easyMultiple ChoiceObjective-mapped
350-701 Practice Question: A company has deployed Cisco Umbrella with a…
A company has deployed Cisco Umbrella with a virtual appliance (VA) for content filtering. Users report that some websites are not loading properly, and the helpdesk suspects that the VA is blocking legitimate traffic. The network administrator checks the VA dashboard and sees that the VA is passing traffic normally. However, the administrator notices that the VA's upstream DNS server is set to a public resolver (208.67.222.222) instead of the company's internal DNS servers. This causes internal hostnames to resolve incorrectly. The company uses Active Directory with domain-joined computers. What should the administrator do to resolve the issue?
⚠ Common exam trap
Cisco often tests the misconception that content filtering policies are the root cause of resolution failures, when in fact the underlying DNS forwarding chain is misconfigured, leading candidates to incorrectly focus on filtering rules or client-side changes rather than the upstream DNS server setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the upstream DNS server in the VA configuration to point to the internal DNS servers.
The virtual appliance (VA) acts as a forwarding proxy; it receives DNS queries from clients, forwards them to its configured upstream DNS server, and applies content filtering policies. When the upstream DNS is set to a public resolver like 208.67.222.222 (OpenDNS), the VA cannot resolve internal Active Directory domain names (e.g., .local or internal FQDNs) because the public resolver has no knowledge of the private DNS zone. Changing the upstream DNS server to the company's internal DNS servers allows the VA to resolve both internal and external names correctly, while still applying Umbrella's content filtering policies to external traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a conditional forwarder in the internal DNS for all .local domains.
Why it's wrong here
Incorrect: The issue is incorrect upstream DNS, not missing forwarders.
- ✗
Configure the clients to use Umbrella's DNS directly instead of the VA.
Why it's wrong here
Incorrect: This bypasses local domain resolution.
- ✗
Disable Umbrella content filtering for internal domain names.
Why it's wrong here
Incorrect: This does not fix DNS resolution.
- ✓
Change the upstream DNS server in the VA configuration to point to the internal DNS servers.
Why this is correct
Correct: This enables proper resolution of internal names.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.