350-701 Content Security Practice Test 6 — 15 Questions

Question 1

Which email authentication method allows the domain owner to publish a policy that instructs receiving mail servers on how to handle messages that fail SPF and DKIM checks?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is specifically designed to allow domain owners to publish a policy in DNS that tells receiving mail servers how to handle messages that fail SPF and DKIM alignment checks. It builds on SPF and DKIM by adding an alignment requirement and a reporting mechanism. The policy can instruct receivers to take actions like none, quarantine, or reject. Thus, DMARC is the correct answer.

Answer

SPF

Answer

SenderBase

Answer

DKIM

Question 2

A security analyst is investigating a Business Email Compromise (BEC) attack. Which two indicators are commonly associated with BEC attacks? (Choose two.)

Accepted Answer

Spoofed email address resembling a legitimate executive. Option A is correct because BEC attacks typically rely on email spoofing or display-name spoofing so the message appears to come from a trusted executive, often using a look-alike domain or a forged From header that passes casual inspection. Option E is correct because the goal of most BEC campaigns is financial fraud, so the message usually contains a time-pressured demand for a wire transfer, gift cards, or updated bank account details to pressure the victim into acting quickly. Options B and D are not typical BEC indicators: ransomware attachments and encrypted ZIP files are hallmarks of malware delivery campaigns such as phishing with loaders or ransomware, not the social-engineering, no-payload approach that defines BEC. Option C is also not a defining BEC indicator, since BEC messages usually avoid obvious phishing URLs and instead rely on plain text, reply-to manipulation, or legitimate-looking links to evade URL filters.

Answer

Malicious attachment with ransomware

Answer

Presence of a phishing URL

Answer

Encrypted ZIP file attachment

Question 3

An organization is deploying Cisco WSA in explicit proxy mode. Which three considerations are important for this deployment? (Choose three.)

Accepted Answer

Client browsers must be configured to use the proxy. In explicit proxy mode, the client must be explicitly told to send its web requests to the WSA, so option A is correct because browsers (or PAC files/WPAD) must be configured with the proxy IP address and port. Option B is correct because the WSA can perform SSL decryption (HTTPS inspection) by presenting its own certificate to clients and acting as a man-in-the-middle, which is a key capability in explicit deployments. Option E is correct because, since clients connect directly to the proxy, the WSA can enforce authentication (e.g., via LDAP/AD, NTLM, or a captive portal) before granting web access. Option C is wrong because explicit proxy mode does not require network changes on all endpoints—only proxy settings on clients. Option D is wrong because WCCP is used for transparent proxy redirection on the router, not for explicit proxy mode, where clients are configured to point at the proxy directly.

Answer

Network changes are required on all endpoints

Answer

The proxy IP address must be configured on the router for WCCP

Question 4

Which two Cisco solutions can be used to provide cloud-based content security including DNS-layer protection and cloud proxy? (Choose two.)

Accepted Answer

Cisco Umbrella DNS-layer security. Cisco Umbrella DNS-layer security (C) is correct because it is a cloud-delivered security service that blocks malicious domains and IPs at the DNS resolution layer before a connection is ever established, providing the DNS-layer protection described in the scenario. Cisco Umbrella SIG (E) is also correct because Secure Internet Gateway extends Umbrella's cloud security to include a cloud proxy (SWG) for full URL inspection, plus CASB, FWaaS, and DNS-layer security in a single cloud service. Cisco ThousandEyes (A) is a network intelligence and digital experience monitoring platform, not a content security or DNS filtering solution. Cisco ESA (B) is an on-premises or virtual email security appliance that filters email traffic, not general web/DNS content security. Cisco WSA (D) is a web security appliance that can be deployed on-premises or as a virtual appliance, but it is not the cloud-based DNS-layer plus cloud proxy solution the question asks for.

Answer

Cisco ThousandEyes

Answer

Cisco ESA

Answer

Cisco WSA

Question 5

An organization wants to prevent outbound email containing credit card numbers from leaving the network. Which Cisco ESA feature should be configured?

Accepted Answer

DLP Policies. Cisco ESA's Data Loss Prevention (DLP) policies are designed to inspect outbound email content and attachments for sensitive data patterns such as credit card numbers, Social Security numbers, and other PII, and then block, quarantine, or encrypt messages that match. DLP uses predefined or custom classifiers to detect credit card numbers via regex and checksum validation (Luhn algorithm).

Answer

AMP for Email

Answer

Anti-spam (SenderBase)

Answer

Outbreak Filters

Question 6

A security engineer needs to block access to social media websites for all users except those in the HR department. The solution must integrate with Active Directory. Which Cisco WSA feature should be used?

Accepted Answer

Identity-based policies with AD integration. Identity-based policies on Cisco WSA use an identity realm integrated with Active Directory (via LDAP, Kerberos, or NTLM) to apply different access rules per user or group. By creating a policy that blocks social media for everyone but allows the HR group, the engineer satisfies both the blocking requirement and the AD integration requirement. This is the native WSA mechanism for group-differentiated web policy.

Answer

SSL/TLS decryption

Answer

Explicit proxy with PAC file

Answer

Transparent proxy with WCCP

Question 7

An email administrator receives reports of a targeted phishing campaign where attackers impersonate the CEO to request wire transfers. Which Cisco ESA feature provides the best defense against this Business Email Compromise (BEC) attack?

Accepted Answer

DMARC verification. DMARC (Domain-based Message Authentication, Reporting, and Conformance) verification is the best defense against Business Email Compromise (BEC) attacks where attackers spoof the CEO's email address. DMARC builds on SPF and DKIM to authenticate the sender's domain and provides policy for handling unauthenticated messages. Cisco ESA supports DMARC verification, which can reject or quarantine emails that fail DMARC checks, thus preventing spoofed emails from reaching users. Other features like Outbreak Filters, anti-spam, and DLP are less effective against spoofing because they focus on malware, spam reputation, or data leakage, not sender authentication.

Answer

Outbreak Filters

Answer

Anti-spam with SenderBase reputation

Answer

DLP policies

Question 8

A company uses Cisco Umbrella SIG to enforce security policies. An employee attempts to visit a website categorized as 'Phishing' but the request is allowed. What is the most likely cause?

Accepted Answer

The policy is set to 'Allow' for the Phishing category. If a website categorized as Phishing is allowed, the most direct explanation is that the policy explicitly permits that category. Umbrella SIG enforces policies based on category and identity; an 'Allow' rule for Phishing overrides the default block. This is a configuration error, not a technical limitation.

Answer

The employee is using a VPN that bypasses the proxy

Answer

DNS security is disabled

Answer

The website uses HTTPS and Umbrella cannot inspect it

Question 9

Which Cisco technology uses SenderBase reputation scores (SBRS) to evaluate incoming email?

Accepted Answer

Cisco ESA anti-spam. Cisco Email Security Appliance (ESA) uses SenderBase reputation scores (SBRS) as part of its anti-spam engine to evaluate the reputation of sending hosts and domains before accepting or scoring email. SBRS is a core input to the ESA's spam verdict alongside content filters and Talos rules.

Answer

Cisco Firepower intrusion prevention

Answer

Cisco WSA URL filtering

Answer

Cisco Umbrella DNS security

Question 10

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes provides end-to-end visibility into SaaS and internet application performance by running synthetic tests and path visualization from agents to the application, exposing latency, loss, and hop-by-hop issues. It is the designated Cisco tool for SaaS performance monitoring.

Answer

Cisco Firepower URL filtering

Answer

Cisco Umbrella SIG

Answer

Cisco WSA bandwidth controls

Question 11

Which Cisco ESA feature uses SHA-256 cloud lookups to detect malware in email attachments?

Accepted Answer

AMP for Email. Cisco ESA's AMP for Email (Advanced Malware Protection) leverages SHA-256 cloud lookups to compare file hashes of email attachments against Talos threat intelligence. When an attachment is processed, its SHA-256 hash is computed and sent to the AMP cloud for real-time verdict (malicious, clean, or unknown). This is distinct from signature-based detection, as it relies on cloud-based file reputation analysis.

Answer

Outbreak Filters

Answer

DLP Policies

Answer

Anti-spam (SenderBase)

Question 12

An organization using Cisco Firepower NGFW wants to block all social media traffic while allowing other web traffic. Which feature should be configured?

Accepted Answer

URL filtering. URL filtering on Cisco Firepower NGFW uses category-based reputation and URL lists to allow or block web destinations. Social media sites are grouped into a predefined category (e.g., 'Social Networking'), so a URL filtering policy that blocks that category while allowing all others achieves the requirement without touching other traffic.

Answer

Intrusion prevention

Answer

TLS server identity discovery

Answer

Application control

Question 13

A security engineer is configuring Cisco WSA for HTTPS inspection but notices that some encrypted traffic is being bypassed. The WSA is configured with a decryption policy that excludes traffic to financial websites. What is the most likely reason for the bypass?

Accepted Answer

The decryption policy has an exception for financial services. The question states the decryption policy explicitly excludes traffic to financial websites. That exception is the direct cause: WSA evaluates the decryption policy before attempting TLS interception, and any destination matching the exception list is passed through without decryption. The observed bypass is therefore expected behavior, not a failure.

Answer

The WSA's certificate is not trusted by clients

Answer

The WSA is in explicit proxy mode

Answer

TLS version is incompatible

Question 14

Which Cisco content security solution provides DNS-layer protection and a cloud proxy to enforce security policies?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Secure Internet Gateway) is the cloud-delivered security platform that provides DNS-layer protection, secure web gateway, cloud firewall, and CASB in a single solution. It is the only option that combines DNS-layer security with a cloud proxy, matching the question's description exactly.

Answer

Cisco ESA

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Question 15

A security analyst notices that emails from a trusted partner's domain are being quarantined by the Cisco ESA. The analyst wants to verify the email authentication status. Which TWO authentication mechanisms should be checked?

Accepted Answer

DKIM. DKIM (B) and SPF (C) are the two email authentication mechanisms that should be checked to verify a sender's legitimacy. SPF validates that the sending mail server's IP address is authorized to send mail for the domain by checking the domain's published SPF TXT record, while DKIM uses a cryptographic signature added to the message headers to verify the email was sent by the domain and not altered in transit. Both are foundational authentication checks the Cisco ESA performs and can use to quarantine or flag messages from a trusted partner's domain. SenderBase (A) is a Cisco reputation service that scores senders based on traffic patterns, not an email authentication mechanism. DMARC (D) is a policy framework that builds on SPF and DKIM alignment but is not itself one of the two underlying authentication mechanisms being verified here. TALOS (E) is Cisco's threat intelligence group that provides reputation and threat data, not an email authentication protocol.

Answer

SenderBase

Answer

DMARC

Answer

TALOS