350-701 Network Security — Timed 20 Questions

Question 1

An engineer is configuring a Modular Policy Framework (MPF) on a Cisco ASA to inspect HTTP traffic and apply QoS. The engineer creates a class-map to match HTTP traffic using the 'match port tcp 80' command. However, the policy is not being applied correctly. What is the most likely reason?

20 minute time limit — choose an answer to begin.

Accepted Answer

The default global inspection policy already inspects HTTP traffic, and the new policy may be overridden.. On a Cisco ASA, the default global inspection policy (the implicit global service-policy) already inspects common protocols including HTTP. If an engineer creates a new class-map and service-policy to inspect HTTP but does not account for the existing global policy, the new policy may not take effect as expected because the default global inspection is already handling that traffic. The correct approach is to modify or override the global policy rather than assume a new interface-level policy will supersede it.

Answer

The class-map should use 'match any' instead of 'match port tcp 80'.

Answer

The ASA does not support HTTP inspection via MPF.

Answer

The service-policy must be applied globally, not to an interface.

Question 2

A security analyst is tuning Snort rules to reduce false positives. The analyst identifies a rule that triggers on a common benign application. Which action should be taken to suppress alerts for that specific traffic without disabling the rule entirely?

Accepted Answer

Add a 'threshold' rule to limit the number of alerts.. Adding a threshold rule (using the `threshold` keyword in Snort) allows the analyst to control the rate at which alerts are generated for a specific rule without disabling it. This is ideal for suppressing excessive false positives from a benign application while still retaining detection capability for anomalous patterns. The threshold can be configured as `limit`, `threshold`, or `both`, and can be scoped by source/destination IP or globally. This directly addresses the requirement to reduce noise without losing the rule entirely.

Answer

Delete the rule from the policy.

Answer

Change the rule action to 'alert'

Answer

Set the rule to 'drop' action.

Question 3

A network engineer is configuring site-to-site IPsec VPN on a Cisco ASA using IKEv2. Which two components are required for IKEv2 configuration? (Choose two.)

Accepted Answer

IKEv2 proposal. Option A (IKEv2 proposal) is correct because IKEv2 requires an ikev2 proposal to define the encryption, integrity, and PRF algorithms (and optionally Diffie-Hellman group) used to protect the IKEv2 SA during Phase 1 negotiation. Option D (Transform set) is correct because the IPsec Phase 2 SA still requires a transform set specifying the ESP encryption and authentication algorithms (e.g., esp-aes esp-sha-hmac) to protect the data traffic. Option B (ISAKMP policy) is incorrect because that is the IKEv1 Phase 1 construct; IKEv2 uses ikev2 policy/proposal instead. Option C (Group policy) is incorrect because group policy is used for remote-access VPN attributes (e.g., AnyConnect), not as a required IKEv2 site-to-site component. Option E (Dynamic crypto map) is incorrect because dynamic crypto maps are used for hub-and-spoke or dynamic peer scenarios, not as a required element of a standard site-to-site IKEv2 configuration.

Answer

ISAKMP policy

Answer

Group policy

Answer

Dynamic crypto map

Question 4

An engineer is configuring an access control policy on Cisco FMC for FTD. The policy must allow HTTP traffic from the inside zone to the outside zone, but block all other traffic. Which rule configuration is correct?

Accepted Answer

Rule 1: Permit HTTP from inside to outside; Rule 2: Block all traffic.. Access control rules in FMC are evaluated top-down, so the permit HTTP rule must come first, followed by a block-all rule to deny everything else. This ensures HTTP from inside to outside is allowed while all other traffic is dropped. The default action alone would not satisfy the 'block all other traffic' requirement explicitly.

Answer

Rule 1: Trust HTTP from inside to outside; Rule 2: Block all traffic.

Answer

Rule 1: Block all traffic; Rule 2: Allow HTTP from inside to outside.

Answer

Rule 1: Allow HTTP from inside to outside; no default rule.

Question 5

A Cisco FTD device is deployed in inline mode and configured with an SSL policy to decrypt traffic. The policy uses 'Decrypt - Known Key' for traffic to an internal server. What is required for this decryption to work?

Accepted Answer

The FTD must have the server's private key imported.. For 'Decrypt - Known Key' in Cisco FTD SSL policy, the firewall must have the server's private key imported so it can decrypt traffic using the server's certificate and key. This allows the FTD to act as the server in the SSL handshake, decrypting and inspecting the traffic.

Answer

The FTD must generate a new certificate for each session.

Answer

The server's certificate must be signed by a public CA.

Answer

The client must trust the FTD's CA certificate.

Question 6

An administrator is configuring Dynamic Access Policies (DAP) on a Cisco ASA for AnyConnect VPN. Which two attributes can be used to create DAP rules? (Choose two.)

Accepted Answer

Anti-virus software version. Option B (Anti-virus software version) is correct because DAP supports endpoint posture attributes, including the presence and version of anti-virus software, which the ASA collects from the AnyConnect posture assessment and uses to evaluate DAP selection criteria. Option C (VPN tunnel group) is correct because DAP rules can be conditioned on the connection profile (tunnel group) the user connects through, allowing different policies per group policy/tunnel group. Option A (Client IP address) is not a standard DAP selection attribute, as DAP evaluates user, endpoint, and connection attributes rather than the client's source IP. Option D (Certificate issuer) is not a DAP rule attribute; certificate-based conditions are handled through certificate mapping and AAA, not DAP selection criteria. Option E (Time of day) is not a supported DAP attribute, since DAP does not evaluate time-based conditions.

Answer

Client IP address

Answer

Certificate issuer

Answer

Time of day

Question 7

A Cisco FTD is configured with an access control policy that includes an intrusion policy. Which three actions can be set in an access control rule regarding intrusion inspection? (Choose three.)

Accepted Answer

Allow with intrusion inspection. In a Cisco FTD access control rule, the Intrusion Policy action dropdown offers three choices: Allow with Intrusion Inspection (option C), which permits the traffic while applying the selected intrusion policy; Allow without Intrusion Inspection (option E), which permits the traffic while bypassing intrusion analysis; and Trust (option D), which skips both access control and intrusion inspection for the matching traffic. These three are the only valid intrusion-related actions available in an access control rule, since intrusion inspection is either applied, bypassed, or entirely skipped via Trust. Options A and B are incorrect because 'Block with intrusion inspection' and 'Interactive Block with intrusion inspection' are not selectable intrusion inspection actions in an FTD access control rule; blocking decisions are made by the rule's overall action (Block, Interactive Block) and do not carry a separate intrusion inspection setting in this context.

Answer

Block with intrusion inspection

Answer

Interactive Block with intrusion inspection

Question 8

An organization is planning to deploy Cisco FTD in a high-availability pair. Which two statements about active/active failover are true? (Choose two.)

Accepted Answer

It requires multiple context mode.. Option A is correct because Cisco FTD active/active failover is implemented by using multiple context mode, where contexts are grouped into failover groups and each unit actively owns at least one group. Option B is correct because in active/active failover both units actively pass traffic simultaneously, each handling its assigned failover groups rather than one unit remaining purely standby. Stateful failover (option C) is not supported in FTD active/active deployments, which is a key reason active/standby is generally preferred when stateful failover is required. Option D is wrong because active/standby is the default failover mode, not active/active. Option E is wrong because configuration is synchronized between the failover peers in an FTD HA pair.

Answer

Stateful failover is supported.

Answer

It is the default failover mode.

Answer

Configuration is not synchronized.

Question 9

A security administrator is configuring URL filtering on Cisco FTD. Which three categories are commonly used in URL filtering policies? (Choose three.)

Accepted Answer

Social Networking. In Cisco FTD URL filtering, categories are content-based classifications used to allow or block web destinations, and Social Networking (A) is a standard reputation/content category that lets administrators control access to sites like Facebook and Twitter. Malware (C) is a recognized URL category used to block sites known to distribute malicious payloads, complementing FTD's file and intrusion policies. Adult Content (D) is likewise a common content category used to enforce acceptable-use policies by blocking mature or explicit sites. Encrypted Traffic (B) is not a URL category but rather a connection characteristic handled by SSL/TLS decryption policies, and Phishing (E) is a threat/reputation classification typically enforced through FTD's Security Intelligence or DNS/URL reputation feeds rather than a standard URL filtering category.

Answer

Encrypted Traffic

Answer

Phishing

Question 10

An engineer is configuring an ASA to allow inbound HTTP traffic from the outside to a server on the DMZ. The outside interface has security level 0 and the DMZ interface has security level 50. Which set of commands correctly implements the required access and NAT?

Accepted Answer

nat (dmz,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside. The ASA requires a static NAT for inbound traffic and an ACL on the outside interface to permit the traffic.

Answer

nat (outside,dmz) static 10.1.1.10; access-list dmz_access_in permit tcp any host 10.1.1.10 eq 80; access-group dmz_access_in in interface dmz

Answer

nat (inside,outside) static 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Answer

nat (dmz,outside) dynamic 10.1.1.10; access-list outside_access_in permit tcp any host 10.1.1.10 eq 80; access-group outside_access_in in interface outside

Question 11

A security administrator is configuring a Cisco FTD device using FMC. The goal is to block traffic from a specific country and allow all other traffic. Which action should be taken in the access control policy?

Accepted Answer

Create an access control rule with source country set to the country and action Block.. The access control policy in FMC is the primary enforcement point for allowing or blocking traffic based on Layer 3/4 and geolocation criteria. Creating an access control rule with the source country (geolocation object) set to the specific country and the action set to Block will drop all traffic originating from that country, while the default action (or a subsequent allow rule) permits all other traffic. This is the correct and most direct method to achieve country-based blocking in an FTD managed by FMC.

Answer

Create a pre-filter rule that blocks traffic from the country.

Answer

Create an intrusion rule with a block action for the country.

Answer

Create a file policy that blocks traffic from the country.

Question 12

A company uses Cisco AnyConnect for remote access VPN. They want to allow only specific Active Directory groups to access the corporate network. Which feature on the ASA or FTD should be configured to enforce this?

Accepted Answer

Dynamic Access Policy (DAP). Dynamic Access Policy (DAP) on Cisco ASA/FTD evaluates endpoint and user attributes (including AD/LDAP group membership via LDAP attribute maps) at connection time and applies differentiated authorization, such as restricting which AD groups can reach the corporate network. It is the only feature designed to make per-user, per-group access decisions after authentication.

Answer

Connection profile with LDAP attribute map

Answer

AAA server group

Answer

Group Policy with filter on group membership

Question 13

An organization has a Cisco ASA with two interfaces: inside (security 100) and outside (security 0). They want to allow traffic from inside to outside without NAT for a specific subnet. Which configuration achieves this?

Accepted Answer

nat (inside,outside) source static 192.168.1.0 192.168.1.0 no-proxy-arp route-lookup. A NAT exemption rule with 'nat 0' (on ASA 9.x+) or 'nat (inside,outside) source static' with an identity NAT can be used. In modern ASA, 'nat (inside,outside) source static NET NET no-proxy-arp route-lookup' is typical.

Answer

nat (inside,outside) dynamic interface

Answer

nat (inside,outside) source dynamic any interface

Answer

access-list outside_access_in permit ip 192.168.1.0 255.255.255.0 any

Question 14

A security analyst is monitoring the Cisco FMC and notices a high number of false positives from an intrusion rule that detects SQL injection attempts. The legitimate web application frequently generates similar patterns. Which course of action would reduce false positives while maintaining detection for actual attacks?

Accepted Answer

Increase the rule's threshold to reduce frequency.. Increasing the rule's threshold reduces the frequency with which the rule fires, which is the standard tuning approach when legitimate traffic triggers false positives but the rule still needs to detect real attacks. By raising the threshold, the rule requires more matching events within a time window before alerting, filtering out isolated benign patterns while still catching sustained attack behavior. This preserves detection capability for actual SQL injection attempts that generate repeated or higher-volume matches.

Answer

Disable the rule entirely.

Answer

Create a new intrusion rule with opposite logic.

Answer

Change the rule action to 'pass'.

Question 15

A security administrator is deploying a Cisco ASA in a DMZ architecture. The inside interface is security 100, outside interface is security 0, and DMZ interface is security 50. Which TWO statements about traffic flow are correct?

Accepted Answer

Traffic from inside to DMZ is allowed by default.. The ASA assigns interface security levels (inside 100, DMZ 50, outside 0) and by default permits traffic from a higher security level to a lower one without an ACL. Option B is correct because inside (100) to DMZ (50) is a high-to-low flow, so it is allowed by default. Option D is correct because inside (100) to outside (0) is also high-to-low and permitted by default. Option A is incorrect because DMZ (50) to outside (0) is high-to-low and allowed by default, not denied. Option C is incorrect because outside (0) to inside (100) is low-to-high and requires an explicit ACL to be permitted. Option E is incorrect because DMZ (50) to inside (100) is low-to-high and is denied by default.

Answer

Traffic from DMZ to outside is denied by default.

Answer

Traffic from outside to inside is allowed by default without ACL.

Answer

Traffic from DMZ to inside is allowed by default.

Question 16

A Cisco FTD is configured with an access control policy that includes a rule to allow traffic from a specific source subnet. However, traffic is being blocked. Which TWO possible causes should be checked?

Accepted Answer

The source subnet is not correctly defined in the network object.. Option C is correct because if the network object representing the source subnet is misconfigured (wrong IP address, mask, or object type), the access control rule will not match the intended traffic, causing the default action to block it. Option D is correct because FTD access control rules are evaluated top-down, so a block rule placed above the allow rule that matches the same traffic will terminate evaluation and block the packets before the allow rule is ever reached. Option A is incorrect because setting an intrusion policy to 'No Inspection' only disables intrusion detection/prevention; it does not block traffic by itself. Option B is incorrect because a default action of 'Allow' would permit unmatched traffic, not block it. Option E is incorrect because an incorrect destination port in the rule would prevent the rule from matching, but the question specifies the rule is meant to allow traffic from a source subnet; port mismatch is a possible cause of non-matching, yet it is not marked correct and is less directly tied to the stated source-subnet condition than C and D.

Answer

The intrusion policy is set to 'No Inspection'.

Answer

The default action is set to 'Allow'.

Answer

The rule has a destination port that is incorrect.

Question 17

An organization wants to deploy Cisco Firepower in a high-availability pair with active/standby failover. Which management solution allows this configuration?

Accepted Answer

FMC. Cisco Firepower Management Center (FMC) is the centralized management platform that supports configuring and managing Firepower appliances in active/standby high-availability pairs. FMC provides the HA configuration workflow, including failover link, stateful failover, and interface monitoring. FDM and ASDM do not support the full HA feature set for Firepower threat defense in the same way.

Answer

CLI only

Answer

FDM (on-box management)

Answer

ASDM

Question 18

A company wants to deploy a DMZ segment accessible from the internet. Which THREE considerations are critical for firewall zone design and security?

Accepted Answer

Use separate firewall interfaces for inside, outside, and DMZ. Option A is correct because a proper DMZ design requires the firewall to have distinct physical or logical interfaces for the inside, outside, and DMZ zones, so that zone-based policy and security levels can be enforced independently on each segment. Option B is correct because DMZ hosts are internet-facing and thus the most likely to be compromised; preventing them from initiating connections into the trusted inside network blocks lateral movement and data exfiltration. Option D is correct because inbound traffic from the untrusted outside should be limited to only the specific ports and protocols needed to reach published DMZ services (e.g., TCP 443 to a web server), minimizing the attack surface. Option C is incorrect because a security level of 100 is the maximum value typically assigned to the most trusted interface (the inside), not the DMZ, which should have a lower level such as 50. Option E is incorrect because allowing all inside-to-DMZ traffic without inspection violates least-privilege and defense-in-depth principles, since a compromised DMZ host could be reached freely and the traffic could carry malicious content.

Answer

DMZ interface should have a security level of 100

Answer

Allow all traffic from inside to DMZ without inspection

Question 19

An engineer is configuring a Cisco ASA to allow traffic from the inside (security level 100) to the outside (security level 0). They create an access list permitting HTTP traffic from inside to outside and apply it to the inside interface inbound. What is the expected behavior?

Accepted Answer

The traffic will be allowed because the ACL permits it.. On a Cisco ASA, ACLs applied inbound on the inside interface are evaluated before any security-level check, and because the ACL explicitly permits HTTP from inside to outside, the traffic is allowed. The ASA's default behavior of permitting traffic from a higher security level (100) to a lower security level (0) is also satisfied, but the explicit ACL is what governs the decision. Therefore, the ACL placement and direction are correct and the traffic will pass.

Answer

The traffic will be blocked because the ACL is applied inbound on the inside interface.

Answer

The traffic will be blocked because the ACL should be applied outbound on the outside interface.

Answer

The traffic will be allowed only if a NAT rule exists.

Question 20

A network administrator is configuring site-to-site IPsec VPN between two Cisco ASAs using IKEv2. They want to ensure that only specific subnets are encrypted, using Virtual Tunnel Interface (VTI). Which configuration element is essential for VTI?

Accepted Answer

A tunnel interface with an IP address and a crypto map.. VTI uses a tunnel interface that is dedicated to the VPN, and the crypto map is applied to the tunnel interface rather than the physical interface. For IKEv2, the tunnel mode is enabled and the crypto map is applied to the VTI.

Answer

A crypto map applied to the physical interface.

Answer

A transform set with ESP encryption and authentication.

Answer

An ISAKMP policy with pre-shared key.