350-701 Timed Practice Test 2 — 10 Questions

Question 1

A security team suspects that malware is exfiltrating data by encoding it in DNS queries. Which Cisco security solution is specifically designed to analyze DNS traffic for malicious activity?

Accepted Answer

Cisco Umbrella. Cisco Umbrella is a cloud-delivered security solution that provides DNS-layer security by intercepting and analyzing DNS queries. It can detect and block DNS-based data exfiltration techniques, such as DNS tunneling, by inspecting DNS request patterns and comparing them against threat intelligence feeds. This makes it the correct choice for analyzing DNS traffic for malicious activity.

Answer

Cisco Firepower NGFW

Answer

Cisco Stealthwatch

Answer

Cisco Email Security Appliance

Question 2

An engineer is troubleshooting a site-to-site IPsec VPN between two Cisco routers. The tunnel is not establishing. Which command would verify that IKE phase 1 negotiations have completed successfully?

Accepted Answer

show crypto isakmp sa. The 'show crypto isakmp sa' command displays the state of IKE (Internet Key Exchange) Phase 1 security associations (SAs). A successful Phase 1 negotiation is indicated by a state of 'MM_ACTIVE' (Main Mode) or 'QM_IDLE' (Aggressive Mode), confirming that the peers have mutually authenticated and established a secure ISAKMP tunnel. This is the direct verification command for Phase 1 completion.

Answer

show crypto ipsec sa

Answer

show crypto map

Answer

debug crypto isakmp

Question 3

An organization uses Cisco Umbrella for DNS-layer security. They want to block access to a newly discovered malicious domain (malware.example.com) immediately. Which action should the administrator take in the Umbrella dashboard?

Accepted Answer

Add the domain to the 'Block List' under the policy's 'Destination Lists'.. Option C is correct because in Cisco Umbrella, the most immediate way to block a specific malicious domain is to add it to the 'Block List' under the policy's 'Destination Lists'. This list is evaluated in real-time for DNS queries, allowing the administrator to enforce the block without waiting for threat intelligence updates or affecting other policies.

Answer

Add the domain to the 'Global Block List' under 'Managed Networks'.

Answer

Add the domain to the 'Temporary Block List' under 'Security Settings'.

Answer

Add the domain to the 'IP Layer Enforcement' list.

Question 4

A security engineer is configuring Cisco Web Security Appliance (WSA) to block access to social media sites during business hours. The company wants to allow access to LinkedIn for the HR department. Which policy configuration approach should the engineer use?

Accepted Answer

Create a time-based access policy to block social media during business hours, and an identity-based policy to allow LinkedIn for HR.. Option A is correct because Cisco WSA uses a hierarchical policy model where time-based access policies control when traffic is allowed or blocked, and identity-based policies (using authentication or IP ranges) provide granular exceptions for specific user groups like HR. By combining a time-based policy to block social media during business hours and an identity-based policy to allow LinkedIn for HR, the engineer achieves the requirement without over-permitting access. This approach leverages WSA's ability to evaluate multiple policy types in order, ensuring the HR exception takes precedence for LinkedIn traffic.

Answer

Enable HTTPS decryption and block social media based on content.

Answer

Create a global URL filtering policy to block social media and add an exception for LinkedIn.

Answer

Configure Data Loss Prevention (DLP) to block social media posts.

Question 5

You are a security engineer for a multinational corporation with 5,000 employees. The company uses Cisco Umbrella for DNS-layer security, Cisco Web Security Appliance (WSA) for proxy services in the data center, and Cisco Email Security Appliance (ESA) for email security. Recently, the security team has received multiple reports of users receiving phishing emails that bypass the ESA. The emails contain links to malicious websites that are also not blocked by Umbrella or WSA. Upon investigation, you find that the phishing emails use newly registered domains (less than 24 hours old) and the malicious websites are hosted on cloud infrastructure with frequently changing IP addresses. The company's current security policies rely on signature-based detection and static blocklists. Which action should you take to most effectively mitigate these threats?

Accepted Answer

Deploy Cisco Threat Response to enable automated threat hunting and blocking across all security products.. Option A is correct because Cisco Threat Response (CTR) provides integrated threat hunting and automated blocking across Cisco security products, including Umbrella, WSA, and ESA. This enables the security team to correlate indicators of compromise (IoCs) from phishing emails and newly registered domains, then automatically block them across all layers, addressing the dynamic nature of the threat (fast-flux hosting and newly registered domains) that signature-based and static blocklists cannot handle.

Answer

Configure the WSA to block all domains registered within the last 30 days.

Answer

Enable Data Loss Prevention (DLP) on the ESA to scan email content for sensitive data.

Answer

Increase the frequency of signature updates on the ESA and WSA to every hour.

Question 6

Which TWO configuration steps are required to enable Cisco AMP for Endpoints to use the Threat Grid appliance for file analysis?

Accepted Answer

Configure the AMP connector policy to submit files to the on-premises Threat Grid appliance.. Option A is correct because the AMP for Endpoints connector policy must be configured to submit files to the on-premises Threat Grid appliance. This directs the endpoint connector to send suspicious files to the local Threat Grid for dynamic analysis instead of the public cloud. Option C is correct because the Threat Grid appliance must be registered in the AMP cloud as a private analysis provider, which creates a secure tunnel (using TLS) between the AMP cloud and the on-premises appliance, enabling file submission and result retrieval.

Answer

Enable SSL decryption in the AMP connector policy.

Answer

Ensure the firewall allows inbound traffic to the Threat Grid appliance from the internet.

Answer

Install the Cisco Threat Grid Connector on each endpoint.

Question 7

A network administrator is troubleshooting an issue where users in the finance VLAN are unable to access a critical server in the server VLAN. The switch logs show multiple 'Authentication failed' messages for MAC addresses in the finance VLAN. The switchport security feature is enabled on the access ports. What is the most likely cause of the issue?

Accepted Answer

Switchport security violation has caused the ports to error-disable or drop traffic.. The switch logs show 'Authentication failed' messages for MAC addresses in the finance VLAN, and switchport security is enabled. When a switchport security violation occurs (e.g., due to a MAC address limit or an unauthorized MAC address), the port can be configured to error-disable or drop traffic. This explains why users in the finance VLAN cannot reach the server, as the access ports are effectively blocking traffic due to the security violation.

Answer

The switch ports are configured as trunks and are not allowing the finance VLAN.

Answer

802.1X authentication is failing for the finance users.

Answer

Spanning Tree Protocol (STP) is blocking the ports in the finance VLAN.

Question 8

In a Cisco TrustSec deployment, security group tags (SGTs) are used to represent user and device roles. These tags must be propagated across the network. Which protocol is used to carry SGT information in Ethernet frames?

Accepted Answer

IEEE 802.1Q with SGT encapsulation (Cisco proprietary). Cisco TrustSec uses SGTs to enforce role-based access control. To propagate SGT information across the network, Cisco developed a proprietary extension to IEEE 802.1Q that embeds the SGT into the Ethernet frame header, specifically using the CMD (Cisco MetaData) field. This allows switches and routers to enforce security policies based on the SGT without requiring additional encapsulation overhead.

Answer

MPLS

Answer

VXLAN

Answer

GRE

Question 9

Which TWO of the following are valid methods for deploying Cisco Firepower Threat Defense (FTD) in high availability?

Accepted Answer

Clustering. Cisco FTD supports high availability through Active/Standby failover (option D) and clustering (option B). Active/Standby failover provides stateful redundancy with one unit handling traffic while the other monitors and takes over upon failure. Clustering groups multiple FTD devices into a single logical unit for both high availability and scalability, distributing traffic across members.

Answer

Active/Active failover

Answer

Load balancing with external load balancer

Answer

StackWise

Question 10

Which THREE of the following are features of Cisco Identity Services Engine (ISE) that can be used to enforce network access control?

Accepted Answer

Profiling. Profiling is a core ISE feature that uses passive and active fingerprinting techniques (e.g., DHCP, HTTP, SNMP, NetFlow) to identify endpoint attributes such as operating system, device type, and MAC vendor. This identity context allows ISE to enforce granular access policies based on the device class, such as blocking IoT sensors from reaching critical servers.

Answer

Application visibility

Answer

NetFlow analysis