350-701 Content Security Practice Test 5 — 15 Questions

Question 1

An organization has deployed Cisco WSA in explicit proxy mode. Users are required to authenticate using their Active Directory credentials. Which WSA feature enables transparent user identification without requiring users to manually log in?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transparent user identification via Kerberos. In explicit proxy mode, users point their browsers at the WSA, but the WSA still needs to know who the user is to apply identity-based policies. Kerberos-based transparent user identification allows the WSA to authenticate the user against Active Directory silently using the existing Kerberos ticket from the domain logon, so no manual credential prompt appears. This is the standard Cisco WSA feature (configured under Network > Authentication) that provides seamless AD-based identification in explicit proxy deployments.

Answer

URL Filtering

Answer

WCCP redirection

Answer

SSL/TLS Decryption

Question 2

A security analyst notices that a user is downloading a file from a website. The Cisco WSA is configured to perform AMP file scanning. What happens when the file's SHA-256 hash is not found in the local cache?

Accepted Answer

The file is sent to the cloud for analysis and a verdict is returned.. When Cisco WSA performs AMP file scanning and the file's SHA-256 hash is not found in the local cache, the file is sent to the Cisco Talos cloud for analysis. Talos returns a verdict based on its global threat intelligence, and the WSA enforces the configured policy, which may allow, block, or quarantine the file. This cloud lookup is the core mechanism of AMP for file reputation.

Answer

The file is allowed immediately.

Answer

The file is quarantined until an administrator reviews it.

Answer

The file is blocked permanently.

Question 3

During a phishing simulation, an employee receives an email that appears to be from the CEO requesting an urgent wire transfer. This type of attack is known as:

Accepted Answer

Business Email Compromise (BEC). Business Email Compromise (BEC) is a sophisticated scam that targets organizations by impersonating a high-level executive (like the CEO) to trick employees into performing unauthorized actions, such as wire transfers. In this scenario, the email appears to be from the CEO requesting an urgent wire transfer, which is a classic BEC attack. BEC often does not involve malicious links or attachments, relying instead on social engineering to exploit trust and urgency.

Answer

Whaling

Answer

Spear phishing

Answer

Malspam

Question 4

A Cisco WSA administrator wants to prioritize bandwidth for video conferencing applications while limiting recreational streaming. Which feature should be configured?

Accepted Answer

Bandwidth Controls. Cisco WSA's Bandwidth Controls feature lets administrators define bandwidth limits and priorities for specific applications, URL categories, or user groups. By assigning a high priority or guaranteed bandwidth to video conferencing categories and a low limit to streaming media categories, the administrator can prioritize conferencing while throttling recreational streaming. This is exactly the use case Bandwidth Controls is designed for.

Answer

SSL/TLS Decryption

Answer

Application Visibility and Control (AVC)

Answer

URL Filtering

Question 5

An organization is using Cisco ESA and wants to ensure that emails sent from their domain are authenticated using a cryptographic signature. Which email authentication method should be configured?

Accepted Answer

DKIM. DKIM (DomainKeys Identified Mail) uses a cryptographic signature added to outgoing email headers, which the receiving server verifies against a public key published in DNS. This provides cryptographic authentication that the message was sent by the domain and was not altered in transit. The question specifically asks for a cryptographic signature, which is the defining characteristic of DKIM.

Answer

DMARC

Answer

SPF

Answer

SenderBase

Question 6

Which TWO of the following are capabilities of Cisco Umbrella SIG? (Choose TWO.)

Accepted Answer

Cloud-based proxy for web traffic. Option D is correct because Cisco Umbrella SIG (Secure Internet Gateway) provides a cloud-based secure web gateway/proxy that inspects and filters web traffic from any location without on-premises hardware. Option E is correct because Umbrella's foundational capability is DNS-layer security, which blocks requests to malicious domains before a connection is established by resolving DNS through Umbrella's global network. Options A, B, and C are not Umbrella SIG capabilities: outbound email DLP and attachment file sandboxing are functions of Cisco Email Security (ESA) with Advanced Malware Protection, and on-premises email filtering is likewise an Email Security appliance feature rather than part of the SIG cloud service.

Answer

DLP for outbound email

Answer

File sandboxing for attachments

Answer

On-premises email filtering

Question 7

A security team is investigating an email threat that bypassed the Cisco ESA. The email appears to be from the CFO asking for a wire transfer. Which THREE of the following are characteristics of this attack? (Choose THREE.)

Accepted Answer

It is a type of phishing known as Business Email Compromise (BEC).. Option A is correct because this is a classic Business Email Compromise (BEC) attack, a form of phishing in which attackers impersonate or compromise a trusted business contact to trick victims into transferring funds. Option C is correct because the scenario describes impersonation of a senior executive (the CFO) to request a wire transfer, which is the defining pretext of BEC fraud. Option D is correct because BEC succeeds through social engineering—manipulating human trust and urgency—rather than exploiting software vulnerabilities or delivering malicious code. Option B is incorrect because BEC messages typically contain no malicious links or attachments and often originate from legitimate or lookalike accounts, so anti-spam filters frequently fail to block them, as the scenario itself demonstrates. Option E is incorrect because this attack does not rely on malware attachments; it is a text-based deception aimed at inducing a voluntary financial transaction.

Answer

It is easily blocked by anti-spam filters.

Answer

It uses malware attachments to compromise the system.

Question 8

Which TWO of the following are valid methods for deploying Cisco WSA? (Choose TWO.)

Accepted Answer

Explicit proxy (browser configuration). Option D (Explicit proxy via browser configuration) is correct because Cisco WSA can be deployed as an explicit proxy, where client browsers or PAC files are configured to send HTTP/HTTPS requests directly to the WSA's proxy listening ports (typically 80, 3128, or 8080). Option E (Transparent proxy via WCCP) is correct because WSA supports WCCP (Web Cache Communication Protocol) to redirect traffic transparently from a Cisco router or switch to the WSA without any client-side configuration. Option A is incorrect because a mail relay handles SMTP email traffic, which is not a WSA deployment role; WSA is a secure web gateway for HTTP/HTTPS. Option B is incorrect because WSA is not a DNS server; it may query DNS for reputation and categorization but does not serve DNS records. Option C is incorrect because firewall port mirroring (SPAN) only copies traffic for monitoring and cannot redirect traffic inline to the WSA for enforcement.

Answer

As a mail relay

Answer

As a DNS server

Answer

Inline with firewall port mirroring

Question 9

A security engineer is configuring the Cisco ESA to block spam. The engineer wants to rely on a reputation-based system that scores senders based on global email traffic patterns. Which technology should be used?

Accepted Answer

IronPort SenderBase reputation. IronPort SenderBase uses a reputation score (SBRS) ranging from -10 to +10 to classify senders as trusted or spam sources.

Answer

DMARC verification

Answer

Cisco TALOS outbreak filters

Answer

AMP for Email

Question 10

An organization wants to prevent employees from accessing social media websites during work hours. Which Cisco WSA feature should be used to enforce this policy?

Accepted Answer

URL filtering. URL filtering on Cisco WSA allows administrators to block or allow access to websites based on URL categories, including social media. It uses a cloud-based categorization database to enforce acceptable use policies during specified hours. This directly addresses the requirement to prevent social media access.

Answer

SSL/TLS decryption

Answer

AMP file scanning

Answer

AVC (Application Visibility and Control)

Question 11

A network administrator wants to deploy Cisco WSA as a transparent proxy to inspect web traffic without changing browser settings. Which protocol should be used to redirect traffic to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) is a Cisco protocol that enables transparent redirection of web traffic to a WSA without changing browser settings. The router or switch configured with WCCP intercepts traffic and redirects it to the WSA for inspection.

Answer

PAC files

Answer

WPAD

Answer

GRE tunneling

Question 12

Which Cisco security solution provides DNS-layer security to block access to malicious domains before a connection is established?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered secure internet gateway whose DNS-layer security resolves and blocks requests to malicious or unwanted domains before any TCP connection is made. It uses global DNS resolvers and threat intelligence to enforce policy at the earliest point in the connection lifecycle.

Answer

Cisco ESA

Answer

Cisco WSA

Answer

Cisco Firepower NGFW

Question 13

An organization uses Cisco ESA to enforce DLP policies. Which of the following is an example of a DLP policy that can be configured on the ESA?

Accepted Answer

Scanning for credit card numbers in outbound email. DLP (Data Loss Prevention) on Cisco ESA is specifically designed to detect and prevent sensitive data from leaving the organization. Scanning for credit card numbers in outbound email is a classic DLP use case, as it identifies personally identifiable information (PII) or payment card data (PCI) and can take action such as quarantining or encrypting the message. The ESA uses DLP policies that leverage pattern matching and content filters to identify such data. This is a core function of the ESA's DLP feature, which integrates with Cisco's DLP engine or third-party DLP providers.

Answer

Blocking email attachments over 10 MB

Answer

Quarantining messages with malware

Answer

Filtering spam based on SenderBase reputation

Question 14

Which Cisco technology provides visibility into the performance of SaaS applications such as Microsoft 365?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Umbrella SIG

Question 15

A security engineer is configuring Cisco Firepower NGFW to block social media applications. Which feature should be used to achieve this?

Accepted Answer

Application control. Firepower uses application control to identify and block specific applications like social media.

Answer

URL filtering

Answer

Intrusion prevention

Answer

TLS server identity discovery