350-701 Security Concepts Practice Test 7 — 15 Questions

Question 1

A network administrator is configuring PKI for secure communications. Which TWO components are essential for a public key infrastructure? (Choose two.)

Accepted Answer

Certificate Authority (CA). Option A, Certificate Authority (CA), is essential because the CA is the trusted entity that issues, signs, and manages digital certificates, binding public keys to identities and forming the root of trust in any PKI. Option C, a Certificate revocation list (CRL) or OCSP responder, is also essential because PKI must provide a way to check and revoke certificates that are no longer valid, such as after key compromise or employee departure; CRLs are published lists and OCSP responders provide real-time status. Option B, the private key of the end user, is not a PKI component itself but a key held by the subscriber; PKI manages certificates and keys, but the end user's private key is not an infrastructure component. Option D, a hashing function, is used within certificate signatures and integrity checks but is a cryptographic primitive, not a defining PKI component. Option E, a symmetric encryption algorithm, is not required for PKI, which is based on asymmetric cryptography and digital certificates.

Answer

Private key of the end user

Answer

Hashing function

Answer

Symmetric encryption algorithm

Question 2

A security analyst is investigating a malware outbreak. Analysis reveals a remote access trojan (RAT) that communicates with a command-and-control (C2) server. Which TWO behaviors are typical of a RAT? (Choose two.)

Accepted Answer

Logs keystrokes and captures credentials. Option C is correct because a RAT typically includes spyware functionality such as keylogging and credential harvesting to exfiltrate sensitive information to the C2 server. Option E is correct because the defining capability of a remote access trojan is granting the attacker interactive, remote control over the infected host, often through a backdoor channel to the C2. Options A, B, and D describe behaviors associated with other malware categories: A is characteristic of ransomware, B is a broader data-theft behavior not unique to RATs, and D is typical of botnet/DDoS malware rather than the core RAT function.

Answer

Encrypts files and demands ransom

Answer

Steals sensitive data from the system

Answer

Performs distributed denial-of-service attacks

Question 3

An organization is adopting Cisco's security portfolio. Which THREE products are correctly paired with their primary function? (Choose three.)

Accepted Answer

Cisco Umbrella - Cloud-delivered DNS security and secure web gateway. Option B (Cisco Umbrella) is correct because Umbrella is Cisco's cloud-delivered security platform that enforces DNS-layer security, secure web gateway (SWG), and firewall capabilities from the cloud, blocking malicious domains before connections are established. Option C (Cisco Firepower) is correct because Firepower NGFW appliances and the Firepower Threat Defense (FTD) software combine next-generation firewall policy with NGIPS intrusion prevention, application visibility, and URL filtering. Option E (Cisco ISE) is correct because Identity Services Engine is Cisco's policy platform for network access control (NAC), performing 802.1X, MAB, and profiling to enforce identity-based access. Option A is wrong because Stealthwatch is a network traffic analysis and flow-based visibility/security analytics product (using NetFlow/IPFIX), not an endpoint detection and response (EDR) tool. Option D is wrong because the Cisco ASA is a traditional stateful firewall/VPN appliance; advanced malware protection (AMP) and full NGFW features belong to the Firepower/FTD line rather than the classic ASA.

Answer

Cisco Stealthwatch - Endpoint detection and response

Answer

Cisco ASA - Next-generation firewall with advanced malware protection

Question 4

A Cisco Firepower NGFW administrator notices that a specific internal host is repeatedly establishing outbound TCP connections to a known command-and-control server across multiple ports. The administrator wants to quickly identify the malicious domain and IP addresses associated with this activity for further investigation. Which Firepower feature should be used to correlate this threat intelligence?

Accepted Answer

Security Intelligence (SI) feeds. Security Intelligence feeds are the correct choice because they provide curated lists of malicious IPs, URLs, and DNS names that Firepower uses to automatically detect and block traffic to command-and-control servers. This allows the administrator to quickly identify and correlate the threat without manual configuration. Other features like Network Discovery or URL filtering do not offer this specific threat intelligence correlation.

Answer

Access control policy with URL filtering

Answer

Network Discovery policy

Answer

Correlation policy with custom rules

Question 5

A security analyst at a financial services firm notices a sudden spike in outbound DNS queries from a single internal host, each query targeting a different random subdomain of the same external domain (e.g., a1b2c3.badzone.example). The queries are small and the responses are also small, but the total volume is high. The analyst suspects data exfiltration. Which technique is MOST likely being used?

Accepted Answer

DNS tunneling. The high volume of small DNS queries to random subdomains of a single domain is a classic indicator of DNS tunneling, where data is encoded in the subdomain labels and exfiltrated via DNS. Unlike DGA, which uses many different domains, or fast flux, which rotates IPs, DNS tunneling maintains a consistent domain but varies subdomains to carry data.

Answer

Domain generation algorithm (DGA) beaconing

Answer

DNS cache poisoning

Answer

Fast flux DNS

Question 6

A security engineer is configuring a Cisco Identity Services Engine (ISE) to authenticate employees connecting to the corporate wireless network. The engineer wants to ensure that only devices that have the latest antivirus definitions and OS patches are allowed access. Which ISE feature should be used to evaluate the device's posture?

Accepted Answer

Posture assessment. Posture assessment is the correct feature because it actively checks endpoints for compliance with security policies, such as up-to-date antivirus and patches, before allowing network access. It integrates with ISE's policy sets to grant or deny access based on the posture result. Other features like profiling or guest services do not evaluate the security state of the device.

Answer

Bring Your Own Device (BYOD) onboarding

Answer

Guest services

Answer

Profiling

Question 7

A security analyst at a financial institution is investigating suspicious outbound traffic from a workstation. The analyst observes that the traffic is encapsulated in DNS TXT record queries to a domain that resolves to an IP address in a known malicious range. The volume of queries is high but each query contains a small, encoded payload. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling. The scenario describes a covert channel using DNS queries to a malicious domain, with small encoded payloads and high query volume. This is classic DNS tunneling, often used for data exfiltration or command-and-control. Other DNS-based attacks like cache poisoning, amplification, or rebinding have different characteristics and goals, making DNS tunneling the correct identification.

Answer

DNS cache poisoning

Answer

DNS amplification attack

Answer

DNS rebinding

Question 8

A security engineer at a financial institution is designing a new threat detection system. The organization wants to identify ongoing attacks by observing real-time network traffic and comparing it against known malicious patterns, but they do not want to block any traffic yet. Which type of security control should the engineer implement?

Accepted Answer

Intrusion detection system (IDS). An intrusion detection system (IDS) passively monitors network traffic and compares it to known malicious signatures or behavioral anomalies, generating alerts without interfering with traffic flow. This aligns perfectly with the need to identify attacks in real time while avoiding any blocking. An IPS would block, a WAF is web-specific, and a stateful firewall enforces policies rather than detecting threats.

Answer

Web application firewall (WAF)

Answer

Stateful firewall

Answer

Intrusion prevention system (IPS)

Question 9

A network security analyst is reviewing logs and notices that an attacker is attempting to guess user passwords by trying common words and variations rapidly. Which type of attack is this?

Accepted Answer

Brute-force attack. A brute-force attack is characterized by repeated, automated attempts to guess credentials, often using dictionaries or common password patterns. The scenario describes rapid guessing of common words, which aligns with brute-force. Phishing is social, SQL injection targets databases, and XSS targets web users, none of which match the described behavior.

Answer

SQL injection

Answer

Phishing

Answer

Cross-site scripting (XSS)

Question 10

A network security administrator is deploying 802.1X authentication on Cisco switches. The administrator wants to ensure that if the RADIUS server becomes unreachable, authenticated supplicants remain connected while new supplicants are denied access. Which command should be configured on the switch ports to achieve this behavior?

Accepted Answer

authentication event server dead action authorize. The correct command is 'authentication event server dead action authorize' because it instructs the switch to keep existing authenticated supplicants in an authorized state when the RADIUS server is dead, while denying new supplicants. This ensures business continuity for already connected users. The other commands either target voice traffic, disrupt sessions, or handle server recovery, not the dead condition.

Answer

authentication event server dead action authorize voice

Answer

authentication event server alive action reinitialize

Answer

authentication event server dead action reinitialize vlan

Question 11

A network security engineer is configuring a Cisco Identity Services Engine (ISE) to enforce endpoint compliance. The engineer wants to ensure that only devices with up-to-date antivirus definitions and operating system patches are allowed on the corporate network. Which ISE feature should be used to achieve this?

Accepted Answer

Posture assessment. To enforce endpoint compliance based on antivirus and patch status, Cisco ISE's posture assessment feature is used. It checks devices against predefined policies and controls network access accordingly. Other features like profiling, guest services, and BYOD onboarding serve different purposes and do not provide the required security posture evaluation.

Answer

Profiling

Answer

Guest services

Answer

BYOD onboarding

Question 12

A security analyst is investigating a potential data breach. The analyst needs to determine which internal host communicated with a known malicious IP address over the past week. Which Cisco Stealthwatch feature should be used to query historical flow data and identify the host?

Accepted Answer

Flow Search. Flow Search is the correct feature because it enables granular queries of historical flow data, allowing the analyst to filter by the malicious IP and time range to identify the internal host. Other features like Alarm Manager or Host Report are either not queryable or require prior knowledge of the host. Policy Management is unrelated to forensic search.

Answer

Host Report

Answer

Policy Management

Answer

Alarm Manager

Question 13

A security engineer is implementing a VPN solution for remote workers. The organization requires that the VPN uses strong encryption, supports perfect forward secrecy, and is widely supported on various client platforms without requiring third-party software. Which VPN technology should the engineer choose?

Accepted Answer

IPsec IKEv2 with AES-256 and SHA-256. IKEv2 with AES-256 and SHA-256 provides strong encryption, supports perfect forward secrecy via Diffie-Hellman, and is natively supported on major client platforms. IKEv1 with SHA-1 is weaker, SSL/TLS VPN may need clients for full tunnel, and PPTP is insecure. Thus, IKEv2 is the best choice for the stated requirements.

Answer

IPsec IKEv1 with AES-256 and SHA-1

Answer

PPTP with MPPE

Answer

SSL/TLS VPN using a web browser

Question 14

A security administrator is configuring a Cisco Firepower Next-Generation Firewall (NGFW) to inspect traffic for malicious patterns. The administrator wants to detect and block exploits that target known vulnerabilities in web servers. Which Firepower feature should be enabled to achieve this?

Accepted Answer

Intrusion policy. Cisco Firepower's intrusion policy uses Snort rules to detect and block exploits targeting known vulnerabilities. It inspects packet payloads for malicious patterns. Access control, SSL, and DNS policies serve different functions and do not provide the required exploit detection for web server traffic.

Answer

DNS policy

Answer

SSL policy

Answer

Access control policy

Question 15

A security architect is designing a network segmentation strategy to protect a cardholder data environment (CDE). The architect wants to ensure that systems in the CDE can only communicate with necessary services and that any lateral movement is contained. Which technology should be implemented to achieve microsegmentation within the data center?

Accepted Answer

Cisco TrustSec with security group tags (SGTs). Cisco TrustSec with SGTs enables microsegmentation by tagging packets with security group information and enforcing policies based on those tags, allowing granular control and containment of lateral movement. VLANs with ACLs are coarse, 802.1Q is just trunking, and PVLANs are Layer 2 only. TrustSec is designed for dynamic, scalable segmentation in data centers.

Answer

VLANs with ACLs on core switches

Answer

802.1Q trunking with native VLAN

Answer

Private VLANs (PVLANs)