350-701 Content Security Practice Test 4 — 15 Questions

Question 1

A security engineer is configuring the Cisco ESA to block spam. The engineer wants to rely on a reputation-based system that scores senders based on global email traffic patterns. Which technology should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IronPort SenderBase reputation. IronPort SenderBase uses a reputation score (SBRS) ranging from -10 to +10 to classify senders as trusted or spam sources.

Answer

DMARC verification

Answer

Cisco TALOS outbreak filters

Answer

AMP for Email

Question 2

An organization wants to prevent employees from accessing social media websites during work hours. Which Cisco WSA feature should be used to enforce this policy?

Accepted Answer

URL filtering. Cisco WSA URL filtering uses categories (e.g., social media) to allow or block access based on policy.

Answer

SSL/TLS decryption

Answer

AMP file scanning

Answer

AVC (Application Visibility and Control)

Question 3

A company using Cisco ESA receives an email that appears to be from the CEO requesting an urgent wire transfer. The email fails SPF and DKIM checks but passes DMARC. What is the most likely explanation?

Accepted Answer

DMARC policy is set to 'p=none'. DMARC policy can be set to 'none' (monitoring only) or 'quarantine'/'reject' based on SPF/DKIM alignment. If DMARC passes, it means the policy is not enforced, or the SPF/DKIM alignment still passes despite individual failures. However, if SPF and DKIM both fail, DMARC would also fail unless the policy is 'none'. The scenario suggests DMARC is set to 'none', so no action is taken.

Answer

The email passed SPF alignment

Answer

DKIM signature was valid but not aligned

Answer

The sender IP is in the SPF whitelist

Question 4

A network administrator wants to deploy Cisco WSA as a transparent proxy to inspect web traffic without changing browser settings. Which protocol should be used to redirect traffic to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) allows routers to redirect web traffic to the WSA transparently.

Answer

PAC files

Answer

WPAD

Answer

GRE tunneling

Question 5

Which Cisco security solution provides DNS-layer security to block access to malicious domains before a connection is established?

Accepted Answer

Cisco Umbrella. Cisco Umbrella operates at the DNS layer to block requests to malicious domains.

Answer

Cisco ESA

Answer

Cisco WSA

Answer

Cisco Firepower NGFW

Question 6

An organization uses Cisco ESA to enforce DLP policies. Which of the following is an example of a DLP policy that can be configured on the ESA?

Accepted Answer

Scanning for credit card numbers in outbound email. DLP policies on ESA scan for patterns like credit card numbers, SSNs, etc., in outbound email to prevent data leaks.

Answer

Blocking email attachments over 10 MB

Answer

Quarantining messages with malware

Answer

Filtering spam based on SenderBase reputation

Question 7

A SOC analyst notices that a user downloaded a malicious file from a website. The Cisco WSA is configured with AMP file scanning. However, the file was not blocked. Which scenario best explains why AMP failed to detect the file?

Accepted Answer

The file was a zero-day malware not yet analyzed by AMP. AMP uses SHA-256 cloud lookup and sandboxing. If the file is new and unknown (zero-day), the cloud may not have a disposition, and if sandboxing is not enabled or the file type is not analyzed, it could be allowed.

Answer

The file was cached from a previous scan

Answer

The file was less than 10 KB

Answer

SSL decryption was disabled

Question 8

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

Accepted Answer

Transparent user identification using Active Directory agent. Transparent user identification on WSA can be achieved via NTLM authentication or Kerberos, but the most common transparent method is using NTLM challenge/response, or via AD agent. However, the question asks for transparent identification without client software; typical methods include using the AD agent or IP-based mapping. The best answer is 'NTLM authentication with browser integration' which is transparent to the user after initial login. But among options, 'Transparent user identification using Active Directory agent' is correct.

Answer

LDAP bind with user credentials

Answer

Explicit proxy with PAC file

Answer

Kerberos authentication with keytab file

Question 9

Which Cisco technology provides visibility into the performance of SaaS applications such as Microsoft 365?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Umbrella SIG

Question 10

A security engineer is configuring Cisco Firepower NGFW to block social media applications. Which feature should be used to achieve this?

Accepted Answer

Application control. Firepower uses application control to identify and block specific applications like social media.

Answer

URL filtering

Answer

Intrusion prevention

Answer

TLS server identity discovery

Question 11

An organization wants to use Cisco Umbrella SIG to enforce security policy for remote users. Which deployment method allows Umbrella to inspect traffic for all ports and protocols, not just DNS?

Accepted Answer

Deploying the Umbrella roaming client. Umbrella SIG (Security Internet Gateway) can be deployed as a cloud proxy or with the Umbrella roaming client. The roaming client forwards all traffic to the cloud proxy for full inspection.

Answer

Configuring a PAC file for proxy

Answer

Using IPsec tunnel to Umbrella

Answer

DNS-layer enforcement only

Question 12

Which email authentication method allows the domain owner to publish a policy that instructs receiving mail servers on how to handle messages that fail SPF and DKIM checks?

Accepted Answer

DMARC. DMARC builds on SPF and DKIM to specify policies (none, quarantine, reject) for failed messages.

Answer

SPF

Answer

SenderBase

Answer

DKIM

Question 13

A security analyst is investigating a Business Email Compromise (BEC) attack. Which two indicators are commonly associated with BEC attacks? (Choose two.)

Accepted Answer

Spoofed email address resembling a legitimate executive. BEC attacks often involve spoofed email addresses (domain lookalikes) and urgent requests for wire transfers or sensitive data.

Answer

Malicious attachment with ransomware

Answer

Presence of a phishing URL

Answer

Encrypted ZIP file attachment

Question 14

An organization is deploying Cisco WSA in explicit proxy mode. Which three considerations are important for this deployment? (Choose three.)

Accepted Answer

Client browsers must be configured to use the proxy. Explicit proxy requires browser configuration (PAC file or manual), supports authentication, and can apply identity-based policies. Transparent proxy does not require client configuration.

Answer

Network changes are required on all endpoints

Answer

The proxy IP address must be configured on the router for WCCP

Question 15

Which two Cisco solutions can be used to provide cloud-based content security including DNS-layer protection and cloud proxy? (Choose two.)

Accepted Answer

Cisco Umbrella DNS-layer security. Cisco Umbrella offers both DNS security and cloud proxy (SIG). Cisco ThousandEyes is for performance, not security. WSA and ESA are on-premises.

Answer

Cisco ThousandEyes

Answer

Cisco ESA

Answer

Cisco WSA