350-701 Endpoint Security and Identity Practice Test 6 — 15 Questions

Question 1

A security administrator is implementing Cisco AMP for Endpoints and wants to identify files that were initially allowed but later determined to be malicious. Which feature allows the administrator to see the propagation of such a file across the environment?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP for Endpoints provides a timeline of file activity, showing where a file originated and how it spread, which is critical for retrospective security analysis.

Answer

Exploit Prevention

Answer

IOC Scanning

Answer

SHA-256 Disposition

Question 2

An engineer is configuring Cisco ISE for 802.1X authentication in a corporate network. A printer that does not support 802.1X needs to be granted network access. Which method should the engineer use to authenticate the printer?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows devices that cannot run an 802.1X supplicant to authenticate based on their MAC address. The printer's MAC is used as the credential against the authentication server.

Answer

Guest Portal

Answer

PEAP-MSCHAPv2

Answer

EAP-TLS

Question 3

A security analyst discovers that an endpoint was infected by a file that initially received a 'clean' disposition from Cisco AMP. The analyst needs to identify all other endpoints that executed the same file and examine their trajectory. Which approach should be used to find these endpoints in the AMP console?

Accepted Answer

Search for the file's SHA-256 hash in the AMP console to see all endpoints with that file. Option A is correct because Cisco AMP maintains a global file disposition database that maps SHA-256 hashes to all endpoints that have ever executed or stored that file. By searching for the file's SHA-256 hash in the AMP console, the analyst can instantly retrieve a list of all endpoints with that file, including those that received a 'clean' disposition before the file was later classified as malicious. This leverages AMP's cloud-based telemetry and file reputation system, enabling rapid identification of all affected systems without requiring additional scans or manual correlation.

Answer

Check the Device Trajectory of the infected endpoint and manually correlate with other endpoints

Answer

Use the IOC scanning feature to scan all endpoints for the file's signature

Answer

Run a retrospective security scan on all endpoints using the file's SHA-256 hash

Question 4

A network administrator is configuring Cisco ISE profiling to identify devices on the network. Which probe allows ISE to identify device type by analyzing the HTTP User-Agent string?

Accepted Answer

HTTP probe. The HTTP probe inspects HTTP packets, including the User-Agent field, to determine the operating system and browser type, aiding in device profiling.

Answer

DHCP probe

Answer

Device Sensor

Answer

SNMP probe

Question 5

An organization uses Cisco ISE to enforce posture compliance. After a user's machine is patched, ISE sends a command to the switch to reclassify the endpoint from a restricted VLAN to a full-access VLAN. Which ISE feature accomplishes this?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change an authenticated session's attributes, such as VLAN assignment or ACL, without requiring reauthentication.

Answer

Posture Assessment

Answer

Profiling

Answer

Guest Access

Question 6

Which component in an 802.1X deployment is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator (switch/WLC). The authenticator (typically a switch or wireless LAN controller) acts as an intermediary, forwarding EAP messages between the supplicant and the authentication server (ISE).

Answer

Supplicant

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Question 7

A company deploys Cisco Duo for multi-factor authentication to protect VPN access. Employees use AnyConnect to connect to the corporate network. After entering their credentials, they receive a push notification on their mobile device. Which Duo authentication method is being used?

Accepted Answer

Duo Push. Duo Push sends a push notification to the user's enrolled mobile device, which they can approve or deny. This is the most common method for VPN MFA with AnyConnect.

Answer

Bypass code

Answer

TOTP (Time-based One-Time Password)

Answer

Hardware token

Question 8

A security team is implementing Privileged Access Management (PAM) using CyberArk integrated with Cisco SecureX. They need to provide just-in-time access to a critical server for a specific task, with automatic password rotation after use. Which PAM capability addresses this requirement?

Accepted Answer

Password vaulting. Password vaulting securely stores and manages privileged credentials, enabling just-in-time access and automatic rotation after use to minimize exposure.

Answer

Remote shell investigation

Answer

Session recording

Answer

EDR file quarantine

Question 9

An endpoint security engineer wants to protect against memory injection attacks on endpoints running Windows. Which Cisco AMP feature should be enabled?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory-based attacks by monitoring and blocking techniques like buffer overflows and code injection.

Answer

Retrospective security

Answer

IOC scanning

Answer

Device Trajectory

Question 10

A network engineer is configuring Cisco ISE for wireless 802.1X authentication. The company wants to use certificate-based authentication for all corporate devices. Which EAP method should be configured?

Accepted Answer

EAP-TLS. EAP-TLS uses digital certificates for mutual authentication between the client and the server, providing strong security without requiring passwords.

Answer

EAP-MD5

Answer

PEAP-MSCHAPv2

Answer

LEAP

Question 11

An organization uses Cisco ISE with TrustSec to assign Security Group Tags (SGTs) to endpoints based on their role. An endpoint initially receives an SGT for 'Employees' but after a posture check reveals missing antivirus updates, ISE changes the SGT to 'Quarantine'. Which ISE feature dynamically updates the SGT?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) is the correct answer because it is the RADIUS-based mechanism (RFC 5176) that allows Cisco ISE to dynamically update an endpoint's Security Group Tag (SGT) after a posture check. When the posture assessment detects missing antivirus updates, ISE sends a CoA request to the network access device (e.g., switch or wireless LAN controller) to reauthenticate the session or push a new SGT, effectively moving the endpoint from 'Employees' to 'Quarantine' without requiring the user to manually reconnect.

Answer

Posture assessment

Answer

Guest access

Answer

Profiling

Question 12

A security analyst needs to investigate a potential breach on an endpoint running Cisco AMP. The analyst wants to remotely execute commands to gather forensic data and potentially isolate the endpoint from the network. Which Cisco AMP EDR capability should the analyst use?

Accepted Answer

Remote shell investigation. Remote shell investigation allows security analysts to execute commands on an endpoint remotely for live forensics, and process isolation can be used to contain threats.

Answer

Process isolation

Answer

Device Trajectory

Answer

File quarantine

Question 13

A network administrator is deploying Cisco ISE for network access control. The administrator needs to profile devices that connect to the network. Which TWO probes can be used to gather information for device profiling? (Choose two.)

Accepted Answer

DHCP probe. DHCP probe collects hostname and other DHCP options; HTTP probe captures User-Agent strings. Both are common profiling probes. SNMP and Device Sensor are also probes, but the question asks for TWO only.

Answer

SNMP probe

Answer

DNS probe

Answer

Device Sensor

Question 14

A security team is implementing endpoint hardening measures. They want to ensure that only approved applications can run, monitor for suspicious behavior, and have the ability to isolate processes if needed. Which THREE Cisco AMP features should they enable? (Choose three.)

Accepted Answer

Host-based IPS (Exploit Prevention). Application whitelisting (via Cisco AMP's application control) restricts execution to approved apps; host-based IPS (Exploit Prevention) monitors behavior; and EDR capabilities (process isolation) allow containment. These three together harden endpoints.

Answer

File quarantine

Answer

Retrospective security

Question 15

An administrator is configuring Cisco Duo for multi-factor authentication. Which THREE authentication methods can Duo provide to users? (Choose three.)

Accepted Answer

Duo Push. Duo offers Duo Push (mobile notification), TOTP (time-based codes from app), and hardware tokens (physical devices). Bypass codes are for emergency access, not a primary method, and SMS is available but not listed. The three correct options are standard MFA methods.

Answer

Bypass code

Answer

SMS passcode