350-701 Security Concepts Practice Test 2 — 15 Questions

Question 1

A security team is implementing a Cisco Firepower NGFW to protect against advanced malware. The team wants to leverage features that provide file analysis and sandboxing to detect zero-day threats. Which two Cisco Firepower features should be configured to achieve this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Intelligence Director (TID). File policy and Threat Intelligence Director (TID) are the two Cisco Firepower features that enable file analysis and sandboxing for zero-day threat detection. File policy submits files for dynamic analysis, while TID integrates external threat intelligence to enhance detection. Together, they provide the advanced malware protection needed to identify unknown threats.

Answer

Network Discovery policy

Answer

SSL policy

Answer

Intrusion Policy

Question 2

A security architect is designing a new data center where east-west traffic between workload VMs must be inspected by Cisco Firepower NGFW before reaching the destination VM. The hypervisor platform supports a service insertion framework that redirects traffic to a virtual NGFW. Which technology should the architect use to accomplish this?

Accepted Answer

Cisco ACI service graph with a PBR node redirecting traffic to the Firepower NGFW. Cisco ACI service graphs with a PBR node are the supported mechanism for inserting Firepower NGFW inline for east-west traffic between endpoint groups. The service graph defines the ordered chain of function nodes, and the PBR node redirects the flow to the firewall so inspection occurs before the destination EPG is reached. This delivers the required VM-to-VM inspection without relying on host-based or cloud egress controls.

Answer

Cisco TrustSec security group tagging (SGT) enforcement at the access layer

Answer

Cisco Umbrella SIG tunnel from each VM to the nearest PoP

Answer

Cisco Identity Services Engine posture assessment for each workload VM

Question 3

A security administrator is implementing 802.1X authentication on Cisco switches. Which two components are required for the authentication process? (Choose two.)

Accepted Answer

Authenticator. The IEEE 802.1X framework defines three roles: supplicant (client), authenticator (switch), and authentication server (RADIUS). The supplicant and authenticator are the components on the endpoint and switch that enable the authentication exchange. The authentication server is also required but is not on the endpoint or switch; it resides on a separate server. The question asks for components on the endpoint and switch, so supplicant and authenticator are correct.

Answer

Certificate Authority

Answer

DHCP server

Answer

RADIUS server

Question 4

A security engineer is reviewing telemetry from Cisco Secure Network Analytics (formerly Stealthwatch). Several internal hosts are generating a high volume of outbound connections to many distinct destination IP addresses on port 443, with small average flow sizes and no corresponding DNS lookups in the flow records. Which threat behavior does this pattern most likely indicate?

Accepted Answer

Domain generation algorithm (DGA) activity used by malware for rendezvous. DGA-based malware contacts a large number of algorithmically generated domains to find its active C2 server, creating a fan-out pattern of many outbound connections on common ports with small flow sizes. The frequent resolution failures explain the missing DNS entries in the flow data, and Secure Network Analytics uses cognitive analytics to flag this behavior as suspicious rendezvous activity.

Answer

A horizontal port scan against the internal server subnet

Answer

Command-and-control beaconing to a hardcoded IP address

Answer

DNS tunneling used to exfiltrate data through the corporate resolver

Question 5

A security operations team wants to centralize event collection from Cisco Firepower intrusion policies, ASA syslog, and ISE authentication logs so analysts can correlate activity in one place and run compliance reports. Which Cisco platform should be deployed as the central collector and correlation point?

Accepted Answer

Cisco Secure Event Connector. Centralized correlation of Firepower intrusion events, ASA syslog, and ISE authentication logs requires a syslog aggregation and correlation component. Cisco Secure Event Connector performs that role, receiving events from multiple Cisco security products and enabling analysis and compliance reporting. Management Center, Secure Network Analytics, and SecureX serve device management, flow analytics, and integration visibility respectively, not long-term multi-source syslog collection.

Answer

Cisco Secure Firewall Management Center

Answer

Cisco SecureX

Answer

Cisco Secure Network Analytics

Question 6

A security analyst is reviewing a packet capture and notices that an internal host is receiving a large number of TCP SYN-ACK packets from many different source IP addresses, but the host never sent corresponding SYN packets. The host's connection table is filling up and legitimate connections are timing out. Which type of attack is this?

Accepted Answer

TCP SYN-ACK reflection attack. The unsolicited SYN-ACK pattern is the signature of TCP SYN-ACK reflection, where the attacker spoofs the victim's address in SYNs sent to many servers. Those servers respond to the victim, which never initiated the connections. The flood of half-open entries exhausts the victim's connection table and causes legitimate sessions to time out, exactly as described.

Answer

Smurf attack

Answer

UDP amplification attack

Answer

SYN flood

Question 7

Which security model requires that all subjects and devices are untrusted by default, and access is granted only after verification, regardless of the network location?

Accepted Answer

Zero Trust. Zero Trust is a security model based on the principle of 'never trust, always verify', requiring continuous authentication and authorization.

Answer

Least Privilege

Answer

Defense in Depth

Answer

CIA Triad

Question 8

An organization wants to ensure that digital certificates issued by its internal CA are validated for revocation in real-time. Which protocol should be implemented to allow clients to check certificate status without downloading a full CRL?

Accepted Answer

OCSP. OCSP (Online Certificate Status Protocol, RFC 6960) allows a client to query a responder for the revocation status of a specific certificate in real time, returning 'good', 'revoked', or 'unknown' without downloading the entire CRL. This satisfies the requirement for real-time revocation checking with minimal bandwidth. OCSP is the standard replacement for CRL-based checking in latency-sensitive environments.

Answer

SCEP

Answer

EST

Answer

CRL

Question 9

During a penetration test, an attacker sends a malicious payload to a web application that causes the server to execute arbitrary SQL commands on the backend database. Which type of attack is being performed?

Accepted Answer

SQL Injection. SQL injection occurs when user input is improperly sanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL commands.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Buffer Overflow

Answer

Cross-Site Scripting (XSS)

Question 10

A security administrator is configuring a Cisco Firepower NGFW to detect and block application-layer DDoS attacks. Which type of DDoS attack is characterized by overwhelming a server with incomplete HTTP requests, causing resource exhaustion?

Accepted Answer

Slowloris. Slowloris is an application-layer DDoS attack that sends partial HTTP requests to keep connections open, exhausting server resources.

Answer

UDP Flood

Answer

ICMP Flood

Answer

SYN Flood

Question 11

Which cryptographic algorithm is considered deprecated and should be avoided due to known vulnerabilities, especially when used in digital signatures and certificate signing?

Accepted Answer

MD5. MD5 is a hashing algorithm with known collision vulnerabilities, making it unsuitable for security-sensitive applications like digital signatures.

Answer

SHA-256

Answer

SHA-3

Answer

AES-256

Question 12

An attacker uses ARP spoofing to intercept traffic between two devices on the same subnet. After successfully becoming a man-in-the-middle, the attacker can then perform which further attack to downgrade HTTPS connections to HTTP?

Accepted Answer

SSL stripping. SSL stripping is a MITM attack that downgrades HTTPS connections to HTTP by intercepting the initial HTTPS request and maintaining a plaintext connection with the client.

Answer

Session hijacking

Answer

DNS cache poisoning

Answer

Typosquatting

Question 13

In a PKI hierarchy, which component is responsible for issuing and revoking certificates for end entities, and is directly subordinate to the root CA?

Accepted Answer

Intermediate CA. In a PKI hierarchy, the intermediate CA (also called a subordinate CA) is the component that issues and revokes end-entity certificates and is directly subordinate to the root CA. This design keeps the root CA offline and protects its private key, while the intermediate CA handles day-to-day issuance. The root CA only signs the intermediate's certificate, forming a chain of trust.

Answer

Registration Authority (RA)

Answer

Root CA

Answer

Certificate Revocation List (CRL)

Question 14

A security engineer is evaluating authentication methods. Which authentication factor category does a fingerprint scanner fall under?

Accepted Answer

Inherence. A fingerprint scanner falls under the inherence factor category because it authenticates based on a physical or behavioral characteristic intrinsic to the user — something the user *is*. Inherence factors include biometrics such as fingerprints, retina/iris scans, voiceprints, and facial recognition. Because the biometric trait cannot be transferred or forgotten like a token or password, it is classified as inherence rather than possession or knowledge.

Answer

Possession

Answer

Knowledge

Answer

Location

Question 15

Which Cisco security product is primarily designed to provide DNS-layer security by blocking requests to malicious domains?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security platform that provides DNS-layer security by intercepting DNS queries and blocking requests to malicious or unwanted domains before a connection is established. It is the primary Cisco product for this function.

Answer

AMP for Endpoints

Answer

Firepower NGFW

Answer

Stealthwatch