easyMultiple ChoiceObjective-mapped
350-701 Practice Question: Use Cisco Umbrella to block access to malicious…
A company wants to use Cisco Umbrella to block access to malicious domains. They have deployed the Umbrella roaming client on all endpoints. However, traffic from a specific application is still reaching a known malicious domain. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the misconception that Umbrella blocks all traffic regardless of how the destination is resolved, when in fact it only blocks based on DNS queries, not direct IP connections or non-DNS protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application uses a hardcoded IP address or non-DNS protocol.
Cisco Umbrella operates at the DNS layer, meaning it can only block domains that are resolved via DNS queries. If an application uses a hardcoded IP address or communicates using a non-DNS protocol (e.g., direct IP connections or protocols like HTTP/HTTPS without DNS resolution), the traffic bypasses Umbrella's DNS-based enforcement entirely. This is why the malicious domain is still reachable despite the roaming client being deployed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Umbrella policy is configured to allow that specific application.
Why it's wrong here
Policies are based on domains, not applications.
- ✗
The domain is not categorized as malicious in Umbrella's database.
Why it's wrong here
If it's known malicious, it should be in the database.
- ✗
The Umbrella roaming client is not installed on the server.
Why it's wrong here
The question says 'all endpoints' including the server.
- ✓
The application uses a hardcoded IP address or non-DNS protocol.
Why this is correct
Umbrella blocks at the DNS layer; if the application does not use DNS, the block does not apply.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.