350-701 Content Security Practice Test 3 — 15 Questions

Question 1

An organization wants to prevent users from accessing known malicious websites. Which Cisco WSA feature should be configured to block access based on website reputation?

Accepted Answer

URL Filtering. Cisco WSA uses Cisco Talos web reputation scores to block access to malicious websites based on their reputation.

Answer

SSL/TLS Decryption

Answer

AMP File Scanning

Answer

AVC (Application Visibility and Control)

Question 2

A security administrator receives an alert that an email with an attachment was blocked by the Cisco Email Security Appliance (ESA). The attachment was identified as malware using cloud lookup. Which technology was used to detect the threat?

Accepted Answer

AMP for Email with SHA-256 cloud lookup. Cisco ESA uses Advanced Malware Protection (AMP) for Email, which performs SHA-256 cloud lookups to detect known malware.

Answer

IronPort SenderBase Reputation Score (SBRS)

Answer

Outbreak Filters

Answer

Data Loss Prevention (DLP) policies

Question 3

An organization is implementing email authentication to prevent domain spoofing. They have deployed SPF and DKIM. Which additional record should they publish to instruct receiving mail servers on how to handle emails that fail SPF or DKIM checks?

Accepted Answer

DMARC TXT record. DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers how to handle emails that fail SPF/DKIM (e.g., reject or quarantine).

Answer

CNAME record for DKIM

Answer

TXT record with v=spf1

Answer

MX record with priority 0

Question 4

A company wants to enforce that all outbound emails containing credit card numbers are blocked. Which Cisco ESA feature should be configured to achieve this?

Accepted Answer

DLP policies. Data Loss Prevention (DLP) policies on Cisco ESA can scan outbound emails for sensitive data like credit card numbers and block them.

Answer

Anti-Spam (SenderBase)

Answer

Outbreak Filters

Answer

AMP for Email

Question 5

A network administrator is configuring Cisco WSA to intercept web traffic transparently. Which protocol should be used to redirect traffic from the router to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) is used to transparently redirect web traffic from routers or switches to the WSA.

Answer

SSL/TLS Decryption

Answer

HTTP Proxy with PAC files

Answer

Active Directory integration

Question 6

Which Cisco cloud-based security solution provides DNS-layer security to block requests to malicious domains?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Security Internet Gateway) is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. When a user attempts to resolve a domain, Umbrella checks the request against its threat intelligence database and blocks the resolution if the domain is known to be malicious, preventing the connection before it is established.

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Answer

Cisco ESA

Question 7

An organization has deployed Cisco WSA in explicit proxy mode. Users are required to authenticate using their Active Directory credentials. Which WSA feature enables transparent user identification without requiring users to manually log in?

Accepted Answer

Transparent user identification via Kerberos. Transparent user identification on Cisco WSA can be achieved using Kerberos authentication or NTLM, allowing automatic authentication with AD credentials without manual login.

Answer

URL Filtering

Answer

WCCP redirection

Answer

SSL/TLS Decryption

Question 8

A security analyst notices that a user is downloading a file from a website. The Cisco WSA is configured to perform AMP file scanning. What happens when the file's SHA-256 hash is not found in the local cache?

Accepted Answer

The file is sent to the cloud for analysis and a verdict is returned.. Cisco WSA AMP file scanning performs a cloud lookup to check the file's reputation; if unknown, it may sandbox the file for analysis.

Answer

The file is allowed immediately.

Answer

The file is quarantined until an administrator reviews it.

Answer

The file is blocked permanently.

Question 9

A company wants to block social media access for employees during work hours. Which Cisco Firepower NGFW feature should be used to achieve this?

Accepted Answer

Application Control. Firepower NGFW application control can block specific application categories such as social media.

Answer

DLP Policies

Answer

URL Filtering

Answer

TLS Server Identity Discovery

Question 10

During a phishing simulation, an employee receives an email that appears to be from the CEO requesting an urgent wire transfer. This type of attack is known as:

Accepted Answer

Business Email Compromise (BEC). Business Email Compromise (BEC) is a targeted attack where the attacker impersonates a senior executive to request fraudulent transfers.

Answer

Whaling

Answer

Spear phishing

Answer

Malspam

Question 11

A Cisco WSA administrator wants to prioritize bandwidth for video conferencing applications while limiting recreational streaming. Which feature should be configured?

Accepted Answer

Bandwidth Controls. Bandwidth controls on Cisco WSA allow setting bandwidth limits per application (via AVC) to prioritize critical applications and limit others.

Answer

SSL/TLS Decryption

Answer

Application Visibility and Control (AVC)

Answer

URL Filtering

Question 12

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a digital signature to verify that an email was not tampered with and is from the claimed domain.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 13

Which TWO of the following are capabilities of Cisco Umbrella SIG? (Choose TWO.)

Accepted Answer

Cloud-based proxy for web traffic. Cisco Umbrella SIG provides DNS-layer security (blocking malicious domains) and a cloud-based proxy for web traffic filtering.

Answer

DLP for outbound email

Answer

File sandboxing for attachments

Answer

On-premises email filtering

Question 14

A security team is investigating an email threat that bypassed the Cisco ESA. The email appears to be from the CFO asking for a wire transfer. Which THREE of the following are characteristics of this attack? (Choose THREE.)

Accepted Answer

It is a type of phishing known as Business Email Compromise (BEC).. This is a Business Email Compromise (BEC) attack, which often involves spoofing, impersonation of executives, and social engineering to request financial transfers.

Answer

It is easily blocked by anti-spam filters.

Answer

It uses malware attachments to compromise the system.

Question 15

Which TWO of the following are valid methods for deploying Cisco WSA? (Choose TWO.)

Accepted Answer

Explicit proxy (browser configuration). Cisco WSA can be deployed as an explicit proxy (browsers configured to use it) or as a transparent proxy using WCCP or other redirection methods.

Answer

As a mail relay

Answer

As a DNS server

Answer

Inline with firewall port mirroring