350-701 Network Security Practice Test 2 — 15 Questions

Question 1

Match each encryption algorithm to its type.

Question 2

A network engineer is troubleshooting an IPsec VPN tunnel that fails to establish. The configuration includes a crypto map with a matching access list. Which command should be used to verify the security associations and error counters for the IPsec phase?

Accepted Answer

show crypto ipsec sa. The 'show crypto ipsec sa' command displays the IPsec security associations (SAs) and their associated packet/byte counters, including error counters such as 'pkts encaps failed' and 'pkts decap failed'. This directly verifies the IPsec Phase 2 SAs and identifies failures in encryption/decryption or integrity checks, which is essential for troubleshooting a tunnel that fails to establish.

Answer

show crypto engine statistics

Answer

debug crypto isakmp

Answer

show crypto isakmp sa

Question 3

A company is deploying a new ASA firewall in a DMZ design. They need to allow web traffic from the internet to a web server in the DMZ, while also permitting outbound traffic from the DMZ to the internet for software updates. Which access control approach best meets these requirements with minimal risk?

Accepted Answer

Create an ACL that permits established connections inbound, and allows HTTP/HTTPS from DMZ to internet with application inspection.. Option B is correct because it uses the 'established' keyword to allow return traffic for inbound web connections while explicitly permitting outbound HTTP/HTTPS with application inspection. This minimizes risk by not blindly allowing all outbound traffic, and inspection ensures protocol compliance and stateful tracking.

Answer

Create an ACL that permits all inbound and outbound traffic between DMZ and internet.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and permits all outbound traffic from DMZ with no inspection.

Answer

Create an ACL that permits inbound web traffic to the DMZ server and denies all outbound traffic from DMZ.

Question 4

An engineer is designing a FlexVPN deployment with multiple hub routers and spoke routers. The spokes need to establish tunnels to the closest hub based on latency. Which feature should be configured to achieve dynamic hub selection?

Accepted Answer

Implement IKEv2 redirect mechanism to direct spokes to the optimal hub.. The IKEv2 redirect mechanism allows a hub to inform a spoke of a more optimal hub based on metrics such as latency or load. The spoke then initiates a new IKEv2 connection to the recommended hub, enabling dynamic hub selection without manual configuration. This is the standard Cisco solution for FlexVPN deployments requiring proximity-based tunnel establishment.

Answer

Configure static priority on each hub and use priority-based selection.

Answer

Use Multipoint GRE with mGRE and NHRP for dynamic tunnel selection.

Answer

Use DHCP option 121 to push static routes for hub selection.

Question 5

A security administrator is reviewing firewall logs and notices that an internal user is generating excessive outbound DNS queries to a known malicious domain. The company uses Cisco Umbrella for DNS-layer security. How should the administrator investigate and block this traffic?

Accepted Answer

Check the Cisco Umbrella dashboard for the domain, identify the internal IP, and block the domain via policy.. Option A is correct because Cisco Umbrella is a DNS-layer security solution that can log and block DNS queries to malicious domains. The administrator should first check the Umbrella dashboard to identify the internal IP generating the excessive queries, then create a policy to block the domain, which will prevent all subsequent DNS resolutions to that domain without affecting other traffic.

Answer

Create a firewall ACL to block the IP address of the DNS server from the internal user.

Answer

Disable the user's network access temporarily and inform the IT department.

Answer

Enable full packet capture on the internal network and wait for the next occurrence.

Question 6

A network administrator is configuring IKEv2 on a Cisco router and wants to ensure that the router does not initiate connections but only responds to incoming IKEv2 requests. Which configuration command should be applied?

Accepted Answer

crypto ikev2 passive. The 'crypto ikev2 passive' command configures the router to only respond to incoming IKEv2 requests and never initiate its own IKEv2 connections. This is essential for scenarios where the router must act as a responder only, such as in hub-and-spoke VPN topologies where the hub should not initiate tunnels.

Answer

crypto ikev2 no initiate

Answer

crypto ikev2 limit max-incoming-sa 10

Answer

crypto ikev2 limit max-negotiations 10

Question 7

A Cisco ASA firewall is configured with multiple contexts. The administrator needs to allow traffic from a context to pass through the management context for management purposes. Which type of interface should be used for this inter-context communication?

Accepted Answer

Use a shared interface that is allowed in multiple contexts.. In multiple-context mode on a Cisco ASA, inter-context communication (such as allowing a user context to send management traffic to the management context) is achieved by using a shared interface. A shared interface is assigned to multiple security contexts, enabling them to communicate directly without requiring a physical or virtual crossover cable. This design allows the management context to receive traffic from other contexts for monitoring or administrative purposes while maintaining separation of forwarding tables.

Answer

Configure a virtual interface in each context and bridge them.

Answer

Use a dedicated physical interface for each context and route through the backplane.

Answer

Configure a subinterface on the management interface for each context.

Question 8

A network engineer is trying to establish a site-to-site IPsec VPN between two Cisco routers. The IKEv2 proposal uses AES-256 encryption and SHA-256 hash. On the remote router, the configuration shows only AES-128 and SHA-1. What will happen during IKEv2 negotiation?

Accepted Answer

The IKEv2 negotiation will fail because no common proposal exists.. IKEv2 negotiation requires that both peers have at least one matching proposal (encryption, hash, DH group, etc.) in their configured transform sets. Since the local router offers AES-256/SHA-256 and the remote router only offers AES-128/SHA-1, there is no common proposal. IKEv2 does not perform automatic fallback or mixing of parameters; it simply fails if no match is found.

Answer

The router with stronger proposal will override the other.

Answer

The routers will automatically fall back to IKEv1.

Answer

The routers will negotiate and use AES-128 with SHA-256.

Question 9

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They want to enable URL filtering based on user identity from an Active Directory (AD) source. Which configuration steps are required on the FMC?

Accepted Answer

Configure an identity source (AD), create realm and user groups, then configure URL filtering rules with user conditions.. Option B is correct because to enable URL filtering based on user identity from Active Directory, you must first configure an identity source (AD) on the FMC, then create a realm and import user groups. After that, you can configure URL filtering rules within an access control policy that includes user conditions to match traffic against specific AD users or groups. This sequence ensures the FTD can resolve user identity before applying URL category-based actions.

Answer

Create a URL category and associate it with a user group in the access control policy.

Answer

Create URL filtering rules first, then assign to users via dynamic object.

Answer

Configure identity source and NAT policy, then apply URL filtering.

Question 10

An administrator is configuring a Cisco ASA 5500-X to perform SSL inspection for outbound traffic. The users must be able to access HTTPS websites without certificate errors. Which configuration step is essential for the ASA to perform decryption?

Accepted Answer

Generate a trusted root CA certificate on the ASA and distribute it to all client machines.. Option D is correct because for the ASA to perform SSL inspection (a man-in-the-middle proxy), it must generate a trusted root CA certificate that is installed as a trusted root on all client machines. This allows the ASA to dynamically sign the web server's certificate during the SSL handshake, so clients trust the re-encrypted traffic without certificate errors.

Answer

Configure the ASA to use a self-signed certificate without distribution.

Answer

Import the web server's private key onto the ASA.

Answer

Configure AAA authentication for SSL inspection.

Question 11

Which TWO are best practices for securing Cisco ASA remote access VPN? (Choose two.)

Accepted Answer

Enforce multi-factor authentication (MFA) for VPN users.. Option C is correct because enforcing multi-factor authentication (MFA) for VPN users adds an additional layer of security beyond just a password, significantly reducing the risk of credential theft and unauthorized access. Cisco ASA supports MFA integration with RADIUS servers (e.g., Cisco ISE, Duo Security) that can require a one-time password (OTP) or push notification, aligning with the principle of defense-in-depth for remote access VPNs.

Answer

Disable clientless SSL VPN to force full-tunnel client.

Answer

Use pre-shared keys for user authentication to simplify deployments.

Answer

Use L2TP/IPsec for legacy compatibility.

Question 12

Which TWO are valid considerations for deploying Cisco Firepower NGIPS with inline mode? (Choose two.)

Accepted Answer

Inline interfaces can drop malicious packets based on signatures and anomalies.. Option C is correct because inline mode in Cisco Firepower NGIPS allows the system to actively drop malicious packets based on signature matches and anomaly detection. Unlike passive monitoring, inline interfaces sit directly in the traffic path, enabling the IPS engine to enforce blocking actions in real time.

Answer

Inline mode automatically decrypts SSL traffic without configuration.

Answer

The IPS engine inspects all traffic regardless of prefilter policies.

Answer

Inline mode requires the use of passive interfaces for failover.

Question 13

Which THREE are valid components of an IKEv2 exchange? (Choose three.)

Accepted Answer

IKE_SA_INIT exchange. IKEv2 simplifies the Internet Key Exchange process by using only two exchanges to establish an IPsec security association: the IKE_SA_INIT exchange (for negotiating cryptographic parameters and exchanging Diffie-Hellman public values) and the IKE_AUTH exchange (for authenticating the peers and establishing the first child SA). These are the mandatory exchanges defined in RFC 7296, making options C and D correct. The INFORMATIONAL exchange is also a valid component of IKEv2, used for error reporting and deleting SAs, which is why option E is correct.

Answer

Aggressive Mode exchange

Answer

Main Mode exchange

Question 14

A company has deployed Cisco AnyConnect VPN for remote access. They want to enforce that only company-managed devices with compliant antivirus and disk encryption can connect. Which solution should be added to the ASA?

Accepted Answer

Cisco Identity Services Engine (ISE) with posture assessment. Cisco ISE with posture assessment is the correct solution because it integrates with the ASA to enforce endpoint compliance before granting VPN access. Posture assessment checks for specific conditions such as antivirus status, disk encryption, and OS patch levels, ensuring only company-managed devices that meet security policies can connect via AnyConnect.

Answer

Cisco Firepower Threat Defense (FTD) with intrusion policy

Answer

Cisco Umbrella with DNS filtering

Answer

Cisco Stealthwatch with NetFlow

Question 15

An engineer is troubleshooting a site-to-site IPsec VPN between two Cisco routers. The tunnel is not establishing. Which command would verify that IKE phase 1 negotiations have completed successfully?

Accepted Answer

show crypto isakmp sa. The 'show crypto isakmp sa' command displays the state of IKE (Internet Key Exchange) Phase 1 security associations (SAs). A successful Phase 1 negotiation is indicated by a state of 'MM_ACTIVE' (Main Mode) or 'QM_IDLE' (Aggressive Mode), confirming that the peers have mutually authenticated and established a secure ISAKMP tunnel. This is the direct verification command for Phase 1 completion.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

debug crypto isakmp