350-701 Security Concepts — 30 Questions

Question 1

A security analyst notices unusual outbound traffic from an internal host to a known malicious IP address on TCP port 4444. The host is also exhibiting high CPU usage and running an unknown process. Which type of malware is most likely present?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote Access Trojan (RAT). A RAT (Remote Access Trojan) often uses a command-and-control (C2) channel on high-numbered ports like 4444, allowing attackers to control the host remotely.

Answer

Ransomware

Answer

Botnet C2 client

Answer

Keylogger

Question 2

A network administrator is configuring an ASA to enforce that traffic between two internal zones must be inspected by the firewall. Which security principle is being applied?

Accepted Answer

Microsegmentation. Microsegmentation is the practice of dividing a network into small, isolated segments and enforcing granular security controls between them — here, the ASA is enforcing that traffic between two internal zones must pass through and be inspected by the firewall. This is the defining characteristic of microsegmentation: east-west traffic between internal segments is subject to policy enforcement rather than being implicitly trusted. The ASA's zone-based policy (using security zones and inter-zone policies) is a classic implementation of this principle.

Answer

Least Privilege

Answer

Separation of Duties

Answer

Defense in Depth

Question 3

A security analyst is investigating a potential ARP spoofing attack. Which two symptoms would indicate this type of attack?

Accepted Answer

Duplicate IP addresses in the ARP table. Option B is correct because ARP spoofing works by sending forged ARP replies that map an attacker's MAC address to a legitimate IP, so the ARP cache on victims or the gateway will show the same IP bound to multiple MAC addresses (duplicate IP entries), which is a classic indicator. Option D is correct because when the attacker impersonates the gateway or a server's IP, traffic is redirected to the attacker's MAC; if the attacker does not forward packets (or forwards them inconsistently), users experience intermittent connectivity or dropped sessions to that server. Option A is not a typical ARP spoofing symptom, since the attack is Layer 2 cache poisoning and does not inherently drive high switch CPU usage. Option C is not specific to ARP spoofing, as increased broadcast traffic is more characteristic of broadcast storms, loops, or other flooding attacks. Option E is unrelated, because unusual outbound DNS queries point to DNS tunneling, malware beaconing, or data exfiltration rather than ARP cache manipulation.

Answer

High CPU usage on the switch

Answer

Increased broadcast traffic

Answer

Unusual outbound DNS queries

Question 4

An employee receives an email that appears to be from the company's IT department requesting their login credentials. This is an example of which type of attack?

Accepted Answer

Phishing. Social engineering attacks manipulate individuals into divulging confidential information. Phishing is a common form.

Answer

Spear phishing

Answer

Vishing

Answer

Whaling

Question 5

What is the primary purpose of a digital signature?

Accepted Answer

Verify the sender's identity and data integrity. A digital signature uses the sender's private key to sign a hash of the message, and the recipient verifies it with the sender's public key. This provides authentication (proving who sent it), integrity (proving the message was not altered), and non-repudiation. It does not provide confidentiality, which is why encryption is a separate operation.

Answer

Encrypt data

Answer

Generate random numbers

Answer

Compress data

Question 6

An attacker uses Shodan to discover internet-facing ICS devices and then performs banner grabbing. This is an example of which type of attack?

Accepted Answer

Passive OSINT. Passive OSINT involves collecting publicly available information without directly interacting with the target. Banner grabbing is active scanning, but the question emphasizes the initial passive phase. However, Shodan is a passive OSINT tool.

Answer

Social engineering

Answer

Active reconnaissance

Answer

Exploitation

Question 7

A security analyst observes a sustained increase in traffic from many different IP addresses to a single web application, causing CPU spikes. The traffic consists of legitimate-looking HTTP GET requests for the same resource. Which TWO types of attack could this be? (Choose two.)

Accepted Answer

Distributed denial-of-service (DDoS) attack. Option C (Distributed denial-of-service (DDoS) attack) is correct because the traffic originates from many different IP addresses targeting one web application, which is the defining characteristic of a distributed attack leveraging numerous sources to overwhelm a victim. Option E (Application layer DDoS (Layer 7) attack) is correct because the requests are legitimate-looking HTTP GET requests for the same resource, which is a hallmark of Layer 7 attacks that exhaust server resources like CPU and memory by mimicking valid user behavior rather than flooding the network pipe. Option A (Volumetric DDoS) is incorrect because volumetric attacks aim to saturate bandwidth with massive packet floods (e.g., UDP or ICMP), whereas here the traffic is application-level HTTP requests causing CPU spikes, not link saturation. Option B (DNS amplification attack) is incorrect because it abuses open DNS resolvers with spoofed queries to generate large responses toward a victim, which does not match the observed pattern of direct HTTP GET requests. Option D (Man-in-the-middle attack) is incorrect because it involves intercepting and possibly altering communications between two parties, not flooding a web application with distributed requests.

Answer

Volumetric DDoS

Answer

DNS amplification attack

Answer

Man-in-the-middle attack

Question 8

A network administrator wants to deploy security products that provide network-based intrusion prevention and advanced threat detection. Which TWO Cisco products are most suitable? (Choose two.)

Accepted Answer

Cisco Stealthwatch. Cisco Stealthwatch (C) is correct because it is a network-based security analytics platform that uses NetFlow and other telemetry to detect advanced threats and anomalous behavior across the network, providing the visibility and detection capabilities the administrator needs. Cisco Firepower NGFW (E) is correct because it combines next-generation firewall capabilities with Snort-based intrusion prevention (IPS) and advanced malware protection, directly delivering network-based intrusion prevention and threat detection at the network edge and internal segments. The other options do not fit: Cisco ISE (A) is primarily for identity and access control (802.1X, profiling, posture), not intrusion prevention; Cisco AMP for Endpoints (B) is host-based endpoint protection rather than network-based; and Cisco ESA (D) is an email gateway focused on email-borne threats, not general network intrusion prevention.

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Advanced Malware Protection (AMP) for Endpoints

Answer

Cisco Email Security Appliance (ESA)

Question 9

A security engineer is configuring a Cisco Firepower NGFW to inspect traffic between two internal VLANs that are both behind the same firewall interface. The engineer wants to ensure that inter-VLAN traffic is subject to access control and intrusion policies. What must be configured to achieve this?

Accepted Answer

Configure the device in routed mode and create subinterfaces for each VLAN.. To inspect inter-VLAN traffic, the Firepower device must be in routed mode with subinterfaces for each VLAN, allowing it to route and apply policies. Transparent mode would not route between VLANs, and promiscuous mode is passive. Intra-interface inspection is for hairpinned traffic, not for routing between VLANs on the same interface.

Answer

Enable intra-interface traffic inspection on the Firepower device.

Answer

Deploy the device in transparent mode and enable EtherChannel.

Answer

Enable promiscuous mode on the monitoring interface.

Question 10

A security administrator is configuring a Cisco ASA firewall to protect a web server. The administrator wants to prevent attacks that exploit vulnerabilities in the web application, such as cross-site scripting (XSS) and SQL injection, by inspecting HTTP traffic. Which Cisco ASA feature should be enabled to achieve this?

Accepted Answer

Modular Policy Framework (MPF) with HTTP inspection. The Cisco ASA's Modular Policy Framework (MPF) enables deep packet inspection, including HTTP inspection, which can detect and block application-layer attacks such as XSS and SQL injection. ACLs only filter at Layer 3/4, FTD with SSL decryption is for encrypted traffic, and DHCP snooping is a Layer 2 feature. Therefore, MPF with HTTP inspection is the correct choice.

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Answer

Cisco Firepower Threat Defense (FTD) with SSL decryption

Answer

Access control lists (ACLs) on the outside interface

Question 11

A security administrator is implementing 802.1X for wired port authentication in a Cisco environment. The administrator wants to ensure that both the user and the device are authenticated before network access is granted. Which two components are required to achieve this? (Choose two.)

Accepted Answer

Supplicant. The two essential roles in 802.1X are the supplicant (client) and the authenticator (switch). The authentication server (e.g., RADIUS) is also part of the framework, but the question asks for two components, and the supplicant and authenticator are the fundamental entities that must be present on the endpoint and network device, respectively.

Answer

RADIUS server

Answer

Certificate Authority

Answer

VPN concentrator

Question 12

A security engineer is implementing Cisco TrustSec in a data center to enforce segmentation based on security group tags (SGTs). The engineer needs to ensure that traffic between servers in different security groups is properly controlled. Which two components are required to enforce SGT-based policies? (Choose two.)

Accepted Answer

Security Group Tag Exchange Protocol (SXP). The two required components are SXP and ISE. ISE dynamically assigns SGTs and defines the policies (SGACLs) that control traffic between groups. SXP propagates those SGT bindings to devices that cannot natively tag packets, ensuring consistent enforcement across the network. Together, they enable scalable, identity-based segmentation.

Answer

Virtual Private Network (VPN) concentrator

Answer

Access Control List (ACL) on each switch port

Answer

Network Time Protocol (NTP) server

Question 13

A security administrator is configuring a Cisco Firepower NGFW to protect against email-based threats. The administrator wants to implement measures to detect and block phishing emails and malicious attachments. Which two features should be enabled to achieve this? (Choose two.)

Accepted Answer

Email Security policy. To detect and block phishing emails and malicious attachments on Cisco Firepower NGFW, the Email Security policy inspects email content for phishing and the File policy analyzes attachments for malware. Together, they provide comprehensive email threat protection. Intrusion, SSL, and DNS policies serve different purposes and are not the primary features for this requirement.

Answer

Intrusion policy

Answer

DNS policy

Answer

SSL policy

Question 14

A security engineer is configuring a Cisco Firepower NGFW to inspect traffic between two internal VLANs. The engineer wants to ensure that the firewall inspects traffic in both directions and that return traffic is allowed without explicit rules. Which firewall mode and feature should be used?

Accepted Answer

Transparent mode with access control policies. Transparent mode on Cisco Firepower NGFW enables Layer 2 bridging, allowing the firewall to inspect traffic between VLANs without IP re-addressing. It performs stateful inspection, so return traffic is automatically permitted. Access control policies can be applied to filter traffic. This mode is designed for seamless integration into existing networks while providing full firewall and IPS capabilities.

Answer

Inline mode with intrusion prevention

Answer

Passive mode with network discovery

Answer

Routed mode with access control policies

Question 15

A security engineer is configuring an ISE deployment so that employees can authenticate to the corporate wireless SSID using their Active Directory credentials while the authentication decision stays on-premises. Which ISE external identity source should be selected for this requirement?

Accepted Answer

Active Directory join point. ISE authenticates wireless users against an external identity store. Joining the ISE node to the on-premises Active Directory domain makes domain controllers the authentication source, so usernames and passwords are validated locally and group data becomes available for authorization rules. The other identity source types serve token, SAML federation, or certificate use cases and cannot validate domain passwords for the SSID.

Answer

SAML identity provider

Answer

Certificate authentication profile

Answer

RADIUS token server

Question 16

A security team is implementing a Cisco Firepower NGFW to protect against advanced malware. The team wants to leverage features that provide file analysis and sandboxing to detect zero-day threats. Which two Cisco Firepower features should be configured to achieve this goal? (Choose two.)

Accepted Answer

Threat Intelligence Director (TID). File policy and Threat Intelligence Director (TID) are the two Cisco Firepower features that enable file analysis and sandboxing for zero-day threat detection. File policy submits files for dynamic analysis, while TID integrates external threat intelligence to enhance detection. Together, they provide the advanced malware protection needed to identify unknown threats.

Answer

Network Discovery policy

Answer

SSL policy

Answer

Intrusion Policy

Question 17

A security architect is designing a new data center where east-west traffic between workload VMs must be inspected by Cisco Firepower NGFW before reaching the destination VM. The hypervisor platform supports a service insertion framework that redirects traffic to a virtual NGFW. Which technology should the architect use to accomplish this?

Accepted Answer

Cisco ACI service graph with a PBR node redirecting traffic to the Firepower NGFW. Cisco ACI service graphs with a PBR node are the supported mechanism for inserting Firepower NGFW inline for east-west traffic between endpoint groups. The service graph defines the ordered chain of function nodes, and the PBR node redirects the flow to the firewall so inspection occurs before the destination EPG is reached. This delivers the required VM-to-VM inspection without relying on host-based or cloud egress controls.

Answer

Cisco TrustSec security group tagging (SGT) enforcement at the access layer

Answer

Cisco Umbrella SIG tunnel from each VM to the nearest PoP

Answer

Cisco Identity Services Engine posture assessment for each workload VM

Question 18

A security administrator is implementing 802.1X authentication on Cisco switches. Which two components are required for the authentication process? (Choose two.)

Accepted Answer

Authenticator. The IEEE 802.1X framework defines three roles: supplicant (client), authenticator (switch), and authentication server (RADIUS). The supplicant and authenticator are the components on the endpoint and switch that enable the authentication exchange. The authentication server is also required but is not on the endpoint or switch; it resides on a separate server. The question asks for components on the endpoint and switch, so supplicant and authenticator are correct.

Answer

Certificate Authority

Answer

DHCP server

Answer

RADIUS server

Question 19

A security engineer is reviewing telemetry from Cisco Secure Network Analytics (formerly Stealthwatch). Several internal hosts are generating a high volume of outbound connections to many distinct destination IP addresses on port 443, with small average flow sizes and no corresponding DNS lookups in the flow records. Which threat behavior does this pattern most likely indicate?

Accepted Answer

Domain generation algorithm (DGA) activity used by malware for rendezvous. DGA-based malware contacts a large number of algorithmically generated domains to find its active C2 server, creating a fan-out pattern of many outbound connections on common ports with small flow sizes. The frequent resolution failures explain the missing DNS entries in the flow data, and Secure Network Analytics uses cognitive analytics to flag this behavior as suspicious rendezvous activity.

Answer

A horizontal port scan against the internal server subnet

Answer

Command-and-control beaconing to a hardcoded IP address

Answer

DNS tunneling used to exfiltrate data through the corporate resolver

Question 20

A security operations team wants to centralize event collection from Cisco Firepower intrusion policies, ASA syslog, and ISE authentication logs so analysts can correlate activity in one place and run compliance reports. Which Cisco platform should be deployed as the central collector and correlation point?

Accepted Answer

Cisco Secure Event Connector. Centralized correlation of Firepower intrusion events, ASA syslog, and ISE authentication logs requires a syslog aggregation and correlation component. Cisco Secure Event Connector performs that role, receiving events from multiple Cisco security products and enabling analysis and compliance reporting. Management Center, Secure Network Analytics, and SecureX serve device management, flow analytics, and integration visibility respectively, not long-term multi-source syslog collection.

Answer

Cisco Secure Firewall Management Center

Answer

Cisco SecureX

Answer

Cisco Secure Network Analytics