350-701 Content Security — 25 Questions

Question 1

A security administrator notices that a significant volume of spam is bypassing the Cisco ESA's anti-spam filters. Upon investigation, they find that the messages have a mid-range SBRS score of 5.0. Which action should the administrator take to improve spam detection?

Accepted Answer

Lower the SBRS threshold to 3.0. The SBRS score ranges from -10 to +10, with negative scores indicating spam. A score of 5.0 is considered likely legitimate. To catch more spam, the administrator should lower the threshold so that messages with scores above a lower value (e.g., 3.0) are treated as spam.

Answer

Change the SBRS score interpretation to positive

Answer

Increase the SBRS threshold to 7.0

Answer

Disable SenderBase reputation checks

Question 2

An organization is deploying Cisco ESA and wants to ensure that outbound emails containing credit card numbers are blocked. The administrator configures a DLP policy to scan for credit card patterns. However, some legitimate emails with credit card numbers are being incorrectly blocked. What is the best approach to reduce false positives while still preventing data leakage?

Accepted Answer

Change the DLP action from 'Block' to 'Confirm with Sender'. Option B is correct because changing the DLP action from 'Block' to 'Confirm with Sender' allows the Cisco ESA to send a notification to the sender when a credit card pattern is detected, asking them to confirm whether the email should be sent. This reduces false positives by giving legitimate senders a chance to override the block, while still preventing accidental data leakage by requiring explicit confirmation. The DLP policy remains active, so unauthorized or unconfirmed outbound emails containing credit card numbers are still stopped.

Answer

Disable the DLP policy for outbound email

Answer

Increase the DLP sensitivity threshold

Answer

Add all senders to a DLP exemption list

Question 3

A Cisco WSA administrator wants to block access to social media sites for all users during work hours. The proxy is deployed in explicit mode. Which policy type should the administrator use to enforce this restriction?

Accepted Answer

Access policy. In explicit proxy mode, the WSA uses access policies to control web traffic based on URL categories. The administrator should create an access policy that identifies social media traffic and sets the action to 'Block'.

Answer

Identity policy

Answer

Routing policy

Answer

Decryption policy

Question 4

Which Cisco content security solution uses DNS to block access to malicious domains and provides cloud-based proxy protection?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that uses DNS to block requests to malicious domains. It also includes a cloud proxy for full URL filtering and threat protection.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Question 5

An organization using Cisco WSA in transparent proxy mode with WCCP redirect notices that some HTTPS traffic is not being decrypted for inspection. The administrator has enabled SSL decryption but certain traffic still bypasses. What is the most likely cause?

Accepted Answer

The SSL decryption policy is not set to decrypt on port 443. In transparent proxy mode, SSL decryption requires that the WSA is positioned in the traffic path (e.g., via WCCP). If decryption is not happening, the WSA may not be intercepting the traffic correctly, often due to the destination port not being included in the decryption policy or the traffic being non-HTTP.

Answer

The clients are not configured to use a proxy

Answer

The web server certificate is self-signed

Answer

The WSA is operating in explicit proxy mode

Question 6

A Cisco ESA administrator is investigating an increase in false positive detections from the outbreak filter. The filter is configured to use TALOS intelligence and has a threshold of 'Medium'. Which action would most effectively reduce false positives while maintaining protection against new outbreaks?

Accepted Answer

Change the threshold to 'High'. The outbreak filter uses TALOS threat intelligence to quarantine suspicious messages. Increasing the threshold to 'High' reduces sensitivity, meaning only messages with strong indicators of maliciousness will be flagged, reducing false positives.

Answer

Change the threshold to 'Low'

Answer

Disable the outbreak filter

Answer

Exempt all internal senders from the filter

Question 7

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy options are: none (monitor), quarantine (send to spam), or reject (block). To reject failing messages, the administrator sets p=reject in the DMARC DNS record.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 8

Which Cisco WSA feature allows administrators to control bandwidth usage per user or group by limiting the amount of bandwidth consumed for specific applications?

Accepted Answer

Bandwidth controls. The WSA includes bandwidth controls that can be applied per user/group and per application category, allowing traffic shaping and rate limiting.

Answer

URL filtering

Answer

AVC (Application Visibility and Control)

Answer

Decryption policies

Question 9

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Accepted Answer

Account takeover (BEC). When an attacker compromises a legitimate email account within the organization and uses it to send malicious emails, it is an account takeover attack, which is a form of Business Email Compromise (BEC). Since the email authenticated correctly, it bypassed email authentication checks.

Answer

Malspam

Answer

Spear phishing

Answer

Whaling

Question 10

An organization is using Cisco Firepower NGFW to enforce content filtering. They want to block social media applications like Facebook and Twitter but allow LinkedIn for business purposes. Which feature should be used to differentiate between these applications?

Accepted Answer

Application control with application filters. Firepower NGFW uses application control to identify and block specific applications. By creating a rule that blocks the 'Social Networking' category but then allows 'LinkedIn' specifically (or blocks Facebook and Twitter by application), the administrator can achieve granular control.

Answer

URL filtering based on categories

Answer

Intrusion policy

Answer

TLS server identity discovery

Question 11

Which Cisco email security feature uses SHA-256 hash lookups to detect known malware in email attachments?

Accepted Answer

AMP for Email. Cisco AMP for Email uses SHA-256 hashing to compare file hashes against a cloud database of known malware. If a match is found, the email is blocked or quarantined.

Answer

Outbreak filters

Answer

Anti-spam

Answer

DLP policies

Question 12

A company is deploying Cisco Secure Web (WSA) and wants to integrate with Active Directory for user-based policies. The proxy is in transparent mode. Which technology allows the WSA to identify users transparently without requiring client configuration?

Accepted Answer

Transparent user identification (TUI). Transparent user identification (TUI) on the WSA uses technologies like NTLM authentication or LDAP to identify users without explicit proxy configuration. It can leverage Active Directory and transparently capture user credentials via HTTP authentication or other means.

Answer

Explicit proxy configuration on browsers

Answer

WCCP redirect

Answer

Kerberos authentication proxy

Question 13

An administrator is configuring Cisco ESA to protect against Business Email Compromise (BEC) attacks. Which TWO of the following features are most effective in detecting and mitigating BEC?

Accepted Answer

Data Loss Prevention (DLP). BEC attacks often involve spoofed or compromised accounts. DMARC helps prevent domain spoofing, and DLP can detect sensitive data being sent to unauthorized recipients. FTL (Forged Email Detection) is also relevant, but DMARC and DLP are standard ESA features for BEC.

Answer

SenderBase reputation

Answer

Outbreak filters

Answer

AMP for Email

Question 14

A Cisco WSA administrator needs to implement HTTPS inspection for traffic from internal users. The administrator wants to avoid decrypting traffic to financial and healthcare sites due to compliance requirements. Which THREE actions should the administrator take to configure this policy?

Accepted Answer

Create a decryption policy with action 'Decrypt' for all traffic. To selectively decrypt, the administrator should create a decryption policy that decrypts all traffic, then use URL category exceptions to bypass decryption for finance and health categories. Alternatively, create a policy that explicitly decrypts all else and uses bypass rules. The three actions: create a decryption policy with action 'Decrypt', add bypass rules for the specified categories, and ensure CA certificate is deployed.

Answer

Configure the proxy in explicit mode

Answer

Enable AMP file scanning for decrypted traffic

Question 15

Which TWO statements about Cisco Umbrella SIG are true?

Accepted Answer

It can enforce URL filtering policies via a cloud proxy. Cisco Umbrella SIG provides cloud-based security including DNS-layer filtering and a cloud proxy. It can enforce URL filtering and blocks threats before connection. It does not require on-premises hardware and can be used with any internet connection.

Answer

It only protects traffic that goes through a VPN

Answer

It requires on-premises hardware for deployment

Answer

It does not provide reporting or analytics

Question 16

To protect against phishing attacks that use fraudulent emails to trick users into revealing credentials, which email authentication technology verifies the sending domain's DNS records for a digital signature?

Accepted Answer

DKIM. DKIM uses a digital signature to verify the email originated from the claimed domain.

Answer

DMARC

Answer

SenderBase

Answer

SPF

Question 17

An organization wants to enforce a policy that blocks outbound emails containing Social Security numbers. Which feature of Cisco ESA should be configured?

Accepted Answer

DLP Policies. DLP policies on Cisco ESA scan outbound email for sensitive data patterns like SSNs.

Answer

Anti-Spam

Answer

AMP for Email

Answer

Outbreak Filters

Question 18

A security engineer is configuring Cisco WSA in explicit proxy mode. Which traffic interception method is being used when each endpoint browser is configured with the proxy address?

Accepted Answer

Explicit proxy. Explicit proxy requires manual browser configuration; transparent proxy uses WCCP or PBR.

Answer

WCCP redirect

Answer

Policy-Based Routing

Answer

Transparent proxy

Question 19

Which Cisco Umbrella feature provides protection against malicious domains by blocking DNS requests to known bad sites?

Accepted Answer

DNS Security. Cisco Umbrella SIG uses DNS security to block requests to malicious domains.

Answer

Cloud Proxy

Answer

Secure Web Gateway

Answer

ThousandEyes

Question 20

An organization wants to implement URL filtering based on user identity. The Cisco WSA must integrate with which directory service to apply policies per user or group?

Accepted Answer

Active Directory. Cisco WSA integrates with Active Directory for identity-based policies.

Answer

RADIUS

Answer

TACACS+

Answer

LDAP