350-701 Security Concepts Practice Test 9 — 15 Questions

Question 1

A company is deploying Cisco Umbrella and wants to block access to malicious domains for users on the corporate network without installing software on endpoints. Which deployment method should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS forwarding from internal DNS servers to Umbrella. Forwarding DNS queries from internal DNS servers to Umbrella allows all corporate network users to benefit from Umbrella's DNS-layer security without any endpoint software. This method is transparent and easy to deploy, ensuring that malicious domains are blocked before a connection is established. It leverages existing DNS infrastructure and provides centralized policy enforcement.

Answer

AnyConnect with Umbrella module

Answer

Virtual appliance on-premises

Answer

Roaming client on each endpoint

Question 2

A security administrator is configuring 802.1X on Cisco switches and wants to ensure that both the identity of the endpoint and the user are validated before network access is granted. Which two Cisco ISE features or capabilities support this requirement? (Choose two.)

Accepted Answer

PEAP with MSCHAPv2 for user authentication. EAP-TLS with client certificates validates the machine identity, while PEAP with MSCHAPv2 validates the user identity. Together they ensure both endpoint and user are authenticated. MAB, CoA, and RADIUS accounting do not provide the required identity validation.

Answer

MAC Authentication Bypass (MAB) for devices that do not support 802.1X

Answer

RADIUS accounting to log session start and stop records

Answer

Change of Authorization (CoA) to reauthenticate after posture assessment

Question 3

A security engineer is analyzing a packet capture and notices that an attacker is sending a large number of TCP SYN packets to a web server from various spoofed source IP addresses. The server's SYN backlog is filling up, causing legitimate connection attempts to be dropped. Which type of attack is this?

Accepted Answer

SYN flood. The scenario describes a SYN flood attack, where an attacker overwhelms a server with TCP SYN packets from spoofed sources, exhausting the SYN backlog and preventing legitimate connections. UDP flood, ping flood, and Smurf attack involve different protocols (UDP or ICMP) and mechanisms, so they do not match the observed TCP SYN behavior.

Answer

UDP flood

Answer

Ping flood

Answer

Smurf attack

Question 4

A company deploys a Cisco Umbrella virtual appliance on-premises so that internal endpoints are identified individually in reporting. After deployment, all internal client DNS requests still show only the public egress IP address in Umbrella Investigate and reporting. Which configuration step was most likely missed?

Accepted Answer

The internal DNS forwarders were not reconfigured to point to the virtual appliance IP addresses.. Umbrella virtual appliances provide internal client IP identity by receiving DNS queries directly from internal resolvers. When forwarders keep using external resolvers, Umbrella sees only the NAT egress address. Pointing internal DNS forwarders at the virtual appliance addresses restores per-client attribution, so reporting and policy can distinguish individual endpoints instead of a single public IP.

Answer

The DNS-over-HTTPS policy was not enabled for the internal networks.

Answer

The identity provider integration was not configured for the internal networks.

Answer

The virtual appliance was not registered with a valid API token in the Umbrella dashboard.

Question 5

A network administrator is deploying Cisco Umbrella to protect users from malicious domains. The administrator wants to block requests to known malicious domains and see which internal hosts are making those requests. Which Umbrella feature provides this visibility and enforcement?

Accepted Answer

DNS-layer security with intelligent proxy and logging to the Umbrella dashboard.. Cisco Umbrella's DNS-layer security blocks DNS requests to malicious domains using threat intelligence and logs the requesting internal host IP addresses. The Umbrella dashboard provides detailed reporting, enabling administrators to see which hosts attempted to access blocked domains. This fulfills both enforcement and visibility requirements.

Answer

Cisco Identity Services Engine (ISE) with profiling and posture.

Answer

Cisco Firepower Next-Generation Firewall with SSL decryption.

Answer

Cisco Secure Network Analytics (Stealthwatch) with DNS analytics.

Question 6

A security architect is designing a data loss prevention strategy for a company that uses Cisco Secure Email Gateway and Cisco Secure Web Appliance. The architect must select controls that prevent sensitive data from leaving the organization through both email and web channels. Which two Cisco capabilities should be included in the design? (Choose two.)

Accepted Answer

Data Loss Prevention policies on Cisco Secure Email Gateway that scan outbound messages for sensitive content patterns. Covering both email and web exfiltration paths requires content inspection on each channel. Secure Email Gateway DLP scans outbound messages and attachments, while Secure Web Appliance DLP inspects outbound HTTP and HTTPS uploads and form submissions. Together they enforce data classification policies across the two channels the architect must protect, which the other listed controls cannot do.

Answer

Cisco Identity Services Engine with posture policies requiring disk encryption on endpoints

Answer

Cisco Secure Network Analytics with encrypted traffic analytics for outbound flows

Answer

Cisco Umbrella DNS-layer security with category-based blocking for file-sharing domains

Question 7

A network engineer is configuring a Cisco Firepower NGFW to inspect traffic between two internal departments. The requirement is to ensure that only traffic matching a specific application is allowed, while all other traffic is blocked, and to log the allowed connections. Which configuration approach should be used?

Accepted Answer

Create an access control policy with a rule that matches the application and allows it, and a default action to block all other traffic.. Application-based access control is configured in the access control policy, where rules can match applications and the default action blocks unmatched traffic. Prefilter, SSL, and intrusion policies serve different purposes and cannot enforce application allow lists.

Answer

Use an SSL policy to decrypt all traffic and then apply an application filter.

Answer

Configure a prefilter policy with a tunnel rule to allow the application and block the rest.

Answer

Apply an intrusion policy with a rule to allow the application and block others.

Question 8

A security architect is designing segmentation for an industrial environment where legacy programmable logic controllers cannot run endpoint agents and must remain reachable only from a small set of engineering workstations. Which two Cisco technologies are appropriate to enforce this requirement? (Choose two.)

Accepted Answer

Cisco TrustSec with security group tags and SGACL enforcement on the network devices. The controllers cannot host agents, so enforcement must happen in the network and authentication must work without a supplicant. ISE with MAB and downloadable ACLs authenticates the controllers by MAC address and pushes restrictive ACLs to the switch ports, while TrustSec tags devices into groups and enforces SGACLs on network devices. Together they deliver agentless, policy-based segmentation limited to authorized engineering workstations.

Answer

Cisco Secure Endpoint with exploit prevention policies pushed to the controllers

Answer

Cisco Umbrella with DNS-layer policies applied to the controller management interface

Answer

Cisco Secure Network Analytics with flow collection from NetFlow exporters

Question 9

A security engineer is configuring a Cisco ASA firewall to secure VPN access for remote users. The engineer wants to ensure that the VPN traffic is encrypted using a protocol that provides both confidentiality and integrity, and that supports perfect forward secrecy (PFS). Which protocol should be used for the IPsec VPN to meet these requirements?

Accepted Answer

ESP (Encapsulating Security Payload). ESP (Encapsulating Security Payload) is the IPsec protocol that provides confidentiality, integrity, and supports perfect forward secrecy when used with IKE. It encrypts the payload and can authenticate it, and PFS is negotiated during IKE Phase 2 to ensure unique session keys, meeting all the engineer's requirements for the VPN.

Answer

AH (Authentication Header)

Answer

SSL/TLS

Answer

GRE (Generic Routing Encapsulation)

Question 10

A security operations center (SOC) analyst is investigating an alert from Cisco SecureX about a suspicious file executed on an endpoint. The analyst needs to determine the file's reputation and gather threat intelligence from multiple sources. Which action should the analyst take within SecureX?

Accepted Answer

Use the SecureX threat response feature to pivot on the file hash and view enrichment from Cisco Talos and other integrated sources.. Cisco SecureX threat response enables analysts to investigate observables such as file hashes by aggregating threat intelligence from Cisco Talos and other integrated sources. This provides immediate reputation and context, allowing the SOC analyst to determine if the file is malicious and take appropriate action.

Answer

Use Cisco Identity Services Engine (ISE) to check the endpoint's posture compliance status.

Answer

Check the Cisco Umbrella DNS logs for the file hash to see if it was queried.

Answer

Run a packet capture on the endpoint using Cisco Firepower and analyze the PCAP for file transfer.

Question 11

A user receives an email that appears to come from the CEO and asks for an urgent wire transfer. The message uses a lookalike domain with a single character changed. Which social engineering technique is being used?

Accepted Answer

Phishing. Email that impersonates a trusted executive and uses a lookalike domain to prompt an urgent action is phishing. The defining characteristics are the email delivery channel, the impersonation of a trusted sender, and the manipulation of the recipient into acting quickly. Business email compromise campaigns commonly use this exact approach, making phishing the correct classification.

Answer

Whaling

Answer

Vishing

Answer

Smishing

Question 12

An administrator must allow a remote user to access the corporate network over a VPN so that the user receives an internal address and traffic is tunneled to the headend while split tunneling is disabled. Which technology matches this requirement?

Accepted Answer

Remote-access IPsec/IKEv2 VPN using Cisco Secure Client. A remote-access IPsec/IKEv2 VPN with Cisco Secure Client gives the roaming user an internal address from a configured pool and tunnels traffic to the headend. With split tunneling disabled, all traffic including internet-bound flows traverses the tunnel, matching the requirement. Site-to-site, clientless, and GRE options lack the per-user client tunnel and internal address assignment.

Answer

Site-to-site IPsec VPN between two firewalls

Answer

GRE tunnel between two routers

Answer

Clientless SSL VPN through a browser portal

Question 13

A security architect is designing segmentation for a multi-tenant data center. The requirement is to provide isolated Layer 2 forwarding domains per tenant across a shared physical leaf-spine fabric, while maintaining a single IP subnet per tenant that can span multiple racks. Which technology should the architect select to meet these requirements?

Accepted Answer

Virtual Extensible LAN (VXLAN) with Ethernet VPN (EVPN) control plane. The requirement is isolated Layer 2 segments per tenant that can span racks over shared physical infrastructure, which is exactly what a VXLAN overlay with an EVPN control plane delivers. VXLAN provides the data-plane encapsulation and VNI-based isolation, while EVPN handles MAC and ARP distribution so endpoints in the same tenant subnet can communicate across leaf switches without flooding the fabric.

Answer

Cisco TrustSec security group tagging (SGT) with SGACL enforcement

Answer

IPsec tunnels between leaf switches with VRF-lite on each VTEP

Answer

802.1Q VLAN trunking with per-tenant VLAN IDs on every leaf switch

Question 14

A network security engineer is configuring a Cisco ASA with VPN load balancing to distribute remote-access VPN connections across multiple ASA devices. Which technology should be used to achieve this?

Accepted Answer

VPN load balancing cluster. Cisco ASA VPN load balancing cluster allows multiple ASAs to act as a single virtual device, distributing remote-access VPN connections across members. This provides scalability and high availability without external load balancers. The cluster uses a virtual IP address that clients connect to, and the master ASA distributes sessions to other members based on load.

Answer

External load balancer

Answer

AnyConnect with multiple profiles

Answer

Dynamic routing with OSPF

Question 15

A security operations team is deploying Cisco Secure Network Analytics (Stealthwatch) with Cisco Identity Services Engine to detect compromised endpoints on the campus network. Which two data sources must be integrated to associate network flows with user identities? (Choose two.)

Accepted Answer

Cisco ISE pxGrid session directory and identity data. Secure Network Analytics builds its behavioral models from NetFlow exported by network infrastructure, and it obtains identity context by subscribing to ISE pxGrid, which publishes username-to-IP and endpoint session data. Combining flow telemetry with identity context lets the platform attribute anomalous communications to a specific user rather than an anonymous IP, which is exactly what the campus detection use case requires.

Answer

SNMP polling of interface counters on access switches

Answer

Syslog messages from Cisco Umbrella roaming clients

Answer

Endpoint AMP for Endpoints event stream