easyMultiple ChoiceObjective-mapped
350-701 Deploying Cisco Umbrella for web security Practice Question
A company is deploying Cisco Umbrella for web security. They want to enforce that all DNS requests from remote users using VPN are filtered. Which deployment method should be used?
⚠ Common exam trap
Cisco often tests the distinction between DNS-layer security and proxy-based web security, and the trap here is that candidates may assume a PAC file or corporate DNS forwarding is sufficient for remote users, overlooking that the Roaming client is specifically designed for off-network enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the Cisco Umbrella Roaming Security client on remote endpoints.
The Cisco Umbrella Roaming Security client is the correct deployment method for filtering DNS requests from remote VPN users because it installs a local DNS forwarder on the endpoint that intercepts all DNS traffic and sends it directly to Umbrella's cloud resolvers, even when the user is off the corporate network. This ensures that DNS queries are filtered regardless of the VPN tunnel state, as the client operates independently of the VPN connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a PAC file to redirect web traffic to Umbrella.
Why it's wrong here
PAC files handle proxy, not DNS filtering.
- ✗
Configure the corporate DNS servers to forward to Umbrella.
Why it's wrong here
This only protects internal users, not remote.
- ✓
Install the Cisco Umbrella Roaming Security client on remote endpoints.
Why this is correct
The client ensures DNS filtering anywhere.
- ✗
Deploy a virtual appliance as a DNS forwarder at the branch office.
Why it's wrong here
Branch forwarder protects on-site users, but remote users off-network need client.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.