350-701 Network Security — 40 Questions

Question 1

A Cisco FTD device is deployed in passive mode. The security team wants to block malicious traffic without affecting legitimate traffic. Which action should be used in the access control policy rule?

Accepted Answer

Set the rule action to 'Allow' and rely on intrusion policy with 'Drop and Reset'. In passive mode, the Cisco FTD receives a copy of traffic and cannot block or drop packets inline. Therefore, access control policy rule actions like 'Block', 'Interactive Block', or 'Trust' are not effective for blocking; 'Trust' bypasses inspection entirely. The only viable action is 'Allow', which lets traffic pass. The intrusion policy with 'Drop and Reset' is used for inline deployments, but in passive mode it only generates alerts and can send TCP resets without dropping the original packet. This combination allows detection of malicious activity via alerts while not impacting legitimate traffic, making answer A correct.

Answer

Set the rule action to 'Trust'

Answer

Set the rule action to 'Block' with a reset

Answer

Set the rule action to 'Interactive Block'

Question 2

An engineer is configuring a Cisco ASA and needs to ensure that traffic from the outside interface to a web server on the DMZ is allowed. The inside interface is security level 100 and the DMZ is level 50. The outside interface is level 0. Which statement about the default traffic flow is true?

Accepted Answer

Traffic from outside to DMZ is denied implicitly because outside level is lower than DMZ level.. By default, the ASA permits traffic from higher security levels to lower security levels without an ACL. However, traffic from lower to higher levels is implicitly denied. Since outside (0) is lower than DMZ (50), an ACL is required.

Answer

Traffic from outside to DMZ is allowed implicitly because the ASA inspects all interfaces equally.

Answer

Traffic from outside to DMZ is allowed implicitly because outside is level 0 and DMZ is level 50.

Answer

Traffic from outside to DMZ is allowed implicitly because both are lower than inside.

Question 3

A network administrator is configuring NAT on a Cisco ASA to allow internal users to access the internet using a single public IP address. The internal network uses RFC 1918 addresses. Which type of NAT should be configured?

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation) allows many internal IPs to share a single public IP by using unique source ports. Dynamic NAT would require a pool of public IPs, and static NAT provides one-to-one mapping.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Identity NAT

Question 4

An engineer is configuring a Modular Policy Framework (MPF) on a Cisco ASA to inspect HTTP traffic and apply QoS. The engineer creates a class-map to match HTTP traffic using the 'match port tcp 80' command. However, the policy is not being applied correctly. What is the most likely reason?

Accepted Answer

The default global inspection policy already inspects HTTP traffic, and the new policy may be overridden.. The default inspection policy (global_policy) already inspects HTTP. Applying a new policy for HTTP with default actions may conflict or be overridden. Also, class-map matching on port alone may not be sufficient if traffic is already handled by default inspection. But the most common mistake is that the default policy already inspects HTTP traffic, and the new policy must be applied with higher priority or modified.

Answer

The class-map should use 'match any' instead of 'match port tcp 80'.

Answer

The ASA does not support HTTP inspection via MPF.

Answer

The service-policy must be applied globally, not to an interface.

Question 5

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They need to create an access control policy that allows traffic from specific source IPs to a web server, but blocks all other traffic. How should the rule base be ordered?

Accepted Answer

Place the permit rule first, then the block rule.. Access control rules are evaluated in order from top to bottom. The first matching rule is applied. Therefore, the permit rule for the specific source IPs must come before the final block rule.

Answer

Place the block rule first, then the permit rule.

Answer

Use a single rule with permit and block conditions combined.

Answer

Order does not matter because FMC processes rules in parallel.

Question 6

A security administrator is investigating an alert from an IPS that detected a SQL injection attempt. The alert was triggered by a signature that looks for specific patterns in the traffic. What type of detection method is this?

Accepted Answer

Signature-based detection. Signature-based detection uses predefined patterns (signatures) to identify known attacks. Anomaly-based detection looks for deviations from normal behavior.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 7

A Cisco Firepower administrator configures an access control policy with a rule that trusts traffic from a specific source network. What is the effect of the trust action on the traffic?

Accepted Answer

The traffic is allowed without further inspection.. The trust action in Firepower bypasses further inspection (IPS, file, etc.) for matching traffic. It allows the traffic without any deep inspection, similar to a permit with fast-path.

Answer

The traffic is blocked and logged.

Answer

The traffic is allowed and inspected by the intrusion policy.

Answer

The traffic is allowed but subject to file policy.

Question 8

An engineer is deploying a Cisco FTD in inline mode and wants to inspect SSL/TLS traffic using the 'decrypt-resign' action. What must be configured on the client devices to avoid certificate errors?

Accepted Answer

Install the organization's CA certificate in the client's trusted root store.. When using 'decrypt-resign', the FTD generates a new certificate signed by a CA that the organization controls. Clients must trust the organization's CA certificate (root CA) that is used to sign the re-encrypted certificates. Without that, clients will see certificate errors.

Answer

Disable certificate validation on all client browsers.

Answer

Install the FTD's self-signed certificate on each client.

Answer

Use 'decrypt-known-key' instead, which does not require client configuration.

Question 9

A company is deploying Cisco AnyConnect SSL VPN and wants to enforce different access policies based on the endpoint's antivirus status. Which feature should be used?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policy (DAP) allows granular access control based on endpoint attributes such as antivirus status, OS, registry keys, etc. Group policies provide basic settings but not dynamic evaluation.

Answer

Group Policy

Answer

Split Tunneling

Answer

Network Access Control (NAC)

Question 10

A Cisco ASA is configured with a site-to-site VPN using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec tunnel?

Accepted Answer

Transform set. A transform set specifies the encryption (e.g., AES) and authentication (e.g., SHA) algorithms for IPsec. ISAKMP policy is for IKE phase 1, and crypto map binds the policy to an interface.

Answer

ISAKMP policy

Answer

IKEv2 proposal

Answer

Crypto map

Question 11

A security analyst is tuning Snort rules to reduce false positives. The analyst identifies a rule that triggers on a common benign application. Which action should be taken to suppress alerts for that specific traffic without disabling the rule entirely?

Accepted Answer

Add a 'threshold' rule to limit the number of alerts.. Snort allows using 'threshold' or 'suppress' options to limit alerts. The 'suppress' keyword can suppress alerts for specific source/destination IPs. Alternatively, creating a pass rule in the local policy could bypass inspection for that traffic. However, directly modifying the rule's action to 'pass' is not standard; using threshold is common.

Answer

Delete the rule from the policy.

Answer

Change the rule action to 'alert'

Answer

Set the rule to 'drop' action.

Question 12

An engineer configures a Cisco FTD in a high-availability pair with active/standby failover. The primary unit fails, and the standby takes over. After the primary recovers, what must be done to ensure it resumes as active?

Accepted Answer

Execute 'failover active' on the primary unit.. In active/standby failover, the active unit can be forced to become standby and the standby active. To make the recovered primary active, the command 'failover active' on the primary or 'failover reset' can be used. However, by default, the primary will not automatically become active unless configured with preempt.

Answer

No action is needed; the primary automatically resumes active role.

Answer

Reboot the secondary unit.

Answer

Disable and re-enable failover.

Question 13

A company uses Cisco Firepower with FMC and wants to block access to social media websites for all users. Which feature should be used to create this policy?

Accepted Answer

URL Filtering. URL filtering allows blocking or allowing access based on URL categories (e.g., Social Networking). Application visibility and control (AVC) can block specific applications, but URL filtering is more appropriate for web browsing categories.

Answer

File Policy

Answer

Intrusion Policy

Answer

Application Visibility and Control (AVC)

Question 14

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Accepted Answer

Trust action bypasses all further inspection modules.. Trust bypasses all further inspection. Allow permits traffic but subjects it to inspection. Block drops traffic. Interactive Block challenges the user with a block page and allows them to proceed if they accept.

Answer

Allow action is the default action if no rule matches.

Answer

Block action logs the traffic and allows it to pass.

Answer

Allow action applies only URL filtering but not IPS.

Question 15

An engineer is configuring a Cisco ASA to support a DMZ segment. Which three of the following are best practices for DMZ design? (Choose three.)

Accepted Answer

Place public-facing servers in the DMZ.. DMZ should have a different security level (typically between inside and outside). Traffic from DMZ to inside should be restricted. Services in DMZ should be hardened. The DMZ interface should be a separate physical or VLAN interface.

Answer

Assign the DMZ interface a security level of 0.

Answer

Use the same subnet for DMZ and inside networks.

Question 16

A network engineer is configuring site-to-site IPsec VPN on a Cisco ASA using IKEv2. Which two components are required for IKEv2 configuration? (Choose two.)

Accepted Answer

IKEv2 proposal. IKEv2 requires an IKEv2 proposal (or policy) defining encryption and authentication for phase 1, and a transform set for IPsec phase 2. Also, a crypto map binds the configuration to an interface. ISAKMP policy is for IKEv1.

Answer

ISAKMP policy

Answer

Group policy

Answer

Dynamic crypto map

Question 17

An administrator configures a Cisco ASA with an interface named 'inside' at security level 100 and 'outside' at security level 0. Which statement about traffic flow is true?

Accepted Answer

Traffic from inside to outside is allowed by default if the connection is statefully inspected.. By default, traffic from a higher security level (inside) to a lower security level (outside) is allowed without an ACL if stateful inspection permits.

Answer

Traffic from inside to outside is denied unless NAT is configured.

Answer

All traffic between inside and outside is denied without an ACL.

Answer

Traffic from outside to inside is allowed by default.

Question 18

A network engineer is configuring NAT on a Cisco ASA for internal servers to be accessible from the internet. One server (10.1.1.10) must always be reachable via a fixed public IP (203.0.113.10). Which NAT type should be used?

Accepted Answer

Static NAT. Static NAT provides a one-to-one fixed mapping between a private IP and a public IP, ensuring the server is always reachable via the same public address.

Answer

Identity NAT

Answer

Dynamic NAT

Answer

Dynamic PAT (overload)

Question 19

An engineer is configuring an access control policy on Cisco FMC for FTD. The policy must allow HTTP traffic from the inside zone to the outside zone, but block all other traffic. Which rule configuration is correct?

Accepted Answer

Rule 1: Permit HTTP from inside to outside; Rule 2: Block all traffic.. Access control rules are processed top-down; a trust rule bypasses further inspection but still allows traffic; a permit rule allows traffic with inspection. The scenario requires allowing HTTP only, so a permit rule for HTTP with a default deny rule after is correct.

Answer

Rule 1: Trust HTTP from inside to outside; Rule 2: Block all traffic.

Answer

Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to outside.

Answer

Rule 1: Allow HTTP from inside to outside; no default rule.

Question 20

Which Snort rule action causes the FTD to drop a packet and generate an alert?

Accepted Answer

drop. The 'alert' action generates an alert but does not drop; 'drop' drops and alerts; 'reject' drops and sends TCP RST; 'pass' ignores the packet.

Answer

reject

Answer

alert

Answer

pass