350-701 Network Security — 30 Questions

Question 1

A network engineer is troubleshooting an issue where users on VLAN 10 cannot access the internet, but they can reach internal resources. The firewall is configured with a default route pointing to the ISP router. The engineer notices that NAT is configured but traffic is not being translated. Which configuration is most likely missing?

Accepted Answer

An ACL to match the traffic to be translated. For NAT to translate traffic, the firewall must know which traffic to translate. An ACL is used to match the source IP addresses (or networks) that should be translated. Without an ACL applied to the NAT rule, the firewall has no criteria to identify traffic from VLAN 10 for translation, so packets are forwarded without NAT, causing internet access to fail while internal routing works.

Answer

A NAT pool with available public IP addresses

Answer

Port Address Translation (PAT) configuration

Answer

A route map to apply NAT based on destination

Question 2

A security engineer is implementing Cisco Identity Services Engine (ISE) for 802.1X authentication. The requirement is to allow full network access for corporate devices that pass posture assessment, while providing limited access for guest devices. The engineer configures an authorization policy with conditions based on identity group and posture status. However, guest devices are still getting full access. What is the most likely cause?

Accepted Answer

The authorization rule for corporate devices is placed above the guest rule, and guest devices are matching the corporate rule first. Cisco ISE authorization policies are evaluated in top-down order, and the first matching rule is applied. If the corporate device rule is placed above the guest rule, guest devices that do not meet the posture condition may still match the corporate rule if the condition is not restrictive enough (e.g., if the identity group condition is broad or the posture check is not enforced as a required match). This results in guest devices receiving full access instead of the intended limited access.

Answer

The guest devices are not passing the certificate validation

Answer

MAC Authentication Bypass (MAB) is not enabled for the guest devices

Answer

The RADIUS attributes for dACL are not being sent correctly

Question 3

A company wants to deploy a site-to-site VPN between two branch offices using Cisco IOS routers. The security policy requires that all traffic between the sites must be encrypted and authenticated using strong encryption. The engineer chooses IPsec with IKEv2. Which IPsec transform set configuration provides the strongest encryption and authentication?

Accepted Answer

transform-set ESP-AES256 ESP-SHA256-HMAC. Option B is correct because it specifies AES-256 encryption, which is the strongest symmetric cipher available in IPsec transform sets, combined with ESP-SHA256-HMAC for integrity and authentication. IKEv2 supports these modern algorithms, and this configuration meets the requirement for strong encryption and authentication.

Answer

transform-set ESP-AES128 ESP-SHA-HMAC

Answer

transform-set ESP-DES ESP-MD5-HMAC

Answer

transform-set ESP-3DES ESP-SHA-HMAC

Question 4

An engineer is configuring Cisco Firepower Threat Defense (FTD) with a pre-filter policy to block traffic from known malicious IP addresses before it reaches the access control policy. The pre-filter rules are configured to block traffic from the malicious IPs. However, the engineer notices that some traffic from those IPs is still being allowed. What is the most likely reason?

Accepted Answer

A pre-filter rule with a lower priority (higher number) is matching the traffic first and allowing it. Pre-filter rules are evaluated in order of priority (lower numbers first). If a rule with a higher priority number (lower priority) is configured to allow traffic, it will be matched before a lower-numbered (higher priority) block rule if the allow rule appears earlier in the sequence. This causes the traffic to be permitted before reaching the intended block rule, which is why some malicious IP traffic is still allowed.

Answer

The pre-filter rules are configured with the wrong source interface

Answer

The access control policy is overriding the pre-filter policy

Answer

The default action for the pre-filter policy is set to 'Allow'

Question 5

A network administrator is configuring Cisco ASA with FirePOWER services. The administrator wants to inspect SSL traffic but is concerned about certificate pinning in modern applications. Which action should the administrator take to ensure that SSL inspection does not break applications that use certificate pinning?

Accepted Answer

Create an SSL decryption rule to exclude traffic from applications known to use certificate pinning. Option C is correct because certificate pinning hardcodes the expected certificate or public key within an application. If the ASA decrypts and re-encrypts the traffic using a different certificate (even one signed by a trusted CA), the pinned certificate will not match, causing the application to reject the connection. By creating an SSL decryption rule that excludes traffic from applications known to use certificate pinning, the administrator avoids breaking those applications while still inspecting other SSL traffic.

Answer

Configure SSL inspection to bypass all traffic to avoid any issues

Answer

Install a custom root CA on all clients and configure the ASA to use that CA

Answer

Use a decryption policy that decrypts the traffic but does not re-encrypt

Question 6

An engineer applies the ACL shown in the exhibit to the inbound direction of interface GigabitEthernet0/0. The goal is to block all traffic from host 10.1.1.100 to the 192.168.0.0/16 network. However, traffic from 10.1.1.100 to 192.168.1.1 is still being permitted. What is the most likely reason?

Accepted Answer

The traffic from 10.1.1.100 is entering through a different interface. Option D is correct because ACLs process traffic only on the interface and direction to which they are applied. If the ACL is applied inbound on GigabitEthernet0/0 but the traffic from host 10.1.1.100 to 192.168.1.1 enters through a different interface (e.g., GigabitEthernet0/1), the ACL will never evaluate that traffic, allowing it to pass. This is a fundamental behavior of interface-based ACL filtering in Cisco IOS.

Answer

The deny entry should be placed after the permit entry

Answer

The ACL should be applied outbound instead of inbound

Answer

The ACL is applied to the wrong direction; it should be 'out'

Question 7

Which TWO are valid methods for implementing Network Admission Control (NAC) in a Cisco environment?

Accepted Answer

802.1X authentication. 802.1X authentication is a valid NAC method because it enforces port-based access control by requiring end devices to authenticate via EAP (Extensible Authentication Protocol) before gaining network access. It integrates with a RADIUS server (e.g., Cisco ISE) to validate credentials and dynamically assign VLANs or ACLs based on policy, making it a core NAC technology.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP source guard

Answer

DHCP snooping

Question 8

Which THREE are characteristics of Cisco Stealthwatch?

Accepted Answer

Can integrate with Cisco ISE for automated threat response. Option A is correct because Cisco Stealthwatch can integrate with Cisco ISE (Identity Services Engine) via pxGrid or REST API to enable automated threat response. When Stealthwatch detects anomalous behavior, it can trigger ISE to enforce policy changes such as quarantining an endpoint or dynamically applying a security group access control list (SGACL), closing the loop between detection and remediation.

Answer

Acts as a next-generation firewall

Answer

Functions as an intrusion prevention system (IPS)

Question 9

A multinational company has deployed a Cisco Firepower 4100 series device as the perimeter firewall. The network consists of multiple internal segments: a corporate LAN (192.168.1.0/24), a data center (10.10.0.0/16), and a guest wireless network (172.16.0.0/16). The firewall is configured with the following access control policy rules:

1. Allow from any to any (for testing, but currently enabled)
2. Allow from corporate LAN to data center (destination ports TCP/443, TCP/8443)
3. Block from guest wireless to data center
4. Allow from any to internet (destination any)

Recently, the security team discovered that a host in the guest network (172.16.5.50) is communicating with a server in the data center (10.10.10.100) on TCP port 443. The security team wants to immediately block this traffic without affecting other legitimate communications. Which action should be taken first?

Accepted Answer

Move rule 3 (block guest to data center) above rule 1 (allow all). Rule 1 is an 'allow any any' rule placed above rule 3, which is supposed to block guest-to-data-center traffic. Because Cisco Firepower processes access control rules in top-down order, rule 1 matches and permits the traffic before rule 3 can be evaluated. Moving rule 3 above rule 1 ensures the block action is applied first, immediately stopping the unwanted communication without altering other rules.

Answer

Modify rule 2 to include a deny for the guest subnet

Answer

Change rule 4 to block all traffic from guest network

Answer

Add a new rule after rule 4 to block the specific traffic

Question 10

A security engineer is configuring Cisco TrustSec on a network. Which TWO actions are required to enable TrustSec on a Cisco switch?

Accepted Answer

Define Security Group Tags (SGTs) on the switch using the 'cts role-based sgt' command or via RADIUS.. B is correct because Security Group Tags (SGTs) are the fundamental building blocks of Cisco TrustSec, used to classify traffic and enforce role-based access control. SGTs can be defined locally on the switch using the 'cts role-based sgt' command or dynamically assigned via a RADIUS server (such as Cisco ISE) during authentication. Without SGTs, the switch cannot perform the source-based or destination-based policy enforcement that TrustSec relies on.

Answer

Enable MACsec encryption on all trunk links.

Answer

Deploy Cisco ISE as the only policy server.

Answer

Apply IP access-lists on interfaces to filter traffic based on source IP.

Question 11

Refer to the exhibit. An engineer configured 802.1X on two switch ports. On Gi1/0/1, a VoIP phone and a PC are connected via a hub. On Gi1/0/2, only a single PC is connected. Which port will successfully authenticate both devices, and what is the issue with the other port?

Accepted Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will only authenticate the PC, and any additional device will be denied.. Option D is correct because Gi1/0/1 is configured with the `authentication port-control auto` and `authentication host-mode multi-auth` commands, which allow both the VoIP phone and the PC to authenticate independently. Gi1/0/2 is configured with `authentication host-mode single-host` (the default), which only permits a single authenticated device; any additional device, such as a second PC connected via a hub, will be denied access.

Answer

Both ports will authenticate all connected devices because 802.1X supports multiple hosts by default.

Answer

Gi1/0/2 will authenticate the PC; Gi1/0/1 will fail because multi-auth is not supported on access ports.

Answer

Gi1/0/1 will authenticate both devices; Gi1/0/2 will fail because the tx-period is too long.

Question 12

A large enterprise uses Cisco Firepower Threat Defense (FTD) as its next-generation firewall. The network team recently deployed a new application that uses HTTPS for all communications. Users report that the application is slow and sometimes fails to load pages. The security team suspects that SSL inspection might be causing the issue. The FTD is configured with an SSL policy that decrypts all HTTPS traffic using a self-signed certificate. The internal CA is not trusted by the application servers. Which action should the engineer take to resolve the performance and connectivity issues while maintaining security visibility?

Accepted Answer

Create an SSL decryption bypass rule for the specific application servers' IP addresses.. Option B is correct because the application servers do not trust the FTD's self-signed certificate, causing SSL/TLS handshake failures or performance degradation due to certificate validation errors and renegotiation. By creating an SSL decryption bypass rule for the specific application servers' IP addresses, the engineer exempts that traffic from inspection, resolving connectivity and performance issues while still inspecting other HTTPS traffic for security visibility.

Answer

Increase the SSL decryption resources by adding more FTD modules.

Answer

Install the internal CA certificate on all application servers.

Answer

Disable SSL inspection globally on the FTD.

Question 13

Drag and drop the steps to configure a Cisco IOS router as a Zone-Based Firewall (ZBF) in the correct order.

Question 14

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

Question 15

Match each Cisco ASA feature to its description.

Question 16

Match each encryption algorithm to its type.

Question 17

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Answer

show crypto engine statistics

Answer

debug crypto isakmp

Answer

show crypto isakmp sa

Question 18

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

Accepted Answer

Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.. Option B is correct because it uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.

Answer

Create an ACL that permits all inbound and outbound traffic between DMZ and internet.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.

Question 19

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

Accepted Answer

Implement IKEv2 redirect mechanism to direct spokes to the optimal hub.. The IKEv2 redirect mechanism allows a hub to inform a spoke of a more optimal hub based on metrics such as latency or load. The spoke then initiates a new IKEv2 connection to the recommended hub, enabling dynamic hub selection without manual configuration. This is the standard Cisco solution for FlexVPN deployments requiring proximity-based tunnel establishment.

Answer

Configure static priority on each hub and use priority-based selection.

Answer

Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.

Answer

Use DHCP option 121 to push static routes for hub selection.

Question 20

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Accepted Answer

Check the Cisco Umbrella dashboard for the domain, identify the internal IP, and block the domain via policy.. Option A is correct because Cisco Umbrella is a DNS-layer security solution that can log and block DNS queries to malicious domains. The administrator should first check the Umbrella dashboard to identify the internal IP generating the excessive queries, then create a policy to block the domain, which will prevent all subsequent DNS resolutions to that domain without affecting other traffic.

Answer

Create a firewall ACL to block the IP address of the DNS server from the internal user.

Answer

Disable the user's network access temporarily and inform the IT department.

Answer

Enable full packet capture on the internal network and wait for the next occurrence.