350-701 Network Security Practice Test 2 — 15 Questions

Question 1

A Cisco FTD is configured with an access control policy that includes a rule to allow traffic from a specific source subnet. However, traffic is being blocked. Which TWO possible causes should be checked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The source subnet is not correctly defined in the network object.. Option C is correct because if the network object representing the source subnet is misconfigured (wrong IP address, mask, or object type), the access control rule will not match the intended traffic, causing the default action to block it. Option D is correct because FTD access control rules are evaluated top-down, so a block rule placed above the allow rule that matches the same traffic will terminate evaluation and block the packets before the allow rule is ever reached. Option A is incorrect because setting an intrusion policy to 'No Inspection' only disables intrusion detection/prevention; it does not block traffic by itself. Option B is incorrect because a default action of 'Allow' would permit unmatched traffic, not block it. Option E is incorrect because an incorrect destination port in the rule would prevent the rule from matching, but the question specifies the rule is meant to allow traffic from a source subnet; port mismatch is a possible cause of non-matching, yet it is not marked correct and is less directly tied to the stated source-subnet condition than C and D.

Answer

The intrusion policy is set to 'No Inspection'.

Answer

The default action is set to 'Allow'.

Answer

The rule has a destination port that is incorrect.

Question 2

An organization wants to deploy Cisco Firepower in a high-availability pair with active/standby failover. Which management solution allows this configuration?

Accepted Answer

FMC. Cisco Firepower Management Center (FMC) is the centralized management platform that supports configuring and managing Firepower appliances in active/standby high-availability pairs. FMC provides the HA configuration workflow, including failover link, stateful failover, and interface monitoring. FDM and ASDM do not support the full HA feature set for Firepower threat defense in the same way.

Answer

CLI only

Answer

FDM (on-box management)

Answer

ASDM

Question 3

A company wants to deploy a DMZ segment accessible from the internet. Which THREE considerations are critical for firewall zone design and security?

Accepted Answer

Use separate firewall interfaces for inside, outside, and DMZ. Option A is correct because a proper DMZ design requires the firewall to have distinct physical or logical interfaces for the inside, outside, and DMZ zones, so that zone-based policy and security levels can be enforced independently on each segment. Option B is correct because DMZ hosts are internet-facing and thus the most likely to be compromised; preventing them from initiating connections into the trusted inside network blocks lateral movement and data exfiltration. Option D is correct because inbound traffic from the untrusted outside should be limited to only the specific ports and protocols needed to reach published DMZ services (e.g., TCP 443 to a web server), minimizing the attack surface. Option C is incorrect because a security level of 100 is the maximum value typically assigned to the most trusted interface (the inside), not the DMZ, which should have a lower level such as 50. Option E is incorrect because allowing all inside-to-DMZ traffic without inspection violates least-privilege and defense-in-depth principles, since a compromised DMZ host could be reached freely and the traffic could carry malicious content.

Answer

DMZ interface should have a security level of 100

Answer

Allow all traffic from inside to DMZ without inspection

Question 4

An engineer is configuring a Cisco ASA to allow traffic from the inside (security level 100) to the outside (security level 0). They create an access list permitting HTTP traffic from inside to outside and apply it to the inside interface inbound. What is the expected behavior?

Accepted Answer

The traffic will be allowed because the ACL permits it.. On a Cisco ASA, ACLs applied inbound on the inside interface are evaluated before any security-level check, and because the ACL explicitly permits HTTP from inside to outside, the traffic is allowed. The ASA's default behavior of permitting traffic from a higher security level (100) to a lower security level (0) is also satisfied, but the explicit ACL is what governs the decision. Therefore, the ACL placement and direction are correct and the traffic will pass.

Answer

The traffic will be blocked because the ACL is applied inbound on the inside interface.

Answer

The traffic will be blocked because the ACL should be applied outbound on the outside interface.

Answer

The traffic will be allowed only if a NAT rule exists.

Question 5

A network administrator is configuring site-to-site IPsec VPN between two Cisco ASAs using IKEv2. They want to ensure that only specific subnets are encrypted, using Virtual Tunnel Interface (VTI). Which configuration element is essential for VTI?

Accepted Answer

A tunnel interface with an IP address and a crypto map.. VTI uses a tunnel interface that is dedicated to the VPN, and the crypto map is applied to the tunnel interface rather than the physical interface. For IKEv2, the tunnel mode is enabled and the crypto map is applied to the VTI.

Answer

A crypto map applied to the physical interface.

Answer

A transform set with ESP encryption and authentication.

Answer

An ISAKMP policy with pre-shared key.

Question 6

An engineer is configuring Dynamic Access Policy (DAP) on an ASA for AnyConnect VPN. They want to assign different access policies based on the client's anti-virus status and device posture. What must be configured to obtain this information?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with posture module. DAP can use endpoint attributes from the AnyConnect client, such as antivirus status, via the Secure Endpoint or posture module. The ASA obtains this information through the AnyConnect client's posture assessment.

Answer

Group policy with split tunneling enabled

Answer

Cisco ISE as the AAA server

Answer

SSL VPN with DTLS enabled

Question 7

A Cisco FTD sensor is deployed in passive mode (IDS) and is receiving traffic via a network tap. The access control policy is configured with an intrusion policy set to 'Security over Connectivity'. However, the administrator notices that the sensor is not generating alerts for some attacks that were identified by a previous inline sensor. What is the most likely reason?

Accepted Answer

The sensor is in passive mode and cannot see return traffic due to asymmetric routing.. In passive (IDS) mode, the sensor receives a copy of traffic via a network tap or SPAN port. If the network uses asymmetric routing, the sensor may see only one direction of the traffic flow, missing the return traffic. Many attacks require inspection of both directions to detect, so the sensor may not generate alerts for attacks that were previously detected by an inline sensor that saw bidirectional traffic. This is the most likely reason for the discrepancy.

Answer

The access control policy requires an 'allow' action to perform intrusion inspection.

Answer

The intrusion policy is set to 'Security over Connectivity', which reduces false positives but may miss some attacks.

Answer

The intrusion policy is not configured to generate alerts.

Question 8

Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?

Accepted Answer

Static NAT. Static NAT on a Cisco ASA creates a fixed one-to-one mapping between an internal private IP address and a public IP address. This allows external hosts to initiate connections to internal servers because the translation is permanent and predictable. It is the standard method for publishing internal services (e.g., web or email servers) to the internet.

Answer

Identity NAT

Answer

PAT (Port Address Translation)

Answer

Dynamic NAT

Question 9

A security administrator is configuring a Cisco Firepower system for network discovery and wants to identify hosts and services on the network. Which two actions must be configured to enable network discovery? (Choose two.)

Accepted Answer

Configure an Access Control Policy with an 'Allow' rule for discovery traffic.. Option C is correct because network discovery in Cisco Firepower requires an Access Control Policy (ACP) that allows the traffic to be inspected; without an Allow rule permitting the discovery traffic, the Firepower Threat Defense (FTD) device will not process the packets and no host or service data can be collected. Option D is correct because the Network Discovery feature must be explicitly enabled in Firepower Management Center (FMC) — typically under Policies > Network Discovery — so that the system generates discovery events and populates the host and service tables. Options A, B, and E are not required: SSL/TLS inspection (A) is only needed to see inside encrypted sessions and is not a prerequisite for basic host/service discovery, a file policy with malware detection (B) is for file analysis and blocking, not discovery, and inline mode (E) is not mandatory since discovery can also work with passive or tap/SPAN interfaces.

Answer

Enable SSL/TLS inspection for all traffic.

Answer

Configure a file policy with malware detection.

Answer

Deploy the FTD in inline mode only.

Question 10

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Accepted Answer

Allow. In a Cisco Firepower access control rule, the valid rule actions are Allow, Trust, Block, Monitor, and Block with Reset; therefore option D (Allow) is correct because it permits matching traffic to pass and continue through the system for further inspection by subsequent policies, and option E (Trust) is correct because it allows matching traffic to bypass all further inspection and be forwarded immediately. Option A (Log) is not a rule action but a logging configuration applied to a rule, and option B (Reset) is not a standalone action—it exists only as the combined action 'Block with Reset.' Option C (Redirect) is not a Firepower access control rule action; redirection is handled by other mechanisms such as URL filtering or external policies, not by the access control rule action itself.

Answer

Log

Answer

Reset

Answer

Redirect

Question 11

An engineer configures a Cisco ASA firewall with three interfaces: inside (security level 100), outside (security level 0), and DMZ (security level 50). Traffic from the inside network to the DMZ network is sourced from 10.1.1.0/24 and destined to 192.168.1.0/24. The inside interface is configured with IP 10.1.1.1, DMZ interface with IP 192.168.1.1. An ACL on the inside interface permits IP traffic from 10.1.1.0/24 to 192.168.1.0/24. What happens when a packet from 10.1.1.10 to 192.168.1.10 arrives at the inside interface?

Accepted Answer

The packet is forwarded because the security levels allow traffic from higher to lower, and an ACL permits it.. On a Cisco ASA, traffic from a higher security level (inside, 100) to a lower security level (DMZ, 50) is permitted by default without requiring an ACL, but here an ACL is also explicitly permitting it. Since the inside interface has an ACL that permits 10.1.1.0/24 to 192.168.1.0/24, the packet matches and is forwarded. The security-level model allows higher-to-lower flows, and the explicit ACL confirms the permit.

Answer

The packet is dropped because no ACL is applied to the DMZ interface.

Answer

The packet is dropped because traffic from higher to lower security levels is implicitly denied.

Answer

The packet is forwarded only if a NAT rule exists for the source address.

Question 12

A Cisco ASA has three interfaces: inside (100), outside (0), and DMZ (50). A static NAT rule is configured to map the DMZ server 10.1.1.10 to outside address 200.1.1.10. An ACL on the outside interface permits traffic to 200.1.1.10. A host on the internet sends a packet to 200.1.1.10. What happens when the packet hits the outside interface?

Accepted Answer

The packet is forwarded to the DMZ server after NAT translation.. On a Cisco ASA, when a packet arrives on the outside interface destined for the mapped global address 200.1.1.10, the ASA performs the static NAT translation to the inside DMZ address 10.1.1.10 and forwards it. Because the outside ACL already permits traffic to 200.1.1.10, and the ASA evaluates the outside ACL before NAT translation on ingress, the packet is allowed and then translated and forwarded to the DMZ server.

Answer

The packet is dropped because no ACL exists for the DMZ interface.

Answer

The packet is forwarded only if an ACL on the DMZ interface permits it.

Answer

The packet is dropped because the outside security level is lower than DMZ.

Question 13

An engineer configures a Cisco ASA in a DMZ architecture. The DMZ hosts web servers that need to be accessible from the internet. Which security level should be assigned to the DMZ interface to ensure proper traffic flow without additional ACLs for return traffic?

Accepted Answer

50. On a Cisco ASA, security levels range from 0 (least trusted) to 100 (most trusted), and traffic is permitted by default from a higher security level to a lower one. Assigning the DMZ interface a level of 50 places it between the inside (100) and outside (0), so the inside can initiate traffic to the DMZ without an ACL, and the DMZ can initiate to the outside without an ACL, while the outside cannot initiate to the DMZ without an explicit ACL. This matches the standard DMZ design pattern.

Answer

255

Answer

0

Answer

100

Question 14

An engineer is deploying Cisco Firepower Threat Defense (FTD) in inline mode and needs to decrypt SSL traffic for inspection. Which two methods are supported by FTD for SSL decryption? (Choose two.)

Accepted Answer

Decrypt - Resign: The FTD re-signs the server certificate with its own CA.. Option D (Decrypt - Resign) is correct because FTD acts as a man-in-the-middle, generating a new certificate signed by an internal Certificate Authority (CA) that the client must trust, allowing the firewall to decrypt, inspect, and re-encrypt the session. Option E (Decrypt - Known Key) is correct because FTD can import the server's RSA private key so it can passively decrypt traffic without re-signing certificates, which is useful when the private key is available and the client cannot be forced to trust a resign CA. The unmarked options do not belong: A (Decrypt - Passthrough) and B (Decrypt - Monitor) describe actions that do not actually decrypt SSL traffic for inspection, and C (Decrypt - Block) is a failure-handling action rather than a supported SSL decryption method in FTD.

Answer

Decrypt - Passthrough: SSL traffic is allowed without inspection.

Answer

Decrypt - Monitor: SSL traffic is monitored but not decrypted.

Answer

Decrypt - Block: SSL traffic is blocked if decryption fails.

Question 15

Which three actions are available in a Cisco Firepower access control rule? (Choose three.)

Accepted Answer

Allow. In a Cisco Firepower access control rule, the available rule actions are Allow, Trust, Block, Monitor, and Block with Reset; the three correct answers here are B (Allow), C (Trust), and E (Block). Allow (B) permits the connection to proceed and then applies further inspection via the associated SSL, intrusion, and file policies. Trust (C) lets the traffic bypass all further inspection and analysis, including intrusion and file policies, and is typically used for trusted internal traffic. Block (E) denies the connection outright without sending a reset, and is a standard access control action for dropping unwanted traffic. Decrypt (A) is not an access control rule action; decryption is configured through SSL policies that are applied to traffic already allowed by an access control rule. Monitor (D) is also not an access control rule action; monitoring/inspection behavior is defined by the inspection policies (such as intrusion or file policies) attached to an Allow rule, not by a separate Monitor action.

Answer

Decrypt

Answer

Monitor