350-701 Network Security Practice Test 4 — 15 Questions

Question 1

Which of the following is a characteristic of a stateful firewall like Cisco ASA?

Accepted Answer

It maintains a state table of active connections.. Stateful firewalls track the state of active connections and make decisions based on the state of the session.

Answer

It filters traffic based solely on packet headers.

Answer

It can only filter based on source IP address.

Answer

It requires a separate proxy for each application.

Question 2

A Cisco FTD is configured with SSL/TLS inspection using the 'decrypt-known-key' method. Which traffic can be decrypted with this method?

Accepted Answer

Traffic to internal servers whose private key is imported into FTD. Decrypt-known-key is used when the FTD has the server's private key, typically for internal servers.

Answer

Traffic to any website on the internet

Answer

Traffic using self-signed certificates only

Answer

All SSL traffic regardless of certificate

Question 3

A network engineer is deploying a Cisco FTD in active/standby high availability. Which statement is true about the configuration synchronization?

Accepted Answer

Configuration changes on the active unit are automatically replicated to the standby unit.. In FTD HA, configuration is synchronized from active to standby via FMC. The standby unit does not accept configuration changes directly.

Answer

Standby unit must be configured separately with identical settings.

Answer

Both units can be managed independently via FMC.

Answer

Failover is configured on the FTD directly without FMC.

Question 4

A security administrator is deploying a Cisco ASA in a DMZ architecture. The inside interface is security 100, outside interface is security 0, and DMZ interface is security 50. Which TWO statements about traffic flow are correct?

Accepted Answer

Traffic from inside to DMZ is allowed by default.. Traffic from higher to lower security levels is allowed by default; lower to higher requires ACLs. Also, traffic from inside to DMZ is allowed, but return traffic is allowed due to stateful inspection.

Answer

Traffic from DMZ to outside is denied by default.

Answer

Traffic from outside to inside is allowed by default without ACL.

Answer

Traffic from DMZ to inside is allowed by default.

Question 5

A company is designing a network segmentation strategy using firewalls. Which THREE considerations are important for a defense-in-depth approach?

Accepted Answer

Use a DMZ to host public-facing services.. Defense-in-depth involves multiple layers: DMZ for public services, internal segmentation to limit lateral movement, and inbound strict rules.

Answer

Allow all outbound traffic from internal users.

Answer

Place all servers in the same segment for easier management.

Question 6

A Cisco FTD is configured with an access control policy that includes a rule to allow traffic from a specific source subnet. However, traffic is being blocked. Which TWO possible causes should be checked?

Accepted Answer

The source subnet is not correctly defined in the network object.. Rule order matters (first match wins) and if an earlier rule blocks the traffic, the allow rule never applies. Also, intrusion policy could block if set to drop.

Answer

The intrusion policy is set to 'No Inspection'.

Answer

The default action is set to 'Allow'.

Answer

The rule has a destination port that is incorrect.

Question 7

Which interface security level is assigned to the inside interface on a Cisco ASA by default?

Accepted Answer

100. The Cisco ASA assigns security level 100 to the inside interface, 0 to the outside, and intermediate values for DMZ interfaces.

Answer

255

Answer

0

Answer

50

Question 8

An engineer wants to configure NAT on a Cisco ASA such that multiple internal hosts share a single public IP address when accessing the internet. Which NAT type should be used?

Accepted Answer

PAT (overload). PAT (Port Address Translation) or NAT overload allows multiple internal hosts to share a single public IP by using unique port numbers.

Answer

Static NAT

Answer

Dynamic NAT

Answer

Identity NAT

Question 9

A Cisco FTD device managed by FMC is processing traffic. An access control rule is configured with the action 'Interactive Block'. What behavior does this action trigger?

Accepted Answer

The user is shown a block page and can click to bypass the block for a specified time.. Interactive Block presents a user with a block page with an option to bypass; it is not a simple block or allow.

Answer

The packet is dropped and logged without any user notification.

Answer

The connection is reset and the source IP is added to a block list permanently.

Answer

The traffic is allowed but inspected more closely.

Question 10

In a Snort intrusion detection rule, which part specifies the action to take when the rule matches?

Accepted Answer

Action. The action is the first field in a Snort rule (e.g., alert, drop, reject).

Answer

Protocol

Answer

Options

Answer

Source IP

Question 11

An organization wants to deploy Cisco Firepower in a high-availability pair with active/standby failover. Which management solution allows this configuration?

Accepted Answer

FMC. FMC (Firepower Management Center) supports high-availability configurations for FTD devices.

Answer

CLI only

Answer

FDM (on-box management)

Answer

ASDM

Question 12

Which deployment mode allows a Cisco Firepower NGFW to inspect traffic without being in the direct forwarding path?

Accepted Answer

Passive. Inline deployment is in the path; passive mode (or SPAN) monitors a copy of traffic.

Answer

Transparent

Answer

Routed

Answer

Inline

Question 13

A network engineer is configuring a site-to-site VPN between two Cisco ASAs using IKEv2. Which component defines the encryption and hash algorithms for Phase 2?

Accepted Answer

Transform set. Transform sets define the Phase 2 parameters such as encryption and integrity algorithms.

Answer

IKEv2 proposal

Answer

Crypto map

Answer

ISAKMP policy

Question 14

An engineer observes that the Cisco ASA connection table shows a consistent number of entries for UDP traffic, but the xlate table shows no entries. What is the most likely reason?

Accepted Answer

NAT is not configured for this traffic. The xlate table holds NAT translations; if no NAT is configured, traffic passes without xlate entries, but connections are still tracked.

Answer

The traffic is being dropped by ACLs

Answer

The ASA is in transparent mode

Answer

UDP traffic does not create connections

Question 15

Which Cisco Firepower feature uses SHA-256 hashes to determine the disposition of files and block malware?

Accepted Answer

File policy. File policy with AMP cloud lookup uses SHA-256 to check file reputation.

Answer

Intrusion policy

Answer

SSL policy

Answer

Network discovery