350-701 Network Security Practice Test 6 — 15 Questions

Question 1

A Cisco FTD administrator is configuring SSL/TLS inspection. They want to inspect encrypted traffic to an external website that uses a certificate signed by a public CA. Which SSL/TLS inspection action should be used to decrypt this traffic?

Accepted Answer

Decrypt-resign. For traffic to external sites with public certificates, the FTD can use 'decrypt-resign' where it re-encrypts the traffic with a custom CA certificate installed on the client. 'Decrypt-known-key' is for traffic where the private key is known (e.g., internal servers).

Answer

Do not decrypt

Answer

Decrypt-known-key

Answer

Block

Question 2

An organization is deploying Cisco AnyConnect VPN with split tunneling. They want to ensure that only traffic destined for the corporate network goes through the VPN tunnel, while internet-bound traffic goes directly. Which configuration element on the ASA controls this?

Accepted Answer

Group policy with split tunneling settings. Split tunneling is configured in the group policy. The group policy specifies which networks are tunneled (via split-tunnel-policy and split-tunnel-network-list).

Answer

Dynamic Access Policy (DAP)

Answer

Network (or client) profile on the ASA

Answer

Connection profile

Question 3

Which Cisco Firepower management option is used for on-box management of a single FTD device, without a separate management center?

Accepted Answer

FDM (Firepower Device Manager). Firepower Device Manager (FDM) is the on-box management interface for a single FTD device. FMC is a centralized management platform for multiple devices.

Answer

Cisco Defense Orchestrator

Answer

FMC (Firepower Management Center)

Answer

ASA CLI

Question 4

A security engineer is tuning an IPS to reduce false positives. They notice that legitimate traffic is triggering a signature for a worm that uses a specific HTTP GET request. The engineer wants to disable the signature for that specific traffic pattern but keep it enabled for other traffic. What is the best approach?

Accepted Answer

Create a rule suppression for the specific source/destination.. In Snort-based IPS, you can create a rule suppression or use a pass rule with a higher priority to skip inspection for that traffic. Alternatively, you can modify the rule to add a 'pcre' condition or use 'tag', but the simplest is to create a suppression or use a rule override to disable the specific signature for that source/destination.

Answer

Increase the signature threshold.

Answer

Disable the signature globally.

Answer

Change the action to 'alert' instead of 'drop'.

Question 5

A Cisco FTD device is configured with an access control policy that has multiple rules. The first rule is 'Allow' for all traffic from the internal network to the internet. The second rule is 'Block' for traffic from a specific internal host to any destination. However, the administrator notices that the specific host can still access the internet. What is the most likely cause?

Accepted Answer

The block rule is placed after the allow rule.. Access control rules are evaluated in order. The first rule allows all internal traffic, and since rules are processed top-down, the first match applies. The second rule is never reached because the first rule already matched. To block the specific host, the more specific rule must be placed before the general allow rule.

Answer

The block rule is not applied to the correct interface.

Answer

The block rule is configured with 'Trust' action.

Answer

The block rule has a lower priority than the allow rule.

Question 6

A security administrator is configuring a Cisco Firepower system for network discovery and wants to identify hosts and services on the network. Which two actions must be configured to enable network discovery? (Choose two.)

Accepted Answer

Configure an Access Control Policy with an 'Allow' rule for discovery traffic.. Network discovery requires enabling discovery in the FMC and configuring the FTD to perform discovery by applying an access control policy that allows discovery traffic or by configuring discovery settings. Also, the FTD must be in an appropriate mode (inline or passive) and have the necessary policies applied.

Answer

Enable SSL/TLS inspection for all traffic.

Answer

Configure a file policy with malware detection.

Answer

Deploy the FTD in inline mode only.

Question 7

A company is using Cisco ASA with AnyConnect VPN. They want to implement Dynamic Access Policy (DAP) to enforce access based on device compliance. Which two attributes can DAP use to evaluate endpoint posture? (Choose two.)

Accepted Answer

Antivirus software version and real-time protection status. DAP can use attributes from the AnyConnect client such as antivirus status, firewall status, and operating system. It can also use AAA attributes from RADIUS or LDAP. The Secure Endpoint (formerly AMP) connector provides device compliance data.

Answer

Cisco ISE authorization profile

Answer

User group membership from Active Directory

Answer

Source IP address

Question 8

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. MPF consists of class-maps to classify traffic, policy-maps to define actions, and service-policy to apply the policy to interfaces or globally. These are the three core components.

Answer

Route-map

Answer

Access-list

Question 9

Which two actions are valid actions in a Cisco Firepower access control rule? (Choose two.)

Accepted Answer

Allow. In Firepower access control policy, the actions are Trust (skip further inspection), Allow (permit and inspect), Block (block traffic), and Interactive Block (present a block page). These are standard actions.

Answer

Log

Answer

Reset

Answer

Redirect

Question 10

A security analyst is investigating a potential intrusion and suspects that the IPS is missing some attacks (false negatives). Which two factors can contribute to false negatives in signature-based IPS? (Choose two.)

Accepted Answer

The attack uses a new exploit for which no signature exists.. False negatives occur when the IPS fails to detect an actual attack. Common causes include outdated signatures, encrypted traffic that cannot be inspected, and evasion techniques like fragmentation or encoding that the IPS cannot reassemble. Also, if the sensor is in passive mode and misses traffic due to asymmetric routing, it can cause false negatives.

Answer

The IPS is in inline mode and blocks malicious traffic.

Answer

The signature threshold is set too low.

Answer

The IPS is configured to drop packets that match a signature.

Question 11

An engineer configures a Cisco ASA firewall with three interfaces: inside (security level 100), outside (security level 0), and DMZ (security level 50). Traffic from the inside network to the DMZ network is sourced from 10.1.1.0/24 and destined to 192.168.1.0/24. The inside interface is configured with IP 10.1.1.1, DMZ interface with IP 192.168.1.1. An ACL on the inside interface permits IP traffic from 10.1.1.0/24 to 192.168.1.0/24. What happens when a packet from 10.1.1.10 to 192.168.1.10 arrives at the inside interface?

Accepted Answer

The packet is forwarded because the security levels allow traffic from higher to lower, and an ACL permits it.. The ASA allows traffic from higher to lower security levels by default, but only if an ACL permits it. Since the inside level (100) is higher than DMZ (50), and the ACL permits the traffic, the packet is forwarded.

Answer

The packet is dropped because no ACL is applied to the DMZ interface.

Answer

The packet is dropped because traffic from higher to lower security levels is implicitly denied.

Answer

The packet is forwarded only if a NAT rule exists for the source address.

Question 12

A network administrator is configuring site-to-site VPN between two Cisco ASA firewalls using IKEv2. The administrator wants to ensure that the VPN tunnel uses the most secure encryption algorithm available. Which encryption algorithm should be selected in the IKEv2 proposal?

Accepted Answer

AES-256. AES-256 provides the highest security among the options. DES and 3DES are weak and deprecated, while AES-128 is less secure than AES-256.

Answer

AES-128

Answer

DES

Answer

3DES

Question 13

Which statement accurately describes the difference between signature-based and anomaly-based intrusion detection?

Accepted Answer

Anomaly-based detection compares traffic against a baseline of normal behavior.. Signature-based detection matches known attack patterns; anomaly-based detects deviations from a baseline of normal traffic.

Answer

Signature-based detection generates fewer false positives than anomaly-based detection.

Answer

Anomaly-based detection is more effective against known attacks than signature-based.

Answer

Signature-based detection uses machine learning to identify unknown attacks.

Question 14

An engineer is configuring Cisco Firepower Threat Defense (FTD) in inline NGFW mode. The access control policy must block all traffic from geolocation 'North Korea' and allow all other traffic. Which type of rule should be used and in what order should it be placed?

Accepted Answer

Block rule with source geolocation North Korea, placed at the top of the policy.. Geolocation filtering is applied in access control rules. The block rule must be placed before any allow rules to ensure traffic from North Korea is blocked. Rule order is top-down.

Answer

Intrusion policy with geolocation filter, placed before access control rules.

Answer

Block rule with source geolocation North Korea, placed at the bottom of the policy.

Answer

Permit rule with destination geolocation North Korea, placed at the top.

Question 15

In Cisco Firepower Management Center (FMC), which action in an access control rule will send a TCP RST to the source and destination and log the event?

Accepted Answer

Block with reset. The 'Block with reset' action sends RST packets to both endpoints. 'Trust' bypasses inspection, 'Allow' permits traffic, and 'Interactive Block' is for SSL decryption failure.

Answer

Trust

Answer

Allow

Answer

Interactive Block