350-701 Endpoint Security and Identity Practice Test 5 — 15 Questions

Question 1

A security administrator notices that a file initially classified as 'unknown' by Cisco AMP for Endpoints was later determined to be malicious after execution. Which feature allows the administrator to see the file's propagation and impact on endpoints?

Accepted Answer

Device Trajectory. Device Trajectory is the correct answer because it provides a chronological timeline of a file's activity across all endpoints, showing its origin, propagation, and actions taken after execution. This feature is specifically designed to visualize the impact and spread of malicious files that were initially unknown but later determined to be malicious by Cisco AMP for Endpoints.

Answer

Exploit Prevention

Answer

Endpoint IOC Scanning

Answer

SHA-256 Disposition

Question 2

An organization wants to provide network access to guest users through Cisco ISE. Guests must register themselves and accept an acceptable use policy before gaining internet-only access. Which guest access method should be configured?

Accepted Answer

Self-registration. Self-registration is the correct guest access method because it allows guest users to create their own credentials and accept an acceptable use policy (AUP) before being granted internet-only access. Cisco ISE's self-registration portal handles the entire workflow: user provides details, accepts the AUP, and ISE provisions a temporary account with restricted access, typically via a sponsored or direct access policy.

Answer

802.1X with PEAP-MSCHAPv2

Answer

MAB

Answer

Sponsor portal

Question 3

In a Cisco ISE deployment, a network administrator needs to dynamically change the VLAN assignment for an endpoint after a posture assessment determines that the endpoint is non-compliant. Which ISE feature enables this dynamic change without re-authentication?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to send updates to the network device to change VLAN, ACL, or other attributes without requiring the endpoint to re-authenticate.

Answer

MAB

Answer

Profiling

Answer

TrustSec

Question 4

Cisco ISE is performing profiling on a network. It receives a DHCP request from a device with vendor class identifier 'MSFT 5.0' and an HTTP user-agent 'Mozilla/5.0 (Windows NT 10.0)'. Which probes are most likely used to collect this information?

Accepted Answer

DHCP probe and HTTP probe. The DHCP probe captures DHCP packets, including the vendor class identifier (option 60) which reveals the device type (e.g., 'MSFT 5.0' for Windows). The HTTP probe intercepts HTTP traffic and parses the User-Agent header (e.g., 'Mozilla/5.0 (Windows NT 10.0)') to identify the operating system and browser. Together, these two probes collect the exact information described in the question.

Answer

Device Sensor and SNMP probe

Answer

HTTP probe and Device Sensor

Answer

DHCP probe and SNMP probe

Question 5

An organization wants to enforce multi-factor authentication for remote VPN access. Cisco AnyConnect is used as the VPN client. Which Cisco product integrates with AnyConnect to provide MFA capabilities such as push notifications and one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo is the correct answer because it is the Cisco product specifically designed to integrate with AnyConnect for multi-factor authentication (MFA). Duo provides push notifications, one-time passwords (OTP), and other MFA methods by acting as an authentication proxy that validates secondary factors via RADIUS or SAML before allowing VPN access.

Answer

Cisco ISE

Answer

Cisco SecureX

Answer

Cisco AMP for Endpoints

Question 6

A network engineer is troubleshooting 802.1X authentication on a Cisco switch. Users report that they cannot authenticate. The engineer verifies that the switch (authenticator) is configured correctly and the RADIUS server (ISE) is reachable. Which component is most likely misconfigured on the client side?

Accepted Answer

Supplicant. The supplicant is the client software that initiates 802.1X authentication. If users cannot authenticate, the supplicant configuration (e.g., EAP method, credentials) is often the issue.

Answer

Authentication server

Answer

RADIUS shared secret

Answer

Authenticator

Question 7

During a security incident, an analyst uses Cisco AMP for Endpoints to remotely investigate a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to continue the investigation. Which AMP action should be taken?

Accepted Answer

Isolate. Process isolation is not a standard AMP action; however, AMP allows endpoint isolation (network containment) and remote shell for investigation. The best option is to isolate the endpoint and use remote shell. But since only one action is allowed, 'Isolate' is the correct answer as it blocks network traffic while allowing AMP management.

Answer

Process isolation

Answer

File quarantine

Answer

Remove connector

Question 8

A company wants to implement network access control for IoT devices that do not support 802.1X. Which Cisco ISE feature can be used to grant these devices network access based on their MAC address?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) is the correct Cisco ISE feature because it allows network access for devices that cannot perform 802.1X, such as IoT devices. MAB works by using the device’s MAC address as the authentication credential; ISE checks the MAC address against an allowed list (e.g., endpoint identity store) and grants or denies access accordingly. This is the standard fallback mechanism for non-802.1X-capable endpoints in a wired or wireless network.

Answer

Guest access

Answer

Profiling

Answer

Posture assessment

Question 9

An organization requires that endpoints must have antivirus running and up-to-date patches before being granted full network access. Cisco ISE is used for authentication. Which ISE component enforces these requirements?

Accepted Answer

Posture assessment. C is correct because Cisco ISE Posture Assessment is the component specifically designed to check endpoints for compliance with security policies, such as having antivirus running and up-to-date patches. It evaluates the endpoint's state before granting full network access, and can enforce remediation or restrict access based on the results.

Answer

Guest access

Answer

TrustSec

Answer

Profiling

Question 10

A security engineer is configuring Cisco ISE for 802.1X authentication using EAP-TLS. What must be deployed on the endpoints to support this authentication method?

Accepted Answer

A client certificate. EAP-TLS requires a client certificate on the supplicant for mutual authentication.

Answer

A username and password

Answer

A TOTP token

Answer

A shared secret

Question 11

A company uses Cisco AMP for Endpoints and wants to deploy it on mobile devices running iOS and Android. Which deployment method is supported for these platforms?

Accepted Answer

App Store or Google Play. Cisco AMP for Endpoints is available for iOS and Android via the respective app stores (MDM is also possible, but the question implies direct deployment).

Answer

Group Policy Object (GPO)

Answer

SCCM

Answer

JAMF Pro

Question 12

Cisco ISE is configured to assign Security Group Tags (SGTs) to endpoints based on their identity. This is part of which Cisco security architecture?

Accepted Answer

Cisco TrustSec. Cisco TrustSec is the security architecture that uses Security Group Tags (SGTs) to enforce access control based on identity rather than IP addresses. Cisco ISE acts as the policy decision point, dynamically assigning SGTs to endpoints and distributing them via protocols like SXP or inline tagging, enabling consistent policy enforcement across the network.

Answer

Cisco Duo

Answer

Cisco SecureX

Answer

Cisco AMP

Question 13

A security analyst is investigating an alert from Cisco AMP for Endpoints. The analyst wants to perform remote actions on the endpoint. Which TWO actions are available in AMP for Endpoints? (Choose two.)

Accepted Answer

File quarantine. AMP for Endpoints allows file quarantine and remote shell for investigation. Process isolation is not a standard action; endpoint isolation is a separate action.

Answer

Just-in-time access

Answer

Password vaulting

Answer

Process isolation

Question 14

A company is deploying Cisco ISE for network access control. They need to authenticate devices that do not support 802.1X, such as printers and IP phones. Which TWO methods can be used to authenticate these devices? (Choose two.)

Accepted Answer

MAB. MAB uses MAC address for authentication. Profiling can identify the device and then ISE can apply policies, but profiling alone does not authenticate; it is often combined with MAB. The question asks for authentication methods, so MAB and (if the device can be profiled and then authenticated via a policy) but typically MAB is the primary method. Another method is to use a device certificate if the device supports it, but the question says non-802.1X devices. So MAB and possibly web authentication (guest portal) for devices that can browse. However, the most common are MAB and web authentication. But from ISE perspective, for non-supplicant devices, MAB and web-auth are options. Since the question says 'authenticate', and web-auth is for guest, I'll include MAB and device registration (which is not standard). Better: MAB and local database authentication via web portal. However, to be precise, the two methods are MAB and authentication using a local or AD account via a web portal (for devices that can do HTTP). But the options: A) 802.1X (not supported), B) MAB, C) Profiling, D) Guest portal, E) Device registration. The correct two: MAB and Guest portal (since guest portal can provide authentication for non-supplicant devices).

Answer

802.1X

Answer

Profiling

Answer

Device registration via posture agent

Question 15

An organization wants to implement Privileged Access Management (PAM) using Cisco SecureX and CyberArk. Which THREE capabilities are typically associated with PAM solutions? (Choose three.)

Accepted Answer

Password vaulting. Password vaulting (B) is a core PAM capability because it securely stores privileged credentials in an encrypted repository, enforcing policies for checkout, rotation, and access control. CyberArk's Vault, for example, uses AES-256 encryption and integrates with Cisco SecureX to provide centralized credential management, ensuring that passwords are never exposed in plaintext.

Answer

Endpoint isolation

Answer

File quarantine