350-701 Network Security Practice Test 7 — 15 Questions

Question 1

An engineer is configuring a Cisco AnyConnect SSL VPN for remote access. Which TWO features are commonly used to control access based on endpoint security posture?

Accepted Answer

Posture assessment (e.g., AnyConnect Posture module). Option B is correct because the AnyConnect Posture module performs host scans on the endpoint (checking things like antivirus, OS patches, and registry keys) and reports the posture result to the ASA/headend, which is exactly how endpoint security posture is evaluated for SSL VPN access. Option E is correct because Dynamic Access Policy (DAP) on the ASA uses attributes such as endpoint posture results, user identity, and connection criteria to selectively permit, deny, or restrict access and apply different authorization settings per session. Option A is incorrect because an IPsec transform set defines encryption and integrity algorithms (e.g., ESP-AES/ESP-SHA) for IPsec SAs, not endpoint posture evaluation. Option C is incorrect because a group policy is a static set of connection and user attributes (address pools, split tunneling, timeouts) applied to a tunnel group or user, and it does not itself assess endpoint security posture. Option D is incorrect because a crypto map binds IPsec parameters to interfaces/traffic for site-to-site or IPsec remote access, and it is unrelated to posture-based access control in an SSL VPN.

Answer

IPsec transform set

Answer

Group policy

Answer

Crypto map

Question 2

A Cisco FTD device is deployed in inline mode and is configured with an access control policy that includes an Intrusion Policy set to 'Balanced Security and Connectivity' and a File Policy with Malware & File blocking enabled. Traffic from a host inside to an external server is allowed by an access control rule. The administrator notices that a file download (PDF) is being blocked even though the file has a good reputation. What is the most likely cause?

Accepted Answer

The file policy is configured to block PDF files regardless of disposition.. A File Policy configured to block PDF files regardless of disposition will block the download even when AMP cloud lookup returns a good reputation. File policies can be set to block specific file types unconditionally, independent of malware disposition, so the PDF is blocked by file-type rule rather than reputation.

Answer

The AMP cloud lookup returned an 'unknown' disposition and the policy blocks unknowns.

Answer

The access control rule requires a 'trust' action to bypass inspection.

Answer

The intrusion policy is set to 'Balanced' and the PDF contains a known exploit signature.

Question 3

An organization is deploying Cisco Firepower Threat Defense (FTD) in a high-availability (HA) pair in active/standby mode. Which statement about state synchronization is true?

Accepted Answer

Connection states are synchronized from active to standby over the failover link.. In an FTD active/standby HA pair, the active unit owns all traffic flows and synchronizes connection state (including TCP sequence numbers, NAT translations, and inspection state) to the standby unit over the failover link. This allows the standby to take over seamlessly during failover without dropping established sessions. Configuration is also synchronized, but the key differentiator is that stateful connection data is replicated, not just config.

Answer

The standby unit mirrors all traffic and builds its own connection table.

Answer

Both units process traffic simultaneously and share states via the control link.

Answer

Only configuration is synchronized; connection states are not replicated.

Question 4

A security analyst is reviewing Snort rule output and sees an alert with the following details: action: alert, protocol: tcp, src: any, dst: any, content: 'malicious'. What type of detection is this rule using?

Accepted Answer

Signature-based detection. The rule matches on a literal content string ('malicious') within TCP traffic, which is the defining characteristic of signature-based detection. Snort rules that use the content keyword look for known byte patterns or strings associated with malicious traffic. This is a static pattern match, not a behavioral or statistical model.

Answer

Behavioral detection

Answer

Heuristic detection

Answer

Anomaly-based detection

Question 5

A company uses Cisco Firepower Management Center (FMC) to manage multiple FTD devices. They want to create an access control policy that allows traffic from a specific user group (Active Directory) to access a web server on the internet, but blocks all other traffic from that group to the internet. Which identity source should be configured in FMC?

Accepted Answer

Active Directory realm. FMC identity policies can enforce user-based access control by integrating with an Active Directory realm, which uses AD as the identity source and supports user/group-based rules. Configuring an AD realm lets FMC retrieve user-to-group mappings and apply access control policy rules that allow the specified user group to reach the web server while blocking other traffic. This is the native identity integration for AD-based user group enforcement in Firepower.

Answer

LDAP

Answer

Local user database

Answer

RADIUS

Question 6

A network architect is designing a DMZ for a web server farm. The ASA firewall will have three interfaces: inside (level 100), DMZ (level 50), and outside (level 0). They want to allow HTTP traffic from the internet to the DMZ web servers and also allow the web servers to initiate connections to the inside for database updates. What is the minimal ACL configuration to achieve this?

Accepted Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.. The ASA assigns security levels to interfaces and by default permits traffic from higher to lower security levels, but traffic from lower to higher (outside to DMZ, DMZ to inside) requires an explicit ACL. To allow internet-to-DMZ HTTP, an ACL on the outside interface inbound is needed; to allow DMZ-to-inside database traffic, an ACL on the DMZ interface inbound is needed. Option D matches this minimal configuration.

Answer

ACL on outside interface inbound permitting HTTP to DMZ; ACL on inside interface inbound permitting database traffic from DMZ.

Answer

No ACL needed because traffic from higher to lower is implicitly allowed.

Answer

ACL on inside interface inbound permitting HTTP to DMZ; ACL on DMZ interface inbound permitting database traffic to inside.

Question 7

A Cisco FTD administrator is configuring SSL/TLS inspection. They want to inspect encrypted traffic to an external website that uses a certificate signed by a public CA. Which SSL/TLS inspection action should be used to decrypt this traffic?

Accepted Answer

Decrypt-resign. For traffic to external sites with public certificates, the FTD can use 'decrypt-resign' where it re-encrypts the traffic with a custom CA certificate installed on the client. 'Decrypt-known-key' is for traffic where the private key is known (e.g., internal servers).

Answer

Do not decrypt

Answer

Decrypt-known-key

Answer

Block

Question 8

An organization is deploying Cisco AnyConnect VPN with split tunneling. They want to ensure that only traffic destined for the corporate network goes through the VPN tunnel, while internet-bound traffic goes directly. Which configuration element on the ASA controls this?

Accepted Answer

Group policy with split tunneling settings. Split tunneling on a Cisco ASA is controlled by the group policy, which contains the split-tunnel-policy and split-tunnel-network-list attributes that define which destinations are tunneled versus sent in the clear. The group policy is applied to the AnyConnect client session after authentication.

Answer

Dynamic Access Policy (DAP)

Answer

Network (or client) profile on the ASA

Answer

Connection profile

Question 9

Which Cisco Firepower management option is used for on-box management of a single FTD device, without a separate management center?

Accepted Answer

FDM (Firepower Device Manager). FDM (Firepower Device Manager) is the on-box, web-based management interface built directly into a single FTD appliance, allowing configuration and monitoring without any external manager. It is designed specifically for small-scale or standalone deployments where a full FMC would be overkill. Because it runs locally on the device, it satisfies the 'single FTD, no separate management center' requirement.

Answer

Cisco Defense Orchestrator

Answer

FMC (Firepower Management Center)

Answer

ASA CLI

Question 10

A security engineer is tuning an IPS to reduce false positives. They notice that legitimate traffic is triggering a signature for a worm that uses a specific HTTP GET request. The engineer wants to disable the signature for that specific traffic pattern but keep it enabled for other traffic. What is the best approach?

Accepted Answer

Create a rule suppression for the specific source/destination.. Rule suppression (also called event filtering or exception rules) allows the engineer to keep the signature active globally while excluding a narrowly defined traffic flow — typically identified by source IP, destination IP, subnet, or specific host pair. This preserves detection coverage for the worm signature across the rest of the network while eliminating the false positive only for the legitimate traffic pattern. It is the surgical, best-practice tuning method in Cisco IPS/NGIPS deployments.

Answer

Increase the signature threshold.

Answer

Disable the signature globally.

Answer

Change the action to 'alert' instead of 'drop'.

Question 11

A Cisco FTD device is configured with an access control policy that has multiple rules. The first rule is 'Allow' for all traffic from the internal network to the internet. The second rule is 'Block' for traffic from a specific internal host to any destination. However, the administrator notices that the specific host can still access the internet. What is the most likely cause?

Accepted Answer

The block rule is placed after the allow rule.. Cisco FTD access control policies evaluate rules top-down and stop at the first match, so an 'Allow' rule placed above a 'Block' rule will match all internal-to-internet traffic first, including traffic from the specific host. The block rule is never reached because the allow rule already matched. To block the host, the block rule must be moved above the allow rule (or the allow rule must exclude that host).

Answer

The block rule is not applied to the correct interface.

Answer

The block rule is configured with 'Trust' action.

Answer

The block rule has a lower priority than the allow rule.

Question 12

A company is using Cisco ASA with AnyConnect VPN. They want to implement Dynamic Access Policy (DAP) to enforce access based on device compliance. Which two attributes can DAP use to evaluate endpoint posture? (Choose two.)

Accepted Answer

Antivirus software version and real-time protection status. DAP on the Cisco ASA evaluates endpoint posture using attributes collected by the AnyConnect HostScan/Posture module, and antivirus software version and real-time protection status (option B) is a classic posture attribute — HostScan queries the installed AV product, its definition/engine version, and whether real-time scanning is enabled, which DAP then matches in its endpoint criteria. The presence of a specific file (option E) is likewise a valid DAP posture condition, since HostScan can check for a file (by name, path, and optionally hash) on the endpoint and report it as a posture attribute for DAP to evaluate. Option A is not a posture attribute DAP reads from the endpoint; a Cisco ISE authorization profile is a result/action applied by ISE, not an endpoint condition evaluated by ASA DAP. Option C, user group membership from Active Directory, is an identity/authorization attribute (typically delivered via LDAP or RADIUS), not an endpoint posture check. Option D, source IP address, is a network-level connection attribute, not a device-compliance posture attribute.

Answer

Cisco ISE authorization profile

Answer

User group membership from Active Directory

Answer

Source IP address

Question 13

A network engineer is configuring a Cisco ASA to use the Modular Policy Framework (MPF) for advanced traffic inspection. Which three components are part of the MPF? (Choose three.)

Accepted Answer

Service-policy. The Modular Policy Framework on a Cisco ASA is built from three core building blocks: class-map, policy-map, and service-policy. Option C (Class-map) is correct because it defines the traffic classification criteria (for example, matching an ACL, a TCP/UDP port, or an inspection default class) that identifies which traffic the MPF will act upon. Option E (Policy-map) is correct because it binds actions to those classes, such as inspect, police, priority, or set connection parameters, thereby defining what happens to the matched traffic. Option A (Service-policy) is correct because it activates the policy-map by attaching it to an interface and direction (global, interface, or a specific direction), which is what actually enforces the MPF configuration on the ASA. Option B (Route-map) is not part of MPF; it is used for route redistribution and policy-based routing on routers, not for ASA traffic inspection. Option D (Access-list) is also not an MPF component by itself; although ACLs can be referenced inside a class-map to match traffic, the ACL is a separate matching tool and not one of the three MPF building blocks.

Answer

Route-map

Answer

Access-list

Question 14

A security analyst is investigating a potential intrusion and suspects that the IPS is missing some attacks (false negatives). Which two factors can contribute to false negatives in signature-based IPS? (Choose two.)

Accepted Answer

The attack uses a new exploit for which no signature exists.. Option A is correct because signature-based IPS detection depends on a known pattern or signature; a brand-new exploit (e.g., a zero-day) has no matching signature, so the IPS will not detect it and a false negative occurs. Option C is correct because if traffic is encrypted (e.g., TLS/HTTPS) and the IPS lacks decryption or SSL inspection capability, it cannot examine the payload to match signatures, again producing false negatives. Option B is incorrect because inline mode with blocking is a deployment/response behavior that prevents malicious traffic; it does not cause missed detections. Option D is incorrect because a threshold set too low would tend to generate more alerts (potential false positives), not false negatives. Option E is incorrect because dropping packets that match a signature is a blocking action, not a cause of missed detection.

Answer

The IPS is in inline mode and blocks malicious traffic.

Answer

The signature threshold is set too low.

Answer

The IPS is configured to drop packets that match a signature.

Question 15

A network administrator is configuring site-to-site VPN between two Cisco ASA firewalls using IKEv2. The administrator wants to ensure that the VPN tunnel uses the most secure encryption algorithm available. Which encryption algorithm should be selected in the IKEv2 proposal?

Accepted Answer

AES-256. AES-256 is the most secure encryption algorithm among the options because it uses a 256-bit key, providing a significantly larger key space than AES-128 (128-bit), DES (56-bit), and 3DES (effectively 112-bit). In IKEv2 proposals, the encryption algorithm (e.g., AES-CBC-256) is specified to protect the IKEv2 control plane and IPsec data plane. While AES-128 is still considered secure, AES-256 offers a higher security margin against brute-force attacks, aligning with the administrator's goal of using the most secure algorithm available.

Answer

AES-128

Answer

DES

Answer

3DES