350-701 Network Security Practice Test 5 — 15 Questions

Question 1

On a Cisco ASA, which command applies a policy-map globally to all interfaces?

Accepted Answer

service-policy. The service-policy command applies the policy-map globally.

Answer

class-map

Answer

policy-map

Answer

access-group

Question 2

A Cisco FTD device is configured with an SSL decryption rule using 'Decrypt - Known Key'. In which scenario is this action appropriate?

Accepted Answer

Decrypting traffic to an internal server whose private key is imported. Decrypt - Known Key is used when the firewall has the server's private key, typically for inbound connections to an internal server.

Answer

Decrypting traffic to any HTTPS site using a self-signed certificate

Answer

Decrypting traffic to an external website

Answer

Decrypting traffic without inspecting the certificate

Question 3

In Cisco ASA modular policy framework, what is the function of a class-map?

Accepted Answer

Classify traffic into different flows. Class-maps identify traffic based on match criteria (e.g., ACL, protocol).

Answer

Apply the policy to an interface

Answer

Configure NAT rules

Answer

Define the action to take on traffic

Question 4

A security analyst is tuning Snort IPS rules to reduce false positives. Which TWO strategies are effective?

Accepted Answer

Disable the rule that is causing false positives. Disabling a rule that is triggering false positives immediately stops those false alerts. Adding a pass rule tells Snort to ignore that traffic, preventing false positives for known benign traffic. Changing the action to 'alert' does not reduce false positives; it only changes the response from dropping to alerting, so the false alerts persist.

Answer

Increase the sensitivity of all rules

Answer

Enable all rules to maximize coverage

Answer

Set the rule action to 'alert' instead of 'drop'

Question 5

An engineer is configuring a Cisco AnyConnect SSL VPN for remote access. Which TWO features are commonly used to control access based on endpoint security posture?

Accepted Answer

Posture assessment (e.g., AnyConnect Posture module). Dynamic Access Policy (DAP) allows access control based on endpoint attributes. Posture assessment checks for compliance. Group policies provide general VPN parameters but not posture-based dynamically.

Answer

IPsec transform set

Answer

Group policy

Answer

Crypto map

Question 6

A company wants to deploy a DMZ segment accessible from the internet. Which THREE considerations are critical for firewall zone design and security?

Accepted Answer

Use separate firewall interfaces for inside, outside, and DMZ. DMZ should have its own interface with a security level between inside and outside. Traffic from outside to DMZ should be restricted to necessary services. Inside to DMZ traffic should be permitted for management but initiated from inside.

Answer

DMZ interface should have a security level of 100

Answer

Allow all traffic from inside to DMZ without inspection

Question 7

An engineer is configuring a Cisco ASA to allow traffic from the inside (security level 100) to the outside (security level 0). They create an access list permitting HTTP traffic from inside to outside and apply it to the inside interface inbound. What is the expected behavior?

Accepted Answer

The traffic will be allowed because the ACL permits it.. On Cisco ASA, when an ACL is applied inbound on the higher security interface (inside), traffic is evaluated before the stateful inspection. Since traffic from higher to lower security is implicitly allowed by default (based on security levels), the ACL does not need to explicitly permit it; however, applying an ACL inbound on the higher interface can restrict traffic. The ACL as described permits HTTP, so the traffic will be allowed.

Answer

The traffic will be blocked because the ACL is applied inbound on the inside interface.

Answer

The traffic will be blocked because the ACL should be applied outbound on the outside interface.

Answer

The traffic will be allowed only if a NAT rule exists.

Question 8

A network administrator is configuring site-to-site IPsec VPN between two Cisco ASAs using IKEv2. They want to ensure that only specific subnets are encrypted, using Virtual Tunnel Interface (VTI). Which configuration element is essential for VTI?

Accepted Answer

A tunnel interface with an IP address and a crypto map.. VTI uses a tunnel interface that is dedicated to the VPN, and the crypto map is applied to the tunnel interface rather than the physical interface. For IKEv2, the tunnel mode is enabled and the crypto map is applied to the VTI.

Answer

A crypto map applied to the physical interface.

Answer

A transform set with ESP encryption and authentication.

Answer

An ISAKMP policy with pre-shared key.

Question 9

A Cisco FTD device is deployed in inline mode and is configured with an access control policy that includes an Intrusion Policy set to 'Balanced Security and Connectivity' and a File Policy with Malware & File blocking enabled. Traffic from a host inside to an external server is allowed by an access control rule. The administrator notices that a file download (PDF) is being blocked even though the file has a good reputation. What is the most likely cause?

Accepted Answer

The file policy is configured to block PDF files regardless of disposition.. The file policy may be configured to block files based on file type or other criteria regardless of malware disposition. In this case, the PDF may be blocked by file type restriction, not by malware detection. The Intrusion policy might also generate alerts but not block the file; the file policy is the one blocking.

Answer

The AMP cloud lookup returned an 'unknown' disposition and the policy blocks unknowns.

Answer

The access control rule requires a 'trust' action to bypass inspection.

Answer

The intrusion policy is set to 'Balanced' and the PDF contains a known exploit signature.

Question 10

An organization is deploying Cisco Firepower Threat Defense (FTD) in a high-availability (HA) pair in active/standby mode. Which statement about state synchronization is true?

Accepted Answer

Connection states are synchronized from active to standby over the failover link.. In active/standby HA, the active unit replicates connection states to the standby unit so that if a failover occurs, the standby can take over without disrupting existing connections. Stateful failover requires synchronization of connection tables.

Answer

The standby unit mirrors all traffic and builds its own connection table.

Answer

Both units process traffic simultaneously and share states via the control link.

Answer

Only configuration is synchronized; connection states are not replicated.

Question 11

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule uses a specific content pattern 'malicious' to match traffic, which is characteristic of signature-based detection. Signature-based IDS relies on predefined patterns or signatures to identify known threats.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 12

A company uses Cisco Firepower Management Center (FMC) to manage multiple FTD devices. They want to create an access control policy that allows traffic from a specific user group (Active Directory) to access a web server on the internet, but blocks all other traffic from that group to the internet. Which identity source should be configured in FMC?

Accepted Answer

Active Directory realm. To map users to traffic, FMC integrates with Active Directory via the Identity Policy. The identity source can be configured using AD realm, and then user identities can be used in access control rules.

Answer

LDAP

Answer

Local user database

Answer

RADIUS

Question 13

An engineer is configuring Dynamic Access Policy (DAP) on an ASA for AnyConnect VPN. They want to assign different access policies based on the client's anti-virus status and device posture. What must be configured to obtain this information?

Accepted Answer

Cisco Secure Client (formerly AnyConnect) with posture module. DAP can use endpoint attributes from the AnyConnect client, such as antivirus status, via the Secure Endpoint or posture module. The ASA obtains this information through the AnyConnect client's posture assessment.

Answer

Group policy with split tunneling enabled

Answer

Cisco ISE as the AAA server

Answer

SSL VPN with DTLS enabled

Question 14

A Cisco FTD sensor is deployed in passive mode (IDS) and is receiving traffic via a network tap. The access control policy is configured with an intrusion policy set to 'Security over Connectivity'. However, the administrator notices that the sensor is not generating alerts for some attacks that were identified by a previous inline sensor. What is the most likely reason?

Accepted Answer

The sensor is in passive mode and cannot see return traffic due to asymmetric routing.. In passive mode, the sensor cannot block traffic, but it should still detect and alert. If it's not alerting, perhaps the traffic is not being seen correctly (e.g., due to asymmetric routing or tap issues) or the intrusion policy is not applied correctly. However, given the scenario, a common issue is that passive deployment can miss attacks if traffic is not visible to the sensor.

Answer

The access control policy requires an 'allow' action to perform intrusion inspection.

Answer

The intrusion policy is set to 'Security over Connectivity', which reduces false positives but may miss some attacks.

Answer

The intrusion policy is not configured to generate alerts.

Question 15

Which NAT type on a Cisco ASA translates both the source and destination IP addresses and is typically used to allow external hosts to access internal servers?

Accepted Answer

Static NAT. Static NAT creates a one-to-one mapping between an internal private IP and an external public IP, translating both source and destination addresses symmetrically. It is commonly used to make internal servers accessible from the outside.

Answer

Identity NAT

Answer

PAT (Port Address Translation)

Answer

Dynamic NAT