easyMultiple ChoiceObjective-mapped
350-701 Practice Question: A company uses Cisco Umbrella to protect its…
A company uses Cisco Umbrella to protect its remote users. The security team notices that some users are able to bypass Umbrella by using a different DNS resolver. Which deployment method ensures that all DNS traffic is forced through Umbrella?
⚠ Common exam trap
Cisco often tests the misconception that network-level solutions (like a virtual appliance or BGP) can protect remote users, but the trap here is that remote endpoints require an agent-based approach (the roaming client) to enforce DNS policy locally, because network-level controls cannot intercept traffic that does not traverse the corporate network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Install the Umbrella roaming client on all endpoints.
The Cisco Umbrella roaming client (C) is the correct deployment method because it installs a local agent on each endpoint that intercepts all DNS queries at the operating system level, regardless of the DNS resolver configured in the network settings. This ensures that all DNS traffic is forced through Umbrella's cloud-based security platform, preventing users from bypassing protection by manually changing their DNS resolver to a non-Umbrella server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the Umbrella virtual appliance in the data center.
Why it's wrong here
The virtual appliance protects on-premises networks but not remote users with alternative DNS.
- ✗
Use BGP to redirect traffic to Umbrella.
Why it's wrong here
BGP is for network-level routing, not endpoint DNS enforcement.
- ✓
Install the Umbrella roaming client on all endpoints.
Why this is correct
The roaming client enforces DNS policy even if users change DNS settings.
- ✗
Configure Active Directory integration.
Why it's wrong here
AD integration provides identity but does not force DNS traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.