350-701 Content Security Practice Test 2 — 15 Questions

Question 1

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transparent user identification using Active Directory agent. Transparent user identification using an Active Directory agent allows Cisco WSA to identify users without client software by querying AD domain controllers for logon events and mapping IP addresses to usernames. This method is transparent because it does not require explicit proxy configuration or client-side agents on end-user machines.

Answer

LDAP bind with user credentials

Answer

Explicit proxy with PAC file

Answer

Kerberos authentication with keytab file

Question 2

An organization wants to use Cisco Umbrella SIG to enforce security policy for remote users. Which deployment method allows Umbrella to inspect traffic for all ports and protocols, not just DNS?

Accepted Answer

Deploying the Umbrella roaming client. Deploying the Umbrella roaming client allows Umbrella to inspect traffic for all ports and protocols, not just DNS, because the roaming client installs a lightweight agent on the endpoint that redirects all internet-bound traffic to Umbrella's SIG (Secure Internet Gateway) for full inspection. This provides layer 3/4 enforcement and supports policies beyond DNS, such as IPsec tunnels or web proxy. It is the recommended method for remote users to get full SIG protection.

Answer

Configuring a PAC file for proxy

Answer

Using IPsec tunnel to Umbrella

Answer

DNS-layer enforcement only

Question 3

A network administrator wants to deploy Cisco WSA as a transparent proxy using WCCP. Which traffic redirection method does WCCP use?

Accepted Answer

WCCP redirects traffic from the router to the WSA. WCCP (Web Cache Communication Protocol) redirects traffic from a router or switch to the Cisco WSA using GRE tunneling or Layer 2 redirection. The correct answer is that WCCP redirects traffic from the router to the WSA, which is the fundamental mechanism. GRE tunneling is the encapsulation method WCCP uses, but the question asks which traffic redirection method WCCP uses, and the answer describes the redirect behavior.

Answer

GRE tunneling

Answer

DNS redirection

Answer

PAC file configuration on clients

Question 4

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

Accepted Answer

Enable DMARC with reject policy. Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Answer

Disable SPF checking

Answer

Increase the SBRS threshold

Answer

Reduce DLP scanning sensitivity

Question 5

A security analyst notices that a user is receiving a high volume of emails from unknown senders with links to malicious sites. The ESA is configured with Cisco TALOS threat intelligence. Which ESA feature should the analyst configure to block these emails based on the reputation of the sender before they reach the user's inbox?

Accepted Answer

IronPort SenderBase reputation. IronPort SenderBase is the reputation service that assigns a reputation score to sending IP addresses and domains based on global traffic patterns, volume, and threat intelligence. Configuring SenderBase reputation filtering on the ESA allows the appliance to reject or throttle messages from senders with poor reputations before they reach the user's inbox. This directly addresses the requirement to block based on sender reputation.

Answer

Anti-malware with AMP for Email

Answer

Outbreak filters

Answer

DLP policies

Question 6

An organization uses Cisco Firepower NGFW to enforce content security policies. The security team wants to block all social media traffic during business hours but allow access during lunch breaks. Additionally, they want to detect and alert on any SSL connections to unknown destinations that might indicate data exfiltration. Which THREE capabilities of the NGFW should be combined to achieve these objectives?

Accepted Answer

URL filtering based on time schedules. Option B (URL filtering based on time schedules) is correct because Firepower's URL filtering policies can be bound to time-range objects, letting the team permit social media categories only during the lunch window and block them during business hours. Option C (Application control) is correct because social media access is best identified and enforced by application-layer signatures (e.g., Facebook, Twitter, TikTok) rather than by IP or port, and these application filters can also be tied to the same schedules. Option D (TLS server identity discovery) is correct because it enables the NGFW to extract the server certificate's subject/SAN and other identity data from SSL/TLS handshakes, allowing detection and alerting on encrypted sessions to unknown or uncategorized destinations that could signal exfiltration. Option A (IPS) is not correct here because IPS inspects traffic for exploit and vulnerability signatures, not for social media policy enforcement or destination-identity-based SSL alerting. Option E (AMP file scanning) is not correct because AMP analyzes files for malware, which does not address time-based social media blocking or detecting SSL connections to unknown destinations.

Answer

Intrusion prevention system (IPS)

Answer

AMP file scanning

Question 7

A company is deploying Cisco Umbrella SIG to protect against malware and phishing. The security team wants to ensure that even if a user clicks on a malicious link in an email, the traffic is inspected and blocked if needed. Which TWO features of Umbrella can be used to provide this protection?

Accepted Answer

Cloud proxy with URL filtering. Option C is correct because Umbrella's cloud proxy with URL filtering inspects the actual HTTP/HTTPS request to a clicked link and can block the destination based on its URL category or reputation, catching malicious links even when the domain itself is not obviously bad. Option D is correct because Umbrella's DNS security layer resolves every domain lookup through Umbrella's global resolvers and blocks requests to domains associated with malware, phishing, or command-and-control, stopping the connection before it is ever established. Together these layers cover both the initial DNS resolution and the subsequent web request, which is exactly the defense-in-depth needed when a user clicks a malicious email link. Option A is not correct here because SSL/TLS decryption is a capability of the Umbrella secure web gateway/proxy rather than a separately selectable feature that provides this protection, and it is not one of the marked answers. Option B is not correct because ThousandEyes agents provide network path visibility and digital experience monitoring, not malware or phishing blocking. Option E is not correct because AMP for mobile devices is an endpoint protection offering, not an Umbrella SIG feature for inspecting and blocking clicked links.

Answer

SSL/TLS decryption on the proxy

Answer

ThousandEyes agents

Answer

AMP for mobile devices

Question 8

A financial institution uses Cisco ESA and wants to protect against spear phishing attacks targeting executives. The security team configures DMARC with a 'reject' policy for the corporate domain. Additionally, they want to ensure that emails from external sources claiming to be from the CEO are flagged and quarantined. Which THREE security measures should be implemented?

Accepted Answer

Impersonation protection (display name spoofing detection). Option B (Impersonation protection / display name spoofing detection) is correct because spear phishing against executives frequently uses a forged display name (e.g., 'CEO John Smith') while the actual SMTP address is external; Cisco ESA's impersonation protection detects this mismatch and can flag or quarantine the message. Option C (Anti-phishing filters with machine learning) is correct because these filters analyze message content, URLs, and behavioral patterns to identify credential-harvesting and targeted phishing emails that evade static signatures, which is essential for executive-focused attacks. Option D (DMARC reject policy) is correct because publishing a DMARC policy of p=reject instructs receiving MTAs to reject mail that fails SPF and DKIM alignment for the corporate domain, preventing direct domain spoofing of the CEO's address. Option A (Outbreak filters) is not correct here because outbreak filters target rapidly spreading virus and malware outbreaks via URL and attachment reputation, not the identity-spoofing and social-engineering tactics of spear phishing. Option E (Anti-spam with SenderBase) is not correct because SenderBase reputation scoring addresses bulk spam and sender IP reputation, which does not reliably detect low-volume, targeted executive impersonation or display-name spoofing.

Answer

Outbreak filters

Answer

Anti-spam with SenderBase

Question 9

A security team wants to block outbound email from their Cisco ESA that contains customer bank account numbers. They need a policy that scans outgoing messages and quarantines any that include a string matching the pattern of a 10-digit account number, while allowing all other business email. Which Cisco ESA feature should they configure to meet this requirement?

Accepted Answer

Data Loss Prevention (DLP) policy with a custom content classifier. Data Loss Prevention on Cisco ESA is purpose-built to identify sensitive data such as bank account numbers using classifiers and to enforce actions like quarantine. A custom content classifier can be created to match the specific pattern, and the DLP policy applies it to outbound mail. Other features either lack pattern-matching capability or do not provide the required quarantine action for this use case.

Answer

Outbreak Filters with a threshold set to quarantine suspicious messages

Answer

Content filter with a regex pattern applied to the message body

Answer

Message filter with a content dictionary using the 'contains' rule

Question 10

A security administrator at a financial services firm is configuring Cisco Umbrella to decrypt and inspect outbound HTTPS traffic from managed roaming laptops. The goal is to detect threats hidden in TLS sessions without installing a root certificate on every endpoint. Which Umbrella capability should the administrator enable to satisfy this requirement?

Accepted Answer

Umbrella TLS inspection with selective decryption using the Umbrella root CA pushed through the Umbrella Roaming Client. The requirement is to inspect encrypted HTTPS traffic without manually installing certificates on each endpoint. Umbrella TLS inspection combined with the Roaming Client's automatic root CA deployment provides centralized decryption and inspection. The other options either inspect only metadata, perform DNS-level blocking, or inspect files without decrypting TLS, none of which deliver the required visibility.

Answer

Umbrella DNS-layer security with DNSCrypt enforcement on all managed endpoints

Answer

Umbrella SIG tunnel with IPsec and SNI-based filtering without certificate deployment

Answer

Umbrella Intelligent Proxy with file inspection of executables downloaded over HTTP

Question 11

An engineer is deploying Cisco Umbrella in an environment that uses a PAC file for web proxy configuration. Users are complaining that some requests bypass the corporate web proxy and go directly to the internet. Which Umbrella component must be configured to ensure that all web traffic is inspected regardless of the PAC file?

Accepted Answer

Umbrella roaming client that intercepts DNS and transparently redirects web traffic to Umbrella. The roaming client is the component that enforces Umbrella inspection on the endpoint itself, intercepting DNS and redirecting web traffic to Umbrella even when a PAC file would bypass the proxy. Because the requirement is to guarantee inspection of all web traffic regardless of PAC file behavior, the endpoint-based enforcement of the roaming client is the only listed mechanism that closes the bypass.

Answer

Umbrella proxy chaining with the corporate proxy configured as the upstream proxy

Answer

Umbrella SIG tunnels (IPsec or DTLS) on the branch edge router

Answer

Cisco WSA in explicit forward proxy mode with the PAC file updated to point to the WSA

Question 12

An administrator is configuring Cisco Umbrella to protect roaming users on laptops and mobile devices. The security team wants to enforce the same web filtering policy for users whether they are on the corporate network or working from a coffee shop. Which Umbrella component should be deployed on the endpoints to redirect DNS queries to Umbrella's global network?

Accepted Answer

Cisco Umbrella Roaming Client. The Umbrella Roaming Client is specifically designed for endpoints that leave the corporate network. It intercepts DNS requests at the OS level and forwards them to Umbrella's resolvers, so the same category-based policies apply in any location. Virtual Appliances and SIG appliances sit at network edges and do not follow the user, while Secure Client with the Umbrella module is a broader agent that requires additional configuration.

Answer

Cisco Umbrella SIG Virtual Appliance

Answer

Cisco Umbrella Virtual Appliance

Answer

Cisco Secure Client with Umbrella module

Question 13

A healthcare provider uses Cisco Email Security Appliance with a single listener for inbound mail. Compliance requires that any message containing protected health information patterns be quarantined and that the sender receive no bounce notification. Which ESA configuration combination accomplishes this?

Accepted Answer

Data Loss Prevention policy with quarantine action and the 'Drop' option for sender notification. ESA DLP policies are designed to detect sensitive content patterns and can apply a quarantine action while suppressing sender notification through the policy's notification setting. A content filter with quarantine still generates notifications, and message filter notify settings do not control sender bounces for DLP matches. Only the DLP policy action provides the combined quarantine and silent handling required by the compliance rule.

Answer

Message filter with 'quarantine' action and 'notify' set to false in the filter rule

Answer

Content filter with quarantine action and a message filter that drops the recipient's notification

Answer

Incoming mail policy with a content filter that adds a disclaimer and delivers the message

Question 14

A security engineer is deploying Cisco Umbrella to protect users from phishing and malware. They want to implement DNS-layer security and also gain visibility into cloud application usage. Which two Umbrella packages or features should they use? (Choose two.)

Accepted Answer

Umbrella SIG Essentials. To achieve DNS-layer security and cloud application visibility, the engineer should use Umbrella DNS Security Essentials for DNS protection and Umbrella SIG Essentials for its CASB capabilities that provide cloud application visibility. Investigate is for threat intelligence, Virtual Appliance is for DNS forwarding, and Roaming Client is an endpoint agent for DNS enforcement, none of which provide the required cloud application visibility.

Answer

Umbrella Investigate

Answer

Umbrella Virtual Appliance

Answer

Umbrella Roaming Client

Question 15

A security administrator is configuring Cisco Email Security Appliance (ESA) to handle inbound email. The organization wants to reject messages that fail DMARC alignment for their own domain, but they still want to allow legitimate third-party senders that are authorized via SPF. Which DMARC policy should the administrator publish in DNS for the domain?

Accepted Answer

p=reject. The requirement is to reject messages that fail DMARC alignment for the organization's domain. A DMARC policy of p=reject tells receivers to reject such messages. Legitimate third-party senders authorized via SPF will pass DMARC if their domain aligns with the From header or if they are included in the SPF record with proper alignment. This policy enforces the desired strict rejection while allowing authorized senders.

Answer

p=reject with sp=none

Answer

p=none

Answer

p=quarantine