350-701 Content Security Practice Test 5 — 15 Questions

Question 1

An organization wants to prevent outbound email containing credit card numbers from leaving the network. Which Cisco ESA feature should be configured?

Accepted Answer

DLP Policies. The Cisco ESA DLP feature scans outbound email for sensitive data like credit card numbers and can block or quarantine such messages.

Answer

AMP for Email

Answer

Anti-spam (SenderBase)

Answer

Outbreak Filters

Question 2

A security engineer needs to block access to social media websites for all users except those in the HR department. The solution must integrate with Active Directory. Which Cisco WSA feature should be used?

Accepted Answer

Identity-based policies with AD integration. Cisco WSA identity-based policies with AD integration allow different URL filtering rules per user group.

Answer

SSL/TLS decryption

Answer

Explicit proxy with PAC file

Answer

Transparent proxy with WCCP

Question 3

An email administrator receives reports of a targeted phishing campaign where attackers impersonate the CEO to request wire transfers. Which Cisco ESA feature provides the best defense against this Business Email Compromise (BEC) attack?

Accepted Answer

DMARC verification. DMARC can detect and block spoofed emails from the CEO's domain by verifying SPF and DKIM alignment.

Answer

Outbreak Filters

Answer

Anti-spam with SenderBase reputation

Answer

DLP policies

Question 4

A company uses Cisco Umbrella SIG to enforce security policies. An employee attempts to visit a website categorized as 'Phishing' but the request is allowed. What is the most likely cause?

Accepted Answer

The policy is set to 'Allow' for the Phishing category. If the security policy does not block the 'Phishing' category, or if the destination is not categorized, the request may be allowed by default.

Answer

The employee is using a VPN that bypasses the proxy

Answer

DNS security is disabled

Answer

The website uses HTTPS and Umbrella cannot inspect it

Question 5

Which Cisco technology uses SenderBase reputation scores (SBRS) to evaluate incoming email?

Accepted Answer

Cisco ESA anti-spam. Cisco ESA uses IronPort SenderBase reputation to assign a score (-10 to +10) to senders to determine spam likelihood.

Answer

Cisco Firepower intrusion prevention

Answer

Cisco WSA URL filtering

Answer

Cisco Umbrella DNS security

Question 6

A network administrator wants to deploy Cisco WSA as a transparent proxy using WCCP. Which traffic redirection method does WCCP use?

Accepted Answer

WCCP redirects traffic from the router to the WSA. WCCP allows routers to redirect web traffic to the WSA transparently without client configuration.

Answer

GRE tunneling

Answer

DNS redirection

Answer

PAC file configuration on clients

Question 7

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

Accepted Answer

Enable DMARC with reject policy. Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Answer

Disable SPF checking

Answer

Increase the SBRS threshold

Answer

Reduce DLP scanning sensitivity

Question 8

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes provides monitoring and visibility into the performance of cloud and SaaS applications.

Answer

Cisco Firepower URL filtering

Answer

Cisco Umbrella SIG

Answer

Cisco WSA bandwidth controls

Question 9

Which Cisco ESA feature uses SHA-256 cloud lookups to detect malware in email attachments?

Accepted Answer

AMP for Email. Cisco ESA's AMP for Email (Advanced Malware Protection) leverages SHA-256 cloud lookups to compare file hashes of email attachments against Talos threat intelligence. When an attachment is processed, its SHA-256 hash is computed and sent to the AMP cloud for real-time verdict (malicious, clean, or unknown). This is distinct from signature-based detection, as it relies on cloud-based file reputation analysis.

Answer

Outbreak Filters

Answer

DLP Policies

Answer

Anti-spam (SenderBase)

Question 10

An organization using Cisco Firepower NGFW wants to block all social media traffic while allowing other web traffic. Which feature should be configured?

Accepted Answer

URL filtering. Firepower URL filtering can block categories such as 'Social Networking' to prevent access to social media sites.

Answer

Intrusion prevention

Answer

TLS server identity discovery

Answer

Application control

Question 11

A security engineer is configuring Cisco WSA for HTTPS inspection but notices that some encrypted traffic is being bypassed. The WSA is configured with a decryption policy that excludes traffic to financial websites. What is the most likely reason for the bypass?

Accepted Answer

The decryption policy has an exception for financial services. If the decryption policy excludes certain categories (e.g., Financial), those sites will not be decrypted and will bypass inspection.

Answer

The WSA's certificate is not trusted by clients

Answer

The WSA is in explicit proxy mode

Answer

TLS version is incompatible

Question 12

Which Cisco content security solution provides DNS-layer protection and a cloud proxy to enforce security policies?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG provides DNS security and a cloud-based proxy for web filtering.

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Question 13

A security analyst notices that emails from a trusted partner's domain are being quarantined by the Cisco ESA. The analyst wants to verify the email authentication status. Which TWO authentication mechanisms should be checked?

Accepted Answer

DKIM. SPF and DKIM are used to authenticate email senders and verify domain ownership.

Answer

SenderBase

Answer

DMARC

Answer

TALOS

Question 14

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Accepted Answer

Install a trusted root CA certificate on all client devices. To block and decrypt HTTPS traffic for specific categories, you need URL filtering, decryption policy, and identity-based policies for granular control.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 15

A company is experiencing an increase in spear-phishing attacks targeting executives. Which TWO Cisco ESA features should be configured to mitigate this threat?

Accepted Answer

BEC impersonation protection. IMPERSONATION PROTECTION (BEC) and DMARC verification help detect spoofed executive emails. Outbreak filters and anti-spam may not catch targeted attacks.

Answer

Anti-spam (SenderBase)

Answer

DLP policies

Answer

Outbreak Filters