350-701 Timed Practice Test 1 — 10 Questions

Question 1

A company uses Cisco Stealthwatch Cloud for network visibility in AWS. They notice a spike in encrypted traffic from an EC2 instance to an unknown external IP. Which Stealthwatch Cloud feature can analyze this traffic for threats without decrypting it?

10 minute time limit — choose an answer to begin.

Accepted Answer

Encrypted Traffic Analytics (ETA). Encrypted Traffic Analytics (ETA) is the correct feature because it uses machine learning and behavioral analysis to inspect metadata (e.g., flow records, packet lengths, timing) of encrypted traffic without decrypting it. This allows Stealthwatch Cloud to detect anomalies like command-and-control communication or data exfiltration even when the payload is encrypted.

Answer

NetFlow generation

Answer

Deep Packet Inspection (DPI)

Answer

SSL Decryption

Question 2

A security analyst notices traffic from an internal host to an external IP address on port 4444, and the host's CPU is high. The host has been running unknown processes. Which type of malware is most likely involved?

Accepted Answer

Remote Access Trojan (RAT). Port 4444 is commonly associated with Blaster worm and remote access tools. A Remote Access Trojan (RAT) allows remote control and often communicates on such ports.

Answer

Ransomware

Answer

Keylogger

Answer

Botnet C2 client

Question 3

A security analyst detects a DDoS attack targeting the company's web server. Which three attack types are classified as application layer attacks? (Choose three.)

Accepted Answer

DNS query flood. Application layer DDoS attacks target specific applications, such as HTTP floods, Slowloris, and DNS query floods.

Answer

DNS amplification

Answer

SYN flood

Question 4

Which Cisco product provides DNS-layer security to block malicious domains and prevent connections to malware command-and-control servers?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-based DNS security solution that blocks requests to malicious destinations.

Answer

Cisco Stealthwatch

Answer

Cisco Firepower

Answer

Cisco ASA

Question 5

Which Cisco cloud-based security solution provides DNS-layer security to block requests to malicious domains?

Accepted Answer

Cisco Umbrella SIG. Cisco Umbrella SIG (Security Internet Gateway) is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. When a user attempts to resolve a domain, Umbrella checks the request against its threat intelligence database and blocks the resolution if the domain is known to be malicious, preventing the connection before it is established.

Answer

Cisco Firepower NGFW

Answer

Cisco WSA

Answer

Cisco ESA

Question 6

A security analyst is tuning Snort rules to reduce false positives. The analyst identifies a rule that triggers on a common benign application. Which action should be taken to suppress alerts for that specific traffic without disabling the rule entirely?

Accepted Answer

Add a 'threshold' rule to limit the number of alerts.. Snort allows using 'threshold' or 'suppress' options to limit alerts. The 'suppress' keyword can suppress alerts for specific source/destination IPs. Alternatively, creating a pass rule in the local policy could bypass inspection for that traffic. However, directly modifying the rule's action to 'pass' is not standard; using threshold is common.

Answer

Delete the rule from the policy.

Answer

Change the rule action to 'alert'

Answer

Set the rule to 'drop' action.

Question 7

Which Cisco technology provides visibility into the performance of SaaS applications such as Microsoft 365?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes is correct because it provides end-to-end visibility into the performance of SaaS applications like Microsoft 365 by using cloud-based agents and enterprise agents to monitor network paths, application latency, and packet loss. It specifically measures the user experience for SaaS services through synthetic testing and real-user monitoring, identifying issues such as ISP throttling or routing problems that affect Microsoft 365 performance.

Answer

Cisco WSA

Answer

Cisco ESA

Answer

Cisco Umbrella SIG

Question 8

A company uses Azure and wants to restrict network traffic between subnets. Which Azure resource should they use?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) filter traffic between subnets based on rules.

Answer

Azure DDoS Protection

Answer

Azure Policy

Answer

Azure Firewall

Question 9

An organization is adopting a cloud-first strategy and wants to ensure least-privilege access for cloud resources. Which THREE measures should be implemented as part of a cloud IAM strategy? (Select three.)

Accepted Answer

Use managed identities for access. Managed identities (such as Azure Managed Identities or AWS IAM Roles for EC2) eliminate the need to store credentials in code or configuration files. The cloud provider automatically rotates the credentials and binds the identity to the compute resource, enforcing least-privilege by granting only the permissions required for that resource to function.

Answer

Store secrets in source code repositories for ease of deployment

Answer

Enable single sign-on with multi-factor authentication

Question 10

A network engineer is configuring OSPF on a Cisco router and needs to enable authentication between neighbors. The authentication type should be MD5. Which configuration step is required?

Accepted Answer

ip ospf authentication message-digest under the interface. To enable OSPF MD5 authentication on a Cisco router, the 'ip ospf authentication message-digest' command must be applied under the specific interface. This command tells OSPF to use MD5 (message-digest) authentication for that interface, and it must be paired with an 'ip ospf message-digest-key' command to define the actual key. The authentication type is configured at the interface level, not globally under the OSPF routing process.

Answer

ospf authentication-key under router ospf

Answer

area 0 authentication command in router configuration

Answer

ip ospf authentication null