350-701 Network Security Practice Test 8 — 15 Questions

Question 1

A security analyst notices a high number of false positives from an intrusion detection system (IDS) using signature-based detection. Which action would best reduce false positives while maintaining detection of real threats?

Accepted Answer

Disable all signatures with a high false positive rate. False positives can be reduced by tuning signatures, such as adjusting thresholds or disabling specific signatures that are known to trigger incorrectly, rather than reducing sensor sensitivity broadly.

Answer

Increase the sensor sensitivity level

Answer

Switch to anomaly-based detection

Answer

Decrease the severity threshold for alerts

Question 2

A Cisco FTD device is deployed inline and configured with an access control policy that includes a rule to block traffic from a specific source IP address. However, traffic from that IP is still passing through. What is the most likely cause?

Accepted Answer

A trust rule exists before the block rule in the policy. In Cisco FTD, the access control policy rules are evaluated in order. If a rule earlier in the order permits the traffic (e.g., a trust rule), subsequent block rules are not evaluated. The rule order must be correct.

Answer

The rule is assigned to the wrong interface

Answer

The intrusion policy is overriding the block action

Answer

The device is in passive mode

Question 3

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?

Accepted Answer

PAT (overload). PAT (Port Address Translation) or overload uses unique source ports to distinguish sessions from multiple internal hosts sharing one public IP.

Answer

Identity NAT

Answer

Static NAT

Answer

Dynamic NAT

Question 4

A company uses a Cisco FMC to manage multiple FTD devices. They want to decrypt SSL/TLS traffic from internal users to external websites using a known private key. Which SSL decryption method should they use?

Accepted Answer

Decrypt-resign. Decrypt-known-key is used when the firewall has the server's private key (e.g., for internal servers), but for outbound traffic, decrypt-resign is typically used to re-sign certificates. However, the question specifies 'using a known private key', which implies the server's key is known, but for outbound inspection, the firewall generates a new cert. The correct method for outbound inspection with a known key is not standard; actually, decrypt-resign uses a CA to re-sign. The best answer is decrypt-resign because decrypt-known-key is for inbound traffic to servers where the key is known.

Answer

Bypass decryption

Answer

Decrypt-known-key

Answer

Decrypt-unknown-key

Question 5

A security engineer is configuring a Cisco FTD high availability pair in active/standby mode. Which statement is true about the failover configuration?

Accepted Answer

The standby unit must have the same hardware and software version. In active/standby failover for FTD, the standby unit monitors the active unit's health via failover link and takes over if the active fails. Configuration synchronization is automatic from active to standby.

Answer

Failover is triggered only by manual intervention

Answer

Configuration changes are made independently on each unit

Answer

Both units process traffic simultaneously

Question 6

A Cisco ASA is configured with a modular policy framework to inspect HTTP traffic. The class-map matches HTTP traffic, and the policy-map applies inspection. Which command correctly applies the policy to an interface?

Accepted Answer

service-policy policy-map-name interface inside. The service-policy command applies a policy-map to an interface or globally. The syntax is: service-policy policy-map-name {global | interface interface-name}.

Answer

service-policy inspect http interface inside

Answer

policy-map service-policy inside

Answer

apply service-policy policy-map-name inside

Question 7

Which Cisco Firepower management option allows direct device management without a separate server, using a web interface on the FTD itself?

Accepted Answer

FDM. FDM (Firepower Device Manager) is the on-box management solution for FTD, running directly on the device.

Answer

ASDM

Answer

CLI

Answer

FMC

Question 8

An engineer wants to block traffic from a specific country on a Cisco FTD. Which feature should be used in the access control policy?

Accepted Answer

Geolocation filtering. Geolocation filtering allows blocking or allowing traffic based on source or destination country. It is configured as a condition in access control rules.

Answer

Intrusion policy

Answer

Application visibility and control (AVC)

Answer

URL filtering

Question 9

A Cisco FTD is configured with a file policy to detect malware. The policy includes a rule to block files with a SHA-256 hash that is known to be malicious. Which component provides the SHA-256 disposition?

Accepted Answer

Cisco AMP cloud. Cisco AMP (Advanced Malware Protection) cloud provides threat intelligence including SHA-256 dispositions (clean, malicious, unknown). The FTD queries the AMP cloud for file disposition.

Answer

Network discovery database

Answer

Local malware cache

Answer

Snort rules

Question 10

Which VPN technology allows Cisco AnyConnect clients to use UDP for transport to avoid TCP overhead and improve performance?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is used by AnyConnect to provide a UDP-based SSL VPN, reducing latency compared to TCP.

Answer

IPsec

Answer

L2TP

Answer

IKEv2

Question 11

A Cisco FTD is deployed in a data center and needs to provide intrusion prevention and application control. Which two actions are available in an access control rule? (Choose two.)

Accepted Answer

Trust. In Cisco FTD access control policy, actions include: TRUST (bypass further inspection), ALLOW (permit with inspection), BLOCK (deny), and INTERACTIVE BLOCK (block with user notification).

Answer

Monitor

Answer

Encrypt

Answer

Redirect

Question 12

An engineer is tuning an IPS on a Cisco FTD to reduce false positives. Which three techniques are effective? (Choose three.)

Accepted Answer

Add source and destination IP filters to signatures. Tuning to reduce false positives includes adjusting thresholds, disabling specific signatures, using rule filtering by source/destination, and customizing rules. Monitoring without dropping (monitor mode) also helps evaluate impact.

Answer

Increase the global sensitivity slider to maximum

Answer

Enable all built-in rules to maximize coverage

Question 13

A company uses Cisco AnyConnect for remote access VPN. Which two components are used to enforce policies based on endpoint posture? (Choose two.)

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policies (DAP) and Group Policies are used with AnyConnect. DAP evaluates endpoint attributes (like antivirus status) to assign access policies, while Group Policies define VPN parameters.

Answer

Transform set

Answer

ISAKMP policy

Answer

Crypto map

Question 14

An engineer is configuring a Cisco ASA to allow inbound HTTPS traffic from the outside to a web server on the DMZ. The outside interface has security level 0, the DMZ interface has security level 50, and the inside has security level 100. Which set of commands correctly allows the traffic considering stateful inspection?

Accepted Answer

static (dmz,outside) tcp 192.168.1.10 443 10.1.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 192.168.1.10 eq 443; access-group OUTSIDE_IN in interface outside. By default, ASA allows traffic from higher to lower security levels without ACL, but for lower to higher an ACL is needed. Static NAT is required for inbound access, and an ACL permitting HTTPS from outside to DMZ is needed on the outside interface.

Answer

static (outside,dmz) tcp 10.1.1.10 443 192.168.1.10 443 netmask 255.255.255.255; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside

Answer

nat (dmz,outside) static 192.168.1.10; access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface dmz

Answer

access-list OUTSIDE_IN permit tcp any host 10.1.1.10 eq 443; access-group OUTSIDE_IN in interface outside; static (inside,outside) tcp 10.1.1.10 443 10.1.1.10 443 netmask 255.255.255.255

Question 15

A Cisco FTD device is deployed in passive mode. The security team wants to block malicious traffic without affecting legitimate traffic. Which action should be used in the access control policy rule?

Accepted Answer

Set the rule action to 'Allow' and rely on intrusion policy with 'Drop and Reset'. In passive mode, the FTD cannot block inline; the 'Interactive Block' action sends a TCP reset but is not recommended as it can affect traffic. The correct approach is to use 'Allow' and rely on an intrusion policy set to 'Drop and Reset' which will generate alerts but not block because the device is passive. Actually, in passive mode, no blocking is possible; the best is to use 'Allow' and monitor. But the question expects 'Interactive Block' which can send resets; however it may affect legitimate traffic. The intended answer is 'Allow' with intrusion policy alerts. But given options, 'Interactive Block' is often used for blocking but can cause issues. The correct answer is to not block, so 'Allow'.

Answer

Set the rule action to 'Trust'

Answer

Set the rule action to 'Block' with a reset

Answer

Set the rule action to 'Interactive Block'