350-701 Network Security Practice Test 2 — 15 Questions

Question 1

A network engineer is configuring site-to-site IPsec VPN on a Cisco ASA using IKEv2. Which two components are required for IKEv2 configuration? (Choose two.)

Accepted Answer

IKEv2 proposal. IKEv2 requires an IKEv2 proposal (or policy) defining encryption and authentication for phase 1, and a transform set for IPsec phase 2. Also, a crypto map binds the configuration to an interface. ISAKMP policy is for IKEv1.

Answer

ISAKMP policy

Answer

Group policy

Answer

Dynamic crypto map

Question 2

An administrator configures a Cisco ASA with an interface named 'inside' at security level 100 and 'outside' at security level 0. Which statement about traffic flow is true?

Accepted Answer

Traffic from inside to outside is allowed by default if the connection is statefully inspected.. By default, traffic from a higher security level (inside) to a lower security level (outside) is allowed without an ACL if stateful inspection permits.

Answer

Traffic from inside to outside is denied unless NAT is configured.

Answer

All traffic between inside and outside is denied without an ACL.

Answer

Traffic from outside to inside is allowed by default.

Question 3

A network engineer is configuring NAT on a Cisco ASA for internal servers to be accessible from the internet. One server (10.1.1.10) must always be reachable via a fixed public IP (203.0.113.10). Which NAT type should be used?

Accepted Answer

Static NAT. Static NAT provides a one-to-one fixed mapping between a private IP and a public IP, ensuring the server is always reachable via the same public address.

Answer

Identity NAT

Answer

Dynamic NAT

Answer

Dynamic PAT (overload)

Question 4

An engineer is configuring an access control policy on Cisco FMC for FTD. The policy must allow HTTP traffic from the inside zone to the outside zone, but block all other traffic. Which rule configuration is correct?

Accepted Answer

Rule 1: Permit HTTP from inside to outside; Rule 2: Block all traffic.. Access control rules are processed top-down; a trust rule bypasses further inspection but still allows traffic; a permit rule allows traffic with inspection. The scenario requires allowing HTTP only, so a permit rule for HTTP with a default deny rule after is correct.

Answer

Rule 1: Trust HTTP from inside to outside; Rule 2: Block all traffic.

Answer

Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to outside.

Answer

Rule 1: Allow HTTP from inside to outside; no default rule.

Question 5

Which Snort rule action causes the FTD to drop a packet and generate an alert?

Accepted Answer

drop. The 'alert' action generates an alert but does not drop; 'drop' drops and alerts; 'reject' drops and sends TCP RST; 'pass' ignores the packet.

Answer

reject

Answer

alert

Answer

pass

Question 6

A Cisco FTD device is deployed in inline mode and configured with an SSL policy to decrypt traffic. The policy uses 'Decrypt - Known Key' for traffic to an internal server. What is required for this decryption to work?

Accepted Answer

The FTD must have the server's private key imported.. 'Decrypt - Known Key' requires the server's private key to be imported into the FTD so it can decrypt the traffic by impersonating the server.

Answer

The FTD must generate a new certificate for each session.

Answer

The server's certificate must be signed by a public CA.

Answer

The client must trust the FTD's CA certificate.

Question 7

An organization needs to inspect traffic between two internal zones (e.g., HR and IT) on a Cisco FTD. Which deployment mode is appropriate?

Accepted Answer

Inline mode with an access control policy. Inline mode allows the FTD to actively inspect and block traffic. Passive mode only monitors. The requirement to inspect implies inline for enforcement.

Answer

Switchport mode

Answer

Routed mode without any policy

Answer

Passive mode with an intrusion policy

Question 8

An administrator is configuring a site-to-site IKEv2 VPN between two Cisco ASAs. Which configuration component defines the encryption and authentication algorithms for the IPsec SA?

Accepted Answer

Transform set. The transform set specifies the IPsec SA parameters (encryption, authentication, etc.). IKEv2 uses proposals and transforms within the transform set.

Answer

Crypto map

Answer

IPsec profile

Answer

ISAKMP policy

Question 9

What is the primary difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Signature-based uses patterns of known attacks; anomaly-based uses behavior baselines.. Signature-based detection compares traffic against known attack patterns; anomaly-based detection establishes a baseline and flags deviations.

Answer

Signature-based has higher false positive rate than anomaly-based.

Answer

Signature-based detects unknown attacks; anomaly-based detects known attacks.

Answer

Both methods are identical in operation.

Question 10

An organization deploys Cisco FTD in a high-availability pair using active/standby. If the active unit fails, what happens to existing connections?

Accepted Answer

Existing connections are preserved if stateful failover is configured.. In active/standby, state information is synchronized. When the standby becomes active, existing connections are preserved if the failover is stateful.

Answer

All connections are dropped and must be re-established.

Answer

The standby unit cannot take over because it has no configuration.

Answer

Only TCP connections are preserved; UDP connections are dropped.

Question 11

A Cisco FMC administrator needs to create a file policy to detect malware in HTTP downloads. The policy should allow the file to be delivered if it is known clean, block if known malicious, and allow but capture for analysis if unknown. Which combination of actions is required?

Accepted Answer

Detect Files: Clean = Allow; Malicious = Block; Unknown = Allow and Capture. The file policy can use dispositions from AMP: clean (allow), malicious (block), and unknown (allow but capture for further analysis).

Answer

Detect Files: Clean = Block; Malicious = Allow; Unknown = Block

Answer

Detect Files: Clean = Allow; Malicious = Allow; Unknown = Block

Answer

Intrusion Policy instead of File Policy

Question 12

Which Cisco FTD feature provides application visibility and control (AVC) to identify and block applications like Facebook or Skype?

Accepted Answer

Access control policy with application conditions. Application visibility and control is achieved through the access control policy using application filters and the application database. Intrusion policy handles threats, not application identification.

Answer

URL filtering policy

Answer

Intrusion policy

Answer

SSL decryption policy

Question 13

An administrator configures a Cisco ASA with a DMZ interface at security level 50. Traffic from the inside (level 100) to the DMZ (level 50) is allowed by default. What additional configuration is needed to allow traffic from the DMZ to the inside?

Accepted Answer

An ACL applied to the DMZ interface permitting traffic to inside.. Traffic from lower to higher security level is blocked by default; an ACL must be applied to the lower security interface (DMZ) to permit traffic to the inside (higher).

Answer

A NAT rule is required.

Answer

An ACL applied to the inside interface permitting traffic from DMZ.

Answer

No additional configuration; it is allowed by default.

Question 14

A security engineer is tuning Snort rules on a Cisco FTD to reduce false positives. Which action should be taken if a rule is generating alerts for legitimate traffic?

Accepted Answer

Disable the rule or set it to 'noalert'.. To reduce false positives, the rule can be disabled (noalert), thresholding can reduce alert frequency, or the rule can be modified to be more specific. Disabling is a common initial step if the rule is not needed.

Answer

Change the rule action to 'reject'.

Answer

Increase the priority of the rule.

Answer

Add the rule to a custom policy with higher precedence.

Question 15

An organization uses Cisco AnyConnect SSL VPN with DTLS enabled. What is the primary benefit of DTLS?

Accepted Answer

It uses UDP to avoid TCP-over-TCP issues and improve performance.. DTLS provides UDP-based transport for VPN traffic, reducing latency and improving performance for real-time applications compared to TCP-based TLS.

Answer

It provides stronger encryption than TLS.

Answer

It is required for DAP policies.

Answer

It allows split tunneling without configuration.