350-701 Content Security Practice Test 3 — 15 Questions

Question 1

A network security engineer is configuring Cisco Umbrella to block access to newly registered domains that are less than 24 hours old, as these are often used in phishing campaigns. The engineer wants to enforce this policy for all users without affecting other categories. Which Umbrella feature should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Newly Registered Domains (NRD) category in Umbrella policies. Cisco Umbrella provides a dedicated security category for Newly Registered Domains (NRD) that specifically targets domains registered within the last 24 hours. Enabling this category in a policy effectively blocks access to these high-risk domains while leaving other categories untouched. This is the most precise and automated method to meet the requirement.

Answer

DNS Query Blocking with a custom domain list

Answer

Content Category Blocking

Answer

Security Category Blocking with 'Newly Seen Domains'

Question 2

An organization has deployed Cisco Secure Web Appliance (formerly WSA) in explicit proxy mode. Users must authenticate before accessing the internet, and the security team wants to apply different policies based on user identity. Which authentication method should be configured to meet these requirements?

Accepted Answer

Kerberos authentication with Active Directory. Kerberos authentication with Active Directory is the recommended method for Cisco Secure Web Appliance in explicit proxy mode when identity-based policies are required. It provides seamless single sign-on, authenticates users against AD, and allows group-based policy application. This satisfies the need to authenticate users before granting internet access and to differentiate policies by user identity without repeated credential prompts, which is essential for a smooth user experience and effective security enforcement.

Answer

SAML authentication with an identity provider

Answer

RADIUS authentication with a central server

Answer

LDAP authentication with a bind account

Question 3

A network security administrator is deploying Cisco Secure Web Appliance (WSA) in explicit proxy mode. Users' browsers are configured to send web requests to the WSA. The administrator wants to authenticate users transparently against Active Directory without prompting for credentials. Which authentication method should be configured on the WSA to achieve this?

Accepted Answer

Kerberos authentication. Kerberos authentication enables the WSA to accept tickets from domain-joined clients, allowing transparent user identification in explicit proxy mode. Browsers configured for integrated Windows authentication automatically present the Kerberos ticket, so users are not prompted. This integrates directly with Active Directory and is the recommended method for seamless authentication.

Answer

SAML 2.0 authentication

Answer

LDAP authentication

Answer

NTLM authentication

Question 4

A company uses Cisco Umbrella to protect roaming users. The security team wants to block access to newly registered domains and dynamic DNS domains because these are commonly used in malware campaigns. Which Umbrella security category should be enabled to block these domains before a connection is established?

Accepted Answer

Newly Seen Domains. The Newly Seen Domains category in Umbrella is designed to block domains that have recently appeared, which is the behavior that covers both newly registered domains and many dynamic DNS domains used in malware campaigns. Because blocking happens at DNS resolution, the connection is never established. The other categories target known command-and-control infrastructure, general suspicious domains, or only dynamic DNS, so they do not fully address the requirement.

Answer

Potentially Harmful Domains

Answer

Dynamic DNS

Answer

Command and Control Callback

Question 5

A security engineer is deploying Cisco Web Security Appliance (WSA) in explicit forward proxy mode. The engineer needs to ensure that HTTPS traffic is inspected and that users are authenticated transparently without prompting for credentials. Which two components must be configured to meet these requirements? (Choose two.)

Accepted Answer

Configure the WSA to use LDAP authentication with single sign-on (SSO).. To inspect HTTPS traffic, the WSA must decrypt SSL/TLS, which requires enabling HTTPS Proxy and installing a trusted root certificate on client browsers. For transparent authentication without prompting, LDAP authentication with SSO allows the WSA to identify users based on their domain login. Together, these components enable HTTPS inspection and transparent user authentication in explicit forward proxy mode.

Answer

Deploy a Cisco Umbrella Virtual Appliance for DNS security.

Answer

Configure the WSA as a transparent proxy using WCCP.

Answer

Enable Cisco Advanced Malware Protection (AMP) for endpoints on the WSA.

Question 6

An organization uses Cisco Umbrella as its DNS-layer security solution. The security team wants to block access to domains that are known to host command-and-control (C2) servers, but they also need to allow a specific domain that is categorized as C2 for a critical business application. How can they achieve this while still blocking other C2 domains?

Accepted Answer

Create a custom allow list entry for the specific domain in the Umbrella policy.. The most effective way to allow a single domain that is categorized as C2 while continuing to block other C2 domains is to add that domain to the Umbrella allow list. Allow list entries override category-based blocks, providing a precise exception. Disabling the category or using other methods would either allow too much or require excessive manual effort.

Answer

Disable the C2 category block and rely on another security layer for C2 protection.

Answer

Set the C2 category to 'monitor only' and create a custom block for all other domains.

Answer

Configure a destination list with the specific domain and set the action to allow.

Question 7

A security administrator notices that a significant volume of spam is bypassing the Cisco ESA's anti-spam filters. Upon investigation, they find that the messages have a mid-range SBRS score of 5.0. Which action should the administrator take to improve spam detection?

Accepted Answer

Increase the SBRS threshold to 7.0. The SenderBase Reputation Score (SBRS) ranges from -10 to +10, with lower scores indicating a higher likelihood of spam and higher scores indicating more legitimate senders. The SBRS threshold is the score below which messages are classified as spam. By default, the threshold may be set low (e.g., 3.0), allowing messages with a mid-range score of 5.0 (which is relatively legitimate) to bypass filters. To catch these messages, the administrator should raise the threshold (e.g., to 7.0), so that messages with scores below 7.0 are considered spam, thus including the 5.0 messages. Option A would reverse score interpretation, causing confusion; Option B would lower the threshold, reducing spam detection because fewer messages would be below the threshold; Option D disables the feature entirely.

Answer

Change the SBRS score interpretation to positive

Answer

Lower the SBRS threshold to 3.0

Answer

Disable SenderBase reputation checks

Question 8

A Cisco WSA administrator wants to block access to social media sites for all users during work hours. The proxy is deployed in explicit mode. Which policy type should the administrator use to enforce this restriction?

Accepted Answer

Access policy. An Access Policy in Cisco WSA defines which users/groups can access which categories or URLs, and what action (allow, block, monitor) applies. Blocking social media during work hours is a classic access policy use case, often combined with a time-range condition.

Answer

Identity policy

Answer

Routing policy

Answer

Decryption policy

Question 9

Which Cisco content security solution uses DNS to block access to malicious domains and provides cloud-based proxy protection?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that uses DNS to block requests to malicious domains. It also includes a cloud proxy for full URL filtering and threat protection.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Question 10

A company is implementing DMARC for its domain. The administrator wants to instruct receivers to reject emails that fail SPF or DKIM checks. Which DMARC policy should the administrator set?

Accepted Answer

p=reject. DMARC policy values are p=none (monitor only), p=quarantine (treat failing mail as suspicious, typically spam/junk), and p=reject (instruct receivers to reject outright). Since the administrator wants receivers to reject messages that fail SPF or DKIM alignment, p=reject is the correct policy. This is the strictest DMARC enforcement level and provides the strongest protection against spoofing.

Answer

p=quarantine

Answer

p=none

Answer

p=deny

Question 11

Which Cisco WSA feature allows administrators to control bandwidth usage per user or group by limiting the amount of bandwidth consumed for specific applications?

Accepted Answer

Bandwidth controls. Cisco WSA's Bandwidth controls feature lets administrators define policies that limit bandwidth consumption per user or group, including for specific applications or categories. This directly matches the requirement to control bandwidth usage by limiting consumption for specific applications.

Answer

URL filtering

Answer

AVC (Application Visibility and Control)

Answer

Decryption policies

Question 12

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Accepted Answer

Account takeover (BEC). This scenario describes a Business Email Compromise (BEC) attack via account takeover: the email originated from a compromised internal account, so it passed SPF, DKIM, and DMARC because it was sent from a legitimate domain and server. The attacker used the compromised account to send phishing emails. Malspam is generic spam with malware, spear phishing targets specific individuals but may not involve a compromised account, and whaling targets executives. The key differentiator is the compromised internal account, which is classic BEC/account takeover.

Answer

Malspam

Answer

Spear phishing

Answer

Whaling

Question 13

An organization is using Cisco Firepower NGFW to enforce content filtering. They want to block social media applications like Facebook and Twitter but allow LinkedIn for business purposes. Which feature should be used to differentiate between these applications?

Accepted Answer

Application control with application filters. Cisco Firepower NGFW's Application Control with application filters allows granular identification and control of applications based on characteristics such as category, risk, business relevance, and tags. Facebook and Twitter can be blocked while LinkedIn is allowed by creating application filters that match social networking applications but exclude LinkedIn, or by explicitly allowing LinkedIn and blocking the others. This provides the differentiation required.

Answer

URL filtering based on categories

Answer

Intrusion policy

Answer

TLS server identity discovery

Question 14

Which Cisco email security feature uses SHA-256 hash lookups to detect known malware in email attachments?

Accepted Answer

AMP for Email. AMP for Email is correct because Cisco Advanced Malware Protection (AMP) for Email uses SHA-256 hash lookups to compare attachment hashes against a cloud-based threat intelligence database, detecting known malware without needing to scan the full file. This hash-based detection is a core feature of AMP's file reputation service.

Answer

Outbreak filters

Answer

Anti-spam

Answer

DLP policies

Question 15

Which TWO statements about Cisco Umbrella SIG are true?

Accepted Answer

It can enforce URL filtering policies via a cloud proxy. Option B is correct because Cisco Umbrella SIG (Secure Internet Gateway) includes a cloud-delivered secure web gateway that can enforce URL filtering policies through its cloud proxy, inspecting and allowing or blocking web requests based on policy. Option C is correct because Umbrella's foundational capability is a recursive DNS resolver that blocks requests to malicious or unwanted domains at the DNS layer before a connection is established. Option A is wrong because Umbrella protects traffic regardless of VPN, including direct internet-bound traffic from any location. Option D is wrong because Umbrella is a cloud-native service requiring no on-premises hardware. Option E is wrong because Umbrella provides extensive reporting and analytics through its dashboard.

Answer

It only protects traffic that goes through a VPN

Answer

It requires on-premises hardware for deployment

Answer

It does not provide reporting or analytics