350-701 Network Security Practice Test 9 — 15 Questions

Question 1

On a Cisco ASA, which NAT type allows multiple internal hosts to share a single public IP address by using different source ports?

Accepted Answer

PAT (overload). PAT (Port Address Translation), also called NAT overload, allows many internal hosts to share a single public IP address by translating both the source IP and source port. The ASA tracks each flow using unique source ports, enabling multiplexing of thousands of sessions over one public address. This is the standard NAT type for internet-bound traffic from internal networks.

Answer

Identity NAT

Answer

Static NAT

Answer

Dynamic NAT

Question 2

A security engineer is configuring a Cisco FTD high availability pair in active/standby mode. Which statement is true about the failover configuration?

Accepted Answer

The standby unit must have the same hardware and software version. In a Cisco FTD active/standby failover pair, the two appliances must be identical in hardware model, interface configuration, and software version so that the standby can seamlessly take over the active role. The standby continuously receives state and configuration synchronization from the active unit, which is only possible when the platforms match. This ensures that when a failover event occurs, the standby can assume traffic processing without compatibility issues.

Answer

Failover is triggered only by manual intervention

Answer

Configuration changes are made independently on each unit

Answer

Both units process traffic simultaneously

Question 3

A Cisco ASA is configured with a modular policy framework to inspect HTTP traffic. The class-map matches HTTP traffic, and the policy-map applies inspection. Which command correctly applies the policy to an interface?

Accepted Answer

service-policy policy-map-name interface inside. On a Cisco ASA, the modular policy framework is activated on an interface using the global configuration command 'service-policy interface '. The policy-map name is a user-defined identifier (not the keyword 'inspect'), and it must be applied to a named interface such as 'inside' or 'outside'. Option A follows this exact syntax and correctly binds the previously defined policy-map to the inside interface.

Answer

service-policy inspect http interface inside

Answer

policy-map service-policy inside

Answer

apply service-policy policy-map-name inside

Question 4

Which Cisco Firepower management option allows direct device management without a separate server, using a web interface on the FTD itself?

Accepted Answer

FDM. FDM (Firepower Device Manager) is the on-box management solution for FTD, running directly on the device.

Answer

ASDM

Answer

CLI

Answer

FMC

Question 5

An engineer wants to block traffic from a specific country on a Cisco FTD. Which feature should be used in the access control policy?

Accepted Answer

Geolocation filtering. Cisco FTD geolocation filtering allows administrators to create access control rules that match traffic based on the source or destination country, using a continuously updated GeoIP database. This is the correct feature for blocking traffic from a specific country.

Answer

Intrusion policy

Answer

Application visibility and control (AVC)

Answer

URL filtering

Question 6

A Cisco FTD is configured with a file policy to detect malware. The policy includes a rule to block files with a SHA-256 hash that is known to be malicious. Which component provides the SHA-256 disposition?

Accepted Answer

Cisco AMP cloud. The Cisco AMP cloud is the authoritative source for file dispositions, including SHA-256 hash reputation. When a file policy on Cisco FTD detects a file, it computes the SHA-256 hash and queries the AMP cloud to determine if the hash is known malicious. The AMP cloud maintains a vast database of file signatures and threat intelligence, enabling real-time verdicts. Thus, the SHA-256 disposition is provided by the Cisco AMP cloud.

Answer

Network discovery database

Answer

Local malware cache

Answer

Snort rules

Question 7

Which VPN technology allows Cisco AnyConnect clients to use UDP for transport to avoid TCP overhead and improve performance?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is the UDP-based counterpart to TLS and is used by Cisco AnyConnect to carry VPN traffic over UDP, avoiding TCP-over-TCP meltdown and reducing latency. AnyConnect uses DTLS for the data channel while TLS handles the control channel.

Answer

IPsec

Answer

L2TP

Answer

IKEv2

Question 8

An engineer is tuning an IPS on a Cisco FTD to reduce false positives. Which three techniques are effective? (Choose three.)

Accepted Answer

Add source and destination IP filters to signatures. Option A is correct because adding source and destination IP filters to signatures narrows the traffic a signature evaluates, so it only fires on relevant hosts and avoids false positives from unrelated traffic. Option B is correct because disabling specific signatures that trigger incorrectly removes the exact noisy rules causing false positives while leaving the rest of the policy intact. Option C is incorrect because increasing the global sensitivity slider to maximum makes signatures more aggressive and typically increases, not reduces, false positives. Option D is incorrect because enabling all built-in rules maximizes coverage but also maximizes the chance of false positives, which is the opposite of the goal. Option E is correct because using monitor mode for new or modified rules lets the engineer observe how those rules behave on live traffic and tune or suppress them before enforcing, preventing false positives from reaching production.

Answer

Increase the global sensitivity slider to maximum

Answer

Enable all built-in rules to maximize coverage

Question 9

An organization is using Cisco FMC with FTD devices. They want to detect and block malware in HTTP traffic. Which policy component must be configured to inspect files and submit SHA-256 hashes to AMP cloud for disposition?

Accepted Answer

File Policy. A File Policy in Cisco FMC is the policy component that inspects files in HTTP, SMTP, FTP, and other protocols, calculates SHA-256 hashes, and submits them to the AMP cloud for disposition. It defines which file types to inspect, what actions to take (block, malware cloud lookup, etc.), and is invoked from an Access Control Policy rule.

Answer

Access Control Policy

Answer

Network Discovery Policy

Answer

Intrusion Policy

Question 10

Which of the following is a characteristic of anomaly-based intrusion detection compared to signature-based detection?

Accepted Answer

Higher false positive rate. Anomaly-based intrusion detection establishes a baseline of normal network or system behavior and flags any deviation as potential malicious activity. Because legitimate traffic patterns can vary widely and baselines are imperfect, this approach generates a higher false positive rate compared to signature-based detection, which only alerts on known patterns. Thus, the correct characteristic is a higher false positive rate.

Answer

Lower false negative rate for known attacks

Answer

Cannot detect zero-day attacks

Answer

Requires frequent signature updates

Question 11

A network security engineer is configuring site-to-site IPsec VPN between two Cisco ASA firewalls using IKEv2. Which of the following configuration elements is required to define the encryption and integrity algorithms for the IPsec SA?

Accepted Answer

Transform set. In IKEv2, the IPsec SA parameters (encryption, integrity, etc.) are defined in the transform set. IKEv2 uses a single transform set. ISAKMP policy is for IKEv1 phase 1. Crypto map binds the transform set to a peer and interface. VTI is a virtual interface for routing but not for algorithm definition.

Answer

Crypto map

Answer

Virtual Tunnel Interface (VTI)

Answer

ISAKMP policy

Question 12

In a Cisco FTD deployment, which management option allows on-box management without the need for a separate FMC server?

Accepted Answer

FDM (Firepower Device Manager). Cisco Firepower Device Manager (FDM) is an on-box management interface that allows administrators to configure and manage a single Firepower Threat Defense (FTD) device without the need for a separate Firepower Management Center (FMC) server. FDM is accessed via a web browser and is ideal for small-scale deployments or remote sites where a centralized manager is not available.

Answer

FMC (Firepower Management Center)

Answer

ASDM (Adaptive Security Device Manager)

Answer

CDO (Cisco Defense Orchestrator)

Question 13

A network security engineer is deploying a Cisco Firepower Threat Defense (FTD) device in a high-availability active/standby pair. The engineer wants to ensure that the standby unit can take over immediately if the active unit fails, without dropping existing connections. Which feature should be configured to meet this requirement?

Accepted Answer

Stateful failover. Stateful failover is designed to replicate connection state between active and standby units, enabling the standby to assume control without dropping existing connections. This is critical for high-availability deployments where session continuity is required. Other features like EtherChannel or dynamic routing do not provide state replication.

Answer

EtherChannel

Answer

Failover link

Answer

Dynamic routing

Question 14

A security administrator is deploying a Cisco Firepower Threat Defense (FTD) device managed by a Firepower Management Center (FMC) in a high-availability pair. The administrator wants to ensure that if the primary FTD fails, the secondary takes over with minimal disruption. Which failover configuration should be used?

Accepted Answer

Active/Standby failover with a dedicated failover link and a state link.. Active/Standby failover is the standard high-availability configuration for a pair of FTD devices managed by FMC. It uses a failover link for health monitoring and a state link for connection state synchronization, ensuring that the standby unit can take over immediately if the primary fails. This provides minimal disruption and is simpler than Active/Active or clustering.

Answer

Standalone FTD with manual failover using a script.

Answer

Active/Active failover with asymmetric routing enabled.

Answer

Clustering with multiple FTD devices in a single cluster.

Question 15

A security engineer is configuring a Cisco Identity Services Engine (ISE) to authenticate employees using 802.1X. The engineer wants to ensure that only domain-joined Windows computers are allowed on the network, while personal devices are denied. Which ISE feature should be used to achieve this?

Accepted Answer

Certificate-based authentication. Certificate-based authentication leverages digital certificates issued to domain-joined computers, allowing ISE to verify their identity and grant access. Personal devices lacking valid certificates are denied. This method provides strong authentication and meets the requirement to allow only corporate-owned Windows computers.

Answer

Profiling

Answer

MAC Authentication Bypass (MAB)

Answer

Guest portal