350-701 Multiple Select — 10 Questions

Question 1

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Accepted Answer

DNS query flood. Application layer DDoS attacks target specific applications, such as HTTP floods, Slowloris, and DNS query floods.

Answer

DNS amplification

Answer

SYN flood

Question 2

An organization is adopting a cloud-first strategy and wants to ensure least-privilege access for cloud resources. Which THREE measures should be implemented as part of a cloud IAM strategy? (Select three.)

Accepted Answer

Use managed identities for access. Managed identities (such as Azure Managed Identities or AWS IAM Roles for EC2) eliminate the need to store credentials in code or configuration files. The cloud provider automatically rotates the credentials and binds the identity to the compute resource, enforcing least-privilege by granting only the permissions required for that resource to function.

Answer

Store secrets in source code repositories for ease of deployment

Answer

Enable single sign-on with multi-factor authentication

Question 3

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. 'Never trust, always verify' is the foundational principle of the Cisco Zero Trust security model, which mandates that no user, device, or network segment is trusted by default, regardless of its location relative to the network perimeter. This principle eliminates implicit trust and requires authentication and authorization for every access request, aligning with the Zero Trust architecture defined in NIST SP 800-207.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 4

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 5

Which TWO actions can be configured in a Cisco ESA DLP policy to respond to a violation involving outbound credit card numbers? (Choose two.)

Accepted Answer

Encrypt the message using a secure policy. Cisco ESA DLP policies can automatically encrypt outbound messages containing sensitive data like credit card numbers. This ensures that even if the message is intercepted, the content remains protected, which is a common compliance requirement for PCI DSS.

Answer

Deliver the message with a CC to the compliance team

Answer

Add a disclaimer that the message is confidential

Answer

Bounce the message back to the sender

Question 6

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Accepted Answer

IKE_SA_INIT exchange. IKEv2 simplifies the Internet Key Exchange process by using only two exchanges to establish an IPsec security association: the IKE_SA_INIT exchange (for negotiating cryptographic parameters and exchanging Diffie-Hellman public values) and the IKE_AUTH exchange (for authenticating the peers and establishing the first child SA). These are the mandatory exchanges defined in RFC 7296, making options C and D correct. The INFORMATIONAL exchange is also a valid component of IKEv2, used for error reporting and deleting SAs, which is why option E is correct.

Answer

Aggressive Mode exchange

Answer

Main Mode exchange

Question 7

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Accepted Answer

Allow. In Firepower access control policy, the actions are Trust (skip further inspection), Allow (permit and inspect), Block (block traffic), and Interactive Block (present a block page). These are standard actions.

Answer

Log

Answer

Reset

Answer

Redirect

Question 8

Which THREE are characteristics of Cisco ISE profiler service?

Accepted Answer

It can determine the endpoint operating system based on MAC OUI and DHCP fingerprints. Cisco ISE's profiler service uses the MAC OUI (Organizationally Unique Identifier) to identify the hardware vendor, and DHCP fingerprints (specific option ordering in DHCP requests) to determine the exact operating system or device type. This passive profiling technique allows ISE to classify endpoints without requiring any agent installation.

Answer

It performs posture compliance checking on endpoints

Answer

It requires the installation of an ISE agent on all endpoints

Question 9

Which TWO of the following are valid methods for Cisco ISE to collect endpoint attributes for profiling? (Choose TWO)

Accepted Answer

NetFlow Probe. Cisco ISE can use a NetFlow Probe to collect NetFlow records from network devices, which provide metadata about traffic flows (e.g., IP addresses, ports, protocols) that ISE analyzes to profile endpoints. This passive collection method helps identify endpoint attributes without requiring active agent deployment.

Answer

Syslog

Answer

RADIUS Accounting

Answer

SNMP Polling

Question 10

An organization wants to deploy endpoint hardening measures. Which three of the following are considered endpoint hardening techniques? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting, host-based IPS, and EDR capabilities are all endpoint hardening techniques that protect endpoints by controlling what runs, detecting threats, and enabling response.

Answer

RADIUS authentication

Answer

SNMP polling