350-701 Network Security Practice Test 4 — 15 Questions

Question 1

A network administrator is configuring NAT on a Cisco ASA to allow internal users to access the internet using a single public IP address. The internal network uses RFC 1918 addresses. Which type of NAT should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PAT (Port Address Translation). PAT (Port Address Translation) allows many internal IPs to share a single public IP by using unique source ports. Dynamic NAT would require a pool of public IPs, and static NAT provides one-to-one mapping.

Answer

Dynamic NAT

Answer

Static NAT

Answer

Identity NAT

Question 2

A company uses Cisco Firepower Threat Defense (FTD) managed by FMC. They need to create an access control policy that allows traffic from specific source IPs to a web server, but blocks all other traffic. How should the rule base be ordered?

Accepted Answer

Place the permit rule first, then the block rule.. Cisco FTD access control policies evaluate rules top-down, first-match. The permit rule for specific source IPs must appear before the block rule so that matching traffic is allowed; the subsequent block rule then catches all remaining traffic. If the block rule were first, it would match all traffic (including the intended permitted sources) and drop it, making the permit rule unreachable.

Answer

Place the block rule first, then the permit rule.

Answer

Use a single rule with permit and block conditions combined.

Answer

Order does not matter because FMC processes rules in parallel.

Question 3

A security administrator is investigating an alert from an IPS that detected a SQL injection attempt. The alert was triggered by a signature that looks for specific patterns in the traffic. What type of detection method is this?

Accepted Answer

Signature-based detection. The alert was triggered by a signature that looks for specific patterns in traffic, which is the definition of signature-based detection. SQL injection signatures match known attack strings or regex patterns (e.g., 'UNION SELECT', 'OR 1=1'). This is a static pattern match against known indicators, not behavioral or statistical analysis.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 4

A Cisco Firepower administrator configures an access control policy with a rule that trusts traffic from a specific source network. What is the effect of the trust action on the traffic?

Accepted Answer

The traffic is allowed without further inspection.. In a Cisco Firepower access control policy, the Trust action allows the traffic to pass without any further inspection by intrusion, file, or other deep-inspection policies. It is effectively a fast-path allow that bypasses the rest of the inspection pipeline. This is useful for trusted internal traffic where inspection overhead is unnecessary.

Answer

The traffic is blocked and logged.

Answer

The traffic is allowed and inspected by the intrusion policy.

Answer

The traffic is allowed but subject to file policy.

Question 5

An engineer is deploying a Cisco FTD in inline mode and wants to inspect SSL/TLS traffic using the 'decrypt-resign' action. What must be configured on the client devices to avoid certificate errors?

Accepted Answer

Install the organization's CA certificate in the client's trusted root store.. When using 'decrypt-resign', the FTD generates a new certificate signed by a CA that the organization controls. Clients must trust the organization's CA certificate (root CA) that is used to sign the re-encrypted certificates. Without that, clients will see certificate errors.

Answer

Disable certificate validation on all client browsers.

Answer

Install the FTD's self-signed certificate on each client.

Answer

Use 'decrypt-known-key' instead, which does not require client configuration.

Question 6

A company is deploying Cisco AnyConnect SSL VPN and wants to enforce different access policies based on the endpoint's antivirus status. Which feature should be used?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policy (DAP) on Cisco ASA and FTD allows administrators to define granular access policies that are evaluated at connection time based on endpoint attributes such as antivirus status, OS version, registry keys, and posture assessment results. DAP records can match on these attributes and apply different permissions, ACLs, or restrictions per user session. This makes DAP the correct feature for enforcing access policies based on endpoint antivirus status in an AnyConnect SSL VPN deployment.

Answer

Group Policy

Answer

Split Tunneling

Answer

Network Access Control (NAC)

Question 7

A Cisco ASA is configured with a site-to-site VPN using IKEv2. Which component defines the encryption and authentication algorithms for the IPsec tunnel?

Accepted Answer

Transform set. In a Cisco ASA site-to-site VPN using IKEv2, the transform set defines the encryption and authentication algorithms (e.g., ESP-AES-256-SHA) that protect the IPsec tunnel data. IKEv2 proposals handle the IKE phase negotiation, not the IPsec SA parameters. Therefore, the transform set is the correct component.

Answer

ISAKMP policy

Answer

IKEv2 proposal

Answer

Crypto map

Question 8

An engineer configures a Cisco FTD in a high-availability pair with active/standby failover. The primary unit fails, and the standby takes over. After the primary recovers, what must be done to ensure it resumes as active?

Accepted Answer

Execute 'failover active' on the primary unit.. In Cisco FTD active/standby failover, when the primary unit recovers it rejoins as standby by default; it does not automatically preempt. To make it active again, an administrator must manually run 'failover active' on the primary (or 'failover standby' on the current active). This is by design to avoid unnecessary failover flapping.

Answer

No action is needed; the primary automatically resumes active role.

Answer

Reboot the secondary unit.

Answer

Disable and re-enable failover.

Question 9

A company uses Cisco Firepower with FMC and wants to block access to social media websites for all users. Which feature should be used to create this policy?

Accepted Answer

URL Filtering. URL Filtering in Cisco Firepower (FMC) is the feature designed to categorize and control access to websites based on URL category, including social media. It uses Cisco Talos URL categories and can be applied within an access control policy to block or allow categories. This directly satisfies the requirement to block social media for all users.

Answer

File Policy

Answer

Intrusion Policy

Answer

Application Visibility and Control (AVC)

Question 10

A Cisco FTD is deployed in inline mode and configured with an access control policy. The policy includes rules with actions: Trust, Allow, Block, and Interactive Block. Which two statements about these actions are correct? (Choose two.)

Accepted Answer

Trust action bypasses all further inspection modules.. Option A is correct because the Trust action in a Cisco FTD access control policy terminates policy evaluation for that connection and bypasses all subsequent inspection, including SSL, IPS, and file/malware inspection, effectively allowing the traffic without further deep inspection. Option B is correct because the Interactive Block action permits the user to proceed after being presented with a customizable block page (a user-response page), unlike the Block action which silently drops the traffic. Option C is incorrect because the default action when no rule matches is Block (or Block with reset), not Allow. Option D is incorrect because the Block action drops the traffic and logs it, it does not allow it to pass. Option E is incorrect because the Allow action permits the traffic and subjects it to all configured inspection modules (IPS, URL filtering, malware, etc.), not URL filtering alone.

Answer

Allow action is the default action if no rule matches.

Answer

Block action logs the traffic and allows it to pass.

Answer

Allow action applies only URL filtering but not IPS.

Question 11

An engineer is configuring a Cisco ASA to support a DMZ segment. Which three of the following are best practices for DMZ design? (Choose three.)

Accepted Answer

Place public-facing servers in the DMZ.. Option A is correct because public-facing servers such as web, mail, and DNS hosts should be placed in the DMZ so that if they are compromised, the attacker is not already inside the protected internal network. Option B is correct because traffic initiated from the DMZ toward the inside network must be restricted or denied, since the DMZ is a lower-trust zone and should not be able to reach internal resources unless explicitly required. Option D is correct because strict ACLs between the outside and DMZ limit which external traffic can reach DMZ hosts, reducing the attack surface and enforcing least-privilege access. Option C is not a best practice because a DMZ interface is typically assigned a security level between the outside (0) and inside (100), commonly 50, so that it is distinct from the untrusted outside zone. Option E is incorrect because the DMZ must use a separate subnet from the inside network to maintain segmentation and prevent direct Layer 2/Layer 3 access between zones.

Answer

Assign the DMZ interface a security level of 0.

Answer

Use the same subnet for DMZ and inside networks.

Question 12

An administrator configures a Cisco ASA with an interface named 'inside' at security level 100 and 'outside' at security level 0. Which statement about traffic flow is true?

Accepted Answer

Traffic from inside to outside is allowed by default if the connection is statefully inspected.. By default, traffic from a higher security level (inside) to a lower security level (outside) is allowed without an ACL if stateful inspection permits.

Answer

Traffic from inside to outside is denied unless NAT is configured.

Answer

All traffic between inside and outside is denied without an ACL.

Answer

Traffic from outside to inside is allowed by default.

Question 13

A network engineer is configuring NAT on a Cisco ASA for internal servers to be accessible from the internet. One server (10.1.1.10) must always be reachable via a fixed public IP (203.0.113.10). Which NAT type should be used?

Accepted Answer

Static NAT. Static NAT provides a one-to-one fixed mapping between a private IP and a public IP, ensuring the server is always reachable via the same public address.

Answer

Identity NAT

Answer

Dynamic NAT

Answer

Dynamic PAT (overload)

Question 14

Which Snort rule action causes the FTD to drop a packet and generate an alert?

Accepted Answer

drop. In Snort/FTD rule actions, 'drop' instructs the sensor to drop the offending packet and generate an alert, blocking the traffic inline. This is the standard action for IPS mode when you want to both log and prevent the packet from reaching its destination. The other actions either only alert or reject with a TCP reset.

Answer

reject

Answer

alert

Answer

pass

Question 15

An organization needs to inspect traffic between two internal zones (e.g., HR and IT) on a Cisco FTD. Which deployment mode is appropriate?

Accepted Answer

Inline mode with an access control policy. Inline mode on a Cisco FTD places the device directly in the traffic path between two internal zones, allowing it to inspect and block traffic based on an access control policy. This is the appropriate deployment mode when the requirement is to inspect traffic between internal zones such as HR and IT. Inline mode supports access control, intrusion prevention, and malware inspection, making it the correct choice for enforcing security policy between internal segments.

Answer

Switchport mode

Answer

Routed mode without any policy

Answer

Passive mode with an intrusion policy