350-701 Network Security Practice Test 10 — 15 Questions

Question 1

A security engineer is deploying Cisco Identity Services Engine (ISE) to enforce 802.1X wired authentication for corporate laptops and MAB for printers. The engineer must ensure that the corporate laptops are placed into the correct VLAN after authentication, while printers are placed into a quarantine VLAN until they are profiled. Which ISE policy element should be configured to dynamically assign the VLAN to the switch port?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization policy with a VLAN attribute in the authorization result. Dynamic VLAN assignment in ISE is achieved through the authorization policy, which returns RADIUS tunnel attributes to the network access device. The switch then places the port into the specified VLAN. This allows different VLANs for corporate laptops and quarantined printers based on identity and profiling. The authentication policy verifies credentials, while the authorization policy enforces the VLAN assignment.

Answer

Authorization policy with a downloadable ACL (dACL)

Answer

Authentication policy with an internal user database

Answer

Profiling policy with a static assignment

Question 2

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by Firepower Management Center (FMC). The engineer wants to ensure that all traffic from the 10.10.10.0/24 network to any destination on port 443 is inspected by the Snort engine and also logged to the FMC. The access control policy currently has a default action of 'Block'. Which configuration step must be taken to achieve this requirement?

Accepted Answer

Add an access control rule with source network 10.10.10.0/24, destination port 443, action 'Allow', and enable logging at the end of connection.. To inspect and log specific traffic on FTD, an access control rule with the appropriate match conditions and an 'Allow' action is needed. The 'Allow' action triggers Snort inspection if an intrusion policy is attached. Logging at the end of connection provides comprehensive connection events. The default action applies only to unmatched traffic, and prefilter or trust actions bypass inspection.

Answer

Create a prefilter policy with a fastpath action for the specified traffic and enable logging.

Answer

Modify the default action to 'Intrusion Prevention' and enable logging on the default action.

Answer

Add an access control rule with source network 10.10.10.0/24, destination port 443, action 'Trust', and enable logging at the beginning of connection.

Question 3

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by Firepower Management Center (FMC). The engineer needs to inspect traffic for a specific application and block it, while allowing all other traffic. The application uses dynamic ports and can be identified by its payload. Which FMC feature should be used to achieve this?

Accepted Answer

Access control policy with an application filter. The access control policy in FMC allows you to create rules that match applications using Cisco's application detection. You can specify the application by name, and the rule will block it while allowing other traffic. This method handles dynamic ports and payload-based identification. Other options either do not block based on application or are not the appropriate tool for this requirement.

Answer

SSL decryption policy with a block action

Answer

Intrusion policy with a custom Snort rule

Answer

DNS policy with a blacklist entry

Question 4

An engineer is configuring a Cisco ASA firewall to allow external users to access an internal web server using HTTPS. The internal server IP is 10.1.1.10, and the public IP is 203.0.113.5. Which ASA feature should be configured to map the public IP to the internal server?

Accepted Answer

Static NAT. Static NAT provides a fixed one-to-one mapping between a public IP and an internal server IP, enabling external users to access the server consistently. Dynamic NAT and PAT are for outbound translations and do not provide the persistent mapping required for inbound access.

Answer

Dynamic NAT

Answer

Dynamic PAT

Answer

Identity NAT

Question 5

A security administrator is configuring Cisco TrustSec on a switch and wants to assign a Security Group Tag (SGT) to traffic based on the user's identity without relying on 802.1X supplicant configuration on the endpoint. Which feature should be used to dynamically assign the SGT?

Accepted Answer

Cisco ISE integration with the switch using Change of Authorization. Dynamic SGT assignment based on user identity is achieved through Cisco ISE integration, where ISE authenticates the user and sends a Change of Authorization to the switch with the appropriate SGT. This method does not require an 802.1X supplicant because ISE can use web authentication or MAB. Static or manual methods do not provide identity-based dynamic tagging.

Answer

Static SGT assignment on the switch port

Answer

MACsec encryption on the access port

Answer

Configuring a manual SGT in the access control list

Question 6

An engineer is deploying Cisco Umbrella for DNS-layer security. The engineer wants to block access to malicious domains for all users on the corporate network without installing any software on endpoints. Which deployment method should be used?

Accepted Answer

Configure the corporate DNS servers to forward queries to Cisco Umbrella's DNS resolvers.. To protect all users without endpoint software, the corporate DNS servers should forward queries to Cisco Umbrella. This ensures that all DNS requests are checked against Umbrella's threat intelligence, blocking malicious domains. Other methods require endpoint software, on-premises appliances, or browser configuration, which do not meet the no-software requirement.

Answer

Install the Cisco Umbrella Roaming Client on each endpoint.

Answer

Deploy Cisco Umbrella virtual appliances on-premises and configure them as DNS servers.

Answer

Configure a PAC file in the web browsers to redirect traffic to Umbrella.

Question 7

A network security engineer is deploying Cisco Identity Services Engine (ISE) to enforce endpoint compliance. The engineer wants to check that endpoints have the latest antivirus definitions and OS patches before allowing network access. Which ISE feature should be used to perform this check?

Accepted Answer

Posture assessment. Posture assessment is the ISE feature that evaluates endpoint compliance with security policies, including antivirus and patch status. It uses agents or dissolvable agents to collect posture data, compares it against posture policies, and returns a compliance result to the authorization policy. This enables enforcement of access based on endpoint health, which is exactly what the engineer needs.

Answer

Guest services

Answer

BYOD onboarding

Answer

Profiling

Question 8

An engineer is deploying Cisco Firepower Threat Defense (FTD) managed by Firepower Management Center (FMC) and must ensure that management traffic between FTD and FMC is protected. The FTD management interface is on a separate management network. Which configuration on the FTD is required to secure the FMC-to-FTD management connection?

Accepted Answer

Register the FTD with FMC using a registration key; the management connection is automatically secured with TLS.. FMC-managed FTD devices use a secure TLS-based management channel established during registration with a registration key. This channel protects all management communications, including policy deployment and event logging. No additional VPN or certificate configuration is required beyond the standard registration process. The other options either describe unsupported methods or miss the native security mechanism.

Answer

Configure an IPsec tunnel between the FTD management interface and the FMC management interface.

Answer

Configure a site-to-site VPN tunnel between FMC and FTD using IKEv2.

Answer

Enable the FTD management interface with a self-signed certificate and register it with FMC.

Question 9

An administrator is configuring a Cisco ASA firewall for AnyConnect VPN. The administrator wants to ensure that after a user authenticates, the VPN session is terminated if the endpoint does not have the latest antivirus signature. Which ASA feature should be configured?

Accepted Answer

HostScan with posture assessment. HostScan is the ASA feature that performs endpoint posture assessment, including checking antivirus signatures. When configured with posture assessment, it can evaluate the endpoint and if it fails, the ASA can terminate the session or apply restricted access. Other options do not perform the actual posture check. DAP can enforce policies based on posture results, but it relies on HostScan to gather the information.

Answer

Dynamic Access Policy (DAP)

Answer

AnyConnect Custom Attributes

Answer

Clientless SSL VPN with bookmarks

Question 10

A security administrator is configuring Cisco Umbrella to block malicious domains for an organization. The administrator wants to ensure that DNS requests from roaming users are filtered even when they are off the corporate network. Which Umbrella component should be deployed on the roaming endpoints?

Accepted Answer

Cisco Umbrella Roaming Client. The Cisco Umbrella Roaming Client is the correct component because it is installed directly on endpoints and ensures that DNS queries are sent to Umbrella for filtering, no matter where the user connects. It enforces the organization's DNS policies for roaming users without requiring VPN or on-premises appliances. This provides consistent protection even when users are off the corporate network.

Answer

Cisco Umbrella Virtual Appliance

Answer

Cisco Umbrella Enforcement API

Answer

Cisco Umbrella SIG

Question 11

A network administrator is configuring a Cisco ASA firewall for VPN load balancing. The administrator wants to distribute incoming AnyConnect VPN sessions across multiple ASA devices in a cluster. Which feature should be configured?

Accepted Answer

VPN load balancing. Cisco ASA VPN load balancing is the feature designed to distribute AnyConnect VPN sessions across multiple ASA devices. It creates a virtual cluster with a shared IP address, and sessions are balanced among the devices. Failover is for redundancy, EtherChannel is for link aggregation, and clustering is for overall firewall scaling, not specifically VPN load distribution.

Answer

Failover

Answer

Clustering

Answer

EtherChannel

Question 12

A network security engineer is configuring a Cisco ASA to support AnyConnect VPN clients. The ASA uses a self-signed certificate for the outside interface. Remote users report that they cannot establish the VPN connection and receive a certificate warning. The engineer wants to eliminate the warning and ensure proper certificate validation. Which action should be taken?

Accepted Answer

Install a publicly trusted CA-signed certificate on the ASA outside interface.. AnyConnect clients validate the ASA's certificate against trusted root CAs. A self-signed certificate is not trusted, causing warnings. Installing a CA-signed certificate from a trusted public CA resolves the warning and ensures proper validation. The other options either do not address trust or compromise security by disabling validation.

Answer

Configure the ASA to use a wildcard self-signed certificate.

Answer

Instruct users to disable certificate validation in the AnyConnect client profile.

Answer

Enable the 'ssl trust-point' command to force clients to trust the self-signed certificate.

Question 13

A security analyst is investigating alerts in Cisco Stealthwatch. The analyst notices a large number of flows from an internal host to multiple external IP addresses on port 445. The analyst suspects a worm infection. Which Stealthwatch feature should be used to quickly identify the internal host and its peers?

Accepted Answer

Host Report for the internal host. The Host Report in Cisco Stealthwatch provides detailed information about a specific host, including its peers, traffic volumes, and security events. By accessing the Host Report for the internal host, the analyst can quickly see all external IP addresses it communicated with on port 445, helping to identify the extent of the worm infection. Other options either require more manual effort or do not provide the comprehensive peer list.

Answer

Dashboard with a custom widget for port 445

Answer

Flow Search with filters for port 445 and internal host

Answer

Alarm details for the triggered alarm

Question 14

A network security administrator is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC to inspect traffic traversing an inline set. The administrator wants to ensure that packets that fail to match any access control rule are logged and blocked. Which action should be configured as the default action in the access control policy?

Accepted Answer

Block with logging enabled. The default action in an FTD access control policy applies to traffic that does not match any explicit rule. To meet the requirement of logging and blocking unmatched packets, the default action must be configured to Block with logging enabled. Block with reset would add a TCP RST that is not requested, Intrusion Prevention would allow the traffic, and Block All Traffic without logging would omit the required logging.

Answer

Intrusion Prevention

Answer

Block with reset

Answer

Access Control: Block All Traffic

Question 15

A network engineer is configuring 802.1X authentication on Cisco switches. The engineer wants to ensure that if the RADIUS server becomes unreachable, authenticated endpoints remain connected while new endpoints are denied access. Which feature should be configured?

Accepted Answer

Inaccessible authentication bypass. Inaccessible authentication bypass is designed to handle the case where the RADIUS server is unreachable. It allows endpoints that have already been authenticated to maintain their network access, while new endpoints are either denied or placed into a critical VLAN. This provides a balance between availability for existing users and security for new connections during an outage.

Answer

Guest VLAN

Answer

Critical VLAN

Answer

MAC Authentication Bypass (MAB)