350-701 Multiple Select — 30 Questions

Question 1

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. Option A is correct because the AMP for Endpoints connector policy must be configured to point file submissions to the on-premises Threat Grid appliance, which is done by selecting the private Threat Grid appliance as the analysis destination in the policy's file analysis settings. Option C is correct because the on-premises Threat Grid appliance must be registered with the AMP cloud as a private analysis provider, which establishes the trust and routing so the AMP cloud knows to send files to that appliance for analysis. Option B is incorrect because SSL decryption is unrelated to file submission to Threat Grid and is not a required configuration step. Option D is incorrect because the Threat Grid appliance initiates outbound connections to the AMP cloud and does not require inbound internet traffic to function as a private analysis provider. Option E is incorrect because the Threat Grid Connector is not installed on endpoints; integration is handled through the AMP connector policy and cloud registration.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 2

Which THREE of the following are valid methods to deploy Cisco AMP for Endpoints Connector on Windows endpoints?

Accepted Answer

Group Policy Software Installation (MSI). Group Policy Software Installation (MSI) is a valid deployment method for Cisco AMP for Endpoints Connector on Windows endpoints because it allows administrators to distribute the AMP connector MSI package via Active Directory Group Policy Objects (GPOs). This method leverages Windows Installer technology for silent, automated installation across domain-joined machines, ensuring consistent deployment without user interaction.

Answer

Cisco Prime Infrastructure

Answer

Cisco DNA Center

Question 3

Which TWO indicators of compromise (IOCs) can Cisco AMP for Endpoints detect and alert on?

Accepted Answer

Fileless attack techniques (e.g., PowerShell injection). Cisco AMP for Endpoints uses advanced endpoint detection capabilities, including behavioral analysis and machine learning, to detect fileless attack techniques such as PowerShell injection. These techniques do not rely on traditional file-based signatures, but AMP monitors process execution, script activity, and memory patterns to identify malicious behavior in real time.

Answer

Malicious DNS queries

Answer

Phishing email headers

Answer

Anomalous network traffic patterns

Question 4

Which THREE of the following are indicators of compromise (IOCs) that can be detected by Cisco AMP for Endpoints?

Accepted Answer

Suspicious process execution. Cisco AMP for Endpoints uses a combination of signature-based, behavioral, and machine learning analysis to detect threats. Suspicious process execution (B) is a key behavioral IOC, as AMP monitors process trees, spawning patterns, and memory injections to identify malicious activity that may evade signature-based detection.

Answer

Physical access badge ID

Answer

Phishing URL in an email

Question 5

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. EDR (Endpoint Detection and Response) focuses on detecting, investigating, and responding to threats on endpoints, so process isolation (B) is correct because it lets the agent terminate or suspend a malicious process to stop its execution while preserving forensic state. Remote shell investigation (C) is correct because EDR platforms provide remote access to an endpoint's command shell or live-response console so analysts can run commands, inspect memory, and gather artifacts without disrupting the user. File quarantine (E) is correct because EDR can automatically or manually move malicious files to an isolated location, neutralizing the threat while retaining the sample for analysis. Multi-factor authentication (A) is an identity/access control measure, not an endpoint detection-and-response function, and application whitelisting (D) is a preventive application-control technique rather than an EDR detection/investigation/response capability.

Answer

Multi-factor authentication

Answer

Application whitelisting

Question 6

A security administrator is configuring a Cisco CloudLock policy for a SaaS application. The policy must detect and alert on sharing of files containing personally identifiable information (PII) with external users. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a data loss prevention (DLP) rule with a PII pattern.. Option C is correct because Cisco CloudLock DLP policies rely on content-matching rules that identify sensitive data such as PII using predefined or custom regex/pattern definitions, which is the detection mechanism required before any alerting can occur. Option D is correct because the scenario specifically requires detecting and alerting on external sharing of PII files, so a policy must be configured with the external-sharing trigger and an alert action tied to the PII DLP rule. Option A is incorrect because the requirement is to detect and alert, not to automatically block, and blocking all external PII sharing exceeds the stated scope. Option B is incorrect because disabling external sharing application-wide is a blunt control that prevents legitimate collaboration and does not provide the required detection and alerting. Option E is incorrect because a transparent proxy inspects network traffic and is not the mechanism used to enforce CloudLock SaaS API-based DLP policies on files shared within a cloud application.

Answer

Configure a policy to automatically block all external sharing of files containing PII.

Answer

Disable external sharing for the entire SaaS application.

Answer

Enable transparent proxy to inspect all traffic.

Question 7

A security team is investigating a breach where the attacker gained access to a server using stolen credentials. Later, the attacker moved laterally and exfiltrated data. Which three security controls would best help detect and prevent lateral movement? (Choose three.)

Accepted Answer

Microsegmentation. Microsegmentation (A) is correct because it enforces granular, identity- and workload-based policies between internal segments, so stolen credentials alone cannot freely reach other servers and lateral movement paths are blocked or alerted. Network behavioral analytics such as Stealthwatch (D) is correct because it baselines normal east-west traffic and uses flow telemetry to detect anomalous internal connections, beaconing, and unusual data transfers indicative of lateral movement and exfiltration. Endpoint detection and response (EDR) (E) is correct because it monitors process, credential, and command activity on hosts, detecting techniques like pass-the-hash, remote service creation, and suspicious lateral tooling, and can isolate the endpoint. A stateful firewall at the perimeter (B) only inspects traffic crossing the network edge and does not see or stop internal east-west lateral movement. SSL inspection (C) decrypts TLS traffic for content inspection but by itself neither segments the internal network nor correlates host/network behavior to detect lateral movement.

Answer

Stateful firewall at perimeter

Answer

SSL inspection

Question 8

Which THREE actions should a security engineer take when configuring a Cisco AMP for Endpoints policy to minimize false positives while maintaining strong protection?

Accepted Answer

Configure custom whitelist exclusions for trusted applications. Option A is correct because creating custom whitelist exclusions for trusted applications prevents legitimate business software from being quarantined or blocked, directly reducing false positives while still allowing AMP for Endpoints to enforce its policies on unknown or untrusted files. Option B is correct because group-based policies let the engineer tailor detection and blocking rules to specific endpoint populations (for example, developers versus standard users), so aggressive settings are not applied where they would generate unnecessary false positives. Option D is correct because setting file reputation to block only files with a 'Malicious' disposition avoids blocking files with 'Unknown' or 'Clean' verdicts, which are common sources of false positives, while still stopping confirmed threats. Option C is not correct because enabling all exploit prevention rules regardless of environment ignores the need to tune protections to the actual software and workloads in use, which increases false positives. Option E is not correct because disabling file reputation removes a core AMP for Endpoints protection layer and its cloud lookups, weakening detection rather than minimizing false positives while maintaining strong protection.

Answer

Enable all exploit prevention rules regardless of environment

Answer

Disable file reputation to reduce cloud queries

Question 9

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Accepted Answer

Install a trusted root CA certificate on all client devices. Option A is correct because HTTPS decryption on the Cisco WSA requires the WSA's certificate authority to be trusted by clients; otherwise browsers will show certificate warnings and the decrypted traffic will be rejected, so the WSA root CA (or a subordinate CA) must be installed in each client's trusted root store. Option B is correct because the administrator explicitly wants to decrypt HTTPS traffic for the social media and streaming video categories; this is done by enabling HTTPS/SSL decryption in the WSA's decryption policy and applying it to those URL categories. Option C is correct because blocking access to social media and streaming video is accomplished through URL filtering by selecting the 'Social Networking' and 'Streaming Media' categories in an access policy and setting the action to Block. Option D is not required because AMP file scanning is a malware/file reputation feature and does not enforce acceptable use or category-based blocking. Option E is not required because WCCP is only one possible method of redirecting client traffic to the WSA (typically on a router or Layer 4 switch); it is a deployment/redirection choice, not a required configuration step for filtering and decrypting these categories.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 10

A company wants to implement Zero Trust principles in their cloud environment. Which THREE of the following are key Zero Trust tenets?

Accepted Answer

Assume breach (minimize blast radius). Option A (Assume breach, minimize blast radius) is a core Zero Trust tenet because it directs architects to segment networks, limit lateral movement, and contain incidents under the assumption that attackers are already inside. Option C (Use least privilege access) is correct because Zero Trust requires just-in-time and just-enough-access (JIT/JEA) so identities receive only the minimum permissions needed, reducing the attack surface. Option D (Verify explicitly) is correct because Zero Trust demands continuous authentication and authorization of every request using all available signals (identity, device health, location, data sensitivity) rather than trusting based on network location. Option B (MFA everywhere) is a valuable identity control that supports Zero Trust but is an implementation mechanism, not one of the three foundational tenets themselves. Option E (Assume the perimeter is secure) directly contradicts Zero Trust, which rejects the castle-and-moat model and assumes no implicit trust from network location.

Answer

Implement multifactor authentication (MFA) everywhere

Answer

Assume that the perimeter is secure

Question 11

An organization is experiencing a DDoS attack that floods the network with large volumes of traffic, overwhelming bandwidth. Which three types of DDoS attacks are primarily volumetric? (Choose three.)

Accepted Answer

UDP flood. UDP flood (A) is volumetric because it blasts the target with massive numbers of User Datagram Protocol packets, consuming bandwidth and processing resources without needing a handshake. DNS amplification (B) is volumetric because small spoofed DNS queries trigger large responses from open resolvers, multiplying traffic volume and saturating the victim's link. ICMP flood (D) is volumetric because it sends enormous volumes of ICMP Echo Request packets (e.g., ping floods) that fill the bandwidth pipe. HTTP GET flood (C) is an application-layer (Layer 7) attack that exhausts web server resources with seemingly legitimate requests rather than raw bandwidth. SYN flood (E) is a protocol/state-exhaustion attack that depletes TCP connection tables via half-open connections, not primarily a volumetric bandwidth flood.

Answer

HTTP GET flood

Answer

SYN flood

Question 12

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. The Modular Policy Framework on a Cisco ASA is built from three core building blocks: class-map, policy-map, and service-policy. Option C (Class-map) is correct because it defines the traffic classification criteria (for example, matching an ACL, a TCP/UDP port, or an inspection default class) that identifies which traffic the MPF will act upon. Option E (Policy-map) is correct because it binds actions to those classes, such as inspect, police, priority, or set connection parameters, thereby defining what happens to the matched traffic. Option A (Service-policy) is correct because it activates the policy-map by attaching it to an interface and direction (global, interface, or a specific direction), which is what actually enforces the MPF configuration on the ASA. Option B (Route-map) is not part of MPF; it is used for route redistribution and policy-based routing on routers, not for ASA traffic inspection. Option D (Access-list) is also not an MPF component by itself; although ACLs can be referenced inside a class-map to match traffic, the ACL is a separate matching tool and not one of the three MPF building blocks.

Answer

Route-map

Answer

Access-list

Question 13

A security administrator is implementing a zero-trust architecture. Which two principles are core to the zero-trust model? (Choose two.)

Accepted Answer

Never trust, always verify. Option C, 'Never trust, always verify,' is a foundational zero-trust principle because zero-trust treats every access request as untrusted regardless of source, requiring continuous authentication and authorization of users, devices, and sessions before granting access to resources. Option E, 'Least privilege access,' is also core to zero-trust because it enforces just-enough-access (JEA) and just-in-time (JIT) permissions so identities receive only the minimum rights needed, limiting lateral movement and blast radius if credentials are compromised. The unmarked options do not belong: A, 'Single perimeter defense,' reflects the traditional castle-and-moat model that zero-trust explicitly replaces with microsegmentation and identity-centric controls; B, 'Implicit trust for internal networks,' is the opposite of zero-trust, which assumes no implicit trust based on network location; and D, 'Trust but verify,' is a legacy governance phrase, not a zero-trust principle, since zero-trust starts from 'never trust' rather than granting trust first.

Answer

Single perimeter defense

Answer

Implicit trust for internal networks

Answer

Trust but verify

Question 14

A company is using Azure and wants to enforce security compliance across their cloud resources. Which TWO services are part of CSPM (Cloud Security Posture Management) in Azure? (Choose two.)

Accepted Answer

Azure Security Center (Defender for Cloud). Azure Security Center, now known as Microsoft Defender for Cloud, is correct (A) because it is Microsoft's core CSPM solution that continuously assesses Azure resources against security benchmarks like the Microsoft Cloud Security Benchmark, surfaces secure score, and provides recommendations to remediate misconfigurations. Azure Policy is also correct (B) because it enforces organizational standards and compliance by evaluating resources against built-in or custom policy definitions and applying deny, audit, or deployIfNotExists effects, which is a foundational CSPM control mechanism. Microsoft Entra ID (C) is an identity and access management service, not a posture management tool, so it does not belong. Azure Monitor (D) is a telemetry and observability platform for metrics, logs, and alerts rather than a compliance posture service. Azure WAF (E) is a web application firewall that protects HTTP/S traffic from exploits like SQL injection and XSS, which is workload protection, not CSPM.

Answer

Azure Active Directory

Answer

Azure Monitor

Answer

Azure WAF

Question 15

A company is deploying Cisco Secure Endpoint and wants to ensure that endpoints are protected against zero-day exploits. Which two features should be enabled to provide this protection? (Choose two.)

Accepted Answer

Exploit Prevention. Exploit Prevention (B) is correct because it uses techniques such as heap spraying protection, stack canary enforcement, and behavioral monitoring to block memory-corruption and other exploitation attempts that target unpatched or unknown vulnerabilities, which is exactly what zero-day attacks leverage. Malware Analytics with sandboxing (C) is correct because it detonates suspicious files in an isolated cloud or on-premises sandbox and uses retrospective verdicts and continuous file analysis to detect never-before-seen malicious behavior, catching zero-day malware that signature-based methods miss. File Reputation (A) is not correct here because it relies on known file hashes and cloud lookups, so it cannot identify a brand-new zero-day binary with no prior reputation record. Application Control (D) is not correct because it enforces allow/block lists of known applications rather than detecting exploitation of unknown vulnerabilities. Device Control (E) is not correct because it governs peripheral usage such as USB mass storage, not zero-day exploit or malware detection.

Answer

File Reputation

Answer

Application Control

Answer

Device Control

Question 16

An organization wants to implement Privileged Access Management (PAM) using Cisco SecureX and CyberArk. Which THREE capabilities are typically associated with PAM solutions? (Choose three.)

Accepted Answer

Password vaulting. Password vaulting (B) is a core PAM capability because it securely stores privileged credentials in an encrypted repository, enforcing policies for checkout, rotation, and access control. CyberArk's Vault, for example, uses AES-256 encryption and integrates with Cisco SecureX to provide centralized credential management, ensuring that passwords are never exposed in plaintext.

Answer

Endpoint isolation

Answer

File quarantine

Question 17

A company is designing a network segmentation strategy using firewalls. Which THREE considerations are important for a defense-in-depth approach?

Accepted Answer

Use a DMZ to host public-facing services.. Option A is correct because a DMZ (demilitarized zone) isolates public-facing services such as web, mail, and DNS servers from the internal network, so a compromise of an exposed host does not grant direct access to internal resources. Option C is correct because strict inbound ACLs on firewalls enforce least privilege by permitting only required ports, protocols, and source addresses into critical zones, reducing the attack surface. Option E is correct because internal segmentation (for example, separating user, server, and management VLANs with inter-zone firewall rules) limits lateral movement and contains threats if a host is compromised. Option B is not appropriate because allowing all outbound traffic enables data exfiltration, command-and-control callbacks, and malware propagation, violating least-privilege egress filtering. Option D is not appropriate because placing all servers in one flat segment removes internal boundaries, allowing a single compromised server to reach every other server and undermining defense in depth.

Answer

Allow all outbound traffic from internal users.

Answer

Place all servers in the same segment for easier management.

Question 18

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Accepted Answer

Trust action bypasses all further inspection modules.. Option A is correct because the Trust action in a Cisco FTD access control policy terminates policy evaluation for that connection and bypasses all subsequent inspection, including SSL, IPS, and file/malware inspection, effectively allowing the traffic without further deep inspection. Option B is correct because the Interactive Block action permits the user to proceed after being presented with a customizable block page (a user-response page), unlike the Block action which silently drops the traffic. Option C is incorrect because the default action when no rule matches is Block (or Block with reset), not Allow. Option D is incorrect because the Block action drops the traffic and logs it, it does not allow it to pass. Option E is incorrect because the Allow action permits the traffic and subjects it to all configured inspection modules (IPS, URL filtering, malware, etc.), not URL filtering alone.

Answer

Allow action is the default action if no rule matches.

Answer

Block action logs the traffic and allows it to pass.

Answer

Allow action applies only URL filtering but not IPS.

Question 19

A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)

Accepted Answer

Certificate Authority (CA). Option A, Certificate Authority (CA), is essential because the CA is the trusted entity that issues, signs, and manages digital certificates, binding public keys to identities and forming the root of trust in any PKI. Option C, a Certificate revocation list (CRL) or OCSP responder, is also essential because PKI must provide a way to check and revoke certificates that are no longer valid, such as after key compromise or employee departure; CRLs are published lists and OCSP responders provide real-time status. Option B, the private key of the end user, is not a PKI component itself but a key held by the subscriber; PKI manages certificates and keys, but the end user's private key is not an infrastructure component. Option D, a hashing function, is used within certificate signatures and integrity checks but is a cryptographic primitive, not a defining PKI component. Option E, a symmetric encryption algorithm, is not required for PKI, which is based on asymmetric cryptography and digital certificates.

Answer

Private key of the end user

Answer

Hashing function

Answer

Symmetric encryption algorithm

Question 20

An organization is implementing a zero trust architecture. Which two principles are foundational to this model? (Choose two.)

Accepted Answer

Never trust, always verify. Option B, 'Never trust, always verify,' is foundational to zero trust because it requires every access request to be authenticated and authorized based on identity, device posture, and context regardless of network location, eliminating implicit trust. Option E, 'Least privilege access,' is also foundational because zero trust enforces just-enough-access (JEA) and just-in-time (JIT) permissions, granting users and workloads only the minimum rights needed for a specific task to limit lateral movement. Option A is incorrect because single factor authentication relies on only one credential and does not provide the continuous, strong verification zero trust requires. Option C is incorrect because implicit trust for internal networks is the traditional perimeter model that zero trust explicitly rejects. Option D is incorrect because 'trust but verify' still starts from a position of trust, whereas zero trust starts from no trust and verifies every request.

Answer

Single factor authentication

Answer

Implicit trust for internal networks

Answer

Trust but verify