350-701 Endpoint Security and Identity — 40 Questions

Question 1

A network administrator wants to deploy Cisco AMP for Endpoints to protect endpoints. Which feature allows the detection of a file that was initially deemed benign but later discovered to be malicious?

Accepted Answer

Retrospective Security. Retrospective security in Cisco AMP for Endpoints continuously monitors file behavior and can re-evaluate files that were previously allowed, updating their disposition if malicious activity is detected later.

Answer

File Reputation

Answer

IOC Scanning

Answer

Exploit Prevention

Question 2

An engineer is configuring Cisco ISE for 802.1X authentication. The organization has a mix of devices, including some that do not support 802.1X supplicants. Which method should the engineer use to allow these non-supplicant devices to authenticate?

Accepted Answer

Enable MAC Authentication Bypass on the authenticator. MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address, which is sent as the username and password.

Answer

Deploy Cisco AMP connectors on all endpoints

Answer

Configure a guest portal for self-registration

Answer

Use EAP-TLS with device certificates

Question 3

During a security incident, a SOC analyst notices that a malicious file was executed on an endpoint. Using Cisco AMP for Endpoints, which feature should the analyst use to visualize the file's propagation and activities across the network over time?

Accepted Answer

Device Trajectory. Device Trajectory provides a timeline view of file and process activities on an endpoint, showing how a file propagated and what actions it performed, which is crucial for incident investigation.

Answer

Orbital Advanced Search

Answer

IOC Scan

Answer

File Reputation Lookup

Question 4

In Cisco ISE, profiling is used to identify device types. Which probe must be enabled for ISE to determine the operating system of a device by analyzing DHCP options?

Accepted Answer

DHCP Probe. DHCP Probe analyzes DHCP packet options (e.g., option 55) to identify the device's OS or vendor class, enabling ISE to profile the device type.

Answer

Device Sensor

Answer

HTTP Probe

Answer

SNMP Probe

Question 5

An organization wants to enforce endpoint posture compliance before granting network access. In Cisco ISE, which component performs the actual checks on the endpoint to verify antivirus status and patch levels?

Accepted Answer

Posture Agent. The posture agent (Cisco AnyConnect Posture Module or ISE Posture Agent) runs on the endpoint and performs checks for required software, updates, and configurations, then reports back to ISE.

Answer

Network Access Device (switch/WLC)

Answer

ISE Policy Service Node

Answer

Profiling Probe

Question 6

A security engineer is configuring Duo for VPN authentication with AnyConnect. Which authentication factor does Duo provide in addition to the user's primary credentials?

Accepted Answer

Second-factor authentication (push, TOTP, etc.). Duo provides second-factor authentication, typically via push notification, TOTP, or hardware token, which is used after the user enters their primary credentials (e.g., LDAP password).

Answer

RADIUS accounting

Answer

SAML assertion

Answer

Machine certificate validation

Question 7

In a Cisco ISE deployment, after a device passes posture assessment, ISE needs to dynamically change the VLAN assignment for the device. Which protocol or feature enables ISE to send a new authorization policy to the network access device without requiring the endpoint to reauthenticate?

Accepted Answer

CoA (Change of Authorization). Change of Authorization (CoA) allows ISE to send real-time authorization changes (e.g., VLAN change) to the NAD using RADIUS Disconnect or Change of Authorization messages, without requiring the client to reauthenticate.

Answer

TrustSec SGT assignment

Answer

RADIUS Accounting

Answer

MAB

Question 8

Which component in the 802.1X architecture is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (e.g., switch or wireless LAN controller) acts as a proxy, forwarding EAP messages between the supplicant (client) and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication Server

Answer

Policy Service Node

Question 9

An organization uses Cisco AMP for Endpoints and wants to perform a remote investigation on an infected endpoint. The security analyst needs to isolate the endpoint from the network while collecting forensic data. Which AMP feature should be used?

Accepted Answer

Endpoint Isolation and Remote Shell. Cisco AMP for Endpoints provides endpoint isolation and remote shell capabilities, allowing analysts to isolate a compromised endpoint from the network and perform forensic investigation remotely.

Answer

Device Trajectory

Answer

File Quarantine

Answer

Orbital Advanced Search

Question 10

In Cisco ISE, which protocol is used for EAP-TLS authentication, and what is the primary requirement for the client to successfully authenticate?

Accepted Answer

EAP-TLS, requiring a client certificate. EAP-TLS uses certificates for mutual authentication. The client must have a valid certificate (typically issued by a CA trusted by ISE) to authenticate successfully.

Answer

EAP-FAST, requiring a PAC file

Answer

LEAP, requiring a shared secret

Answer

PEAP-MSCHAPv2, requiring username and password

Question 11

A company wants to implement privileged access management (PAM) to secure administrative credentials. They need a solution that provides just-in-time access and session recording. Which product integrated with Cisco SecureX can fulfill these requirements?

Accepted Answer

CyberArk. CyberArk is a leading PAM solution that provides just-in-time access, session recording, and password vaulting. Cisco SecureX can integrate with CyberArk for unified visibility.

Answer

Cisco Duo

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 12

In Cisco AMP for Endpoints, which technology prevents exploit techniques such as code injection and memory corruption at runtime without relying on signatures?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP uses exploit mitigation techniques like memory protection and injection detection to block common exploit methods (e.g., buffer overflows, DLL injection) without needing signatures.

Answer

Indicators of Compromise (IOC)

Answer

File Reputation

Answer

Orbital Advanced Search

Question 13

A network administrator is configuring Cisco ISE for guest access. The company requires a solution where guests can create their own accounts and receive network access after a sponsor approves. Which two components must be configured? (Choose two.)

Accepted Answer

Self-registration portal. To allow guests to self-register and have a sponsor approve, ISE needs a self-registration portal and a sponsor portal.

Answer

Hotspot portal

Answer

Posture assessment

Answer

MAB

Question 14

An organization wants to deploy endpoint hardening measures. Which three of the following are considered endpoint hardening techniques? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting, host-based IPS, and EDR capabilities are all endpoint hardening techniques that protect endpoints by controlling what runs, detecting threats, and enabling response.

Answer

RADIUS authentication

Answer

SNMP polling

Question 15

An administrator is configuring Cisco ISE profiling using Device Sensor. Which two types of information can the Device Sensor collect from endpoints? (Choose two.)

Accepted Answer

DHCP details (hostname, vendor class). Cisco Device Sensor can collect DHCP information (e.g., hostname, vendor class) and HTTP information (e.g., user-agent) to identify device type and operating system.

Answer

RADIUS accounting logs

Answer

NetFlow data

Answer

SNMP MIB objects

Question 16

A security engineer is deploying Cisco AMP for Endpoints in an organization. To ensure that any malicious file that was initially allowed but later determined to be malicious can be traced, which feature should be used?

Accepted Answer

Device Trajectory. Cisco AMP uses retrospective security to continuously analyze file behavior. If a file is later deemed malicious, the Device Trajectory shows its propagation path and actions, allowing for containment and remediation.

Answer

SHA-256 file disposition

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Question 17

During 802.1X authentication, which component acts as the intermediary that forwards authentication requests between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X architecture, the authenticator (typically a switch or wireless LAN controller) is the network device that relays EAP messages between the supplicant and the authentication server (e.g., ISE).

Answer

Authentication server

Answer

RADIUS proxy

Answer

Supplicant

Question 18

A network administrator needs to provide network access to a legacy printer that does not support 802.1X. Which Cisco ISE feature should be used to authenticate this device?

Accepted Answer

MAC Authentication Bypass. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicant software to authenticate based on their MAC address. ISE can be configured to accept the MAC address as the credential.

Answer

Posture assessment

Answer

Guest access with self-registration

Answer

Profiling using DHCP probe

Question 19

An organization uses Cisco ISE for network access control. After a user authenticates via 802.1X, a posture assessment determines that the user's antivirus definitions are outdated. What ISE feature can be used to dynamically restrict the user's network access until the issue is resolved?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change the user's authorization state, such as moving them to a restricted VLAN or applying a more restrictive ACL, after posture assessment.

Answer

Profiling

Answer

TrustSec SGT assignment

Answer

Guest portal

Question 20

Which Cisco security product provides multi-factor authentication through push notifications, TOTP, and hardware tokens?

Accepted Answer

Cisco Duo. Cisco Duo is a multi-factor authentication solution that offers various methods including push notifications, time-based one-time passwords (TOTP), and hardware tokens.

Answer

Cisco AnyConnect

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints