350-701 Network Security Practice Question
A Cisco FTD device is deployed in inline mode and is configured with an access control policy that includes an Intrusion Policy set to 'Balanced Security and Connectivity' and a File Policy with Malware & File blocking enabled. Traffic from a host inside to an external server is allowed by an access control rule. The administrator notices that a file download (PDF) is being blocked even though the file has a good reputation. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file policy is configured to block PDF files regardless of disposition.
The file policy may be configured to block files based on file type or other criteria regardless of malware disposition. In this case, the PDF may be blocked by file type restriction, not by malware detection. The Intrusion policy might also generate alerts but not block the file; the file policy is the one blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The AMP cloud lookup returned an 'unknown' disposition and the policy blocks unknowns.
Why it's wrong here
Incorrect. If the file has good reputation, it would not be unknown.
- ✗
The access control rule requires a 'trust' action to bypass inspection.
Why it's wrong here
Incorrect. Trust action skips further inspection, but here the file is being inspected and blocked.
- ✗
The intrusion policy is set to 'Balanced' and the PDF contains a known exploit signature.
Why it's wrong here
Incorrect. Intrusion policy may alert but not block the file itself; file blocking is done by file policy.
- ✓
The file policy is configured to block PDF files regardless of disposition.
Why this is correct
Correct. File policy can block file types even if they are not malicious.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.