350-701 Endpoint Security and Identity Practice Test 7 — 15 Questions

Question 1

A security analyst notices that a file that was initially allowed by Cisco AMP for Endpoints has later been determined to be malicious. The analyst needs to investigate the file's propagation across endpoints. Which Cisco AMP feature should the analyst use to view the timeline of events?

Accepted Answer

Device Trajectory. Device Trajectory in Cisco AMP provides a chronological view of events on an endpoint, showing how a file propagated and what actions were taken. Continuous monitoring and retrospective security allow AMP to re-evaluate files that were initially allowed but later deemed malicious.

Answer

Exploit Prevention

Answer

Endpoint IOC scanning

Answer

SHA-256 file disposition

Question 2

An organization wants to deploy Cisco ISE to authenticate devices that do not support 802.1X supplicant software, such as printers and IoT sensors. Which authentication method should be configured on the switch port to allow these devices network access?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows devices that cannot run 802.1X supplicants to authenticate based on their MAC address. The switch sends the MAC address as the username and password to ISE.

Answer

EAP-TLS

Answer

EAP-FAST

Answer

PEAP-MSCHAPv2

Question 3

A network administrator is configuring Cisco ISE for posture assessment. A Windows laptop connects to the network and passes 802.1X authentication. ISE then checks if the antivirus software is running and if the OS patches are up to date. If the posture check fails, ISE should dynamically restrict the endpoint to a remediation VLAN. Which mechanism allows ISE to change the VLAN assignment after authentication without requiring the user to reauthenticate?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically change the authorization state (e.g., VLAN or ACL) on the network device after the initial authentication. This is used to enforce posture policies without requiring the endpoint to reauthenticate.

Answer

802.1X reauthentication

Answer

MAB reauthentication

Answer

RADIUS Disconnect

Question 4

An organization wants to enforce multi-factor authentication (MFA) for VPN access using Cisco AnyConnect. Which Cisco product integrates with AnyConnect to provide MFA via push notifications or one-time passwords?

Accepted Answer

Cisco Duo. Cisco Duo integrates directly with AnyConnect via the Duo Authentication Proxy or the native Duo AnyConnect client module to provide multi-factor authentication. It supports push notifications to the Duo Mobile app, one-time passwords (OTP) generated by the app or hardware tokens, and phone callback, making it the correct choice for MFA enforcement on VPN access.

Answer

Cisco SecureX

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 5

A security engineer is deploying Cisco AMP for Endpoints and wants to ensure that the client can detect and block memory injection attacks. Which AMP feature should be enabled to provide this protection?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP focuses on detecting and blocking memory injection attacks, such as buffer overflows and code injection, by monitoring process behavior.

Answer

Device Trajectory

Answer

Endpoint IOC scanning

Answer

File quarantine

Question 6

A network administrator is configuring Cisco ISE for device profiling. The goal is to identify the type of device (e.g., Windows PC, iPhone, printer) connecting to the network. Which probe should be used to gather the DHCP option 60 (vendor class identifier) and option 12 (hostname) information?

Accepted Answer

DHCP probe. The DHCP probe in ISE collects information from DHCP packets, including option 60 (vendor class identifier) and option 12 (hostname), which are used for device profiling.

Answer

Cisco Device Sensor

Answer

SNMP probe

Answer

HTTP probe

Question 7

Which 802.1X component is responsible for enforcing access control on the network and relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. The authenticator (typically a switch or WLC) enforces access control and acts as a proxy between the supplicant and the authentication server (ISE).

Answer

Authentication server

Answer

RADIUS server

Answer

Supplicant

Question 8

An organization uses Cisco ISE for guest access. They want to allow guests to create their own accounts through a web portal while requiring approval from a sponsor before network access is granted. Which guest access method should be configured?

Accepted Answer

Self-registration with sponsor approval. Self-registration with sponsor approval allows guests to create accounts, but access is only granted after a sponsor approves the request. This is a common guest access scenario in ISE.

Answer

Hotspot guest access

Answer

Self-registration without approval

Answer

Sponsor portal

Question 9

A security analyst is investigating an incident on an endpoint protected by Cisco AMP. The analyst needs to isolate the compromised process and prevent it from communicating with other processes or the network. Which EDR capability should be used to achieve this?

Accepted Answer

Process isolation. Process isolation is an EDR capability that terminates the process and blocks its network and inter-process communication, effectively containing the threat.

Answer

File quarantine

Answer

IOC scanning

Answer

Remote shell

Question 10

Which Cisco product provides privileged access management (PAM) capabilities such as just-in-time access, session recording, and password vaulting through integration with CyberArk?

Accepted Answer

Cisco SecureX. Cisco SecureX integrates with CyberArk to provide PAM capabilities, including just-in-time access, session recording, and password vaulting. SecureX is the Cisco platform for threat response and security analytics.

Answer

Cisco AMP for Endpoints

Answer

Cisco ISE

Answer

Cisco Duo

Question 11

A network administrator is configuring 802.1X on a Cisco switch for corporate Windows laptops. The organization uses certificates for authentication. Which EAP method should be configured on the supplicant and ISE to provide certificate-based mutual authentication?

Accepted Answer

EAP-TLS. EAP-TLS (Transport Layer Security) is the correct choice because it provides certificate-based mutual authentication, where both the supplicant (Windows laptop) and the authentication server (ISE) present X.509 certificates to verify each other's identity. This meets the requirement for certificate-based authentication and is the only EAP method listed that inherently requires certificates on both sides for mutual authentication.

Answer

PEAP-MSCHAPv2

Answer

EAP-MD5

Answer

EAP-FAST

Question 12

An organization wants to deploy endpoint hardening by allowing only approved applications to run. Which technology should be implemented to achieve this?

Accepted Answer

Application whitelisting. Application whitelisting is the correct technology because it enforces endpoint hardening by explicitly allowing only approved applications to execute, blocking all others by default. This is a fundamental principle of least privilege and is often implemented using tools like Windows AppLocker or Cisco AMP's application control, which maintain a hash-based or path-based allow list.

Answer

EDR

Answer

Host-based IPS

Answer

Antivirus software

Question 13

A network engineer is configuring Cisco ISE to assign Security Group Tags (SGTs) to endpoints based on their identity and role. Which two components are required for TrustSec SGT classification and enforcement? (Choose two.)

Accepted Answer

Network devices (switches/firewalls) that enforce SGACLs. TrustSec uses SGTs assigned by ISE (policy enforcement point) and enforced by network devices (e.g., switches) that can apply security group ACLs (SGACLs) based on the SGT.

Answer

Cisco AnyConnect client

Answer

Cisco AMP for Endpoints

Answer

Cisco Duo

Question 14

A security analyst needs to investigate a potential breach on an endpoint. Cisco AMP for Endpoints provides several EDR capabilities. Which three actions can the analyst perform using AMP's EDR features? (Choose three.)

Accepted Answer

Remote shell investigation. Cisco AMP's EDR capabilities include file quarantine, process isolation, and remote shell investigation. These allow investigation and containment of threats on endpoints.

Answer

SGT assignment

Answer

VLAN reassignment

Question 15

An organization wants to implement multi-factor authentication (MFA) for administrative access to network devices. Which two methods can be used with Cisco Duo to provide MFA for admin access? (Choose two.)

Accepted Answer

Push notification. Push notification is correct because Cisco Duo can send a push notification to the Duo Mobile app on the administrator's smartphone. The admin approves or denies the login attempt directly from the app, providing a seamless and secure second factor for authentication to network devices.

Answer

SMS passcode

Answer

Biometric fingerprint

Answer

Bypass code