentication), Failover (high availability), ASDM (web GUI), and Packet Tracer (traffic simulation). Common confusions include mistaking Cut-Through Proxy for application inspection and Failover for multiple contexts.

Answer

Cut-Through Proxy: Inspects packets at the application layer for malicious content

Answer

Failover: Allows multiple contexts to be managed independently on a single ASA

Question 4

Match each encryption algorithm to its type.

Accepted Answer

AES: Symmetric encryption. AES and DES are symmetric encryption algorithms, RSA is asymmetric, and SHA-256 is a hashing algorithm. Common confusions include misclassifying AES as asymmetric or RSA as symmetric, and confusing hash functions with encryption.

Answer

AES: Asymmetric encryption

Answer

RSA: Symmetric encryption

Answer

SHA-256: Symmetric encryption

Question 5

Match each 802.1X component to its role.

Accepted Answer

Supplicant: End user device that requests access. In 802.1X, the supplicant is the client requesting access, the authenticator is the network device (switch/AP) that enforces access control, and the authentication server (RADIUS) validates credentials. Common confusions involve swapping the roles of supplicant and authenticator.

Answer

Supplicant: Device that enforces access control and grants access

Answer

Authenticator: End user device that requests authentication

Question 6

Match each threat type to its definition.

Accepted Answer

DDoS: Overwhelming a system with traffic from multiple sources. Correct matches: DDoS = traffic flood, Phishing = fraudulent emails, Malware = malicious software, Ransomware = encryption extortion. Common confusions: associating DDoS with encryption or phishing with traffic overload.

Answer

DDoS: Malware that encrypts data and demands payment

Answer

Phishing: Overwhelming a system with traffic from multiple sources

Question 7

Match each protocol to its default port number.

Accepted Answer

SSH: 22. These are well-known port numbers for common protocols.

Answer

SSH: 21

Answer

HTTPS: 22

Question 8

Match each VPN type to its characteristic.

Accepted Answer

Site-to-Site VPN: Connects entire networks between different locations using IPsec.. The correct matches are: Site-to-Site VPN (connects networks), Remote Access VPN (connects individual users), MPLS VPN (uses MPLS in provider network), and DMVPN (dynamic tunnels). Common confusions involve swapping site-to-site and remote access characteristics.

Answer

Site-to-Site VPN: Allows individual users to connect to a corporate network from remote locations.

Answer

Remote Access VPN: Connects entire networks between different locations using IPsec.

Question 9

Match each Cisco security command to its function.

Accepted Answer

ip access-group: Applies an access control list to an interface.. The correct matches are: ip access-group applies ACLs to interfaces; ip inspect enables stateful firewall inspection; crypto map configures IPSec. Common confusions include swapping the functions of 'ip access-group' and 'ip access-list', or misattributing encryption to 'ip inspect'.

Answer

ip access-group: Defines an access control list.

Answer

ip inspect: Encrypts all data traffic on an interface.

Answer

crypto map: Applies an ACL to an interface for filtering.

Question 10

Match each Cisco security product to its category.

Accepted Answer

Cisco Firepower: Next-Generation Firewall. Cisco Firepower is an NGFW; Cisco ISE is a NAC; Cisco Umbrella is a cloud security solution; Cisco Stealthwatch is for network security monitoring. Common confusions include swapping Firepower with ISE and Stealthwatch with Firepower.

Answer

Cisco Firepower: Network Access Control

Answer

Cisco Stealthwatch: Next-Generation Firewall