350-701 Content Security Practice Test 8 — 15 Questions

Question 1

A network security team is deploying Cisco Firepower Threat Defense (FTD) managed by Cisco Secure Firewall Management Center. They need to decrypt outbound HTTPS traffic so that file policies can inspect downloaded files, but they must not break connections to sites that use certificate pinning. Which FTD feature should be used to selectively bypass decryption for those sites?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSL policy with a Do Not Decrypt rule that matches the pinned sites. Selective decryption in FTD is controlled by the SSL policy, which can contain Do Not Decrypt rules that match traffic by category, URL, or certificate attributes. A Do Not Decrypt rule for the pinned sites preserves those connections while other HTTPS traffic is decrypted and inspected by file policies. Access control blocking, file policy actions, and intrusion preprocessor settings do not influence the decryption decision.

Answer

Access control policy with an SSL inspection action set to Block

Answer

File policy with a Block Malware action

Answer

Intrusion policy with a preprocessor rule to ignore TLS handshake errors

Question 2

A security engineer is configuring Cisco Umbrella to protect a remote branch that uses the Cisco AnyConnect Secure Mobility Client. The engineer wants DNS requests from roaming users to be inspected by Umbrella even when they are off the corporate network. Which configuration on the Umbrella dashboard is required to accomplish this?

Accepted Answer

Enable the Umbrella roaming client module in the AnyConnect profile and associate it with the organization's Umbrella tenant.. The requirement is to inspect DNS from roaming users who are off the corporate network. Only a client-side component that runs on the endpoint and sends DNS to Umbrella regardless of the local network can satisfy this. The Umbrella roaming client module in AnyConnect does exactly that, whereas network-based identities, forwarders, and tunnels depend on traffic passing through a fixed network device.

Answer

Create an Umbrella site-to-site VPN tunnel between the branch office and the Umbrella data centers.

Answer

Add the public IP address of the branch office to the Umbrella network identities.

Answer

Configure a DNS Forwarder on the branch office router to point to the Umbrella resolvers.

Question 3

A security engineer is tuning a Cisco Secure Email Gateway (ESA) to reduce false positives for inbound mail. The organization receives a high volume of legitimate marketing messages that are being quarantined. The engineer wants to use features that influence spam scoring based on sender reputation and message content. Which two ESA features should be examined to adjust how messages are evaluated? (Choose two.)

Accepted Answer

Content Filters. SBRS and Content Filters are the two ESA features that directly influence how inbound messages are scored and acted upon. SBRS provides a reputation-based score that can be tuned or overridden for trusted senders, while Content Filters allow granular rules that can exempt legitimate marketing content from quarantine. Together they address the false-positive problem without disabling broader anti-spam protections.

Answer

Email Encryption

Answer

Data Loss Prevention (DLP)

Answer

Message Tracking

Question 4

A network security team is deploying Cisco Firepower Threat Defense (FTD) managed by Cisco Secure Firewall Management Center. They need to decrypt outbound HTTPS traffic so that file policies can inspect downloaded files, but they must not break connections to sites that use certificate pinning. Which FTD feature should be used to selectively bypass decryption for those sites?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kerberos authentication with transparent user identification. Per-user policy enforcement on Cisco Secure Web Appliance requires the appliance to know the identity of the user making each web request. LDAP authentication against Active Directory and Kerberos transparent identification both provide that identity. SNMPv3, TACACS+, and RADIUS serve monitoring, device administration, or network access functions and do not supply web user identity to the WSA policy engine.

Answer

RADIUS authentication for wireless client onboarding

Answer

SNMPv3 authentication to correlate user sessions with network devices

Answer

TACACS+ authentication for administrative access to the WSA CLI

Question 5

A security operations team is investigating alerts from Cisco Secure Email and Web Manager (formerly Cisco Content Security Management Appliance). They want to reduce false positives in Cisco ESA spam detection without degrading legitimate mail flow. Which two actions should they take? (Choose two.)

Accepted Answer

Add trusted senders to an allowed list in the mail policy. Reducing false positives in Cisco ESA spam detection involves tuning quarantine thresholds with review, and using allowed lists for known legitimate senders. These actions target the specific misclassification problem while preserving protection for the broader mail stream. Disabling reputation filtering, auto-deleting quarantine, or lowering the spam threshold all either weaken security or increase false positives, so they do not satisfy the requirement.

Answer

Set the spam quarantine to automatically delete all messages after one hour

Answer

Disable SenderBase reputation filtering entirely

Answer

Lower the spam threshold so more messages are quarantined

Question 6

An administrator is configuring Cisco Firepower Management Center to block outbound access to a list of known malicious domains. The requirement is to use the reputation data that Cisco curates and updates automatically, without manually maintaining the domain list. Which Firepower feature should be used?

Accepted Answer

Security Intelligence feeds with DNS and URL reputation lists. Security Intelligence feeds in Firepower Management Center provide Cisco-curated, automatically updated reputation data for DNS, URL, and IP indicators. Using these feeds in an access control policy blocks outbound access to known malicious domains without manual list maintenance. Custom URL groups require manual upkeep, SSL decryption is only a supporting function, and network discovery provides visibility rather than enforcement.

Answer

Custom URL object group with manually entered malicious domains

Answer

Network discovery policy with host input from Cisco Talos

Answer

Access control policy with an SSL policy that decrypts all outbound traffic

Question 7

A security administrator is configuring Cisco Web Security Appliance (WSA) to inspect HTTPS traffic for malware. The administrator wants to ensure that the WSA can decrypt, inspect, and re-encrypt traffic without causing certificate errors for users. Which configuration is required on the WSA?

Accepted Answer

Upload a CA-signed certificate and enable HTTPS Proxy with a decryption policy.. HTTPS decryption on Cisco WSA requires a trusted CA-signed certificate that the appliance uses to generate per-site certificates. The decryption policy determines which traffic to decrypt. This setup allows the WSA to act as a man-in-the-middle, decrypting and inspecting traffic before re-encrypting it to the destination. Without a trusted certificate, users would see certificate errors, so uploading a CA-signed certificate and enabling the decryption policy is essential.

Answer

Enable SSLv3 and use a self-signed certificate for decryption.

Answer

Install a client certificate on all user devices and enable mutual authentication.

Answer

Configure a passthrough policy for all HTTPS traffic and enable malware scanning.

Question 8

A security operations center is using Cisco Firepower Management Center (FMC) to manage a Firepower NGFW. They want to block outbound traffic that matches known malware command-and-control (C2) domains and IP addresses. The analyst wants to ensure the blocklist is automatically updated from Cisco Talos intelligence. Which feature should be configured on the FMC?

Accepted Answer

Security Intelligence with DNS and IP blocklists sourced from Talos. Cisco Firepower's Security Intelligence feature leverages Talos feeds to dynamically block traffic to known malicious domains and IPs. By configuring DNS and IP blocklists with Talos as the source, the FMC automatically updates the blocklist, ensuring protection against current C2 infrastructure. This is the most efficient and accurate method for the scenario.

Answer

SSL Decryption policy with certificate pinning

Answer

Intrusion Prevention System (IPS) with custom signatures

Answer

Access Control Policy with manual IP blocklist entries

Question 9

A company uses Cisco Secure Email Gateway and wants to prevent outbound email from being flagged as spam by recipients because of spoofing. The security team has already published SPF records and wants to add cryptographic signing so that receiving servers can verify the domain. Which record should be published in DNS?

Accepted Answer

A DKIM record containing the public key for the signing selector. Cryptographic signing of outbound email is provided by DKIM, which publishes a public key in DNS so receivers can verify the signature added by the sending gateway. SPF authorizes sending IPs but does not sign messages, DMARC defines handling policy based on SPF or DKIM results, and BIMI controls logo display. Only the DKIM record supplies the public key needed for signature verification.

Answer

An SPF record with a hard fail qualifier of -all

Answer

A DMARC record with a policy of p=reject

Answer

A BIMI record with a logo URL and authority evidence

Question 10

A security engineer is deploying Cisco Secure Firewall to inspect traffic for malicious content. The engineer needs to ensure that the firewall can detect and block threats in both inbound and outbound directions, and that file transfers are inspected for malware. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure intrusion prevention policy. To detect and block threats in both directions and inspect file transfers, the firewall must have both a file policy with malware inspection and an intrusion prevention policy. The file policy handles file reputation and malware analysis, while the IPS policy detects and blocks exploit traffic. Together, they provide comprehensive threat inspection. SSL decryption and network discovery may enhance visibility but are not strictly required to meet the stated detection and blocking objectives.

Answer

Deploy a DNS sinkhole policy

Answer

Enable SSL decryption for all traffic

Answer

Configure a network discovery policy

Question 11

A security analyst is investigating an alert from Cisco Secure Network Analytics (formerly Stealthwatch) indicating a host is communicating with a known command-and-control server. The analyst wants to quickly identify the user and device associated with the host IP address. Which Cisco solution should be integrated with Secure Network Analytics to provide this identity context?

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the identity services platform that maintains a mapping of users and devices to IP addresses. Through pxGrid, it shares this context with Secure Network Analytics, enabling analysts to see the username and device associated with a suspicious IP. This integration is essential for rapid incident response and is a common exam objective.

Answer

Cisco Secure Firewall Management Center (FMC)

Answer

Cisco Umbrella

Answer

Cisco Secure Email Gateway (ESA)

Question 12

A security engineer is deploying Cisco Secure Network Analytics (formerly Stealthwatch) to detect anomalous traffic that may indicate data exfiltration. The engineer needs to configure the system to monitor internal-to-external traffic and generate alarms for suspicious flows. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Define inside and outside networks in the Secure Network Analytics configuration.. To detect anomalous internal-to-external traffic, Secure Network Analytics requires flow data (NetFlow, IPFIX, etc.) exported from network devices, and the definition of inside and outside networks to establish traffic direction and baselines. These two actions enable the system to monitor flows and generate alarms for suspicious activity. Other options are either not required or address different security functions.

Answer

Deploy a Cisco Umbrella virtual appliance for DNS security.

Answer

Configure SNMP traps on all network devices to send alerts to the Secure Network Analytics Manager.

Answer

Enable application visibility and control on the firewalls.

Question 13

A company has deployed Cisco Secure Firewall (Firepower) with SSL decryption to inspect outbound HTTPS traffic. Users report that some banking websites fail to load and show certificate errors after decryption is enabled. The security team wants to allow these sites without decryption while still inspecting other HTTPS traffic. Which action should be taken on the Secure Firewall to resolve this?

Accepted Answer

Add the banking sites to the SSL policy's Do Not Decrypt list using URL categories.. The SSL policy on Cisco Secure Firewall includes Do Not Decrypt rules that can match on URL category, reputation, or other criteria. By placing the banking sites in a Do Not Decrypt rule, the firewall passes their traffic without interception, eliminating certificate errors. Other HTTPS traffic continues to be decrypted and inspected, preserving security visibility.

Answer

Enable certificate pinning exceptions in the SSL policy.

Answer

Create a custom URL category for the banking sites and apply a block action.

Answer

Disable SSL decryption globally on the Secure Firewall.

Question 14

A company is using Cisco Umbrella to enforce DNS-layer security. An employee attempts to visit a domain that is categorized as 'Command and Control' by Umbrella. The security team wants to ensure the user sees a block page and that the attempt is logged. Which Umbrella feature should be verified as enabled to meet this requirement?

Accepted Answer

Block page and logging configuration in the Umbrella policy. Cisco Umbrella's policy settings include options to display a block page and to log blocked requests. When a domain is categorized as Command and Control and the policy blocks it, enabling the block page ensures the user is notified, and logging records the event for security monitoring. Verifying these settings directly addresses the requirement. Other features like DNSCrypt, Intelligent Proxy, or DoH do not control block page presentation or logging for DNS-layer blocks.

Answer

Intelligent Proxy for HTTP inspection

Answer

DNSCrypt validation

Answer

DNS over HTTPS (DoH) enforcement

Question 15

A network security administrator is configuring Cisco Firepower NGFW to block outbound traffic to known malicious IP addresses and domains. The administrator wants to ensure that the system can automatically update its threat intelligence without manual intervention. Which feature should be enabled to achieve this?

Accepted Answer

Security Intelligence feeds. Security Intelligence feeds in Cisco Firepower NGFW are dynamic lists of malicious IPs, URLs, and DNS names that are automatically updated by Cisco Talos. Enabling these feeds allows the firewall to block traffic to known malicious destinations without manual intervention. This directly satisfies the requirement for automatic threat intelligence updates, unlike URL filtering, IPS, or AMP, which serve different purposes.

Answer

Cisco Advanced Malware Protection (AMP) for networks

Answer

Intrusion prevention system (IPS) policies

Answer

Access control policy with URL filtering