350-701 Content Security Practice Test 2 — 15 Questions

Question 1

To protect against phishing attacks that use fraudulent emails to trick users into revealing credentials, which email authentication technology verifies the sending domain's DNS records for a digital signature?

Accepted Answer

DKIM. DKIM uses a digital signature to verify the email originated from the claimed domain.

Answer

DMARC

Answer

SenderBase

Answer

SPF

Question 2

An organization wants to enforce a policy that blocks outbound emails containing Social Security numbers. Which feature of Cisco ESA should be configured?

Accepted Answer

DLP Policies. DLP policies on Cisco ESA scan outbound email for sensitive data patterns like SSNs.

Answer

Anti-Spam

Answer

AMP for Email

Answer

Outbreak Filters

Question 3

A security engineer is configuring Cisco WSA in explicit proxy mode. Which traffic interception method is being used when each endpoint browser is configured with the proxy address?

Accepted Answer

Explicit proxy. Explicit proxy requires manual browser configuration; transparent proxy uses WCCP or PBR.

Answer

WCCP redirect

Answer

Policy-Based Routing

Answer

Transparent proxy

Question 4

Which Cisco Umbrella feature provides protection against malicious domains by blocking DNS requests to known bad sites?

Accepted Answer

DNS Security. Cisco Umbrella SIG uses DNS security to block requests to malicious domains.

Answer

Cloud Proxy

Answer

Secure Web Gateway

Answer

ThousandEyes

Question 5

An organization wants to implement URL filtering based on user identity. The Cisco WSA must integrate with which directory service to apply policies per user or group?

Accepted Answer

Active Directory. Cisco WSA integrates with Active Directory for identity-based policies.

Answer

RADIUS

Answer

TACACS+

Answer

LDAP

Question 6

Which Cisco technology uses SHA-256 file hashes to determine if a file is malicious by querying a cloud database?

Accepted Answer

AMP for Email. AMP for Email uses SHA-256 cloud lookup to compare file hashes against known threats.

Answer

DLP Policies

Answer

Outbreak Filters

Answer

SenderBase Reputation

Question 7

A security engineer is troubleshooting an issue where users can bypass the Cisco WSA by using HTTPS. What must be enabled on the WSA to inspect encrypted traffic?

Accepted Answer

HTTPS Inspection. SSL/TLS decryption (HTTPS inspection) is required to decrypt and inspect encrypted web traffic.

Answer

AVC

Answer

URL Filtering

Answer

Bandwidth Controls

Question 8

Which Cisco NGFW technology can be used to block social media categories such as Facebook and Twitter during business hours?

Accepted Answer

URL Filtering. Firepower URL filtering allows blocking by category, including social media.

Answer

TLS Server Identity Discovery

Answer

Intrusion Prevention

Answer

Application Control

Question 9

What is the correct order of email authentication checks recommended by Cisco?

Accepted Answer

SPF, DKIM, DMARC. The recommended order is SPF, then DKIM, then DMARC policy.

Answer

SPF, DMARC, DKIM

Answer

DMARC, SPF, DKIM

Answer

DKIM, SPF, DMARC

Question 10

A company receives a spear-phishing email that appears to come from the CEO requesting an urgent wire transfer. What type of email attack is this?

Accepted Answer

Whaling. Whaling targets senior executives with personalized attacks.

Answer

Phishing

Answer

Spear Phishing

Answer

Malspam

Question 11

In Cisco ESA, which feature uses TALOS intelligence to provide real-time protection against newly identified email threats before signature updates are available?

Accepted Answer

Outbreak Filters. Outbreak Filters leverage TALOS to detect emerging threats in near real-time.

Answer

DLP Policies

Answer

Anti-Spam

Answer

AMP for Email

Question 12

What is the primary purpose of DMARC in email authentication?

Accepted Answer

To specify a policy for failed authentication. DMARC tells receiving servers how to handle emails that fail SPF or DKIM checks.

Answer

To add a digital signature

Answer

To encrypt email content

Answer

To verify the sending IP address

Question 13

A Cisco WSA administrator wants to apply different web usage policies based on user group membership. Which two methods can be used to identify users transparently? (Choose two.)

Accepted Answer

Active Directory integration. Transparent identification can use Active Directory or NTLM authentication without explicit proxy config.

Answer

Explicit proxy configuration

Answer

LDAP bind

Answer

WCCP redirect

Question 14

A SOC analyst is investigating a BEC attack. Which three indicators should be examined in the email headers to detect the spoofing? (Choose three.)

Accepted Answer

DKIM result. SPF, DKIM, and DMARC results indicate authentication status and potential spoofing.

Answer

Subject line

Answer

Message body content

Question 15

An organization wants to block access to malicious websites using Cisco Umbrella. Which two protection layers are available with the Umbrella SIG? (Choose two.)

Accepted Answer

Cloud proxy. Umbrella SIG includes DNS security and cloud proxy for web traffic filtering.

Answer

IPS/IDS

Answer

VPN termination

Answer

Email sandboxing