mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: A multinational company has recently deployed…
A multinational company has recently deployed Cisco Umbrella for DNS-layer security across all offices. The security team receives reports that users in the Asia-Pacific region cannot access a critical cloud-based CRM application (crm.company.com). The CRM is hosted by a third-party provider and uses a custom domain. The Umbrella dashboard shows that DNS requests for crm.company.com are being blocked with the reason 'Cisco Umbrella Intelligence Feed: Blocked Domain'. The domain is not part of any standard security category. The IT team has verified that the domain is legitimate and necessary for business operations. What should the administrator do to restore access while maintaining security?
⚠ Common exam trap
Cisco often tests the distinction between DNS-layer and IP-layer enforcement, leading candidates to incorrectly choose IP whitelisting (Option A) when the block is actually occurring at the DNS layer before IP-layer policies are evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add crm.company.com to the global allow list in the Umbrella dashboard under Policy > Destination Lists > Allow
The domain is being blocked by the Cisco Umbrella Intelligence Feed, which is a curated threat intelligence feed. Since the domain is legitimate and not part of a standard security category, the proper method to restore access is to add it to the global allow list under Policy > Destination Lists > Allow. This overrides the block from the intelligence feed while preserving all other security policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Whitelist the CRM server's IP address in the IP-layer enforcement settings
Why it's wrong here
Whitelisting IP does not affect DNS blocking; the domain is blocked at DNS level.
- ✗
Configure the local DNS server to forward crm.company.com directly to the CRM provider's DNS
Why it's wrong here
This would bypass Umbrella for that domain, but also for any other lookups, and may not be manageable.
- ✗
Disable the Cisco Umbrella Intelligence Feed for the Asia-Pacific region
Why it's wrong here
This would remove protection from many threats, not just the CRM.
- ✓
Add crm.company.com to the global allow list in the Umbrella dashboard under Policy > Destination Lists > Allow
Why this is correct
This allows the domain to bypass DNS blocking while preserving other protections.
Go deeper
Related to this question
About these practice questions
This 350-701 question is part of Courseiva's 978-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.