350-701 Endpoint Security and Identity Practice Test 8 — 15 Questions

Question 1

An administrator needs to enforce 802.1X authentication for devices that do not support 802.1X supplicants. Which method should be configured on Cisco ISE to allow these devices to authenticate?

Accepted Answer

MAB. MAC Authentication Bypass (MAB) allows non-supplicant devices to authenticate based on their MAC address.

Answer

802.1X with EAP-TLS

Answer

Guest portal

Answer

PEAP-MSCHAPv2

Question 2

A security analyst notices that a file initially deemed 'unknown' by Cisco AMP for Endpoints was later reclassified as 'malicious'. The analyst needs to investigate the propagation of this file across endpoints. Which Cisco AMP feature provides a timeline view of file activity and spread?

Accepted Answer

Device Trajectory. Device Trajectory is the correct feature because it provides a timeline view of a file's activity across endpoints, including its origin, propagation, and subsequent actions. When Cisco AMP for Endpoints reclassifies a file from 'unknown' to 'malicious', Device Trajectory allows the analyst to trace the file's spread and interactions on each affected endpoint, enabling a thorough investigation of the infection chain.

Answer

SHA-256 disposition

Answer

Exploit Prevention

Answer

IOC scanning

Question 3

Cisco ISE is configured with posture assessment to ensure endpoints meet security requirements before gaining network access. After a posture check, ISE needs to dynamically change the VLAN assignment for a non-compliant endpoint. Which ISE feature enables this real-time change?

Accepted Answer

Change of Authorization (CoA). Change of Authorization (CoA) allows ISE to dynamically update authentication and authorization attributes such as VLAN assignment.

Answer

TrustSec

Answer

Guest portal

Answer

Profiling

Question 4

A company uses Cisco ISE for network access control. They want to authenticate users connecting via VPN using multi-factor authentication. Which solution integrates with ISE to provide MFA for AnyConnect VPN?

Accepted Answer

Cisco Duo. Cisco Duo integrates with ISE and AnyConnect to provide multi-factor authentication for VPN access.

Answer

Cisco AMP for Endpoints

Answer

Cisco SecureX

Answer

CyberArk

Question 5

In the 802.1X authentication process, which component is responsible for relaying authentication messages between the client and the authentication server?

Accepted Answer

Authenticator. In the 802.1X authentication process, the authenticator (typically a switch or wireless access point) is responsible for relaying Extensible Authentication Protocol (EAP) messages between the supplicant (client) and the authentication server (e.g., ISE). The authenticator encapsulates EAP frames into RADIUS packets for transmission to the server, acting as a transparent proxy that does not modify or terminate the EAP conversation. This role is defined in IEEE 802.1X-2010, where the authenticator controls port access based on the authentication result.

Answer

Authentication server (ISE)

Answer

RADIUS proxy

Answer

Supplicant

Question 6

An organization wants to grant temporary administrative access to a server for a specific task and automatically revoke the access after the task is completed. Which Cisco solution should be used?

Accepted Answer

Cisco SecureX with CyberArk. Cisco SecureX integrates with CyberArk to provide just-in-time (JIT) privileged access management.

Answer

Cisco Duo

Answer

Cisco ISE

Answer

Cisco AMP for Endpoints

Question 7

A security team deploys Cisco AMP for Endpoints and wants to detect and block memory injection attacks. Which AMP feature should be enabled to achieve this?

Accepted Answer

Exploit Prevention. Exploit Prevention in Cisco AMP protects against memory injection and other exploit techniques.

Answer

Device Trajectory

Answer

IOC scanning

Answer

File quarantine

Question 8

Cisco ISE uses profiling to identify the type of device connecting to the network. Which probe helps ISE identify a device by analyzing the DHCP requests it sends?

Accepted Answer

DHCP probe. The DHCP probe captures DHCP request options to identify the device type.

Answer

HTTP probe

Answer

Device Sensor

Answer

SNMP probe

Question 9

An administrator configures Cisco ISE for guest access with a sponsor portal. What is the primary purpose of the sponsor portal?

Accepted Answer

Allow sponsors to create and manage guest accounts. The sponsor portal in Cisco ISE is specifically designed to allow authorized users (sponsors) to create, manage, and approve guest accounts. This enables controlled guest access where a sponsor, such as an employee or administrator, provisions credentials for visitors, ensuring accountability and policy enforcement without requiring guests to self-register.

Answer

Provide network access for non-supplicant devices

Answer

Enable guests to authenticate with MFA

Answer

Allow guests to self-register

Question 10

An endpoint running Cisco AMP for Endpoints is suspected of being compromised. The security analyst needs to isolate the process and perform a live investigation. Which EDR capability should the analyst use?

Accepted Answer

Remote shell investigation. Remote shell investigation allows analysts to perform live forensics on endpoints via a secure shell.

Answer

Process isolation

Answer

IOC scanning

Answer

File quarantine

Question 11

An organization uses Cisco ISE for network access control. They want to authenticate users with certificates for strong security. Which two EAP methods support certificate-based authentication? (Choose two.)

Accepted Answer

PEAP-MSCHAPv2. EAP-TLS and PEAP-MSCHAPv2 both support certificate-based authentication, though PEAP-MSCHAPv2 uses certificates for server-side only.

Answer

LEAP

Answer

EAP-MD5

Answer

EAP-FAST

Question 12

Cisco ISE can profile endpoints using various probes. Which three probes are used for device profiling? (Choose three.)

Accepted Answer

HTTP probe. The HTTP probe (A) is correct because Cisco ISE uses it to profile endpoints by inspecting HTTP user-agent strings and other HTTP header fields, which reveal the operating system or browser type. This passive fingerprinting helps classify devices like smartphones, tablets, or PCs without requiring credentials.

Answer

DNS probe

Answer

RADIUS probe

Question 13

Cisco AMP for Endpoints provides endpoint protection. Which two are core capabilities of AMP? (Choose two.)

Accepted Answer

Continuous monitoring. C is correct because Cisco AMP for Endpoints provides continuous monitoring of file activity and telemetry across endpoints, analyzing behavior in real time to detect threats. This capability ensures that even if a file is initially deemed safe, any subsequent malicious activity is identified and blocked, leveraging cloud-based threat intelligence and analytics.

Answer

Privileged access management

Answer

Exploit prevention

Answer

Multi-factor authentication

Question 14

An organization wants to implement EDR capabilities for endpoints. Which three actions are typically associated with EDR? (Choose three.)

Accepted Answer

Process isolation. File quarantine, process isolation, and remote shell investigation are EDR actions. Application whitelisting is a hardening technique, and MFA is authentication.

Answer

Multi-factor authentication

Answer

Application whitelisting

Question 15

Cisco TrustSec uses Security Group Tags (SGTs) for policy enforcement. Which two components are required for TrustSec to function? (Choose two.)

Accepted Answer

SGT assignment via ISE. TrustSec requires SGT assignment and SGT-based policies on network devices. Profiling is used to assign SGTs but is not a core component; MAB and 802.1X are authentication methods.

Answer

802.1X with EAP-TLS

Answer

MAC Authentication Bypass

Answer

Device profiling