350-701 Network Security Practice Test 3 — 15 Questions

Question 1

A security analyst notices a high number of false positives from an intrusion detection system (IDS) using signature-based detection. Which action would best reduce false positives while maintaining detection of real threats?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable all signatures with a high false positive rate. Disabling signatures that generate a high rate of false positives directly removes the noisy rules while leaving the rest of the signature set intact, preserving detection of genuine threats. This is a targeted tuning action that reduces alert fatigue without abandoning signature-based detection. It is the standard operational practice for IDS tuning.

Answer

Increase the sensor sensitivity level

Answer

Switch to anomaly-based detection

Answer

Decrease the severity threshold for alerts

Question 2

A company uses a Cisco FMC to manage multiple FTD devices. They want to decrypt SSL/TLS traffic from internal users to external websites using a known private key. Which SSL decryption method should they use?

Accepted Answer

Decrypt-resign. Decrypt-resign (also called SSL Forward Proxy with re-signing) is the FTD/FMC method used when the organization controls a trusted internal CA and wants to intercept outbound SSL/TLS traffic to external sites. The FTD presents a certificate signed by its own CA to the internal client, decrypts the session, inspects it, then re-encrypts to the external server. This is the standard approach for decrypting traffic to external websites where the firewall does not possess the server's private key.

Answer

Bypass decryption

Answer

Decrypt-known-key

Answer

Decrypt-unknown-key

Question 3

A Cisco FTD is deployed in a data center and needs to provide intrusion prevention and application control. Which two actions are available in an access control rule? (Choose two.)

Accepted Answer

Trust. In a Cisco FTD access control rule, the available actions are Allow, Trust, Monitor, Block, and Block with Reset; among the listed options, D (Trust) and E (Allow) are valid rule actions. Trust (D) is correct because it permits the traffic to pass without further inspection by intrusion prevention, file, or application-layer policies, which is useful for trusted flows that should bypass deep inspection. Allow (E) is correct because it permits the traffic and then subjects it to the configured intrusion prevention, application control, and other inspection policies, which matches the requirement to provide IPS and application control. Encrypt (B) is not an access control rule action; encryption is handled by VPN or TLS/SSL inspection features, not by the rule action itself. Redirect (C) is also not an access control rule action in FTD; redirection is not one of the standard actions (Allow, Trust, Monitor, Block, Block with Reset). Monitor (A) is a valid FTD action in general, but it is not one of the two marked correct answers here, so it is excluded from this response.

Answer

Monitor

Answer

Encrypt

Answer

Redirect

Question 4

A company uses Cisco AnyConnect for remote access VPN. Which two components are used to enforce policies based on endpoint posture? (Choose two.)

Accepted Answer

Dynamic Access Policy (DAP). Option B, Dynamic Access Policy (DAP), is correct because DAP on the Cisco ASA (or Firepower) evaluates endpoint posture attributes received from AnyConnect (e.g., via HostScan) and applies granular authorization decisions such as ACLs, VLAN assignment, or restrictions based on those posture results. Option E, Group policy, is correct because the group policy is the container that holds the connection and authorization settings applied to the VPN session, and DAP-selected attributes/ACLs are delivered through the group policy (or a DAP-assigned group policy) to enforce the posture-based result. Options A (Transform set), C (ISAKMP policy), and D (Crypto map) are incorrect because they are IPsec/IKE negotiation constructs that define encryption/integrity algorithms, Phase 1/Phase 2 parameters, and crypto map bindings for site-to-site or IPsec VPNs; they do not evaluate endpoint posture or enforce posture-based access policies for AnyConnect sessions.

Answer

Transform set

Answer

ISAKMP policy

Answer

Crypto map

Question 5

An engineer is configuring a Cisco ASA to allow inbound HTTPS traffic from the outside to a web server on the DMZ. The outside interface has security level 0, the DMZ interface has security level 50, and the inside has security level 100. Which set of commands correctly allows the traffic considering stateful inspection?

Accepted Answer

static (dmz,outside) tcp 192.168.1.10 443 10.1.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 192.168.1.10 eq 443; access-group OUTSIDE_IN in interface outside. The correct syntax for a static NAT on an ASA is 'static (real_if,mapped_if) tcp '. Here, the DMZ is the real interface (security level 50) and outside is the mapped interface (security level 0), so 'static (dmz,outside) tcp 192.168.1.10 443 10.1.1.10 443' maps the public IP 192.168.1.10 to the DMZ server 10.1.1.10. The ACL must permit traffic to the mapped (public) IP and be applied inbound on the outside interface.

Answer

static (outside,dmz) tcp 10.1.1.10 443 192.168.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside

Answer

nat (dmz,outside) static 192.168.1.10; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface dmz

Answer

access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside; static (inside,outside) tcp 10.1.1.10 443 10.1.1.10 443 netmask 255.255.255.255

Question 6

A Cisco FTD device is deployed in passive mode. The security team wants to block malicious traffic without affecting legitimate traffic. Which action should be used in the access control policy rule?

Accepted Answer

Set the rule action to 'Allow' and rely on intrusion policy with 'Drop and Reset'. In a passive (monitor-only) FTD deployment, the device cannot drop traffic inline, so the access control rule action must be 'Allow' and enforcement is achieved through the intrusion policy, where 'Drop and Reset' lets the IPS drop malicious packets and reset offending sessions without blocking legitimate traffic. Option A is therefore correct because it matches the passive-mode requirement of allowing traffic at the access control layer while relying on the intrusion policy for blocking. Option B ('Trust') bypasses all further inspection, including the intrusion policy, so no malicious traffic would be blocked. Option C ('Block' with reset) is an inline access control action that drops traffic at the access control stage, which is not supported or appropriate in passive mode. Option D ('Interactive Block') also requires inline blocking and user interaction, which a passive deployment cannot perform.

Answer

Set the rule action to 'Trust'

Answer

Set the rule action to 'Block' with a reset

Answer

Set the rule action to 'Interactive Block'

Question 7

An administrator configures a Cisco ASA with the following Modular Policy Framework (MPF) commands:

class-map type inspect http match any
policy-map type inspect http http_policy
 parameters
 protocol-violation action reset
service-policy http_policy global

What is the result of this configuration?

Accepted Answer

Creates an HTTP inspection policy that resets connections that violate HTTP protocol. The configuration defines an HTTP inspection policy-map (http_policy) that is applied globally via the service-policy command. Within the policy-map, the 'protocol-violation action reset' parameter instructs the ASA to reset any connection that violates the HTTP protocol (e.g., malformed requests, RFC violations). This is a standard MPF Layer 7 inspection configuration that does not block all HTTP traffic, but rather enforces protocol conformance by terminating offending sessions.

Answer

Blocks all HTTP traffic globally

Answer

Enables HTTP deep inspection and logs all HTTP requests

Answer

Applies the policy only on the inside interface

Question 8

An engineer is configuring a Cisco Firepower Management Center (FMC) to manage multiple FTD devices. The engineer needs to ensure that access control policies are applied consistently across all devices. Which FMC feature should be used to group devices and apply policies uniformly?

Accepted Answer

Device groups. Device groups in FMC allow you to group FTD devices and apply access control policies uniformly. This feature is essential for managing multiple devices consistently, ensuring that security policies are enforced across the entire group without manual per-device configuration.

Answer

Tenants

Answer

FlexConfig

Answer

Policy assignments

Question 9

A network security engineer is deploying Cisco Identity Services Engine (ISE) in a new branch office to authenticate wired supplicants using 802.1X. The engineer wants to minimize the impact of a temporary loss of connectivity to the central ISE node in the data center. Which ISE deployment persona should be deployed locally at the branch to support authentication during WAN outages?

Accepted Answer

Policy Service Node in Standalone mode. The Policy Service Node in Standalone mode is specifically designed for branch offices to provide local authentication and authorization when the WAN link to the central ISE deployment is unavailable. It caches policies and processes 802.1X requests independently. Other personas either manage configuration or collect logs, and a standard PSN still depends on central nodes for full operation.

Answer

Policy Administration Node

Answer

Monitoring and Troubleshooting Node

Answer

Policy Service Node

Question 10

An administrator is configuring a Cisco ASA firewall for remote access VPN using AnyConnect. The administrator wants to ensure that the VPN users can access internal resources and that their traffic is inspected by the ASA's security policies. Which feature must be configured to allow the VPN traffic to be inspected by the ASA?

Accepted Answer

Same-security-traffic permit intra-interface. For remote access VPN traffic that enters and exits the same ASA interface, the same-security-traffic permit intra-interface command is needed to allow the traffic to be inspected and forwarded. Without it, the ASA blocks traffic that attempts to re-enter the same interface. Split tunneling and VPN filters do not enable inspection of hairpinned VPN traffic.

Answer

Dynamic split tunneling

Answer

VPN filter

Answer

Split tunneling

Question 11

A security engineer is configuring a Cisco Firepower Threat Defense (FTD) device managed by FMC. The engineer needs to inspect traffic for a specific application that uses a non-standard port. The application is known to use TLS 1.3 with encrypted SNI. Which action should be taken to ensure the application is properly identified and controlled?

Accepted Answer

Configure an SSL policy with Decrypt - Resign to decrypt the traffic and then apply an access control rule based on the application.. When an application uses TLS 1.3 with encrypted SNI, the SNI is not visible in the clear, so application detection based on SNI fails. To properly identify and control such traffic, the FTD must decrypt the TLS session. An SSL policy with Decrypt - Resign decrypts the traffic, allowing the access control policy to inspect the plaintext and identify the application. This enables granular control.

Answer

Use a prefilter policy to fastpath the traffic, as prefilter policies can identify applications even with encrypted SNI.

Answer

Create a custom application detector using the Snort 3 rule language and upload it to FMC.

Answer

Enable TLS 1.3 support in the FTD platform settings and rely on the default application detectors.

Question 12

An engineer is configuring a Cisco ASA firewall for remote access VPN using AnyConnect. The engineer wants to ensure that split tunneling is enabled so that only traffic destined for the corporate network goes through the VPN tunnel. Which configuration is required on the ASA?

Accepted Answer

Configure an ACL for split tunneling and apply it to the group policy.. Split tunneling on ASA is configured by creating an ACL that defines the corporate networks to be tunneled and applying it to the group policy with 'split-tunnel-network-list'. The split-tunnel-policy is set to 'tunnelspecified' to use the ACL. The client then sends only traffic to those networks through the VPN, while other traffic goes directly.

Answer

Configure the AnyConnect client profile to enable split tunneling.

Answer

Enable split tunneling globally with the 'split-tunnel-all' command.

Answer

Set the 'split-tunnel-policy' to 'tunnelspecified' and define the tunneled networks in the group policy.

Question 13

A network administrator is configuring Cisco Umbrella for a branch office. The administrator wants to ensure that DNS queries from client devices are resolved by Umbrella's global network and that malicious domains are blocked. Which configuration step is required on the branch office router to redirect DNS traffic to Umbrella?

Accepted Answer

Configure a NAT rule to redirect all UDP port 53 traffic to Umbrella's anycast IP addresses.. To enforce Umbrella for all clients at a branch, the router must intercept DNS queries and redirect them to Umbrella's anycast IPs. Configuring a NAT rule for UDP port 53 accomplishes this, ensuring that even clients with hardcoded DNS servers use Umbrella. This method is effective and commonly used in Umbrella deployments.

Answer

Configure the router's DNS server to point to Umbrella's anycast IP addresses.

Answer

Enable DNS snooping on the router to forward queries to Umbrella.

Answer

Configure a static route for 208.67.222.222/32 to the Umbrella tunnel interface.

Question 14

A network administrator is configuring a Cisco FTD device in a high-availability pair using FMC. The administrator wants to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which failover type should be configured to achieve this?

Accepted Answer

Active/standby failover. The correct answer is active/standby failover. This configuration provides a simple and effective high-availability solution where one unit is active and the other standby, ensuring minimal disruption upon failure. Active/active, cluster, and stateful failover are either more complex, not applicable to a pair, or a feature rather than a type.

Answer

Cluster failover

Answer

Active/active failover

Answer

Stateful failover

Question 15

An engineer is configuring a Cisco ASA and needs to ensure that traffic from the outside interface to a web server on the DMZ is allowed. The inside interface is security level 100 and the DMZ is level 50. The outside interface is level 0. Which statement about the default traffic flow is true?

Accepted Answer

Traffic from outside to DMZ is denied implicitly because outside level is lower than DMZ level.. Cisco ASA assigns security levels 0-100, and the default implicit rule permits traffic from a higher security level to a lower one while denying traffic from a lower level to a higher level. The outside interface (level 0) is lower than the DMZ (level 50), so traffic from outside to DMZ is implicitly denied. Any permitted outside-to-DMZ traffic must be explicitly allowed via an ACL.

Answer

Traffic from outside to DMZ is allowed implicitly because the ASA inspects all interfaces equally.

Answer

Traffic from outside to DMZ is allowed implicitly because outside is level 0 and DMZ is level 50.

Answer

Traffic from outside to DMZ is allowed implicitly because both are lower than inside.