350-701 Network Security Practice Test 7 — 15 Questions

Question 1

In Cisco Firepower Management Center (FMC), which action in an access control rule will send a TCP RST to the source and destination and log the event?

Accepted Answer

Block with reset. The 'Block with reset' action sends RST packets to both endpoints. 'Trust' bypasses inspection, 'Allow' permits traffic, and 'Interactive Block' is for SSL decryption failure.

Answer

Trust

Answer

Allow

Answer

Interactive Block

Question 2

A Cisco ASA is configured with dynamic PAT to translate internal addresses to a single outside IP address. A user on the inside initiates a connection to an external web server. The ASA creates a connection entry. Which table is checked first when a return packet arrives from the web server?

Accepted Answer

Connection table (conn). The ASA checks the connection table (conn table) first for stateful inspection. The xlate table is used for NAT translation, but connection table is checked for session state.

Answer

ACL table

Answer

NAT table (xlate)

Answer

Routing table

Question 3

An FTD device is deployed in passive mode. Which statement about its traffic processing is true?

Accepted Answer

It receives traffic from a network tap or SPAN port and cannot block traffic.. In passive mode, the FTD receives a copy of traffic from a span port; it cannot block traffic in real-time. It can only generate alerts.

Answer

It can block malicious traffic by sending TCP resets.

Answer

It operates as a transparent firewall with inline inspection.

Answer

It can use the 'Block' action in access control rules.

Question 4

A Cisco ASA has three interfaces: inside (100), outside (0), and DMZ (50). A static NAT rule is configured to map the DMZ server 10.1.1.10 to outside address 200.1.1.10. An ACL on the outside interface permits traffic to 200.1.1.10. A host on the internet sends a packet to 200.1.1.10. What happens when the packet hits the outside interface?

Accepted Answer

The packet is forwarded to the DMZ server after NAT translation.. The ASA translates the destination address to the DMZ IP using the static NAT rule, then routes the packet to the DMZ interface. Security levels do not block because NAT is performed before routing.

Answer

The packet is dropped because no ACL exists for the DMZ interface.

Answer

The packet is forwarded only if an ACL on the DMZ interface permits it.

Answer

The packet is dropped because the outside security level is lower than DMZ.

Question 5

Which of the following is a benefit of using Dynamic Access Policy (DAP) for AnyConnect SSL VPN?

Accepted Answer

It enforces access based on endpoint security posture.. DAP allows granular access based on endpoint attributes such as antivirus status, registry keys, and location.

Answer

It eliminates the need for group policies.

Answer

It enables split tunneling automatically.

Answer

It provides load balancing across multiple VPN peers.

Question 6

An engineer configures a Cisco ASA in a DMZ architecture. The DMZ hosts web servers that need to be accessible from the internet. Which security level should be assigned to the DMZ interface to ensure proper traffic flow without additional ACLs for return traffic?

Accepted Answer

50. For internet-to-DMZ traffic, the DMZ interface should have a security level higher than outside (0) but lower than inside (100) to allow return traffic from DMZ to outside without explicit ACLs. Level 50 is common.

Answer

255

Answer

0

Answer

100

Question 7

In Cisco Firepower, a file policy is configured with a rule that detects malware. The action is set to 'Malware Cloud Lookup'. What happens if the SHA-256 hash of a file is unknown to the AMP cloud?

Accepted Answer

The file is allowed and a retrospective alert is generated if later found malicious.. When the hash is unknown, the file may be submitted for static or dynamic analysis depending on the disposition. If the hash is unknown, the file may be allowed or blocked based on additional configuration; typically it is allowed pending analysis.

Answer

The file is blocked immediately.

Answer

The file is quarantined until the cloud responds.

Answer

The file is sent for dynamic analysis in a sandbox.

Question 8

Which component of a Snort rule specifies the action to take when the rule conditions are matched?

Accepted Answer

Action. In Snort, the first part of the rule header is the action (e.g., alert, drop, reject).

Answer

Rule options

Answer

Source address

Answer

Protocol

Question 9

An engineer wants to configure high availability on a pair of Cisco Firepower Threat Defense (FTD) devices. Which HA mode supports active/standby failover with stateful replication of connection information?

Accepted Answer

Active/standby with stateful failover. Active/standby HA with stateful failover syncs connection states. Active/active is typically for routed mode with asymmetric routing.

Answer

Active/standby without stateful failover

Answer

Active/active with asymmetric routing

Answer

Clustering

Question 10

In Cisco Firepower, an access control policy has multiple rules. Rule 1: Allow HTTP from any to any. Rule 2: Block HTTP from 10.0.0.0/8 to any. A packet from 10.0.0.1 to 192.168.1.1 with destination port 80 is inspected. What action is taken?

Accepted Answer

The packet is allowed because Rule 1 is matched first.. Rules are evaluated top-down. The packet matches Rule 1 first (Allow HTTP), so it is allowed. Even though Rule 2 would block it, Rule 1 is matched first.

Answer

The packet is allowed only if no intrusion policy triggers.

Answer

The packet is blocked because Rule 2 is more specific.

Answer

The packet is blocked and an alert is generated.

Question 11

Which of the following is a characteristic of a 'false negative' in intrusion detection?

Accepted Answer

Malicious traffic is not detected.. A false negative occurs when the IDS/IPS fails to detect an actual attack. It misses the malicious activity.

Answer

The signature database is updated.

Answer

The system crashes due to high resource usage.

Answer

An alert is generated for benign traffic.

Question 12

A network security engineer is configuring Cisco ASA for remote access VPN using AnyConnect. Which two components must be configured to enable split tunneling? (Choose two.)

Accepted Answer

An access list that defines the networks to be tunneled or excluded.. Split tunneling requires defining an ACL that specifies which traffic goes through the tunnel, and applying that ACL in the group policy. The ACL is configured on the ASA and referenced in the group policy.

Answer

A crypto map that specifies the VPN encryption parameters.

Answer

A dynamic access policy (DAP) that enforces split tunneling.

Answer

A tunnel group that defines the VPN connection parameters.

Question 13

An engineer is deploying Cisco Firepower Threat Defense (FTD) in inline mode and needs to decrypt SSL traffic for inspection. Which two methods are supported by FTD for SSL decryption? (Choose two.)

Accepted Answer

Decrypt - Resign: The FTD re-signs the server certificate with its own CA.. FTD supports decrypting traffic using a known private key (e.g., from a web server) or by re-signing certificates using a CA certificate installed on the device. The other options are not valid SSL decryption methods.

Answer

Decrypt - Passthrough: SSL traffic is allowed without inspection.

Answer

Decrypt - Monitor: SSL traffic is monitored but not decrypted.

Answer

Decrypt - Block: SSL traffic is blocked if decryption fails.

Question 14

Which three actions are available in a Cisco Firepower access control rule? (Choose three.)

Accepted Answer

Allow. The main actions in access control rules are Trust (bypass inspection), Allow (permit with inspection), Block (deny), and Interactive Block (block with user interaction). Monitor is not an action; it is a logging option.

Answer

Decrypt

Answer

Monitor

Question 15

An engineer needs to allow inbound HTTP traffic from the internet to a web server in the DMZ on a Cisco ASA. The DMZ interface security level is 50, and the outside interface is 0. Which interface direction should the access control entry be applied?

Accepted Answer

Inbound on the outside interface. Traffic from outside (level 0) to DMZ (level 50) is inbound to the DMZ interface, so the ACL should be applied inbound on the outside interface or outbound on the DMZ interface; the standard approach is inbound on the lower security interface.

Answer

Outbound on the DMZ interface

Answer

Outbound on the outside interface

Answer

Inbound on the DMZ interface