350-701 Network Security Practice Test 3 — 15 Questions

Question 1

A network architect is designing a DMZ for a web server that must be accessible from the internet. The server should not initiate connections to the internal network. Which firewall rule best achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Permit HTTP from outside to DMZ; deny all from DMZ to inside.. To allow inbound traffic to the DMZ server but block outbound from DMZ to inside, an ACL on the DMZ interface should permit inbound traffic from outside and deny outbound to inside.

Answer

Permit HTTP from DMZ to outside; deny all from inside to DMZ.

Answer

Permit any from outside to DMZ; permit any from DMZ to inside.

Answer

Permit any from outside to DMZ; deny any from DMZ to outside.

Question 2

An administrator is configuring Dynamic Access Policies (DAP) on a Cisco ASA for AnyConnect VPN. Which two attributes can be used to create DAP rules? (Choose two.)

Accepted Answer

Anti-virus software version. DAP can use endpoint attributes like antivirus status, registry entries, or connection attributes like group policy. Certificate issuer is not a standard DAP attribute.

Answer

Client IP address

Answer

Certificate issuer

Answer

Time of day

Question 3

A Cisco FTD is configured with an access control policy that includes an intrusion policy. Which three actions can be set in an access control rule regarding intrusion inspection? (Choose three.)

Accepted Answer

Allow with intrusion inspection. Access control rules can be set to 'Allow' with intrusion inspection, 'Allow' without inspection, 'Trust' (bypass inspection), 'Block', or 'Interactive Block'. The question asks for actions regarding intrusion inspection; 'Allow' with inspection, 'Allow' without, and 'Trust' are three possible actions.

Answer

Block with intrusion inspection

Answer

Interactive Block with intrusion inspection

Question 4

An organization is planning to deploy Cisco FTD in a high-availability pair. Which two statements about active/active failover are true? (Choose two.)

Accepted Answer

It requires multiple context mode.. Active/active failover requires multiple context mode and both units can process traffic simultaneously. Stateful failover is supported only in active/standby.

Answer

Stateful failover is supported.

Answer

It is the default failover mode.

Answer

Configuration is not synchronized.

Question 5

A security administrator is configuring URL filtering on Cisco FTD. Which three categories are commonly used in URL filtering policies? (Choose three.)

Accepted Answer

Social Networking. Common URL categories include Social Networking, Malware, and Adult Content. Phishing is a subcategory of Malware, but Malware is a top-level category. Streaming Media is also a standard category.

Answer

Encrypted Traffic

Answer

Phishing

Question 6

An engineer is configuring a Cisco ASA for site-to-site IKEv2 VPN with a VTI. Which two statements about VTI are true? (Choose two.)

Accepted Answer

VTI can be configured in IKEv2 mode with an IPsec profile.. VTI is a virtual interface that simplifies VPN configuration. It is a tunnel interface that uses IPsec profiles and supports routing protocols over the tunnel.

Answer

VTI requires a separate ACL to define interesting traffic.

Answer

VTI is only supported on the ASA 5500-X series.

Answer

VTI uses a crypto map to define the IPsec policy.

Question 7

An engineer is configuring an ASA to allow inbound HTTP traffic from the outside to a server on the DMZ. The outside interface has security level 0 and the DMZ interface has security level 50. Which set of commands correctly implements the required access and NAT?

Accepted Answer

nat (dmz,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside. The ASA requires a static NAT for inbound traffic and an ACL on the outside interface to permit the traffic.

Answer

nat (outside,dmz) static 10.1.1.10; access-list dmz_access_in permit tcp any host 10.1.1.10 eq 80; access-group dmz_access_in in interface dmz

Answer

nat (inside,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Answer

nat (dmz,outside) dynamic 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Question 8

A security administrator is configuring a Cisco FTD device using FMC. The goal is to block traffic from a specific country and allow all other traffic. Which action should be taken in the access control policy?

Accepted Answer

Create an access control rule with source country set to the country and action Block.. Geolocation filtering is configured under access control rules; a rule with block action for the country should be placed before any allow rules.

Answer

Create a pre-filter rule that blocks traffic from the country.

Answer

Create an intrusion rule with a block action for the country.

Answer

Create a file policy that blocks traffic from the country.

Question 9

On a Cisco ASA, which table holds information about translated addresses for active connections?

Accepted Answer

Xlate table. The xlate table stores translation entries (NAT translations) for active sessions.

Answer

ARP table

Answer

Conn table

Answer

Routing table

Question 10

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. Using a suppression filter allows the rule to remain active but suppresses alerts for specific source/destination IPs or ports.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 11

A company uses Cisco AnyConnect for remote access VPN. They want to allow only specific Active Directory groups to access the corporate network. Which feature on the ASA or FTD should be configured to enforce this?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policies (DAP) can evaluate user attributes from AD to assign access rights.

Answer

Connection profile with LDAP attribute map

Answer

AAA server group

Answer

Group Policy with filter on group membership

Question 12

A Cisco FTD is deployed in inline mode and is configured with a file policy to detect malware. When a file is transferred, the FTD computes a SHA-256 hash and checks it against AMP cloud. The cloud returns 'unavailable' for the hash. What action will the FTD take by default?

Accepted Answer

Allow the file and log the event.. By default, if the cloud lookup cannot determine the disposition (clean, malware, unknown), the file is allowed but logged.

Answer

Perform a deep packet inspection on the file.

Answer

Detonate the file in a sandbox before deciding.

Answer

Block the file because it could not be verified.

Question 13

Which type of VPN on Cisco ASA is typically used for site-to-site connectivity and encrypts all traffic between two sites?

Accepted Answer

IKEv2 IPsec site-to-site VPN. IKEv2 IPsec site-to-site VPN encrypts traffic between two gateways.

Answer

L2TP VPN

Answer

DTLS VPN

Answer

SSL VPN

Question 14

An organization has a Cisco ASA with two interfaces: inside (security 100) and outside (security 0). They want to allow traffic from inside to outside without NAT for a specific subnet. Which configuration achieves this?

Accepted Answer

nat (inside,outside) source static 192.168.1.0 192.168.1.0 no-proxy-arp route-lookup. A NAT exemption rule with 'nat 0' (on ASA 9.x+) or 'nat (inside,outside) source static' with an identity NAT can be used. In modern ASA, 'nat (inside,outside) source static NET NET no-proxy-arp route-lookup' is typical.

Answer

nat (inside,outside) dynamic interface

Answer

nat (inside,outside) source dynamic any interface

Answer

access-list outside_access_in permit ip 192.168.1.0 255.255.255.0 any

Question 15

A security analyst is monitoring the Cisco FMC and notices a high number of false positives from an intrusion rule that detects SQL injection attempts. The legitimate web application frequently generates similar patterns. Which course of action would reduce false positives while maintaining detection for actual attacks?

Accepted Answer

Increase the rule's threshold to reduce frequency.. Modifying the rule's threshold to require a higher number of matches or using a suppression filter for the web server IP can reduce false positives.

Answer

Disable the rule entirely.

Answer

Create a new intrusion rule with opposite logic.

Answer

Change the rule action to 'pass'.