350-701 Content Security Practice Question
A company uses Cisco Umbrella SIG to secure internet access for remote users. The security team wants to block access to social media websites but allow access to business-related websites that may share the same IP addresses. Which Umbrella feature should be used to enforce this granular control?
⚠ Common exam trap
Cisco often tests the distinction between DNS-layer security (domain-based) and proxy-based URL filtering (full URL inspection), leading candidates to mistakenly choose the DNS security layer when granular control over websites sharing IP addresses is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud proxy with URL filtering
Cisco Umbrella's cloud proxy with URL filtering operates at the application layer (HTTP/HTTPS), inspecting full URLs rather than just domain names. This allows the security team to block social media websites while permitting business-related websites that may resolve to the same IP addresses, as the proxy can differentiate based on the URL path and content category.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS security layer
Why it's wrong here
DNS security blocks based on domain names but cannot differentiate between subdomains or paths on the same IP.
- ✗
ThousandEyes agents
Why it's wrong here
ThousandEyes is for performance visibility, not policy enforcement.
- ✓
Cloud proxy with URL filtering
Why this is correct
The cloud proxy inspects HTTP/HTTPS requests and can apply URL category policies to block social media while allowing business sites.
- ✗
AMP file scanning
Why it's wrong here
AMP is for malware detection, not URL categorization.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 978 original 350-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.