350-701 Security Concepts Practice Test 3 — 15 Questions

Question 1

An attacker performs a DNS cache poisoning attack on a recursive DNS server. What is the primary impact of this attack?

Accepted Answer

Redirection of traffic to malicious servers. DNS cache poisoning injects false DNS records, causing users to be redirected to malicious sites when they attempt to access legitimate domains.

Answer

Encryption of DNS queries

Answer

Exposure of DNS server credentials

Answer

Denial of service to the DNS server

Question 2

A security analyst is investigating a potential insider threat. Which TWO indicators are most commonly associated with malicious insider activity? (Choose two.)

Accepted Answer

Accessing files outside normal working hours without justification. Option D is correct because accessing files outside normal working hours without justification is a classic behavioral indicator of insider threat activity; anomalous access patterns such as off-hours file retrieval can signal data exfiltration or reconnaissance that evades normal monitoring windows. Option E is correct because attempting to disable security logging on a workstation is a direct anti-forensic action; tampering with audit logs, event logging services, or SIEM agents is a strong indicator of malicious intent to conceal unauthorized activity. Option A is not an indicator because frequent password changes mandated by policy are a normal, expected compliance behavior. Option B is not an indicator because a promotion to a higher security clearance is an administrative HR event, not evidence of malicious activity. Option C is not an indicator because using a company-approved VPN for remote access is an authorized and secure method of connecting to corporate resources.

Answer

Frequent password changes as required by policy

Answer

Receiving a promotion to a higher security clearance

Answer

Using a company-approved VPN for remote access

Question 3

A company is implementing a Zero Trust architecture. Which THREE principles are core to the Zero Trust model? (Choose three.)

Accepted Answer

Never trust, always verify. Option B (Never trust, always verify) is a core Zero Trust principle because it requires every access request to be explicitly authenticated and authorized based on identity, device health, and context, regardless of network location. Option C (Least privilege access) is correct because Zero Trust enforces just-in-time and just-enough-access (JIT/JEA) so users and workloads receive only the minimum permissions needed, limiting lateral movement. Option D (Microsegmentation) is correct because Zero Trust relies on granular network segmentation, often at the workload or application level, to prevent unrestricted east-west traffic and contain breaches. Option A (Trust but verify) reflects a traditional perimeter-based model, not Zero Trust, since Zero Trust assumes no implicit trust. Option E (Defense in depth) is a broader layered-security strategy that can complement Zero Trust but is not one of its defining core principles.

Answer

Trust but verify

Answer

Defense in depth

Question 4

A network engineer is tasked with securing email communications. Which TWO Cisco products are specifically designed for email security? (Choose two.)

Accepted Answer

Cisco ESA (Email Security Appliance). Cisco ESA (Email Security Appliance), option C, is a dedicated on-premises email security gateway that inspects SMTP traffic for spam, malware, phishing, and data loss prevention, making it specifically designed for email security. Cisco Secure Email (Cloud), option D, is the cloud-hosted equivalent (formerly Cisco Cloud Email Security) that provides the same email threat protection, spam filtering, and encryption without on-premises hardware. The other options do not belong: Cisco Stealthwatch (A) is a network traffic analysis and flow-based anomaly detection tool, Cisco ISE (B) is a NAC/identity and access control platform using 802.1X and RADIUS, and Cisco WSA (E) is a secure web gateway that proxies HTTP/HTTPS traffic rather than email.

Answer

Cisco Stealthwatch

Answer

Cisco ISE (Identity Services Engine)

Answer

Cisco WSA (Web Security Appliance)

Question 5

A security analyst is reviewing logs and sees multiple failed login attempts from a single IP address, followed by a successful login. Which type of attack does this represent?

Accepted Answer

Brute-force attack. A brute-force attack involves repeated attempts to guess credentials, often automated, until successful.

Answer

SQL injection

Answer

Man-in-the-middle attack

Answer

Phishing

Question 6

An organization wants to implement a security model where no user or device is trusted by default, regardless of whether they are inside or outside the network perimeter. Which concept does this describe?

Accepted Answer

Zero Trust. Zero Trust assumes no implicit trust and verifies every access request.

Answer

Defense in depth

Answer

Least privilege

Answer

Network segmentation

Question 7

A security engineer is configuring a Cisco Firepower NGFW to detect and block a new malware variant that communicates with a command-and-control server using encrypted DNS queries. Which Cisco security product is best suited to provide visibility into this malicious DNS traffic?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered DNS security service that can block malicious domains and provide visibility into DNS queries.

Answer

Cisco ASA

Answer

Cisco AMP

Answer

Cisco Stealthwatch

Question 8

Which of the following is an example of a passive reconnaissance technique?

Accepted Answer

OSINT gathering from public websites. Passive reconnaissance involves gathering information without directly interacting with the target, such as through public sources.

Answer

Port scanning

Answer

Social engineering

Answer

Vulnerability scanning

Question 9

A company deploys a solution that uses a root certificate authority (CA) and intermediate CAs to issue certificates. What is the term for the hierarchical structure of certificates from the root CA to the end entity?

Accepted Answer

Certificate chaining. Certificate chaining refers to the path from the root CA through intermediates to the end-entity certificate.

Answer

Certificate signing request

Answer

Certificate revocation list

Answer

Public key infrastructure

Question 10

Which Cisco security product provides identity-based access control and policy enforcement for wired and wireless networks?

Accepted Answer

Cisco ISE. Cisco Identity Services Engine (ISE) is the Cisco product that provides identity-based access control and policy enforcement for wired and wireless networks. It integrates with AAA, 802.1X, and profiling to enforce granular access policies based on user and device identity.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 11

An attacker intercepts traffic between a client and a server and modifies the communication without either party knowing. Which type of attack is being performed?

Accepted Answer

Man-in-the-middle attack. A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and possibly alters communications between two parties who believe they are communicating directly with each other. The scenario describes exactly this: the attacker intercepts traffic between client and server and modifies it without either party knowing. This is the defining characteristic of a MITM attack, which can be active (modifying traffic) or passive (eavesdropping only).

Answer

Phishing

Answer

Replay attack

Answer

Denial of service

Question 12

Which encryption algorithm is classified as symmetric?

Accepted Answer

AES. AES is a symmetric encryption algorithm, using the same key for encryption and decryption.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECDSA

Question 13

A security team implements a policy where users must provide a password and a one-time code from a mobile app. Which authentication factors are being used?

Accepted Answer

Knowledge and possession. Something you know (password) and something you have (mobile app one-time code).

Answer

Inherence only

Answer

Possession and inherence

Answer

Knowledge and inherence

Question 14

A Cisco ESA administrator notices that a large number of emails with malicious attachments are being delivered to users. Which feature should be configured to inspect attachments in a sandbox environment before delivery?

Accepted Answer

Cisco ESA with AMP. Cisco ESA can integrate with AMP (Advanced Malware Protection) to sandbox and analyze attachments.

Answer

Cisco AMP for Endpoints

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Question 15

What is the primary purpose of a digital signature?

Accepted Answer

Verify the sender's identity and ensure message integrity. A digital signature provides authentication, integrity, and non-repudiation.

Answer

Compress the data

Answer

Prevent replay attacks

Answer

Encrypt the message