350-701 Security Concepts — Timed 15 Questions

Question 1

A network security engineer is deploying Cisco Firepower Threat Defense (FTD) in a data center. The requirement is to inspect traffic between two internal VLANs while allowing the firewall to enforce access control policies based on source and destination zones. Which deployment mode should the engineer use?

Accepted Answer

Transparent mode. Transparent mode (Layer 2 mode) is correct because the requirement specifies inspecting traffic between two internal VLANs without routing. In transparent mode, the FTD acts as a bridge, forwarding frames based on MAC addresses while enforcing access control policies based on source and destination zones. This allows the firewall to inspect inter-VLAN traffic without requiring IP address changes or acting as a default gateway.

Answer

Routed mode

Answer

Inline mode

Answer

Hybrid mode

Question 2

A security architect is designing a zero-trust architecture for a remote workforce using Cisco SD-WAN. The company requires that all traffic between branch sites and the data center is encrypted and authenticated, and that no device can access resources unless it has a valid certificate. Which technology should be used to enforce device identity?

Accepted Answer

Cisco TrustSec. Cisco TrustSec uses Security Group Tags (SGTs) and device identity based on certificates to enforce access control in a zero-trust architecture. It integrates with SD-WAN to ensure that only devices with valid certificates can communicate, meeting the requirement for encrypted and authenticated traffic between branch sites and the data center.

Answer

802.1X with EAP-TLS

Answer

Network Access Control (NAC)

Answer

IPsec VPN

Question 3

An engineer is troubleshooting a Cisco ASA firewall and notices that traffic from a specific subnet is being dropped. The engineer wants to verify if the drop is due to an access control list (ACL) or an inspection policy. Which command should be used to see the reason for packet drops?

Accepted Answer

show asp drop. The 'show asp drop' command displays packet drop statistics from the Accelerated Security Path (ASP) on a Cisco ASA. It provides a detailed breakdown of why packets are dropped, including drops due to ACLs, inspection policies, or other security checks. This makes it the correct tool to differentiate between ACL and inspection policy drops.

Answer

show access-list

Answer

show conn

Answer

show service-policy

Question 4

Which TWO of the following are valid approaches to mitigate ARP spoofing attacks on a switched network?

Accepted Answer

Enable Dynamic ARP Inspection (DAI) on VLANs. Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in a network. It relies on a DHCP snooping binding database to map IP addresses to MAC addresses, and it drops ARP packets that have invalid IP-to-MAC bindings, thereby preventing ARP spoofing attacks on a switched network.

Answer

Enable BPDU Guard on all switchports

Answer

Enable Port Security on all access ports

Answer

Enable DHCP Snooping globally

Question 5

Which THREE of the following are key principles of the Cisco Zero Trust security model?

Accepted Answer

Never trust, always verify. Option A is correct because 'Never trust, always verify' is the foundational principle of the Cisco Zero Trust security model, which mandates that no user, device, or network segment is trusted by default, regardless of its location relative to the network perimeter. This principle eliminates implicit trust and requires authentication and authorization for every access request, aligning with the Zero Trust architecture defined in NIST SP 800-207.

Answer

Implicit trust for internal traffic

Answer

Perimeter-based security

Question 6

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Accepted Answer

The DHCP snooping database is not updated because interface Gi0/1 is not trusted. The host cannot ping its default gateway because DHCP Snooping marks interface Gi0/1 as untrusted by default. Since the DHCP server is connected to Gi0/1, the switch drops DHCP replies from that interface, preventing the DHCP snooping binding database from being updated with the host's IP address. Without a valid binding, IP Source Guard on Gi0/0 drops all IP traffic from the host, including pings to the gateway.

Answer

The static IP source binding is configured on the wrong VLAN

Answer

ARP inspection is not enabled, so the switch drops ARP replies

Answer

The 'ip verify source' command is missing the 'port-security' keyword

Question 7

Refer to the exhibit. An engineer is analyzing an intrusion policy on Cisco Firepower Management Center (FMC). The network uses Windows servers and clients. A flood of HTTP traffic is being detected as a potential attack, but it is legitimate. Which preprocessor configuration change would most likely reduce false positives without losing detection of real attacks?

Accepted Answer

Change global_sensitivity to medium. The http_inspect preprocessor's global_sensitivity setting controls how aggressively it normalizes HTTP traffic before analysis. Setting it to 'medium' reduces false positives from legitimate HTTP floods by relaxing the threshold for anomalous HTTP behavior, while still allowing the preprocessor to detect real attacks that exhibit more extreme deviations. This is the most targeted change because it directly addresses the flood of HTTP traffic without disabling the preprocessor entirely.

Answer

Disable the http_inspect preprocessor

Answer

Change frag3 policy to bsd

Answer

Change stream5_tcp policy to linux

Question 8

A company is implementing Cisco Umbrella to provide DNS-layer security. They want to block access to known malicious domains while allowing all other traffic. Which policy configuration should be used?

Accepted Answer

Create a block list with known malicious domains. Cisco Umbrella's DNS-layer security operates by intercepting DNS queries and comparing them against policy-defined lists. A block list containing known malicious domains is the correct approach because Umbrella will block DNS resolution for those domains while allowing all other traffic to pass through normally. This aligns with the requirement to block only malicious destinations without affecting access to legitimate sites.

Answer

Enable selective proxy for all traffic

Answer

Create an allow list with only safe domains

Answer

Use a custom policy with both allow and block lists

Question 9

An engineer is configuring Cisco ISE for guest access. The requirement is that guests must accept an acceptable use policy (AUP) before being granted network access. Which portal type should be used?

Accepted Answer

Self-registration guest portal. The self-registration guest portal is the correct choice because it allows guests to create their own credentials and, crucially, includes a configurable step where the user must accept an Acceptable Use Policy (AUP) before being granted network access. This portal type is specifically designed for scenarios where guests self-onboard and must acknowledge a policy, which is a core requirement for compliance in many guest access deployments.

Answer

Sponsored guest portal

Answer

Hotspot guest portal

Answer

BYOD portal

Question 10

Which TWO of the following are valid methods for authenticating VPN users in a Cisco AnyConnect deployment?

Accepted Answer

RADIUS. Cisco AnyConnect VPN authentication can be performed using RADIUS, which is a widely supported AAA protocol. RADIUS enables centralized authentication, authorization, and accounting for VPN users, and it is natively integrated with Cisco ASA and Firepower Threat Defense (FTD) appliances for remote access VPNs.

Answer

TACACS+

Answer

OSPF

Answer

SNMP

Question 11

Which THREE of the following are common indicators of a DDoS attack at the network layer?

Accepted Answer

A spike in UDP traffic to a single target. A spike in UDP traffic to a single target is a classic indicator of a UDP flood attack, a common network-layer DDoS. Attackers send a high volume of UDP packets, often to random ports, overwhelming the target's ability to process them and consuming bandwidth. This is a direct Layer 3/4 attack that does not require a completed handshake, making it easy to generate and hard to mitigate without proper filtering.

Answer

Unusual traffic on non-standard TCP/UDP ports

Answer

High CPU usage on network devices

Question 12

A financial company has a data center with Cisco FTD firewalls in a high-availability pair. They use Cisco ISE for network access control and Cisco Stealthwatch for network visibility. Recently, they deployed a new web application that is accessed by both internal employees and external customers. The application uses HTTPS on port 443. After deployment, the security team notices that the FTD is dropping some HTTPS sessions that appear legitimate. The drops are inconsistent and seem to occur only during peak hours. The FTD logs show the drop reason as 'TCP state violation'. The team has verified that the web server and clients are configured correctly. The Stealthwatch reports show no anomalies. What is the most likely cause and solution?

Accepted Answer

Configure TCP state bypass on the FTD for the web server traffic. The 'TCP state violation' drops during peak hours indicate that the FTD's stateful inspection engine is seeing TCP segments that do not match the expected state machine, likely due to asymmetric routing or session timeouts under load. Configuring TCP state bypass for the web server traffic disables stateful inspection for those flows, allowing the firewall to forward packets based on ACLs alone without tracking TCP states, which resolves the issue without compromising security for legitimate traffic.

Answer

Enable SSL decryption to inspect the encrypted traffic

Answer

Increase the TCP timeout values on the FTD to accommodate longer sessions

Answer

Block all traffic to the web server except from trusted IPs

Question 13

A security engineer is configuring a Cisco ASA to block traffic from a specific IP address. Which access control entry (ACE) should be applied to the inbound direction of the outside interface?

Accepted Answer

access-list outside_in extended deny ip host 10.1.1.1 any. Option B is correct because the ACE uses the 'ip' protocol to block all traffic from the specific source host 10.1.1.1 to any destination, which is the most comprehensive way to block all IP traffic from that address. In Cisco ASA ACLs, the order of source and destination is 'source destination', so 'deny ip host 10.1.1.1 any' correctly matches packets with source IP 10.1.1.1 and any destination, applied inbound on the outside interface to block traffic entering the network.

Answer

access-list outside_in extended deny ip any host 10.1.1.1

Answer

access-list outside_in extended deny tcp any host 10.1.1.1

Answer

access-list outside_in extended deny tcp host 10.1.1.1 any eq 80

Question 14

A company is deploying Cisco Umbrella to protect against DNS-based threats. Which deployment method provides the most comprehensive coverage for all devices on the network without requiring per-device configuration?

Accepted Answer

Configure the network's DNS forwarders to point to Umbrella's DNS resolvers.. Option D is correct because configuring the network's DNS forwarders to point to Umbrella's DNS resolvers (typically on the organization's DHCP server or router) ensures that all DNS queries from any device on the network are automatically forwarded to Umbrella for filtering, without requiring any per-device configuration. This method provides comprehensive coverage for all devices, including those that cannot run agents (e.g., IoT devices, printers, guest devices), by intercepting DNS traffic at the network level.

Answer

Install the Umbrella roaming client on every endpoint.

Answer

Configure each device's DNS settings to use Umbrella's resolvers.

Answer

Deploy a PAC file that routes all traffic through a proxy with DNS filtering.

Question 15

An engineer is troubleshooting traffic drops on a Cisco Firepower Threat Defense (FTD) device. The traffic is allowed by the access control policy but is being dropped. Which feature should the engineer check to identify the cause of the drop?

Accepted Answer

Use the 'capture' command with trace option to see packet flow and drop reason.. Option C is correct because the 'capture' command with the 'trace' option on Cisco FTD provides a detailed, packet-level analysis of how traffic is processed through the firewall pipeline. It shows each step (e.g., ingress, routing, access control, NAT, egress) and explicitly states the drop reason, such as 'action-drop' due to intrusion prevention, URL filtering, or security intelligence, even when the access control policy appears to allow the traffic. This is the only option that directly identifies the specific cause of a drop in the data path.

Answer

Check the 'show access-list' output for the hit count.

Answer

Check the 'show route' output for routing issues.

Answer

Check the 'show conn' output for the connection state.