350-701 Security Concepts Practice Test 8 — 15 Questions

Question 1

A Cisco administrator is configuring AnyConnect for a remote-access VPN and wants to ensure that unmanaged endpoints are denied access if they lack the required antivirus software. Which Cisco solution should be integrated with the ASA to enforce this endpoint posture requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco Identity Services Engine (ISE). Cisco ISE is the centralized policy engine that integrates with ASA to perform endpoint posture assessment for VPN users. It evaluates compliance attributes like antivirus, patches, and processes, then enforces access decisions. The other options provide network security or visibility but lack posture assessment and enforcement capabilities. ISE uniquely satisfies the need to deny unmanaged endpoints that fail posture checks.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower Management Center

Answer

Cisco Umbrella Roaming Client

Question 2

A security engineer is implementing a VPN solution for remote workers. The engineer wants to ensure that the VPN uses a protocol that provides strong encryption and supports both IPv4 and IPv6. Which VPN technology should be chosen?

Accepted Answer

IPsec. IPsec is a suite that provides strong encryption and authentication for both IPv4 and IPv6 traffic. It is a standard choice for VPNs requiring protocol-level security. PPTP is insecure, L2TP lacks encryption without IPsec, and SSL VPN, while secure, operates at a different layer and is not a protocol that inherently encrypts IP packets.

Answer

L2TP

Answer

SSL VPN

Answer

PPTP

Question 3

A security team deploys Cisco Umbrella to protect roaming users who connect their laptops to public Wi-Fi at airports and coffee shops. Users report that web filtering policies still apply even when they are not connected to the corporate VPN. Which Cisco Umbrella capability makes this enforcement possible?

Accepted Answer

DNS-layer security that resolves recursive DNS queries through Umbrella's global network. Umbrella enforces policy at the DNS resolution step, so the roaming laptop sends its recursive queries to Umbrella's resolvers no matter which network it joins. Because blocking occurs before the TCP connection to a malicious or disallowed domain is established, protection persists without a VPN or an on-premises appliance, which matches the reported behavior on untrusted Wi-Fi.

Answer

TLS decryption of every HTTPS session using a certificate pinned to the endpoint

Answer

Full inline next-generation firewall inspection performed by a virtual appliance on the endpoint

Answer

Endpoint-based application allow listing enforced by the Cisco Secure Client posture module

Question 4

A Cisco engineer is designing a secure remote-access VPN that must support clientless connections to internal web applications, full tunnel access for managed laptops, and integration with Cisco Identity Services Engine for posture assessment. Which Cisco solution should be deployed to meet all these requirements in a single platform?

Accepted Answer

Cisco Secure Client (AnyConnect) with Cisco Secure Firewall ASA headend. Cisco Secure Client deployed with an ASA or Secure Firewall headend supports clientless portal access, full tunnel VPN, and ISE posture integration in one solution. The other options address cloud web security, branch interconnect, or identity services alone, none of which provide the combined remote-access capabilities required.

Answer

Cisco Umbrella with SIG tunneling from branch offices

Answer

Cisco Identity Services Engine with pxGrid and passive identity

Answer

Cisco SD-WAN with IPsec tunnels between branches

Question 5

A network security engineer is designing a defense-in-depth strategy for a new data center. The engineer needs to select a control that will detect and alert on malicious activity after it has already bypassed perimeter defenses, without actively blocking the traffic. Which type of security control should be implemented?

Accepted Answer

Detective control. A detective control is designed to identify and alert on security incidents after they occur, providing visibility into malicious activity that has bypassed preventive measures. In a defense-in-depth strategy, detective controls such as IDS or SIEM are essential for identifying compromises and enabling timely response, without actively blocking traffic as a preventive control would.

Answer

Corrective control

Answer

Preventive control

Answer

Deterrent control

Question 6

A hospital must protect a medical imaging server that stores patient records from both external attackers and malicious insiders. The security team wants a control that segments east-west traffic between the imaging VLAN and the clinical workstation VLAN, and that can enforce policy based on user identity and device posture. Which Cisco solution best meets these requirements?

Accepted Answer

Cisco Identity Services Engine enforcing TrustSec security group tags between the VLANs. Segmenting internal east-west traffic while enforcing policy based on user identity and device posture requires an identity-aware segmentation technology. Cisco TrustSec with ISE assigns security group tags and enforces group-based policies in the network fabric, which isolates the imaging server from unauthorized clinical workstations and limits lateral movement for both external and insider threats.

Answer

Cisco Secure Network Analytics monitoring NetFlow to build behavioral baselines

Answer

Cisco Secure Email Gateway scanning attachments sent to clinical staff mailboxes

Answer

Cisco Umbrella DNS-layer security applied to the clinical workstation subnet

Question 7

A security operations team wants to detect malicious command-and-control traffic that uses domain fronting and encrypted TLS sessions to well-known cloud services. They need a solution that inspects TLS metadata without full decryption and correlates with threat intelligence. Which Cisco technology best fits this requirement?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch) with Encrypted Traffic Analytics. Secure Network Analytics with Encrypted Traffic Analytics identifies malware in encrypted flows using metadata and machine learning without decrypting TLS. The other options either decrypt traffic, rely on DNS controls, or enforce segmentation, none of which meet the no-decryption, metadata-based detection requirement.

Answer

Cisco Firepower NGFW with SSL decryption policy

Answer

Cisco Identity Services Engine with TrustSec SGTs

Answer

Cisco Umbrella with DNS-layer security

Question 8

A Cisco Secure Network Analytics (Stealthwatch) administrator notices that a host is generating a high volume of DNS queries for randomly generated domain names, and the host has begun communicating with newly registered domains. The administrator needs to identify the specific threat behavior and the best mitigation. Which conclusion and action are most appropriate?

Accepted Answer

The host is likely infected with malware using Domain Generation Algorithms (DGA); isolate the host and investigate using Cisco SecureX threat response.. The combination of high-volume DNS queries for random domains and communication with newly registered domains strongly indicates a Domain Generation Algorithm (DGA) used by malware for command-and-control. The appropriate response is to isolate the infected host and use Cisco SecureX threat response to investigate and remediate, rather than implementing broad DNS blocks that could impact legitimate traffic.

Answer

The host is performing a DNS tunneling data exfiltration; configure Cisco Firepower to block all DNS TXT records.

Answer

The host is participating in a peer-to-peer botnet; block all outbound DNS traffic at the perimeter firewall.

Answer

The host is experiencing a DNS amplification attack; enable DNS rate limiting on the Cisco Umbrella virtual appliance.

Question 9

A security administrator is configuring a Cisco Identity Services Engine (ISE) to enforce endpoint compliance. The administrator wants to ensure that only endpoints with up-to-date antivirus signatures and operating system patches are allowed full network access. Which ISE feature should be used to assess the endpoint's posture before granting access?

Accepted Answer

Posture assessment. Posture assessment is the Cisco ISE feature that evaluates endpoint compliance with security policies, such as antivirus updates and OS patches, before allowing network access. It ensures that only healthy endpoints receive full access, while non-compliant devices can be quarantined or remediated, directly addressing the administrator's requirement.

Answer

BYOD onboarding

Answer

Guest services

Answer

Profiling

Question 10

A security operations center (SOC) analyst is investigating a potential security incident. The analyst observes that an attacker has gained initial access to a workstation and is now attempting to move laterally to other systems by exploiting a vulnerability in the Server Message Block (SMB) protocol. The analyst wants to correlate this activity with known adversary tactics and techniques. Which framework should the analyst use to map the observed behavior to a specific technique ID?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the appropriate framework for mapping adversary behavior to specific tactics and techniques. It provides a comprehensive matrix of techniques, each with a unique ID, enabling analysts to correlate observed activities like SMB exploitation for lateral movement to a standardized technique. The other options serve different purposes: NIST CSF for risk management, CVSS for vulnerability severity, and STIX/TAXII for threat intelligence sharing.

Answer

STIX/TAXII

Answer

CVSS (Common Vulnerability Scoring System)

Answer

NIST Cybersecurity Framework

Question 11

A security operations center observes an attacker who has compromised a workstation and is now moving laterally to enumerate domain controllers using valid but stolen credentials. The attacker has not triggered any signature-based alerts. Which Cisco security capability is specifically designed to detect this kind of credential-based lateral movement by analyzing network telemetry and correlating it with identity information?

Accepted Answer

Cisco Secure Network Analytics with Identity Services Engine integration for user-to-IP mapping. Detecting lateral movement that uses valid credentials requires behavioral analysis of network flows enriched with identity context. Secure Network Analytics builds baselines from flow telemetry, and ISE integration maps IP addresses to authenticated user accounts, allowing the platform to flag anomalies like one identity touching many internal hosts, which signature-based tools would miss.

Answer

Cisco Secure Endpoint with exploit prevention and file reputation lookups

Answer

Cisco Umbrella with DNS tunneling detection enabled on the corporate resolver

Answer

Cisco Secure Firewall with Snort intrusion prevention rules tuned for SMB exploits

Question 12

An organization is deploying a new PKI for internal services and needs a certificate that will be used to sign other certificates, including subordinate CA certificates. Which type of certificate should be issued for this purpose?

Accepted Answer

Root CA certificate. A root CA certificate is the trust anchor and includes the CA basic constraint, allowing it to sign subordinate CA certificates and end-entity certificates. End-entity, self-signed server, and CRL signing certificates serve different purposes and cannot issue subordinate CAs.

Answer

End-entity certificate

Answer

Self-signed server certificate

Answer

Certificate Revocation List signing certificate

Question 13

A security engineer is configuring Cisco Identity Services Engine (ISE) to enforce posture assessment for employees connecting to the corporate network. The requirement is that endpoints must have the latest antivirus definitions and an active firewall before being granted full access. Which ISE feature should be used to meet this requirement?

Accepted Answer

Configure posture policies with conditions that check antivirus definition date and firewall status, and assign a posture profile that triggers remediation.. Cisco ISE posture policies are designed to assess endpoint compliance with security requirements such as up-to-date antivirus definitions and active firewall. By configuring conditions that check these attributes and associating a posture profile, the engineer can enforce remediation for non-compliant endpoints before granting full network access.

Answer

Implement TrustSec security group tags (SGTs) and enforce a policy that permits only endpoints with a specific SGT.

Answer

Enable Change of Authorization (CoA) to reauthenticate endpoints periodically and apply a redirect URL.

Answer

Create an authorization policy that assigns a downloadable ACL (dACL) based on the endpoint's MAC address.

Question 14

A network administrator is configuring a Cisco Identity Services Engine (ISE) to authenticate users via 802.1X. The administrator wants to ensure that only domain-joined Windows computers with up-to-date antivirus definitions are allowed on the corporate network. Which ISE feature should be used to evaluate the endpoint's compliance with these requirements before granting access?

Accepted Answer

Posture assessment. Cisco ISE Posture assessment is designed to check endpoint compliance with security policies, such as antivirus definitions, patch levels, and domain membership, before granting network access. Profiling identifies devices, guest services manage visitors, and BYOD onboarding handles personal devices. Therefore, posture assessment is the correct feature to meet the requirement.

Answer

BYOD onboarding

Answer

Guest services

Answer

Profiling

Question 15

A financial services firm is designing a new remote access solution. The security policy requires that administrators connecting to the data center must be authenticated with a hardware token, and that the resulting session must be tied to a specific user and device identity so that authorization decisions can be made per session. Which Cisco solution provides this combination of strong authentication and per-session identity context?

Accepted Answer

Cisco Identity Services Engine acting as a RADIUS server for the VPN headend with certificate-based and token-based authentication. The requirement is strong, token-based authentication combined with session identity that can drive authorization. ISE as the RADIUS and policy engine for the VPN headend enforces certificate and token credentials and then applies authorization profiles that bind the session to user and device, enabling per-session policy and downstream enforcement through TrustSec or dynamic ACLs.

Answer

Cisco Secure Email Gateway with strong TLS enforcement for administrator mail

Answer

Cisco Umbrella roaming client with DNS-layer protection on the administrator laptops

Answer

Cisco Secure Network Analytics with flow-based anomaly detection for VPN traffic