350-701 Network Security Practice Test 5 — 15 Questions

Question 1

An administrator is configuring a site-to-site IKEv2 VPN between two Cisco ASAs. Which configuration component defines the encryption and authentication algorithms for the IPsec SA?

Accepted Answer

Transform set. A transform set defines the specific encryption and authentication (integrity) algorithms—for example, esp-aes-256 and esp-sha-hmac—that protect the IPsec SA. It is referenced by the crypto map or IPsec profile to specify how traffic is secured. Without a transform set, the IPsec SA cannot negotiate its cryptographic parameters.

Answer

Crypto map

Answer

IPsec profile

Answer

ISAKMP policy

Question 2

What is the primary difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Signature-based uses patterns of known attacks; anomaly-based uses behavior baselines.. Signature-based intrusion detection compares network traffic or system activity against a database of known attack patterns (signatures), so it reliably identifies previously documented threats with low false positives. Anomaly-based detection instead builds a baseline of normal behavior and flags deviations from that baseline, allowing it to catch novel or zero-day attacks that have no existing signature. Thus, the core difference is that signature-based relies on known attack patterns while anomaly-based relies on behavioral baselines.

Answer

Signature-based has higher false positive rate than anomaly-based.

Answer

Signature-based detects unknown attacks; anomaly-based detects known attacks.

Answer

Both methods are identical in operation.

Question 3

An organization deploys Cisco FTD in a high-availability pair using active/standby. If the active unit fails, what happens to existing connections?

Accepted Answer

Existing connections are preserved if stateful failover is configured.. In a Cisco FTD active/standby high-availability pair with stateful failover configured, existing connections are preserved because the standby unit receives state information from the active unit. When failover occurs, the standby takes over and maintains the connection state, allowing ongoing sessions to continue without interruption.

Answer

All connections are dropped and must be re-established.

Answer

The standby unit cannot take over because it has no configuration.

Answer

Only TCP connections are preserved; UDP connections are dropped.

Question 4

A Cisco FMC administrator needs to create a file policy to detect malware in HTTP downloads. The policy should allow the file to be delivered if it is known clean, block if known malicious, and allow but capture for analysis if unknown. Which combination of actions is required?

Accepted Answer

Detect Files: Clean = Allow; Malicious = Block; Unknown = Allow and Capture. A Firepower file policy defines actions per verdict: Clean files can be allowed, Malicious files blocked, and Unknown files allowed but submitted for analysis (Allow and Capture, i.e., send to Cisco Secure Malware Analytics). This combination matches the stated requirements exactly. The file policy is applied via an access control rule and inspects files in allowed traffic.

Answer

Detect Files: Clean = Block; Malicious = Allow; Unknown = Block

Answer

Detect Files: Clean = Allow; Malicious = Allow; Unknown = Block

Answer

Intrusion Policy instead of File Policy

Question 5

Which Cisco FTD feature provides application visibility and control (AVC) to identify and block applications like Facebook or Skype?

Accepted Answer

Access control policy with application conditions. Application visibility and control (AVC) on Cisco FTD is delivered through the Access Control Policy using application conditions, which leverage Snort-based Layer 7 inspection and Cisco's application detectors to identify and block applications such as Facebook or Skype regardless of port or IP. URL filtering only sees URLs, not application behavior.

Answer

URL filtering policy

Answer

Intrusion policy

Answer

SSL decryption policy

Question 6

An administrator configures a Cisco ASA with a DMZ interface at security level 50. Traffic from the inside (level 100) to the DMZ (level 50) is allowed by default. What additional configuration is needed to allow traffic from the DMZ to the inside?

Accepted Answer

An ACL applied to the DMZ interface permitting traffic to inside.. On a Cisco ASA, security levels determine default traffic flow: traffic from a higher security level to a lower security level is permitted by default, while traffic from a lower security level to a higher security level is denied by default. To allow traffic from the DMZ (level 50) to the inside (level 100), an ACL must be applied to the DMZ interface permitting that traffic. This is the standard ASA configuration pattern for permitting lower-to-higher security level flows.

Answer

A NAT rule is required.

Answer

An ACL applied to the inside interface permitting traffic from DMZ.

Answer

No additional configuration; it is allowed by default.

Question 7

A security engineer is tuning Snort rules on a Cisco FTD to reduce false positives. Which action should be taken if a rule is generating alerts for legitimate traffic?

Accepted Answer

Disable the rule or set it to 'noalert'.. When a Snort rule on Cisco FTD generates alerts for legitimate traffic (false positives), the correct tuning action is to disable the rule or change its action to 'noalert' so it stops generating alerts without blocking legitimate traffic. This preserves visibility into the rule's behavior while eliminating the noise. Changing the action to 'reject' would actively block legitimate traffic, which is the opposite of what's needed.

Answer

Change the rule action to 'reject'.

Answer

Increase the priority of the rule.

Answer

Add the rule to a custom policy with higher precedence.

Question 8

An organization uses Cisco AnyConnect SSL VPN with DTLS enabled. What is the primary benefit of DTLS?

Accepted Answer

It uses UDP to avoid TCP-over-TCP issues and improve performance.. DTLS provides UDP-based transport for VPN traffic, reducing latency and improving performance for real-time applications compared to TCP-based TLS.

Answer

It provides stronger encryption than TLS.

Answer

It is required for DAP policies.

Answer

It allows split tunneling without configuration.

Question 9

A network architect is designing a DMZ for a web server that must be accessible from the internet. The server should not initiate connections to the internal network. Which firewall rule best achieves this?

Accepted Answer

Permit HTTP from outside to DMZ; deny all from DMZ to inside.. To allow inbound traffic to the DMZ server but block outbound from DMZ to inside, an ACL on the DMZ interface should permit inbound traffic from outside and deny outbound to inside.

Answer

Permit HTTP from DMZ to outside; deny all from inside to DMZ.

Answer

Permit any from outside to DMZ; permit any from DMZ to inside.

Answer

Permit any from outside to DMZ; deny any from DMZ to outside.

Question 10

An engineer is configuring a Cisco ASA for site-to-site IKEv2 VPN with a VTI. Which two statements about VTI are true? (Choose two.)

Accepted Answer

VTI can be configured in IKEv2 mode with an IPsec profile.. Option A is correct because a Cisco ASA VTI (Virtual Tunnel Interface) is configured by applying an IPsec profile to a tunnel interface in IKEv2 mode, which binds the IPsec policy directly to the interface rather than to a crypto map. Option C is correct because the VTI is a routable tunnel interface that can participate in dynamic routing protocols such as OSPF or EIGRP, allowing the ASA to form routing adjacencies across the VPN. Option B is incorrect because VTI eliminates the need for a separate ACL to define interesting traffic; the IPsec profile applied to the tunnel interface determines what is encrypted. Option D is incorrect because VTI support is not limited to the ASA 5500-X series; it is available on other ASA platforms and versions that support IKEv2 VTIs. Option E is incorrect because VTI uses an IPsec profile on a tunnel interface, not a crypto map, which is the legacy policy-based method.

Answer

VTI requires a separate ACL to define interesting traffic.

Answer

VTI is only supported on the ASA 5500-X series.

Answer

VTI uses a crypto map to define the IPsec policy.

Question 11

On a Cisco ASA, which table holds information about translated addresses for active connections?

Accepted Answer

Xlate table. The xlate table stores translation entries (NAT translations) for active sessions.

Answer

ARP table

Answer

Conn table

Answer

Routing table

Question 12

An engineer is tuning Snort signatures on a Cisco FTD to reduce false positives. A rule triggers on legitimate traffic that matches a known exploit pattern but is actually benign. Which tuning technique would be most appropriate to suppress the alerts without completely disabling the rule?

Accepted Answer

Add a suppression filter for the specific source IP addresses.. A suppression filter tells Snort to stop generating alerts for a specific rule when the traffic matches a defined condition, such as a specific source IP, destination IP, or subnet. This preserves the rule's detection capability for other traffic while eliminating the false positives from the known-benign source.

Answer

Change the rule action from 'alert' to 'pass'.

Answer

Increase the rule's threshold to require more hits before alerting.

Answer

Disable the rule in the intrusion policy.

Question 13

A Cisco FTD is deployed in inline mode and is configured with a file policy to detect malware. When a file is transferred, the FTD computes a SHA-256 hash and checks it against AMP cloud. The cloud returns 'unavailable' for the hash. What action will the FTD take by default?

Accepted Answer

Allow the file and log the event.. In Cisco Firepower/FTD file policies, when the AMP cloud is unreachable or returns 'unavailable' for a file hash, the default action for the Malware Cloud Lookup is to allow the file and log the event. This preserves availability and avoids blocking legitimate traffic based solely on a lookup failure. The administrator can change this behavior by configuring the file policy to block on lookup failure, but the out-of-box default is allow-and-log.

Answer

Perform a deep packet inspection on the file.

Answer

Detonate the file in a sandbox before deciding.

Answer

Block the file because it could not be verified.

Question 14

Which type of VPN on Cisco ASA is typically used for site-to-site connectivity and encrypts all traffic between two sites?

Accepted Answer

IKEv2 IPsec site-to-site VPN. An IKEv2 IPsec site-to-site VPN on Cisco ASA is specifically designed for connecting two sites and encrypting all traffic between them. It uses IKEv2 for key exchange and IPsec for encryption, providing a secure tunnel for site-to-site connectivity. The other options are either client-based or not typically used for site-to-site.

Answer

L2TP VPN

Answer

DTLS VPN

Answer

SSL VPN

Question 15

Which of the following is a characteristic of a stateful firewall like Cisco ASA?

Accepted Answer

It maintains a state table of active connections.. A stateful firewall such as Cisco ASA maintains a state table that tracks active connections, including source/destination IPs, ports, sequence numbers, and TCP flags. Return traffic for an established session is automatically permitted without an explicit inbound rule. This connection-awareness is the defining characteristic of stateful inspection.

Answer

It filters traffic based solely on packet headers.

Answer

It can only filter based on source IP address.

Answer

It requires a separate proxy for each application.