350-701 Content Security — Timed 30 Questions

Question 1

An organization is deploying Cisco ESA and wants to ensure that outbound emails containing credit card numbers are blocked. The administrator configures a DLP policy to scan for credit card patterns. However, some legitimate emails with credit card numbers are being incorrectly blocked. What is the best approach to reduce false positives while still preventing data leakage?

30 minute time limit — choose an answer to begin.

Accepted Answer

Change the DLP action from 'Block' to 'Confirm with Sender'. Changing the DLP action from 'Block' to 'Confirm with Sender' allows the Cisco ESA to send a notification to the sender when a credit card pattern is detected, asking them to confirm whether the email should be sent. This reduces false positives by giving legitimate senders a chance to override the block, while still preventing accidental data leakage by requiring explicit confirmation. The DLP policy remains active, so unauthorized or unconfirmed outbound emails containing credit card numbers are still stopped.

Answer

Disable the DLP policy for outbound email

Answer

Increase the DLP sensitivity threshold

Answer

Add all senders to a DLP exemption list

Question 2

An organization using Cisco WSA in transparent proxy mode with WCCP redirect notices that some HTTPS traffic is not being decrypted for inspection. The administrator has enabled SSL decryption but certain traffic still bypasses. What is the most likely cause?

Accepted Answer

The SSL decryption policy is not set to decrypt on port 443. In transparent proxy mode with WCCP, the WSA intercepts traffic based on the WCCP service and redirect rules. If the SSL decryption policy does not explicitly include port 443 (or the relevant HTTPS ports) in its decryption criteria, HTTPS traffic on those ports bypasses decryption. Enabling SSL decryption globally is not enough; the policy must match the traffic.

Answer

The clients are not configured to use a proxy

Answer

The web server certificate is self-signed

Answer

The WSA is operating in explicit proxy mode

Question 3

A Cisco ESA administrator is investigating an increase in false positive detections from the outbreak filter. The filter is configured to use TALOS intelligence and has a threshold of 'Medium'. Which action would most effectively reduce false positives while maintaining protection against new outbreaks?

Accepted Answer

Change the threshold to 'High'. The outbreak filter in Cisco ESA uses Talos intelligence and a threshold that determines sensitivity. Raising the threshold from 'Medium' to 'High' makes the filter more selective, requiring stronger evidence before classifying a message as an outbreak, which reduces false positives while still catching clear, high-confidence outbreaks. This maintains protection against genuine new outbreaks without disabling the filter.

Answer

Change the threshold to 'Low'

Answer

Disable the outbreak filter

Answer

Exempt all internal senders from the filter

Question 4

A company is deploying Cisco Secure Web (WSA) and wants to integrate with Active Directory for user-based policies. The proxy is in transparent mode. Which technology allows the WSA to identify users transparently without requiring client configuration?

Accepted Answer

Transparent user identification (TUI). Transparent User Identification (TUI) allows the WSA, when deployed in transparent mode, to identify users without any client-side configuration by leveraging existing authentication events such as Active Directory login scripts or Cisco ISE. It maps IP addresses to usernames by monitoring authentication traffic, enabling user-based policies even when the proxy is invisible to the client. This is the only option that works transparently without client changes.

Answer

Explicit proxy configuration on browsers

Answer

WCCP redirect

Answer

Kerberos authentication proxy

Question 5

An administrator is configuring Cisco ESA to protect against Business Email Compromise (BEC) attacks. Which TWO of the following features are most effective in detecting and mitigating BEC?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) [CORRECT] is effective against BEC because it inspects outbound and inbound message content for sensitive data patterns (PII, financial data, credentials) and can quarantine or encrypt messages, directly countering the data-exfiltration and impersonation goals of BEC. DMARC verification [CORRECT] is effective because it validates the From: header against SPF/DKIM alignment and enforces the domain owner's policy (p=none/quarantine/reject), blocking spoofed executive or partner domains commonly used in BEC impersonation. SenderBase reputation is not the best fit because it scores sending IP/domain reputation and is better suited to spam and malware volume detection than to targeted, low-volume BEC social engineering. Outbreak filters are not the best fit because they target virus outbreak and phishing URL waves using outbreak rules, not BEC impersonation or content-based fraud. AMP for Email is not the best fit because it analyzes attachments and URLs for malware, which is largely irrelevant to BEC messages that typically carry no malicious payload.

Answer

SenderBase reputation

Answer

Outbreak filters

Answer

AMP for Email

Question 6

A Cisco WSA administrator needs to implement HTTPS inspection for traffic from internal users. The administrator wants to avoid decrypting traffic to financial and healthcare sites due to compliance requirements. Which THREE actions should the administrator take to configure this policy?

Accepted Answer

Create a decryption policy with action 'Decrypt' for all traffic. Option B is correct because a decryption policy with the action 'Decrypt' is the mechanism that enables the WSA to perform HTTPS inspection on the traffic that should be inspected. Option C is correct because HTTPS decryption requires the WSA's CA certificate to be trusted by client devices; otherwise browsers will present certificate warnings and the inspection will fail. Option E is correct because a bypass rule (action 'Do Not Decrypt' or 'Bypass') for the 'Finance' and 'Health' URL categories ensures compliance-sensitive financial and healthcare traffic is not decrypted. Option A is incorrect because explicit mode is a deployment/proxy mode choice, not a required step for defining which traffic is decrypted or bypassed. Option D is incorrect because AMP file scanning is an additional security feature for inspected traffic and is not required to implement the HTTPS inspection policy or its compliance bypass.

Answer

Configure the proxy in explicit mode

Answer

Enable AMP file scanning for decrypted traffic

Question 7

An organization wants to implement URL filtering based on user identity. The Cisco WSA must integrate with which directory service to apply policies per user or group?

Accepted Answer

Active Directory. Cisco WSA integrates with Active Directory to authenticate users and apply URL filtering policies based on user or group identity. AD provides the user and group structure that WSA uses for identity-based policies, typically via LDAP queries or the WSA's AD agent/connector. This enables per-user and per-group web policy enforcement.

Answer

RADIUS

Answer

TACACS+

Answer

LDAP

Question 8

Which Cisco NGFW technology can be used to block social media categories such as Facebook and Twitter during business hours?

Accepted Answer

URL Filtering. URL Filtering on Cisco NGFW (Firepower) categorizes and blocks web traffic by URL category, including social media categories like Facebook and Twitter. It can be scheduled to apply only during business hours via time-range objects in the access control policy. This directly addresses the requirement to block specific categories on a schedule.

Answer

TLS Server Identity Discovery

Answer

Intrusion Prevention

Answer

Application Control

Question 9

A company receives a spear-phishing email that appears to come from the CEO requesting an urgent wire transfer. What type of email attack is this?

Accepted Answer

Whaling. Whaling targets senior executives with personalized attacks.

Answer

Phishing

Answer

Spear Phishing

Answer

Malspam

Question 10

A Cisco WSA administrator wants to apply different web usage policies based on user group membership. Which two methods can be used to identify users transparently? (Choose two.)

Accepted Answer

Active Directory integration. Option B (Active Directory integration) is correct because the WSA can join or query Active Directory to map client IP addresses to user and group identities via the AD agent, allowing group-based policies to be applied without prompting the user for credentials. Option D (NTLM authentication) is correct because the WSA can transparently authenticate users through the NTLM challenge/response mechanism (often with AD as the backend), identifying the user and their group membership without an explicit login prompt. Option A (Explicit proxy configuration) is not transparent, since the client browser must be manually configured to point at the proxy. Option C (LDAP bind) is a directory query/authentication method but by itself does not transparently identify the user's group from the client session. Option E (WCCP redirect) transparently redirects traffic to the WSA but does not itself identify the user or their group membership.

Answer

Explicit proxy configuration

Answer

LDAP bind

Answer

WCCP redirect

Question 11

An organization wants to block access to malicious websites using Cisco Umbrella. Which two protection layers are available with the Umbrella SIG? (Choose two.)

Accepted Answer

Cloud proxy. Cisco Umbrella SIG (Secure Internet Gateway) provides DNS-layer security (option C), which blocks malicious domains at the DNS resolution stage before any connection is made, making it the first and most fundamental layer of protection. It also provides a cloud proxy (option B), which inspects and enforces policy on web traffic (HTTP/HTTPS) to block malicious sites and content that DNS-layer filtering alone cannot catch. Together, DNS security and the cloud proxy form the two core protection layers of Umbrella SIG for blocking access to malicious websites. IPS/IDS (A) is a network intrusion prevention capability not delivered as an Umbrella SIG protection layer, VPN termination (D) is a remote-access function rather than a web-blocking layer, and email sandboxing (E) belongs to Cisco Email Security, not Umbrella SIG.

Answer

IPS/IDS

Answer

VPN termination

Answer

Email sandboxing

Question 12

Which Cisco cloud-based security solution provides DNS-layer security to block requests to malicious domains?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Security Internet Gateway) is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. When a user attempts to resolve a domain, Umbrella checks the request against its threat intelligence database and blocks the resolution if the domain is known to be malicious, preventing the connection before it is established.

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Answer

Cisco ESA

Question 13

A company wants to block social media access for employees during work hours. Which Cisco Firepower NGFW feature should be used to achieve this?

Accepted Answer

Application Control. Firepower NGFW application control can block specific application categories such as social media.

Answer

DLP Policies

Answer

URL Filtering

Answer

TLS Server Identity Discovery

Question 14

A company using Cisco ESA receives an email that appears to be from the CEO requesting an urgent wire transfer. The email fails SPF and DKIM checks but passes DMARC. What is the most likely explanation?

Accepted Answer

DMARC policy is set to 'p=none'. DMARC policy can be set to 'none' (monitoring only) or 'quarantine'/'reject' based on SPF/DKIM alignment. If DMARC passes, it means the policy is not enforced, or the SPF/DKIM alignment still passes despite individual failures. However, if SPF and DKIM both fail, DMARC would also fail unless the policy is 'none'. The scenario suggests DMARC is set to 'none', so no action is taken.

Answer

The email passed SPF alignment

Answer

DKIM signature was valid but not aligned

Answer

The sender IP is in the SPF whitelist

Question 15

A SOC analyst notices that a user downloaded a malicious file from a website. The Cisco WSA is configured with AMP file scanning. However, the file was not blocked. Which scenario best explains why AMP failed to detect the file?

Accepted Answer

The file was a zero-day malware not yet analyzed by AMP. Cisco WSA with AMP uses Cisco Talos threat intelligence to detect known malware signatures. A zero-day malware sample that has never been seen or analyzed by Talos will not have a signature in the AMP cloud database, so the file will not be flagged as malicious. AMP's retrospective detection may later identify it once Talos updates its intelligence, but at the time of download, it remains undetected. This is the fundamental limitation of signature-based and reputation-based detection for unknown threats.

Answer

The file was cached from a previous scan

Answer

The file was less than 10 KB

Answer

SSL decryption was disabled

Question 16

An administrator wants to enforce identity-based policies on Cisco WSA by integrating with Active Directory. Which method allows the WSA to identify users transparently without requiring client software?

Accepted Answer

Transparent user identification using Active Directory agent. Transparent user identification using an Active Directory agent allows Cisco WSA to identify users without client software by querying AD domain controllers for logon events and mapping IP addresses to usernames. This method is transparent because it does not require explicit proxy configuration or client-side agents on end-user machines.

Answer

LDAP bind with user credentials

Answer

Explicit proxy with PAC file

Answer

Kerberos authentication with keytab file

Question 17

An organization wants to use Cisco Umbrella SIG to enforce security policy for remote users. Which deployment method allows Umbrella to inspect traffic for all ports and protocols, not just DNS?

Accepted Answer

Deploying the Umbrella roaming client. Deploying the Umbrella roaming client allows Umbrella to inspect traffic for all ports and protocols, not just DNS, because the roaming client installs a lightweight agent on the endpoint that redirects all internet-bound traffic to Umbrella's SIG (Secure Internet Gateway) for full inspection. This provides layer 3/4 enforcement and supports policies beyond DNS, such as IPsec tunnels or web proxy. It is the recommended method for remote users to get full SIG protection.

Answer

Configuring a PAC file for proxy

Answer

Using IPsec tunnel to Umbrella

Answer

DNS-layer enforcement only

Question 18

A network administrator wants to deploy Cisco WSA as a transparent proxy using WCCP. Which traffic redirection method does WCCP use?

Accepted Answer

WCCP redirects traffic from the router to the WSA. WCCP (Web Cache Communication Protocol) redirects traffic from a router or switch to the Cisco WSA using GRE tunneling or Layer 2 redirection. The correct answer is that WCCP redirects traffic from the router to the WSA, which is the fundamental mechanism. GRE tunneling is the encapsulation method WCCP uses, but the question asks which traffic redirection method WCCP uses, and the answer describes the redirect behavior.

Answer

GRE tunneling

Answer

DNS redirection

Answer

PAC file configuration on clients

Question 19

During an email security audit, it is discovered that some phishing emails are passing through the Cisco ESA. Analysis shows the emails have valid SPF and DKIM signatures but are classified as phishing. What additional Cisco ESA feature should be tuned to improve detection?

Accepted Answer

Enable DMARC with reject policy. Even with valid SPF/DKIM, phishing can occur if the domain is compromised. Tuning anti-spam or outbreak filters can help, but DMARC can provide additional protection by enforcing alignment.

Answer

Disable SPF checking

Answer

Increase the SBRS threshold

Answer

Reduce DLP scanning sensitivity

Question 20

A security analyst notices that a user is receiving a high volume of emails from unknown senders with links to malicious sites. The ESA is configured with Cisco TALOS threat intelligence. Which ESA feature should the analyst configure to block these emails based on the reputation of the sender before they reach the user's inbox?

Accepted Answer

IronPort SenderBase reputation. IronPort SenderBase is the reputation service that assigns a reputation score to sending IP addresses and domains based on global traffic patterns, volume, and threat intelligence. Configuring SenderBase reputation filtering on the ESA allows the appliance to reject or throttle messages from senders with poor reputations before they reach the user's inbox. This directly addresses the requirement to block based on sender reputation.

Answer

Anti-malware with AMP for Email

Answer

Outbreak filters

Answer

DLP policies