350-701 Content Security Practice Test 7 — 15 Questions

Question 1

An organization is deploying Cisco WSA to enforce acceptable use policies. The administrator wants to block access to social media and streaming video, while also decrypting HTTPS traffic for these categories. Which THREE configuration steps are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install a trusted root CA certificate on all client devices. Option A is correct because HTTPS decryption on the Cisco WSA requires the WSA's certificate authority to be trusted by clients; otherwise browsers will show certificate warnings and the decrypted traffic will be rejected, so the WSA root CA (or a subordinate CA) must be installed in each client's trusted root store. Option B is correct because the administrator explicitly wants to decrypt HTTPS traffic for the social media and streaming video categories; this is done by enabling HTTPS/SSL decryption in the WSA's decryption policy and applying it to those URL categories. Option C is correct because blocking access to social media and streaming video is accomplished through URL filtering by selecting the 'Social Networking' and 'Streaming Media' categories in an access policy and setting the action to Block. Option D is not required because AMP file scanning is a malware/file reputation feature and does not enforce acceptable use or category-based blocking. Option E is not required because WCCP is only one possible method of redirecting client traffic to the WSA (typically on a router or Layer 4 switch); it is a deployment/redirection choice, not a required configuration step for filtering and decrypting these categories.

Answer

Enable AMP file scanning

Answer

Configure WCCP on the router

Question 2

A company is experiencing an increase in spear-phishing attacks targeting executives. Which TWO Cisco ESA features should be configured to mitigate this threat?

Accepted Answer

BEC impersonation protection. IMPERSONATION PROTECTION (BEC) and DMARC verification help detect spoofed executive emails. Outbreak filters and anti-spam may not catch targeted attacks.

Answer

Anti-spam (SenderBase)

Answer

DLP policies

Answer

Outbreak Filters

Question 3

A company is using Cisco WSA with explicit proxy mode. The security team wants to enforce HTTPS inspection for all web traffic from the finance department to detect malicious content in encrypted connections. However, they want to exclude traffic to financial institutions' websites due to compliance reasons. Which configuration approach should be used to achieve this?

Accepted Answer

Configure a policy for the finance department with HTTPS inspection enabled and add a bypass rule for the Financial Services URL category.. In Cisco WSA explicit proxy mode, HTTPS inspection is controlled per-identity/group via access policies, and exclusions are handled with bypass rules or URL category exceptions. Creating a policy that applies to the finance department with HTTPS decryption enabled, then adding a bypass for the Financial Services URL category, satisfies both the inspection mandate and the compliance carve-out. This is the standard WSA configuration pattern for selective SSL decryption.

Answer

Disable HTTPS inspection globally and enable it only for the finance department using a custom policy.

Answer

Configure SSL/TLS decryption on the firewall instead of the WSA.

Answer

Use transparent proxy mode with WCCP redirect to bypass inspection for financial sites.

Question 4

An organization wants to protect against Business Email Compromise (BEC) attacks where attackers spoof the CEO's email address to request wire transfers. Which email authentication method is specifically designed to help prevent domain spoofing by allowing senders to specify how email that fails authentication should be handled?

Accepted Answer

DMARC. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is specifically designed to allow domain owners to specify how email that fails SPF and/or DKIM authentication should be handled, such as quarantine or reject. It also provides reporting. This directly addresses domain spoofing by giving senders control over unauthenticated email.

Answer

SPF

Answer

DKIM

Answer

SenderBase

Question 5

A company uses Cisco Umbrella SIG to secure internet access for remote users. The security team wants to block access to social media websites but allow access to business-related websites that may share the same IP addresses. Which Umbrella feature should be used to enforce this granular control?

Accepted Answer

Cloud proxy with URL filtering. Cisco Umbrella's cloud proxy with URL filtering operates at the application layer (HTTP/HTTPS), inspecting full URLs rather than just domain names. This allows the security team to block social media websites while permitting business-related websites that may resolve to the same IP addresses, as the proxy can differentiate based on the URL path and content category.

Answer

DNS security layer

Answer

ThousandEyes agents

Answer

AMP file scanning

Question 6

A company is deploying Cisco ESA and wants to protect against malware delivered via email attachments. Which TWO features can be used together to provide both signature-based detection and behavioral analysis?

Accepted Answer

SHA-256 cloud lookup. AMP for Email uses SHA-256 cloud lookup for known malware and file sandboxing for unknown files to detect malicious behavior.

Answer

Outbreak filters

Answer

DLP policies

Answer

Anti-spam with SenderBase

Question 7

A company is using Cisco WSA with transparent proxy via WCCP. The security team wants to identify which users are accessing banned websites and also enforce bandwidth limits for video streaming. Which TWO features should be configured on the WSA?

Accepted Answer

Identity-based policies with AD integration. Option A (Identity-based policies with AD integration) is correct because in a transparent WCCP deployment the WSA does not receive an explicit proxy authentication challenge, so it must learn the user identity out-of-band; integrating with Active Directory via the WSA's authentication realm (using the AD agent/connector or transparent user identification) lets the WSA map client IP addresses to authenticated usernames so policies can report and act on which specific users hit banned sites. Option C (Bandwidth controls) is correct because the WSA's QoS/bandwidth control feature lets you define bandwidth limits and apply them to traffic classes such as video streaming, throttling or blocking that category per policy. Option B (AMP file scanning) is not relevant here because AMP inspects files for malware, not user identity or bandwidth usage. Option D (SSL/TLS decryption) is not required by the stated goals; it would only be needed to inspect encrypted traffic, and the question asks about identifying users and limiting video bandwidth. Option E (URL filtering categories) is a prerequisite for defining banned sites but by itself does not identify users or enforce bandwidth limits, so it is not one of the two features to add for these requirements.

Answer

AMP file scanning

Answer

SSL/TLS decryption

Answer

URL filtering categories

Question 8

An organization wants to prevent sensitive data such as credit card numbers from being sent via email. Which TWO features of Cisco ESA can be used to achieve this?

Accepted Answer

Content filters. Content filters (C) are correct because they let you define rules that inspect message bodies, headers, and attachments for patterns such as credit card numbers and then take actions like drop, quarantine, or notify, which directly prevents sensitive data from leaving via email. DLP policies (E) are correct because Cisco ESA Data Loss Prevention uses predefined or custom classifiers (for example, credit card and PCI compliance templates) to detect and block sensitive content in outbound mail. Outbreak filters (A) only protect against virus outbreaks and phishing by quarantining suspicious messages based on threat rules, not by detecting data patterns like credit card numbers. Anti-spam filters (B) score and block unsolicited bulk email, and SenderBase reputation (D) evaluates sender IP and domain reputation; neither inspects message content for sensitive data, so they do not satisfy the requirement.

Answer

Outbreak filters

Answer

Anti-spam filters

Answer

SenderBase reputation

Question 9

A security team is deploying Cisco Umbrella for DNS-layer security. They want to prevent endpoint users from bypassing the DNS filtering by manually changing their DNS server settings to an external resolver. Which Cisco Umbrella component should they implement to enforce this?

Accepted Answer

Cisco Umbrella Roaming Client. The Umbrella Roaming Client is specifically designed to enforce DNS-layer security on endpoints by intercepting DNS requests and directing them to Umbrella, regardless of the device's configured DNS servers. This ensures that users cannot bypass filtering by manually changing DNS settings. Other Umbrella components like the Virtual Appliance or Investigate do not provide this endpoint-level enforcement.

Answer

Cisco Umbrella Investigate

Answer

Cisco Umbrella SIG Essentials

Answer

Cisco Umbrella Virtual Appliance

Question 10

An administrator is configuring Cisco ESA to handle inbound email. They want to ensure that messages claiming to be from a trusted partner domain are rejected if they fail DMARC alignment, even if they pass SPF or DKIM individually. Which Cisco ESA feature should be configured to enforce this?

Accepted Answer

Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification. DMARC verification on Cisco ESA combines SPF and DKIM results with alignment checks against the From: domain and applies the domain owner's published policy. This allows the administrator to reject messages that fail DMARC, even if they pass SPF or DKIM separately. SPF and DKIM verification alone do not enforce alignment or policy, and AMP for Email focuses on malware, not authentication.

Answer

Cisco Advanced Malware Protection (AMP) for Email

Answer

DomainKeys Identified Mail (DKIM) verification

Answer

Sender Policy Framework (SPF) verification

Question 11

A network security engineer is configuring Cisco Firepower NGFW to block access to a specific URL category. They want to ensure that the policy applies to both HTTP and HTTPS traffic without decrypting SSL. Which feature should they use?

Accepted Answer

URL Filtering with category-based rules. URL filtering with category-based rules on Cisco Firepower NGFW can block or allow traffic based on URL categories. For HTTPS traffic without decryption, the system uses the server name indication (SNI) to determine the category. This allows enforcement without SSL decryption. Other options like SSL decryption would require decryption, application filtering may not cover all URLs in a category, and DNS sinkholing is for threat blocking, not category-based control.

Answer

SSL decryption policy with category-based rules

Answer

Application filtering with application-based rules

Answer

DNS sinkholing with Umbrella integration

Question 12

A security administrator is configuring Cisco WSA to scan outbound uploads for data loss prevention. They want to ensure that files containing credit card numbers are blocked when uploaded to any website. Which WSA feature should be configured?

Accepted Answer

Data Loss Prevention (DLP) policies with custom identifiers. To block outbound uploads containing credit card numbers, the administrator must configure DLP policies on Cisco WSA. DLP policies inspect content for patterns like credit card numbers and can block or quarantine the transaction. Acceptable Use Controls and Anti-Malware do not inspect for sensitive data, and HTTPS decryption is only an enabler for inspection, not the blocking mechanism itself.

Answer

Anti-Malware scanning with file reputation

Answer

Acceptable Use Controls with URL categories

Answer

HTTPS decryption policy for outbound traffic

Question 13

A security team is configuring Cisco Umbrella to protect a remote branch where users frequently connect directly to the internet without VPN. They want to enforce web filtering policies and block malicious domains for these roaming users without installing a virtual appliance on the branch router. Which deployment method should they use?

Accepted Answer

Umbrella Roaming Client. The requirement is to protect roaming users who connect directly to the internet without VPN and without a virtual appliance at the branch. The Umbrella Roaming Client is installed on endpoints and enforces DNS-layer security wherever the user goes. It ensures web filtering and malicious domain blocking without relying on network infrastructure, making it the appropriate choice for this scenario.

Answer

Umbrella SIG tunnel

Answer

Umbrella Virtual Appliance

Answer

Cisco Firepower DNS policy

Question 14

A security administrator is configuring Cisco ESA to protect against inbound email that contains malicious attachments. The administrator wants to quarantine messages that contain files with macro-enabled Office extensions before they reach user mailboxes. Which Cisco ESA feature should be configured to meet this requirement?

Accepted Answer

Message filters with attachment file type conditions. Message filters are the Cisco ESA mechanism that inspects message attributes such as attachment file type and applies actions like quarantine. Because the requirement is to quarantine inbound messages based on macro-enabled Office extensions, a message filter with an attachment file type condition and a quarantine action is the correct control. Other features address sender reputation, outbreak intelligence, or domain authentication rather than deterministic attachment-type enforcement.

Answer

SenderBase reputation filtering (SBRS)

Answer

Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification

Answer

Outbreak Filters with outbreak quarantine

Question 15

A security administrator is configuring a Cisco Secure Email Gateway (formerly ESA) to detect and block outbound messages containing customer credit card numbers. The compliance team requires that messages be quarantined when a valid card number pattern is found, and that the detection engine ignore common false-positive patterns such as sequential digits. Which feature should the administrator configure to meet these requirements?

Accepted Answer

Data Loss Prevention (DLP) policies with custom classifiers. DLP policies in Cisco Secure Email Gateway are purpose-built to inspect message content for sensitive data patterns such as credit card numbers. They include predefined classifiers and allow custom classifiers, enabling the administrator to detect valid card numbers while excluding common false positives like sequential digits. Applying a quarantine action to matching messages fulfills the compliance requirement without relying on brittle literal-string dictionaries or unrelated authentication and anti-malware features.

Answer

Outbreak Filters with outbreak quarantine

Answer

Sender Policy Framework (SPF) verification

Answer

Message filters configured with content dictionaries