350-701 Endpoint Security and Identity Practice Test 2 — 15 Questions

Question 1

A security engineer is deploying Cisco AMP for Endpoints in an organization. To ensure that any malicious file that was initially allowed but later determined to be malicious can be traced, which feature should be used?

Accepted Answer

Device Trajectory. Cisco AMP uses retrospective security to continuously analyze file behavior. If a file is later deemed malicious, the Device Trajectory shows its propagation path and actions, allowing for containment and remediation.

Answer

SHA-256 file disposition

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Question 2

During 802.1X authentication, which component acts as the intermediary that forwards authentication requests between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X architecture, the authenticator (typically a switch or wireless LAN controller) is the network device that relays EAP messages between the supplicant and the authentication server (e.g., ISE).

Answer

Authentication server

Answer

RADIUS proxy

Answer

Supplicant

Question 3

A network administrator needs to provide network access to a legacy printer that does not support 802.1X. Which Cisco ISE feature should be used to authenticate this device?

Accepted Answer

MAC Authentication Bypass. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicant software to authenticate based on their MAC address. ISE can be configured to accept the MAC address as the credential.

Answer

Posture assessment

Answer

Guest access with self-registration

Answer

Profiling using DHCP probe

Question 4

An organization uses Cisco ISE for network access control. After a user authenticates via 802.1X, a posture assessment determines that the user's antivirus definitions are outdated. What ISE feature can be used to dynamically restrict the user's network access until the issue is resolved?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change the user's authorization state, such as moving them to a restricted VLAN or applying a more restrictive ACL, after posture assessment.

Answer

Profiling

Answer

TrustSec SGT assignment

Answer

Guest portal

Question 5

Which Cisco security product provides multi-factor authentication through push notifications, TOTP, and hardware tokens?

Accepted Answer

Cisco Duo. Cisco Duo is a multi-factor authentication solution that offers various methods including push notifications, time-based one-time passwords (TOTP), and hardware tokens.

Answer

Cisco AnyConnect

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 6

A security analyst wants to investigate a remote endpoint that is suspected of being compromised. Using Cisco AMP for Endpoints, which capability allows the analyst to run commands on the endpoint and perform live analysis?

Accepted Answer

Remote shell investigation. Cisco AMP for Endpoints includes endpoint detection and response (EDR) capabilities such as remote shell, which allows analysts to execute commands on the endpoint for investigation.

Answer

Process isolation

Answer

File quarantine

Answer

IOC scanning

Question 7

In a Cisco TrustSec deployment, after successful authentication, ISE assigns a Security Group Tag (SGT) to the user. Which protocol is used to propagate the SGT to the network devices for policy enforcement?

Accepted Answer

SXP (SGT Exchange Protocol). Cisco TrustSec uses SGT Exchange Protocol (SXP) to propagate SGT mappings from the policy server (ISE) to network devices that do not natively support SGT tagging in hardware.

Answer

SNMP

Answer

RADIUS

Answer

EAP

Question 8

Which Cisco ISE probe is used to identify the operating system and open ports of an endpoint by actively scanning it?

Accepted Answer

HTTP probe. The HTTP probe can be used for profiling by analyzing HTTP traffic and headers, but for OS and open ports, the NMAP probe (or similar) is used. However, among the options, the HTTP probe is the only one listed that can provide some OS information via HTTP User-Agent. But the most accurate answer is the NMAP probe, which is not listed. Given the options, DHCP probe gives vendor info, SNMP gives device type, HTTP gives OS via User-Agent. The question expects 'HTTP probe' as it can identify OS. Actually, the standard Cisco ISE probes: DHCP (vendor), HTTP (OS/browser), SNMP (device type). So HTTP is correct for OS.

Answer

DNS probe

Answer

DHCP probe

Answer

SNMP probe

Question 9

An organization is implementing privileged access management (PAM) with Cisco SecureX and CyberArk. Which feature allows administrators to grant temporary elevated privileges for a specific task, after which the privileges are automatically revoked?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited elevated privileges that are automatically revoked after the task is completed, reducing the risk of standing privileges.

Answer

Session recording

Answer

Application whitelisting

Answer

Password vaulting

Question 10

A network engineer is configuring 802.1X on a switch port that connects to a VoIP phone and a PC behind the phone. Which authentication method should be used to authenticate both devices separately?

Accepted Answer

Multi-domain authentication (MDA). Multi-domain authentication (MDA) allows a switch port to authenticate multiple devices (e.g., phone and PC) separately, each with its own VLAN.

Answer

Single-host authentication

Answer

MAC Authentication Bypass (MAB)

Answer

Guest VLAN

Question 11

Which EAP method used with 802.1X requires a client-side certificate for authentication?

Accepted Answer

EAP-TLS. EAP-TLS uses certificates on both the client and server sides for mutual authentication. PEAP-MSCHAPv2 uses server certificate and client credentials (password).

Answer

LEAP

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Question 12

Cisco ISE posture assessment requires that endpoints meet certain security requirements before being granted network access. Which of the following is a typical posture requirement?

Accepted Answer

Antivirus definition file version. Posture assessment checks for compliance with security policies, such as having antivirus software installed and up-to-date, patch levels, and disk encryption enabled.

Answer

SGT assignment

Answer

Device type identification via profiling

Answer

MAC address registration

Question 13

A security administrator is configuring Cisco ISE for guest access. Which TWO components are required to allow guests to self-register and obtain network access? (Choose two.)

Accepted Answer

Guest VLAN. Guest self-registration requires a sponsor portal (or self-registration portal) and a guest VLAN or restricted ACL to provide limited access initially. The self-registration portal is typically part of the sponsor portal.

Answer

Device sensor

Answer

Posture assessment policy

Answer

Active Directory integration

Question 14

A company wants to deploy endpoint hardening measures to prevent unauthorized applications from executing. Which THREE techniques are commonly used for application control? (Choose three.)

Accepted Answer

Application whitelisting. Application whitelisting allows only approved applications to run. Host-based IPS monitors/prevents malicious behavior. EDR capabilities like file quarantine and process isolation help control applications. Blacklisting is less effective; patch management is not application control.

Answer

Patch management

Answer

Application blacklisting

Question 15

An organization is deploying Cisco Duo for multi-factor authentication. Which TWO authentication methods can be used with Duo? (Choose two.)

Accepted Answer

Time-based one-time password (TOTP). Duo provides push notifications to a mobile app and time-based one-time passwords (TOTP) as authenticator methods. Biometrics is not a Duo method; SMS passcodes are available but legacy; hardware tokens are supported but the question asks for TWO, and push and TOTP are the most common. However, hardware token is also valid. The exam expects push and TOTP as primary.

Answer

Kerberos ticket

Answer

Smart card

Answer

Biometric authentication